ALB, NLB, and Gateway Load Balancer solve different problems
ALB inspects HTTP content for Layer 7 routing; NLB forwards raw TCP/UDP at Layer 4 with static IPs and PrivateLink support; GWLB transparently inserts a fleet of inspection appliances inline.
Speaker notes
- Application Load Balancer (ALB) operates at Layer 7: it reads the actual HTTP request (host header, path, query string) to make routing decisions, making it the right fit for microservices and container-based architectures where one load balancer needs to fan out to many backend services by URL path or hostname, exactly the AWS Load Balancer Controller's default choice for a Kubernetes Ingress on EKS.
- Network Load Balancer (NLB) operates at Layer 4: it forwards TCP/UDP without inspecting content, offers a static IP per AZ (useful for allowlisting and multi-region failover), extreme connection throughput, and is the only load balancer type that can sit behind a VPC Endpoint Service, meaning NLB is the actual mechanism PrivateLink is built on, covered in depth later in this deck.
- Gateway Load Balancer (GWLB) is architecturally different from the other two: it's a transparent Layer 3 gateway that distributes traffic across a fleet of third-party security/inspection appliances (a firewall, an IDS) using the GENEVE protocol, inserted inline in the traffic path without the appliances needing to be endpoints themselves. It's the mechanism behind 'inspect every packet before it reaches the application' architectures at scale.
Deck map
01
AWS Networking, end to end
02
The certification landscape: Associate to Professional to Specialty
03
The VPC is the network; everything else attaches to it
04
A subnet lives in exactly one AZ, and that's the whole point
05
The route table decides, the resource doesn't
06
An Internet Gateway makes a subnet public, nothing else does
07
NAT Gateway vs. NAT Instance: managed reliability vs. control
08
Security Groups are stateful, and that's the whole trick
09
Two firewalls, two layers, evaluated in a fixed order
10
Elastic IPs and ENIs: identity that outlives the instance
11
VPC Peering is direct, private, and never transitive
12
Gateway endpoints are free; interface endpoints are PrivateLink
13
ALB, NLB, and Gateway Load Balancer solve different problems
14
Six routing policies, one DNS service
15
CloudFront optimizes what's delivered, not how it travels
16
Shield, WAF, and the edge defense stack
17
VPC Flow Logs: the record of what actually happened
18
Transit Gateway: from N-squared peering to one hub
19
Direct Connect: a physical circuit, not a tunnel
20
Direct Connect resiliency is a model you choose, not a default
21
Direct Connect Gateway: one circuit, many regions
22
Site-to-Site VPN and Client VPN solve different connectivity problems
23
Choosing hybrid connectivity: bandwidth vs. lead time vs. cost
24
Cloud WAN: the network becomes a policy document
25
VPC sharing: one network, many accounts
26
PrivateLink: a service exposed as an ENI, nothing more
27
VPC Lattice moves service networking up to Layer 7
28
PrivateLink vs. VPC Lattice vs. Transit Gateway: the 2026 pattern
29
Route 53 Resolver: DNS that crosses the on-premises boundary
30
Five layers deep: NACL to Shield Advanced
31
Global Accelerator: two static IPs, one fast path
32
Three tools that answer 'why can't this reach that'
33
IPv6 in AWS is additive, not a migration
34
Bandwidth is a design decision, not a given
35
Scenario: a global SaaS platform's hub-and-spoke backbone
36
Scenario: a trading platform's latency and compliance walls
37
Scenario: merging two companies' networks without an outage
38
Scenario: a network that survives losing a region
39
Scenario: exiting a data center without a hard cutover
40
The Advanced Networking Specialty exam, domain by domain
41
The traps that recur across every certification level
42
Quick-fire recall
43
The one-page decision cheat sheet
44
Readiness checklist: is this network actually enterprise-grade?