Refer to the exhibit.

FortiGate CNF in AWS uses a Gateway Load Balancer endpoint (GWLBe) in the protected VPC to steer workload traffic toward the FortiGate CNF service for inspection. The EC2 instance does not send traffic directly to the internet gateway first, and the CNF is not placed inline as a normal VM firewall inside the EC2 subnet. Instead, AWS routing sends the EC2 traffic to the relevant GWLBe. The traffic is then forwarded to FortiGate CNF, where security policies are evaluated and enforced. If the traffic is allowed, it is returned to the same GWLBe and then continues toward the internet gateway. Therefore, the correct traffic path is EC2 instance → GWLBe → FortiGate CNF → GWLBe → IGW → internet.