The SG had to do a few TCP-level things for NAT purposes like rewriting checksums, and it would sometimes synthesize a RST. No layer 7 processing at all

There was a low level protocol allowing backends to get some extra metadata about a connection