# Gateway Load Balancer Failover Just Got Way Faster: Minutes to Seconds!

Hi, I'm Shii-chan!

Today I found a nice networking update from AWS's What's New, so let's dig in.

## What was announced?

According to AWS's What's New, AWS Gateway Load Balancer (GWLB) now supports sending TCP Reset (RST) packets. GWLB can send a TCP RST when a target becomes unhealthy, when a target is deregistered, or when a flow's idle timeout expires. This helps reduce traffic interruptions from minutes down to seconds.

## The story so far

Until now, when a GWLB target failed, existing TCP connections kept being forwarded to that unhealthy target — a "fail-open" behavior. Applications could experience interruptions lasting several minutes while the TCP retry and exponential back-off mechanisms built into client or server TCP stacks kicked in.

## What changes

With TCP Reset enabled, GWLB responds to incoming traffic with a TCP RST, telling the sender that the connection is no longer viable. The sender can then quickly establish a new TCP flow through a healthy target, which noticeably shortens the downtime you feel during a failure. This is great news if you're running network virtual appliances (NVAs) behind a GWLB.

## Dive Deep

Here's what the announcement says about how the feature works:

- It's disabled by default, preserving backward compatibility with existing behavior
- You can enable it per target group via the AWS Management Console, AWS CLI, or API
- There are three independent triggers you can enable separately
  - The target is marked unhealthy
  - The target is deregistered (after connection draining)
  - The TCP idle timeout expires
- Available for all new and existing Gateway Load Balancers, in every AWS Region where GWLB is available
- There's no additional charge for using it

## Wrap-up

- AWS Gateway Load Balancer now supports sending TCP Reset packets
- Previously, a target failure meant fail-open behavior and recovery could take minutes
- TCP Reset lets senders re-establish a new flow right away, cutting recovery time from minutes to seconds
- Enabled per target group, off by default, with three triggers and no extra cost

If you're running security appliances behind a GWLB and want to shrink failover interruptions, this update is worth checking out!