Welcome to Aviatrix Docs¶
All Aviatrix product documentation can be found here. If you cannot find what you need, email us at support@aviatrix.com. Hats off to all who helped fix typos and mistakes. You can do that too by clicking the “Edit on GitHub” button on the top right corner of any document. Please also visit our main website for more information regarding use cases and upcoming events.
While all content is searchable, the site is organized into the following sections:
- Getting Started
- Onboarding and Accounts
- Gateway
- Transit Gateway Orchestrator
- Encrypted Transit Network
- Firewall Network (FireNet)
- CloudWAN
- Peering
- Site2Cloud
- OpenVPN®
- Security
- Useful Tools
- Settings
- Troubleshoot
- REST APIs
- Downloads
- Release Notes
- CoPilot
- Tech Notes
- Good To Know
- Support Center
- IPmotion
- Troubleshooting Playbook
Getting Started¶
Onboarding and Accounts¶
- Onboarding and Account FAQs
- Access Account
- IAM Roles for Secondary Access Accounts
- Customize Aviatrix IAM Role Names for Secondary Accounts
- AWS IAM Policies
- Aviatrix IAM Policy Requirements
- Customize AWS-IAM-Policy for Aviatrix Controller
- Azure ARM
- GCP Credentials
- Oracle Cloud Infrastructure (OCI) Onboarding Guide
- Admin Users and Duo Sign in
- Aviatrix Companion Gateway
- Quick Tour
- Account with Access Key
- Account Audit
- Role Based Access Control FAQ
AWS Transit Gateway Orchestrator
- AWS TGW Orchestrator FAQ
- AWS Transit Gateway Orchestrator Plan
- AWS Transit Gateway Orchestrator Build
- TGW Approval
- AWS Transit Gateway Orchestrator Design Patterns
- Aviatrix Transit Gateway Encrypted Peering
- Migrating a CSR Transit to AWS Transit Gateway (TGW)
- Migrating a DIY TGW to Aviatrix Managed TGW Deployment
- Aviatrix Transit Gateway to External Devices
- Global Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
Encrypted Transit Network¶
- Transit VPC/VNET FAQ
- Global Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
- Aviatrix Transit Gateway to External Devices
- Encrypted Transit Approval
- Transit Network Design Patterns
- Setup Transit Network using Aviatrix Terraform Provider
- Transit FireNet FAQ
- Transit FireNet Workflow
- ActiveMesh FAQ
- ActiveMesh Design Notes
- Aviatrix ActiveMesh Workflow
- Insane Mode Encryption FAQ
- ActiveMesh Insane Mode Encryption Performance
- Insane Mode CloudN Deployment Checklist
Firewall Network (FireNet)¶
- Firewall Network FAQ
- Firewall Network (FireNet) Workflow
- Firewall Network Design Patterns
- Setup API Access to Palo Alto Networks VM-Series
- AWS Ingress Firewall Setup Solution
- Azure Ingress Firewall Setup Solution
- Example Config for Palo Alto Network VM-Series
- Bootstrap Configuration Example for VM-Series
- Example Config for FortiGate VM in AWS
- Bootstrap Configuration Example for FortiGate Firewall
- Example Config for CheckPoint VM in AWS
- Setup Firewall Network(Firenet)
- Deploy PFsense instance From AWS marketplace
- Deploying a Barracuda CloudGen Firewall for use with the Aviatrix FireNet
Security¶
- Stateful Firewall FAQ
- Tag Based Security Policy
- Egress FQDN FAQ
- Egress Control Filter
- Egress FQDN Discovery
- Egress FQDN View Log
- Amazon GuardDuty Integration
- Public Subnet Filtering Gateway FAQ
- PrivateS3 FAQ
- What is the security exposure when uploading files to AWS S3 over Direct Connect?
- What is Aviatrix PrivateS3?
- What are the benefits of PrivateS3?
- How does PrivateS3 work?
- How to deploy PrivateS3?
- Can PrivateS3 work for traffic initiated from a VPC?
- Is there an additional AWS data charge by going through the Aviatrix gateway?
- Can PrivateS3 be deployed in TGW environment?
- Can Direct Connect termination VPC be in a different region of managed S3 buckets?
- Can PrivateS3 gateway be in a different region of managed S3 buckets?
- Can PrivateS3 solution scale out?
- How can I test PrivateS3?
- How do I troubleshoot PrivateS3?
- Why doesn’t AWS S3 list command work?
- PrivateS3 Workflow
Peering¶
Site2Cloud¶
- Site2Cloud FAQs
- Site2Cloud IPSec VPN Instructions
- Aviatrix Gateway to Azure VPN Gateway
- Aviatrix Gateway to Aviatrix Gateway
- Aviatrix Gateway to AWS VGW
- Aviatrix Gateway to Oracle DRG
- Aviatrix Gateway to Palo Alto Firewall
- Aviatrix Gateway to Check Point(R77.30)
- Aviatrix Gateway to Check Point(R88.10)
- Aviatrix Gateway to Cisco ASA
- Aviatrix Gateway to Cisco IOS Router
- Aviatrix Gateway to Sonicwall
- Aviatrix Gateway to pfSense
- Aviatrix Gateway to FortiGate
- Aviatrix Gateway to Meraki MX64
- Aviatrix Gateway to Meraki vMX100
- Aviatrix Gateway to Juniper SRX
- CloudN for Site2Cloud
- Site2Cloud Case Study
- Encryption over DirectConnect/ExpressRoute
- Connect Networks With Overlap CIDRs
- Connect Overlapping VPC to On-prem
OpenVPN®¶
- Configuring Aviatrix User SSL VPN
- Aviatrix OpenVPN® FAQs
- How do I launch a VPN gateway?
- How can I avoid managing multiple VPN user certs?
- How do I scale out VPN solution?
- How do I setup Okta authentication for VPN?
- How do I enable Geo VPN?
- How do I add a VPN user?
- What user devices are VPN client software supported?
- Is NAT capability supported on the gateway?
- Is full tunnel mode supported on the gateway?
- Can the maximum number of simultaneous connections to VPN gateway be configured?
- What is user profile based security policy?
- How do I setup profile based security policies?
- How do I assign a user to a profile?
- What if I want to change profile policies?
- How do I change a user’s profile programmatically?
- Is DUO multi-factor authentication supported?
- How do I configure LDAP authentication?
- Can I combine LDAP and DUO authentication?
- Is OKTA supported?
- How does Policy Based Routing (PBR) work?
- What are the monitoring capabilities?
- Does the Aviatrix OpenVPN® solution support SAML client?
- When should I use the Aviatrix VPN client?
- Are multiple VPN configuration profiles supported by the Aviatrix VPN client?
- What is “Client Certificate Sharing”?
- How do I fix the Aviatrix VPN timing out too quickly?
- Where do I find the log for the Aviatrix Client?
- Why can’t my VPN client access a newly created VPC?
- How do I turn off NAT with an OpenVPN® gateway?
- What IP Address is used for NAT’ing the VPN Clients?
- Aviatrix OpenVPN® Feature Highlights
- OpenVPN® Design for Multi Accounts and Multi VPCs
- VPN Access Gateway Selection by Geolocation of User
- UDP LoadBalanced VPN using DNS
- LDAP Configuration for Authenticating VPN Users
- Okta Authentication with Okta API Token
- Duo Authentication
- OpenVPN® with SAML Authentication
- SAML Profile as an Attribute
- OpenVPN® with SAML Authentication on Okta IDP
- OpenVPN® with SAML Authentication on Google IDP
- OpenVPN® with SAML Authentication on OneLogin IdP
- OpenVPN® with SAML Authentication on AWS SSO IdP
- OpenVPN® with SAML Authentication on Azure AD IdP
- OpenVPN® with SAML Authentication on Centrify IDP
- Anonymous Internet Surfing
- Developer’s Sandbox
- External PKI for OpenVPN Certificates
- VPN User Accelerator
- Use IPv6 for User VPN Access
- Use AWS Transit Gateway to Access Multiple VPCs in One Region
Useful Tools¶
Settings¶
- Controller Backup and Restore
- Controller HA in AWS
- Inline Software Upgrade
- Logging
- Emails and Alert Configuration
- Advanced Config
- Controller LDAP Login Configuration
- Netflow Integration
- AWS CloudWatch Integration
- Aviatrix Controller Login with SAML Authentication
- Controller Certificate Management
- FIPS 140-2 Module
- Controller Configuration
- Migrating Aviatrix Controller AMI
- Controller Migration in AWS
- Controller Migration in Azure
- Controller Migration in GCP
Troubleshoot¶
Downloads¶
Release Notes¶
CoPilot¶
Tech Notes¶
- Auto Booting CloudN VM Using ISO File
- Hybrid Network Load Balancing (NLB)
- Datadog Integration
- Launch Aviatrix Controller Manually
- Using Aviatrix to Build a Site to Site IPsec VPN Connection
- Aviatrix Controller Security for SAML auth based VPN Deployment
- How to Connect Office to Multiple AWS VPCs with AWS Peering
- Site2Cloud With Customized SNAT
- Site2Cloud with NAT to fix overlapping VPC subnets
- Site2Cloud to a Public IP Address
- Accessing a Virtual IP address instance via Aviatrix Transit Network
- Aviatrix Active Mesh with customized SNAT and DNAT on spoke gateway
- Connecting Meraki Network to Aviatrix Transit Network
- Reserve For On-Prem Use
- Deploying Spoke without Programming RFC1918 Routes
- AWS Managed Microsoft AD for Aviatrix
- Extending Your vmware Workloads to Public Cloud
- How to Build a Zero Trust Cloud Network Architecture with Aviatrix
- AWS Global Transit Network
- Connect to Floating IP Addresses in Multiple AWS AZs
- Egress NAT to a Pool of IP Addresses
- AWS Transit Gateway Route Limit Test Validation
- Transit Gateway ECMP for DMZ Deployment Limitation Test Validation
- Transit Gateway Egress VPC Firewall Limitation Test Validation
- AWS Transit Gateway Orchestrator
- High Performance Encryption with InsaneMode
- Aviatrix NEXT GEN TRANSIT with customized SNAT and DNAT features
- Use IPv6 to Connect Overlapping VPC CIDRs
- Aviatrix Transit Architecture for Azure
- NAT for non-tunnel-bound Traffic
- Migrating from Classic Aviatrix Encrypted Transit Network to Aviatrix ActiveMesh Transit Network
- OpenVPN FQDN Filter Solution
- Enable SAML App for a group of users in G-Suite using Organization
- Setup Okta SAML with Profile Attribute
Good To Know¶
Support Center¶
IPmotion¶
Troubleshooting Playbook¶