Welcome to Aviatrix Docs¶
All Aviatrix product documentation can be found here. If you cannot find what you need, email us at support@aviatrix.com. Hats off to all who helped fix typos and mistakes. You can do that too by clicking the “Edit on GitHub” button on the top right corner of any document. Please also visit our main website for more information regarding use cases and upcoming events.
While all content is searchable, the site is organized into the following sections:
- Getting Started
- Onboarding and Accounts
- Gateway
- Multi-Cloud Transit Network
- Transit Gateway Orchestrator
- Firewall Network (FireNet)
- CloudWAN
- Peering
- Site2Cloud
- OpenVPN®
- Security
- Useful Tools
- Settings
- Troubleshoot
- API
- Downloads
- Release Notes
- Security Bulletin
- CoPilot
- Tech Notes
- Good To Know
- Support Center
- IPmotion
- Troubleshooting Playbook
Getting Started¶
Onboarding and Accounts¶
- Onboarding and Account FAQs
- Access Account
- IAM Roles for Secondary Access Accounts
- Customize Aviatrix IAM Role Names for Secondary Accounts
- AWS IAM Policies
- Aviatrix IAM Policy Requirements
- Customize AWS-IAM-Policy for Aviatrix Controller
- Azure Account Credential Setup
- Use Azure IAM Custom Role
- GCP Credentials
- Oracle Cloud Infrastructure (OCI) Onboarding Guide
- Admin Users and Duo Sign in
- Aviatrix Companion Gateway in Azure
- Quick Tour
- Account with Access Key
- Account Audit
- Role Based Access Control FAQ
Multi-Cloud Transit Network¶
- Multi Cloud Global Transit FAQ
- Multi-cloud Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
- Aviatrix Transit Gateway to External Devices
- Encrypted Transit Approval
- Transit Advanced Config
- Transit Network Design Patterns
- Azure Transit Network Design Patterns
- Transit Network Segmentation FAQ
- Aviatrix Transit Network Segmentation Workflow
- ActiveMesh FAQ
- ActiveMesh Design Notes
- Aviatrix ActiveMesh Workflow
- Insane Mode Encryption FAQ
- ActiveMesh Insane Mode Encryption Performance
- Insane Mode CloudN Deployment Checklist
- Managed CloudN Workflows
- Setup Transit Network using Aviatrix Terraform Provider
- Migrating TGW Orchestrator to Multi-Cloud Transit
- Multi-Cloud Transit Integration with Azure VNG
- Private OOB Deployment Workflow in AWS
- GRE Tunneling for Multi-cloud Transit Gateway to on-prem Workflow
- AWS Multi-cloud Transit BGP over LAN Workflow
- Azure Multi-cloud Transit BGP over LAN Workflow
AWS Transit Gateway Orchestrator
- AWS TGW Orchestrator FAQ
- TGW Plan
- TGW Build
- TGW List
- TGW Approval
- TGW Design Patterns
- Aviatrix Transit Gateway Encrypted Peering
- Migrating a CSR Transit to AWS Transit Gateway (TGW)
- Migrating a DIY TGW to Aviatrix Managed TGW Deployment
- Aviatrix Transit Gateway to External Devices
- Multi-cloud Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
Firewall Network (FireNet)¶
- Firewall Network (FireNet) FAQ
- Firewall Network (FireNet) Workflow
- Transit FireNet FAQ
- Transit FireNet Workflow for AWS/Azure
- Transit FireNet Design Patterns
- Firewall Network (FireNet) Advanced Config
- Setup API Access to Palo Alto Networks VM-Series
- AWS Ingress Firewall Setup Solution
- Azure Ingress Firewall Setup Solution
- Example Config for Palo Alto Network VM-Series in AWS
- Example Config for Palo Alto Networks VM-Series in Azure
- Bootstrap Configuration Example for VM-Series in AWS
- Bootstrap Configuration Example for VM-Series in Azure
- Example Config for FortiGate VM in AWS
- Example Config for FortiGate VM in Azure
- Bootstrap Configuration Example for FortiGate Firewall in AWS
- Bootstrap Configuration Example for FortiGate Firewall in Azure
- Example Config for Check Point VM in AWS
- Example Config for Check Point VM in Azure
- Bootstrap Configuration Example for Check Point Security Gateway in AWS/Azure
- Setup Firewall Network(Firenet) for Netgate PFSense
- Deploy PFsense instance From AWS marketplace
- Deploying a Barracuda CloudGen Firewall for use with the Aviatrix FireNet
- Firewall Network Design Patterns
Security¶
- Stateful Firewall FAQ
- Tag Based Security Policy
- Egress FQDN FAQ
- Egress Control Filter
- Egress FQDN Discovery
- Egress FQDN View Log
- Amazon GuardDuty Integration
- Public Subnet Filtering Gateway FAQ
- PrivateS3 FAQ
- What is the security exposure when uploading files to AWS S3 over Direct Connect?
- What is Aviatrix PrivateS3?
- What are the benefits of PrivateS3?
- How does PrivateS3 work?
- How to deploy PrivateS3?
- Can PrivateS3 work for traffic initiated from a VPC?
- Is there an additional AWS data charge by going through the Aviatrix gateway?
- Can PrivateS3 be deployed in TGW environment?
- Can Direct Connect termination VPC be in a different region of managed S3 buckets?
- Can PrivateS3 gateway be in a different region of managed S3 buckets?
- Can PrivateS3 solution scale out?
- How can I test PrivateS3?
- How do I troubleshoot PrivateS3?
- Does AWS S3 list command work?
- Can Aviatrix Spoke gateways be used for PrivateS3 function?
- Is S3 endpoint required for PrivateS3?
- PrivateS3 Workflow
- Step 1. Launch an Aviatrix Gateway
- Step 2. Create Access Accounts
- Step 3. Enable/Update PrivateS3
- Step 4. Update S3 Bucket Policy
- Step 5 View/Delete PrivateS3
- Additional Configuration 1: Create on-prem DNS Private Zone
- Additional Configuration 2: S3 endpoint
- Adding More PrivateS3 Gateways
- Additional Read
Peering¶
Site2Cloud¶
- Site2Cloud FAQs
- Site2Cloud IPSec VPN Instructions
- Aviatrix Gateway to Azure VPN Gateway
- Aviatrix Gateway to Aviatrix Gateway
- Aviatrix Gateway to AWS VGW
- Aviatrix Gateway to Oracle DRG
- Aviatrix Gateway to Palo Alto Firewall
- Aviatrix Gateway to Check Point(R77.30)
- Aviatrix Gateway to Check Point(R88.10)
- Aviatrix Gateway to Cisco ASA
- Aviatrix Gateway to Cisco IOS Router
- Aviatrix Gateway to Sonicwall
- Aviatrix Gateway to pfSense
- Aviatrix Gateway to FortiGate
- Aviatrix Gateway to Meraki MX64
- Aviatrix Gateway to Meraki vMX100
- Aviatrix Gateway to Juniper SRX
- CloudN for Site2Cloud
- Site2Cloud Case Study
- Encryption over DirectConnect/ExpressRoute
- Solving Overlapping Networks with Network Mapped IPSec
- Overlapping Network Connectivity Solutions
- Connect Networks With Overlap CIDRs
- Connect Overlapping VPC to On-prem
- Periodic Ping
OpenVPN®¶
- Configuring Aviatrix User SSL VPN
- Aviatrix OpenVPN® FAQs
- How do I launch a VPN gateway?
- How can I avoid managing multiple VPN user certs?
- How do I scale out VPN solution?
- How do I setup Okta authentication for VPN?
- How do I enable Geo VPN?
- How do I add a VPN user?
- What user devices are VPN client software supported?
- Is NAT capability supported on the gateway?
- Is full tunnel mode supported on the gateway?
- Can the maximum number of simultaneous connections to VPN gateway be configured?
- What is user profile based security policy?
- How do I setup profile based security policies?
- How do I assign a user to a profile?
- What if I want to change profile policies?
- How do I change a user’s profile programmatically?
- How to set User VPN License Threshold Notification?
- Is DUO multi-factor authentication supported?
- How do I configure LDAP authentication?
- Can I combine LDAP and DUO authentication?
- Is OKTA supported?
- How does Policy Based Routing (PBR) work?
- What are the monitoring capabilities?
- Does the Aviatrix OpenVPN® solution support SAML client?
- When should I use the Aviatrix VPN client?
- Are multiple VPN configuration profiles supported by the Aviatrix VPN client?
- What is “Client Certificate Sharing”?
- How do I fix the Aviatrix VPN timing out too quickly?
- Where do I find the log for the Aviatrix Client?
- Why can’t my VPN client access a newly created VPC?
- How do I turn off NAT with an OpenVPN® gateway?
- What IP Address is used for NAT’ing the VPN Clients?
- What is User Defined Email Notification?
- How to customize pop-up messages after a VPN user is connected?
- How to set a minimum Aviatrix VPN client software version for OpenVPN® connection?
- What is Download SAML VPN Client?
- Aviatrix OpenVPN® Feature Highlights
- User VPN Performance Guide for Deployment
- OpenVPN® Design for Multi Accounts and Multi VPCs
- VPN Access Gateway Selection by Geolocation of User
- UDP LoadBalanced VPN using DNS
- LDAP Configuration for Authenticating VPN Users
- Okta Authentication with Okta API Token
- Duo Authentication
- OpenVPN® with SAML Authentication
- SAML Profile as an Attribute
- OpenVPN® with SAML Authentication on Okta IDP
- OpenVPN® with SAML Authentication on Google IDP
- OpenVPN® with SAML Authentication on OneLogin IdP
- OpenVPN® with SAML Authentication on AWS SSO IdP
- OpenVPN® with SAML Authentication on Azure AD IdP
- OpenVPN® with SAML Authentication on Centrify IDP
- Anonymous Internet Surfing
- Developer’s Sandbox
- External PKI for OpenVPN Certificates
- VPN User Accelerator
- Use IPv6 for User VPN Access
- Use AWS Transit Gateway to Access Multiple VPCs in One Region
- Setup Okta SAML with Profile Attribute
- Setup PingOne for Customers web SAML app with Profile Attribute
Useful Tools¶
Settings¶
- Controller Backup and Restore
- Controller HA in AWS
- Inline Software Upgrade
- Logging
- Emails and Alert Configuration
- Advanced Config
- Controller LDAP Login Configuration
- Netflow Integration
- AWS CloudWatch Integration
- Aviatrix Controller Login with SAML Authentication
- Certificate Management Overview
- Controller Certificate Management
- Gateway Certificate Management
- FIPS 140-2 Module
- Controller Configuration
- Migrating Aviatrix Controller AMI
- Controller Migration in AWS
- Migrate
- Restore
- Controller Migration in Azure
- Controller Migration in GCP
Troubleshoot¶
Downloads¶
Release Notes¶
Security Bulletin¶
CoPilot¶
Tech Notes¶
- Auto Booting CloudN VM Using ISO File
- Hybrid Network Load Balancing (NLB)
- Datadog Integration
- Launch Aviatrix Controller Manually
- Using Aviatrix to Build a Site to Site IPsec VPN Connection
- Aviatrix Controller Security for SAML auth based VPN Deployment
- How to Connect Office to Multiple AWS VPCs with AWS Peering
- Site2Cloud With Customized SNAT
- Site2Cloud with NAT to fix overlapping VPC subnets
- Site2Cloud to a Public IP Address
- Accessing a Virtual IP address instance via Aviatrix Transit Network
- Aviatrix Active Mesh with customized SNAT and DNAT on spoke gateway
- Connecting Meraki Network to Aviatrix Transit Network
- Reserve For On-Prem Use
- Deploying Spoke without Programming RFC1918 Routes
- AWS Managed Microsoft AD for Aviatrix
- Extending Your vmware Workloads to Public Cloud
- How to Build a Zero Trust Cloud Network Architecture with Aviatrix
- AWS Global Transit Network
- Connect to Floating IP Addresses in Multiple AWS AZs
- Egress NAT to a Pool of IP Addresses
- AWS Transit Gateway Route Limit Test Validation
- Transit Gateway ECMP for DMZ Deployment Limitation Test Validation
- Transit Gateway Egress VPC Firewall Limitation Test Validation
- AWS Transit Gateway Orchestrator
- High Performance Encryption with InsaneMode
- Aviatrix NEXT GEN TRANSIT with customized SNAT and DNAT features
- Use IPv6 to Connect Overlapping VPC CIDRs
- Aviatrix Transit Architecture for Azure
- NAT for non-tunnel-bound Traffic
- Migrating from Classic Aviatrix Encrypted Transit Network to Aviatrix ActiveMesh Transit Network
- OpenVPN + FQDN Filter Solution
- Enable SAML App for a group of users in G-Suite using Organization
- Transit FireNet Workflow for AWS
- Transit FireNet Workflow with AWS Gateway Load Balancer (GWLB)
- Transit FireNet Workflow for Azure
- Aviatrix CloudWAN Workflow for Azure Virtual WAN
- Using Aviatrix Site2Cloud tunnels to access VPC Endpoints in different regions
- Multi-cloud Transit Gateway Peering over Private Network Workflow
- Aviatrix in AWS Outposts
- Private OOB Network Design
- Tuning For Sub-10 Seconds Failover Time in Overlapping Networks
- Aviatrix BGP over LAN with Cisco Meraki in AWS
Good To Know¶
Support Center¶
IPmotion¶
Troubleshooting Playbook¶