What configuration on AWS is required in order for VM-Series to forward traffic between its network interfaces?

By default, an Amazon EC2 instance performs a Source/Destination Check, which verifies that the instance is the source or destination of any traffic it sends or receives. A VM-Series firewall, when deployed as a gateway or router, must be able to forward traffic between other sources and destinations. To allow the firewall to handle this transit traffic (i.e., traffic for which it is neither the source nor the final destination), the Source/Destination Check must be disabled on its network interfaces that process this traffic.

B. Enabling both checks is the default for standard EC2 instances and would prevent the VM-Series from forwarding traffic it does not own.
C. Disabling only the Source Check is insufficient; the firewall must also be able to receive traffic not destined for its own IP address.
D. Disabling only the Destination Check is insufficient; the firewall must also be able to send traffic with a source IP other than its own.

1. Palo Alto Networks

VM-Series Deployment Guide for AWS

"Basic Gateway Deployment on AWS". The guide states

"For each ENI that will be forwarding traffic

you must disable the source/destination check." This applies to the ENIs on the VM-Series that handle data plane traffic.

2. Amazon Web Services Documentation

"Elastic network interfaces"

Section: "Changing the source or destination checking". It explains: "You must disable source/destination checks if the instance runs services such as network address translation

routing

or a firewall."