How to get Autoscale VMs to only receive traffic from VNF?

[btzq]

Hi Community,

Our company widely uses Autoscale Feature for our VMs. However, most of our customers prioritise security and we have identified that there is a need to put a VNF (eg. PFsense Firewall) infront of our Autoscale Groups to filter malicious traffic before hitting the VMs.

I previously raise this ticket discussion but it seems that more discussion is needed and it will take more time to come to a conclusion. We have a need for a more immediate solution: #9158

So what we are thinking, is to have a VPC (will multiple networks), have a VNF Pfsense Firewall there, and somehow get our Autoscale VMs in the 'Internet Network Tier' to only receive incoming traffic from the VNF PFsense Firewall.

Illustration below:

But, we arent sure how we can get the Autoscale VMs to do just that. Any ideas? Thank you.