F5 ASM AWS deployment

Hello, We have a requirement to build 3 subnets ( 1 public and 2 private) in AWS platform with fortigate NGF firewall as a perimeter and F5 WAF for protecting web applications.

 

1. Web ( Public)
2. App (Private)
3. DB (Private)

The default gateway for 3 subnets will be configured on fortigate. While the WAF protects the public zone. Can we have a Private IP as VIP in F5 and nat it in fortigate for the user reachability or assign a Elastic IP as VIP in F5 and publish to internet.

 

Which instance should be selected in AWS for this deployment.

 

Which one is the suggested model.

 

thanks Ram