Ban outgoing encrypted traffic. Terminate TLS at the load balancer.
You can force everyone to go over a proxy where you can MitM it, or have MitM that swaps out all TLS negotiations to use your own certs and replace things (but then all clients need to have your local CA cert installed on all machines egressing the network.
IPS's have had this downfall for a long while, and likely just keeps getting worse. I think MitM is the only way to do deep packet inspection. Otherwise you're just going to do host/traffic analysis to look for oddities in the hosts being connected to and how much is flowing. Host analysis can give you some data, but no where near as good as what Snort can do with deep packet inspection.
ingress is tls offloading at waf
https://www.thesslstore.com/blog/an-introduction-to-pinning/
I see no issues here - your WAF itself is initiating and terminating outgoing and incoming TLS connections. DHE keys are generated on the WAF. The WAF's cert could be the authoritative one.
The WAF could then re-establish a new connection to applications behind it.
There does not seem to be any technical boundary here.
You've only unwrapped one layer of the onion this way, which only works if the data inside it is in plaintext. If it's encrypted you're back to square one.
In my professional opinion requiring insecure internal connections is also a bad idea.
Perfect security is commonly unusable and therefore often useless, because the business requirements still come in and need a solution.