Second internal ingress configuration question

[QustodioPablo]

Hello!

We are using an external istio gateway on EKS, which works as expected, which is created through the istio operator using the following configuration:

ingressGateways:
    - enabled: true
      name: istio-ingressgateway
      k8s:
        serviceAnnotations:
          service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
          service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
          service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
          service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
          service.beta.kubernetes.io/aws-load-balancer-ssl-cert: XXXXXXXXX,XXXXXXXXXXX
          service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
          service.beta.kubernetes.io/aws-load-balancer-type: external
          service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS13-1-2-2021-06

The annotations are for the AWS LoadBalancer controller.

We needed a second ingress, but for internal usage, so we added the new ingress, with the following configuration:

- enabled: true
      name: istio-ingressgateway-internal
      label:
        app : istio-ingressgateway-internal
        istio: ingressgateway-internal
      k8s:
        serviceAnnotations:
          service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
          service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
          service.beta.kubernetes.io/aws-load-balancer-scheme: internal
          service.beta.kubernetes.io/aws-load-balancer-ssl-cert: XXXXXXXXXXXX
          service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS13-1-2-2021-06
          service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
          service.beta.kubernetes.io/aws-load-balancer-type: external  

This created the ALB correctly, but every single request made to it, returned an empty response. We were unable to find any logs on the ingress pods. We tried different configurations, always with the same result.
I decided to explicitly define the ports the istio ingress service should use in the operator, like this:

          ports:
           - name: https
             port: 443
             targetPort: 8443
             nodePort: 32114

Note these values are exactly the same as those created by the operator.
After making this change, the internal ingress started working.

I have no clue what the issue was, or why this fixed it.
Could anyone help me understand what the issue with istio was?

Thanks!