# Aviatrix Documentation: Aviatrix Enterprise 10.1 ## 10.1 - [Aviatrix Enterprise / 10.1 / Guides (251 pages)](https://docs.aviatrix.com/_llms/aviatrix-enterprise/10-1/guides.txt): Documentation for Aviatrix Enterprise / 10.1 / Guides. - [Aviatrix Enterprise / 10.1 / Reference (783 pages)](https://docs.aviatrix.com/_llms/aviatrix-enterprise/10-1/reference.txt): Documentation for Aviatrix Enterprise / 10.1 / Reference. ### Concepts & Architecture - [CNSF](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/CNSF/index.md): Introduction to the Aviatrix Cloud Native Security Fabric (CNSF), providing zero trust security, network segmentation, and workload protection across multi-cloud environments. #### Solutions ##### Security for AI - [AI Agent Workload Containment](https://docs.aviatrix.com/docs/enterprise/10.1/solutions/security-for-ai/ai-agent-workload-security.md): How Aviatrix DCF closes the network security gap for AI agent workloads: threat model, east-west containment, selective TLS inspection, and the business case for default-deny enforcement across any agent platform or framework. - [MCP Server Security Through Containment Architecture](https://docs.aviatrix.com/docs/enterprise/10.1/solutions/security-for-ai/mcp-server-egress-security.md): How Aviatrix containment architecture closes the egress security gap for MCP server workloads: the business case, deployment approaches, compliance impact, and key capabilities. ##### AI Agent Integrations - [Aviatrix MCP for Enterprise Fabrics](https://docs.aviatrix.com/docs/enterprise/10.1/solutions/ai-agent-integrations/mcp-for-enterprise-fabrics.md): Connect an MCP-compatible AI agent to the Aviatrix MCP Server for authenticated, read-only access to Controller and CoPilot data: topology, policy, flow intelligence, and diagnostics. - [Aviatrix MCP for Docs](https://docs.aviatrix.com/docs/enterprise/10.1/solutions/ai-agent-integrations/mcp-for-docs.md): Connect an MCP-compatible AI agent to the Aviatrix documentation MCP server to search product documentation without leaving your IDE, terminal, or AI assistant. - [Suggested Use Cases for the Aviatrix Enterprise MCP Server](https://docs.aviatrix.com/docs/enterprise/10.1/solutions/ai-agent-integrations/mcp-suggested-use-cases.md): Validated prompts and example outputs for using an AI assistant with the Aviatrix MCP server, covering health checks, security audits, CVE exposure analysis, upgrade planning, incident response, and infrastructure-as-code. #### Components ##### Control Plane - [CoPilot Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/controlplane/copilot-overview.md): Overview of Aviatrix CoPilot capabilities, deployment model, and related product guides. - [CoPilot Features](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/controlplane/copilot-features.md): This section provides an overview of Aviatrix CoPilot key features. - [Controller Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/controlplane/controller-overview.md): Overview of Aviatrix Controller capabilities, deployment model, and related product guides. ##### Edge - [Edge Platform](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/edge-gateways/edge-aep.md): Aviatrix Edge Platform is an Aviatrix turnkey solution that enables cloud orchestration of edge hardware and Aviatrix Edge Gateways for deployment in customer on-premises locations. The hardware is recommended by Aviatrix and comes pre-staged before it is shipped to a customer site. - [Hybrid Cloud Edge](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/edge-gateways/edge-overview.md): Aviatrix Hybrid Cloud Edge is an enterprise grade solution that enables customers to extend the Aviatrix Cloud Networking architecture to the edge of their networks for consistent and repeatable architecture, management, visibility, security, and control. - [Edge Spoke Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/edge-gateways/edge-spoke-overview.md): The Aviatrix Edge Spoke Gateway provides a secure, high-performance networking solution for on-premises to cloud. It enables dynamic routing, end-to-end encryption, segmentation and supports advanced NAT for connectivity to various cloud providers and on-premises environments while providing... - [Edge Spoke Gateway Use Cases](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/edge-gateways/edge-spoke-usecases.md): This document illustrates these common use cases for deploying Aviatrix Edge Spoke Gateway. - [Edge Transit Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/edge-gateways/edge-transit-overview.md): The Aviatrix Edge Transit Gateway provides a secure, high-performance networking solution designed to simplify and accelerate hybrid and multicloud connectivity. ##### Connectivity - [ActiveMesh](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/activemesh-about.md): ActiveMesh is an Aviatrix Encrypted Transit Network architecture where both primary gateways and backup gateways forward packets in a load balancing fashion. The architecture statistically doubles the network throughput. - [ActiveMesh 4.0](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/activemesh-4.0.md): Overview of Aviatrix ActiveMesh 4.0, the latest version of the encrypted transit network architecture with enhanced performance and availability. - [ActiveMesh Design Notes](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/activemesh-design-notes.md): ActiveMesh is the default mode when launching an Aviatrix Transit Gateway. This document describes the supported common design patterns while deploying ActiveMesh Gateways. - [Smart Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/smart-gateways-overview.md): An overview of Smart Gateways, how it is built, how it works, its key capabilities, and when to use it. - [IPv6 Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/ipv6-overview.md): IPv6 (Internet Protocol version 6) is the next-generation IP addressing protocol designed to overcome IPv4 limitations and provide enhanced scalability, security, and performance for modern networks. - [Native Peering](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/native-peering-about.md): You can use Aviatrix CoPilot to create native peering connections between cloud VPCs or VNets. There are two types of native peering: VPC/VNet to VPC/VNet, and Transit VNet to Spoke VNet (previously referred to as Azure ARM Spoke through Native Peering). - [Site2Cloud](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/s2c-overview.md): Traditionally enterprises host their IT applications in their own data center or at a co-location. Remote sites typically connect to the data center via an Internet-based IPsec VPN tunnel or MPLS based private network. Such a hub and spoke architecture has been prevalent in the last 15 years. - [VRF Multi-Tenancy](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/connectivity/vrf-overview.md): How Aviatrix VRF isolates traffic between tenants and business units with overlapping IP addresses, and propagates that segment identity end-to-end across transit peerings. ##### Security - [About High Performance Encryption](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/security/hpe-about.md): Aviatrix High Performance Encryption tunneling techniques establish multiple tunnels between the two virtual routers, thus allowing all CPU cores to be used for performance scaling with the CPU resources, as shown below. - [High Performance Encryption for GCP](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/security/hpe-for-gcp.md): Because GCP network infrastructure is different from AWS and Azure, Aviatrix High Performance Encryption mode for GCP differs from AWS and Azure in the following ways: - [Transit Network Segmentation](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/security/transit-segmentation-faq.md): Aviatrix Multicloud Transit Segmentation provides network isolation through network domains and connection policies to Aviatrix Transit network where both Spoke and Transit networks deploy Aviatrix Gateways across multi-region and multicloud. ##### Distributed Cloud Firewall - [Distributed Cloud Firewall Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/dcf-overview.md): Distributed Cloud Firewall (DCF) uses micro-segmentation to provide granular network security rules for distributed applications in the Cloud. Distributed Cloud Firewall enables network policy enforcement between SmartGroups, WebGroups, and ExternalGroups you define in a single cloud or across... - [Distributed Cloud Firewall Rulesets](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/dcf-rulesets-about.md): Your Distributed Cloud Firewall (DCF) policies are essential for managing and securing network traffic across various parts of an organization. - [Enforcing Zero Trust with Distributed Cloud Firewall and the Default Action Rule](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/dcf-zero-trust.md): Aviatrix Distributed Cloud Firewall (DCF) provides a foundational framework for implementing zero trust principles across multi-cloud environments. A key component of this framework is the Default Action Rule, which establishes a baseline security posture by controlling how traffic is handled... - [Kubernetes Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/kubernetes-overview.md): Aviatrix Kubernetes Firewall extends Distributed Cloud Firewall (DCF) security policies to containerized applications by including Kubernetes Pod and Service addresses in SmartGroups. - [Security Group Orchestration for Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/security-group-orchestration.md): After configuring your SmartGroups and Distributed Cloud Firewall rules, you can enable Security Group Orchestration for workload traffic that will remain in your virtual network. - [SmartGroup Use Cases](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/smartgroup-use-cases.md): The following are examples of how to use SmartGroups in Distributed Cloud Firewall (DCF) policies. - [Managing SmartGroups](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/smartgroups-about.md): This section describes SmartGroups and how they can be used for implementing different Aviatrix features. - [Managing WebGroups](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/webgroups-about.md): Enable the Distributed Cloud Firewall (DCF) feature to avail the WebGroups. See Distributed Cloud Firewall Overview for more information. - [About DNS Hostname SmartGroups](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/dcf/hostname-smartgroups-about.md): DNS Hostname SmartGroups enable you to filter non-HTTP/TLS traffic by fully qualified domain name (FQDN). The gateway proactively resolves hostnames to IP addresses and enforces them as firewall rules in DCF policies. ##### AWS Transit Gateway - [AWS Transit Gateway Orchestrator](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/tgw/tgw-landing-page.md): Landing page for AWS Transit Gateway (TGW) Orchestrator resources, including overview, FAQ, design patterns, and attachment workflows. - [AWS Transit Gateway Orchestrator FAQ](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/tgw/tgw-orchestrator-faq.md): Aviatrix AWS TGW (Transit Gateway) Network Orchestration creates a single hub for transit networks across multiple AWS regions. The AWS TGW feature in Aviatrix CoPilot connects your Aviatrix platform to this AWS feature and enables you to attach Spoke VPCs to your transit network. ##### UserVPN - [UserVPN Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/uservpn/user-vpn-feature-description.md): The Aviatrix UserVPN feature provides a cloud-native and feature-rich client VPN solution, leveraging OpenVPN® compatibility to ensure seamless integration with all OpenVPN® clients. ##### Egress - [Egress Security Score Protection](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/components/egress/egress-overview.md): Controller 8.0 and the enablement of the DCF feature is required to view the Security > Egress > Overview tab. #### Architecture - [Aviatrix Platform Overview](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/platform-overview.md): Aviatrix® cloud networking software allows you to easily build your cloud network backbone, connect gateways in different regions, cloud service providers (CSPs), or data centers, and extend your applications to the edge of your network. ##### Connectivity - [Edge Spoke Gateway High Availability](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-ha.md): This document provides a brief overview of Edge Spoke Gateway high availability. - [Local Internet Breakout at Network Edge](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-local-internet-breakout.md): Aviatrix Hybrid Cloud Edge solution offers Local Internet Breakout capability. - [Customized SNAT and DNAT on Edge](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-snat-dnat.md): The Aviatrix Hybrid Cloud Edge solution supports customized SNAT and DNAT for the use case where the cloud service provider (CSP) network CIDR overlaps with the on-premises network CIDR. The customized SNAT and DNAT apply to HPE-enabled and HPE-disabled Edge Spoke gateways. - [Transit Peering Over Public Network with Edge Spoke Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-transit-peering.md): If you have a multicloud environment across cloud service roviders (CSPs), for example, AWS and Azure, you can create Transit Gateway Peering over public network and use the Transit Gateway Peering as a secondary or backup path while the Edge Spoke Gateway with Transitive Routing enabled is... - [Transitive Routing with Edge Spoke Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-transitive-routing.md): The Transitive Routing feature allows an Edge Spoke Gateway to forward routes between multiple Transit Gateways that are connected to it. You have the option to enable or disable Transitive Routing for an Edge Spoke Gateway; it is disabled by default. - [Extending VLAN Segmentation to the Cloud](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-vlan-segmentation.md): This document describes the Aviatrix Hybrid Cloud Edge solution to extend virtual LAN (VLAN) network segmentation into cloud. - [Aviatrix in the China Regions](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/aviatrix-china-overview.md): This document provides an overview of the Aviatrix features that are supported and the requirements for implementing Aviatrix in the China regions. It also provides various options and design patterns for interconnecting Aviatrix in the China regions and Global regions. - [Bidirectional Forwarding Detection for BGP](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/bgp-bfd.md): This document describes Bidirectional Forwarding Detection (BFD) for BGP in Aviatrix. - [BGP Communities](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/bgp-communities.md): This document outlines BGP communities in Aviatrix and describes how to configure BGP communities for implementing routing policies that direct traffic between on-premises or remote offices and the Aviatrix fabric. - [AZ Affinity and Symmetric Routing Architecture](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/az-affinity-symmetric-routing.md): How Aviatrix combines AZ-aware nexthop selection with per-spoke symmetric routing to cut cross-AZ costs and enable east-west inspection in AWS. - [Edge Spoke Gateway Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-design-patterns.md): This document describes these common design patterns for deploying Aviatrix Edge Spoke Gateway. - [Edge Spoke Gateway Horizontal Scaling](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-spoke-scaling.md): This document provides a brief overview of Aviatrix Edge Spoke Gateway horizontal scaling. - [Edge Transit Gateway Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-transit-design-patterns.md): Edge Transit Gateway allows you to build high performance encrypted connections across Equinix and Megaport fabric to cloud environments. You can also deploy Edge Spoke Gateways in on-premises for high performance encrypted connections to Edge Transit Gateway in Equinix and Megaport. - [Edge Transit Gateway External Connection](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/edge-transit-s2c-overview.md): Many enterprises today use cloud adjacent and on-premises data center locations for connecting various remote sites and partners. The ability to seamlessly build a secure network fabric to cloud and remote sites and deploy segmentation controls to meet agility and business zero trust... - [Enabling GCP Global VPC Routing](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/gcp-global-vpc.md): GCP Global VPC creates regional awareness between the VPC and Aviatrix gateways, letting you restrict spoke gateway traffic to transit gateways in the same region as the spoke gateway and, starting with Controller 10.1, configure a distinct egress mode for each region. - [Multicloud Transit Network Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/multi-cloud-design-patterns.md): This document describes how to configure your VPC/VNets for a variety of single and multi-region scenarios. - [Aviatrix Multicloud Transit Architecture for Azure](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/nextgen-transit-azure.md): The most common design topology within Azure is the Hub and Spoke model. The hub is a virtual network (VNet) in Azure that acts as a central point of connectivity to your on-premises network. - [Azure Transit Network Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/planning-azure.md): There are many design patterns for networking and networking security deployment in the cloud. This document summarizes these design patterns that apply to Azure networks. - [Overview of Transit Gateway to External Devices](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/transit-externaldevice-usecase.md): This document focuses on Aviatrix Transit Gateway connection to an external device. - [Aviatrix Multicloud Transit Network FAQ](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/transit-network-faq.md): Aviatrix Multicloud Transit Network architecture is about building connectivity between the cloud and on-prem in the most agile manner possible. In the Aviatrix Multicloud Transit Network architecture, there is one connection (not including the backup) between on-prem and a Transit VPC or... - [TGW Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/tgw-design-patterns.md): Many design patterns exist to deploy your network with the AWS Transit Gateway Orchestrator. Here are some examples. - [VRF Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/vrf-design-patterns.md): Reference topologies for VRF multi-tenancy on Aviatrix fabrics: single-transit and multi-transit VRF stitching designs. - [Aviatrix UserVPN Design for Multi-Accounts and Multi-VPC/VNets](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/connectivity/user-vpn-designs.md): This reference design helps you build an end-to-end secure cloud network, from users accessing the network (AWS VPC, Azure VNet, or GCP VPC) to routing packets among the VPC/VNets, such that once a user is connected via VPN, they can access any private resources in the cloud no matter where... ##### Security - [FireNet Design Patterns](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/security/firenet-design-patterns.md): FireNet supports High Performance Encryption Mode. - [East-West Suricata IPS and TLS MITM Inspection Architecture](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/security/ips-east-west-design-patterns.md): A reference architecture for inspecting east-west traffic between Aviatrix spoke gateways with Suricata IPS and TLS MITM decryption, and the symmetric routing dependency this design requires. - [FireNet Ingress Traffic Inspection](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/security/planning-firenet-ingress.md): If the FireNet deployment is for both Egress and Ingress traffic, you need to SNAT on the firewall instance to its LAN or Trusted Interface IP (eth2 interface). ##### Sizing - [Auto Right-Sizing](https://docs.aviatrix.com/docs/enterprise/10.1/concepts-architectures/architecture/sizing/auto-right-sizing-about.md): You can use the Auto Right-Sizing feature to apply appropriate sizing to Transit and Spoke gateway instances (AWS and Azure). This can reduce cloud provider costs, improve performance and mitigate packet loss. ## OpenAPI Specs - [aviatrix-api](/openapi/10.1/aviatrix-api.json) - [aviatrix-api](/openapi/8.2/aviatrix-api.json)