# Aviatrix Documentation: Aviatrix Enterprise 10.1 Guides ## Guides ### Getting Started - [AWS Getting Started Guide](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/getting-started-guide-aws.md): Aviatrix provides a product launch experience with automation and a simple UI guided flow to make it easy for you to begin using the product. - [Azure Getting Started Guide](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/getting-started-guide-azure.md): Aviatrix provides a product launch experience with automation and a simple UI guided flow to make it easy for you to begin using the product. - [Deploy Aviatrix Controller through CSP Consoles](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/manual-launch-controller-csp.md): This guide provides step-by-step instructions for manually launching the Aviatrix Controller in AWS, Azure, and GCP using their respective cloud consoles or CLI tools. ### Connectivity #### Edge - [Installing Edge OS and Onboarding Dell Hardware](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-device-onboarding.md): To deploy an Aviatrix Edge Transit or Spoke Gateway, you must first procure and onboard your edge device onto the Aviatrix Edge Platform. - [Edge Gateway Image Upgrade and Post-Upgrade Tasks](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-gateway-upgrade.md): This document provides information about Aviatrix Edge Gateway image upgrade and post-upgrade tasks. For complete instructions on upgrading Aviatrix Controller and gateways, see Upgrade Aviatrix Controller and Gateways. - [Edge Gateway Multi-Peer BGP over LAN Connection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-multipeer-bgpolan.md): This document provides information about multi-peer BGP over LAN connections from an Aviatrix Edge gateway to on-premises LAN BGP routers. - [Setting up Accounts for Edge Platforms](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-platform-account.md): Edge platform accounts determine the features and functions that are available for creating and deploying a gateway on an edge platform. For instance, setting up a platform account for the Aviatrix Edge Platform allows the Aviatrix Controller to register with the Aviatrix Edge infrastructure... - [Using a Proxy Profile on the Edge Device](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-proxy-profile.md): The edge devices supported on the Aviatrix Edge Platform requires egress over the public internet to communicate with the Aviatrix Platform. If internet traffic is routed through a proxy server, you can configure a proxy profile and associate the profile with the edge device. - [Creating the Default RBAC Access Account for Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-rbac-account.md): You have the option to create a default RBAC group and assign users to this group with permissions to create, delete, and manage Aviatrix Edge Gateways. - [Edge Transit Gateway External Connection Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-s2c-workflow.md): This document describes how to connect an Edge gateway in hybrid or multicloud environment to an on-premises remote device, such as a remote router or firewall that terminate VPN connection. - [Create Edge Spoke Gateway Attachments](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-spoke-attachments.md): An Edge Spoke Gateway can be attached to multiple gateways for hybrid, multicloud, and LAN connectivity. - [Deploy an Edge Spoke Gateway on Equinix Network Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-spoke-workflow-equinix.md): This document provides instructions to deploy a primary Edge Spoke Gateway on Equinix Network Edge. - [Deploy an Edge Spoke Gateway on Megaport Virtual Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-spoke-workflow-megaport.md): This document provides instructions to deploy a primary Edge Spoke Gateway on Megaport Virtual Edge (MVE). - [Deploy an Edge Spoke Gateway on Aviatrix Edge Platform](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-spoke-workflow-onpremise.md): This document provides instructions for deploying a primary and secondary highly available (HA) Edge Spoke Gateways on the Aviatrix Edge Platform. - [Edge Spoke Gateway Deployment Workflow on Self-Managed VMware ESXi and KVM](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-spoke-workflow-selfmanaged.md): This document provides instructions for deploying a primary and secondary highly available (HA) Edge Spoke Gateways on self-managed VMware ESXi or an open-source Kernal-based Virtual Machine (KVM). - [Create Edge Transit Gateway Attachments](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-transit-attachments.md): An Edge Transit Gateway can be attached to multiple Aviatrix gateways for hybrid, multicloud, and LAN connectivity. - [Deploy an Edge Transit Gateway on Equinix Network Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-transit-workflow-equinix.md): This document provides instructions to deploy a primary Edge Transit Gateways on Equinix Network Edge. - [Deploy an Edge Transit Gateway on Megaport Virtual Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-transit-workflow-megaport.md): This document provides instructions to deploy a primary Edge Transit Gateway on Megaport Virtual Edge (MVE). - [Deploy an Edge Transit Gateway on the Aviatrix Edge Platform](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-transit-workflow-onpremise.md): This document provides instructions to deploy a primary and secondary highly available (HA) Edge Transit Gateways on the Aviatrix Edge platform. - [Troubleshooting Edge Gateway Connectivity](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/edge/edge-troubleshooting.md): This document provides information about using the Aviatrix Edge Gateway's command-line interface to troubleshoot common connectivity issues. #### Gateways - [Edge Gateway Attachments](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/gateways/edge-gateway-attachments.md): The Aviatrix Edge gateways provide a secure high-performance networking solution designed to simplify and accelerate hybrid and multicloud connectivity. - [Edge Gateway External Connection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/gateways/edge-s2c.md): Edge Gateway External Connection (S2C) enables you to build secure connectivity between Edge gateways in hybrid and multicloud environments to remote sites such as on-premises, branch offices, and partner locations, by establishing connections to remote routers and firewalls that terminate VPN... - [External Connection Settings](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/gateways/external-connection-settings.md): This document describes the options that you can configure for an Aviatrix gateway Site2Cloud (S2C) external connection to remote devices, such as on-premises router or firewall. - [Transit Gateway CSP Related Settings](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/gateways/transit-gateway-csp-settings.md): Configuration settings for Transit Gateway CSP-related features in the Aviatrix platform. #### Kubernetes - [Securing and Scaling Kubernetes - AWS EKS](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/kubernetes/secure-eks-design.md): Architect identity-based Kubernetes firewalling on Amazon EKS using Aviatrix spoke gateways, non-routable pod CIDRs, and DCF SmartGroups — enabling namespace-as-a-service and cluster-as-a-service platform models without DaemonSets, sidecars, or CNI replacement. #### NAT - [Tuning for Sub-10 Seconds Failover Time in Overlapping Networks](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/nat/s2c-overlapping-cidrs-with-fast-convergence.md): The purpose of this document is to provide the instructions for tuning network configurations for sub-10 seconds failover time when network address ranges on-prem and cloud are overlapping. #### Peering - [Creating AWS VPC Peering Connection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/peering/aws-vpc-peering.md): The Aviatrix Controller integrates native AWS VPC peering to create a peering connection between two VPCs to enable traffic flow between the VPCs privately. - [Creating Azure VNet Peering Connection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/peering/azure-vnet-peering.md): The Aviatrix Controller integrates native Azure Virtual network peering to create a peering connection between two VNets to enable traffic flow between the VNets privately. - [Multi-Region Multicloud Transit Gateway Peering Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/peering/transit-gateway-peering-workflow.md): Aviatrix Transit Gateway Peering enables connectivity across two or more Aviatrix Transit Gateways for communication between groups of Spoke VPCs or VNets across single or multiple clouds and regions. - [Transit Gateway Peering Over Private Network Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/peering/transit-peering-over-private-network-hpe.md): The Aviatrix Transit Gateway Peering over Private Network feature expands Transit Gateway peering to across multiclouds where there is a private network connectivity between the cloud providers via on-prem or a co-location. - [Transit Gateway Peering over Public Network Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/peering/transit-peering-over-public-network-hpe.md): Aviatrix Transit Gateway peering over public network expands Aviatrix Transit Gateway peering across multicloud where the connection between cloud service providers is over the internet. #### Routing - [BGP Route Approval](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/bgp-route-approval.md): Aviatrix Transit Gateways, BGP-enabled Spoke Gateways, and Edge Gateways dynamically learn BGP routes from remote peers. These learned routes are reported to the Aviatrix Controller, which then propagates and programs the route entries into the Spoke VPC or VNet route tables. - [GCP Spoke Single IP SNAT and Tagless Default Routes (Regional VPC)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/gcp-spoke-single-ip-snat-regional-vpc.md): Starting with Controller 9.0, Single IP SNAT on a GCP Regional VPC spoke or standalone gateway supports tagless default routes so serverless workloads and untagged VMs can egress through the Aviatrix gateway without the avx-snat-noip network tag. - [Transit Gateway BGP Over LAN in AWS Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/transit-externaldevice-aws-bgpolan.md): Steps to build an Aviatrix Transit Gateway to External Device connection using BGP over LAN in AWS, enabling communication without tunneling protocols like IPsec or GRE. - [Transit Gateway Multi-Peer BGP Over LAN with Azure Route Server Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/transit-externaldevice-azure-bgpolan-ars.md): The Aviatrix Platform allows Azure Route Server (ARS) integration for on-premises connectivity using Azure ExpressRoute with no overlay. Azure Route Server is a managed service with high availability. - [Transit Gateway BGP Over LAN in Azure Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/transit-externaldevice-azure-bgpolan.md): Transit BGP to LAN allows Aviatrix Transit Gateways to communicate with a pair of instances in different VNets in Azure without running any tunneling protocol such as IPsec or GRE. - [Transit Gateway Multi-Peer BGP Over LAN in GCP Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/transit-externaldevice-gcp-multipeer-bgpolan.md): Transit BGP to LAN allows Aviatrix Transit Gateways to communicate with multiple instances in the same VPC in GCP without running any tunneling protocol such as IPsec or GRE (traffic needs to be sent to the subnet gateway for forwarding). - [Configure VRF End-to-End Propagation](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/routing/vrf-configuration.md): Step-by-step instructions for enabling VRF end-to-end propagation across spoke-transit and transit-transit peerings in Aviatrix CoPilot, and for verifying that segment identity and traffic isolation carry through the transit layer. #### Transit - [Single-Region Multicloud Transit Network Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/transit/transitvpc-workflow.md): This document provides instructions to build a hub-and-spoke network model across multiple clouds in a single-region with Aviatrix Spoke and Transit Gateways. - [Explicit Azure Route Table Selection for Single IP SNAT](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/transit/azure-route-table-selection-snat.md): Pick which Azure route tables receive the 0/0 default route when Single IP SNAT is enabled on an Aviatrix spoke gateway, replacing the previous auto-detection behavior. #### TGW - [Overview of AWS Transit Gateway Orchestrator Features](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/tgw/tgw-overview.md): The Aviatrix CoPilot > Networking > Connectivity > AWS TGW tab provides a list of AWS Transit Gateways. Select any AWS TGW on this page to review and create Attachments, Network Domains, Connection Policies, TGW Routes, or Approvals for any AWS TGW. - [AWS Transit Gateway Route Limit Test Validation](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/tgw/tgw-route-limit.md): While an AWS Transit Gateway (TGW) carries thousands of routes in the TGW route table, a TGW VPN has the same 100 route limit as the VGW VPN. - [Migrating a CSR Transit to AWS Transit Gateway (TGW)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/tgw/tgw-csr-migrate.md): This document assumes that you have deployed a CSR Transit solution with Transit hub CSR instances and VGWs in Spoke VPCs. The steps below provide instructions to migrate a live CSR deployment to Aviatrix with the Transit Gateway Orchestrator. - [Migrating a DIY TGW to Aviatrix Managed TGW Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/tgw/tgw-migrate-aviatrix-tgw.md): Use this document to migrate to an Aviatrix-managed TGW deployment from an existing AWS Transit Gateway (TGW) deployment. #### VPN - [Site2Cloud Solution for Encryption over Direct Connect/ExpressRoute](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/aws-azure-encryption.md): AWS Direct Connect and Azure ExpressRoute provide a private routed circuit between an AWS VPC and an Azure VNet. - [Using Aviatrix Site2Cloud Tunnels to Access VPC Endpoints in Different Regions](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/aws-site2cloud-tunnels.md): VPC Endpoints in AWS allow you to expose services to customers and partners over AWS PrivateLink. In situations where allowing resources to be accessed directly from the Internet is undesirable, VPC Endpoints can enable internal VPC connectivity to resources in other accounts. - [Accessing a Virtual IP Address Instance via Aviatrix Transit Network](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/firewall-onprem-virtualip.md): This document addresses the scenario where a customer on-prem firewall device needs to route encrypted traffic to a partner network in the cloud (AWS/Azure/GCP), but due to concerns for overlapping CIDR blocks to the customer network, the customer side enforces a policy that the destination IP... - [Networks with Overlapping CIDRs Scenarios](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/overlapping-network-connectivity-solutions.md): This document describes a few scenarios of overlapping networking CIDRs and their solutions. The solution uses the Mapped option of the Aviatrix Site2Cloud feature when building IPsec tunnels. - [Configuring Overlapping Networks with Network Mapped IPsec](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/overlapping-networks-mapped-ipsec.md): This document illustrates an example solution to a specific use case. In this AWS use case, a customer needs to connect certain on-prem hosts to certain EC2 instances in a VPC over an IPsec tunnel over the Internet, but the on-prem network range overlaps with the VPC CIDR range, and the... - [Proxy-ID for Routed IPSec Connections](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/proxy-id-routed-ipsec-connections.md): This document describes how to enable IKE phase 2 Proxy-ID traffic selectors on route-based Site-to-Cloud IPSec connections so Aviatrix gateways interoperate with policy-based IPSec peers while remaining route-based on the Aviatrix side. - [Aviatrix Gateway to Aviatrix Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-aviatrixgw.md): This section describes how to configure an IPsec tunnel between an Aviatrix Gateway and another Aviatrix Gateway using Aviatrix Site2Cloud. - [Aviatrix Gateway to AWS Virtual Private Gateway (VGW)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-aws-vgw.md): This section describes how to configure an IPsec tunnel between an Aviatrix Gateway and an AWS VGW. - [Aviatrix Gateway to Azure VPN Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-azure-vpn.md): This document describes how to configure Site2Cloud IPsec tunnels between an Aviatrix Gateway and an Azure Virtual Network Gateway (VNG). - [Aviatrix Gateway to Check Point(R77.30)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-checkpoint-r77.md): This document describes how to build an IPsec tunnel-based Site2Cloud connection between Aviatrix Gateway and Check Point Firewall. To simulate an on-prem Check Point Firewall, we use a Check Point CloudGuard IaaS firewall VM at AWS VPC. - [Aviatrix Gateway to Check Point (R80.10)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-checkpoint-r80.md): This document describes how to build an IPsec tunnel based Site2Cloud connection between Aviatrix Gateway and Check Point Firewall. To simulate an on-prem Check Point Firewall, we use a Check Point CloudGuard IaaS firewall VM at AWS VPC. - [Aviatrix Gateway to Cisco ASA](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-cisco-asa.md): This document describes how to build an IPsec tunnel based Site2Cloud connection between an Aviatrix Gateway and Cisco ASA Firewall. - [Aviatrix Gateway to Cisco Ios Router](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-cisco-ios-router.md): This document describes how to build an IPsec tunnel based Site2Cloud connection between an Aviatrix Gateway and a Cisco IOS router. - [Aviatrix Gateway to FortiGate](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-fortigate.md): This document describes how to configure an IPsec tunnel between an Aviatrix Gateway and a FortiGate firewall using Aviatrix Site2Cloud. This task is divided into two parts: - [Aviatrix Gateway to Juniper SRX](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-juniper-srx.md): Aviatrix does not officially support Juniper SRX, but you can configure Juniper SRX to work with the Aviatrix software. Aviatrix does not actively test our software with Juniper SRX and you should rigorously test your configuration in a development environment before deploying in a production... - [Aviatrix Integration with Microsoft's SSE Solution](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-microsoft-entra.md): This document provides instructions on how to build an external connection from an Aviatrix Gateway to Microsoft's Security Service Edge (SSE) Solution. - [Aviatrix Gateway to Oracle Drg](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-oracle-drg.md): This document describes how to configure an IPsec tunnel between an Aviatrix Gateway and an Oracle Dynamic Routing Gateway (DRG). - [Aviatrix Gateway to Palo Alto Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-paloalto-firewall.md): This document describes how to build an IPsec tunnel-based Site2Cloud connection between an Aviatrix Gateway and a Palo Alto Networks Firewall. To simulate an on-prem Firewall, we use a VM-Series in an AWS VPC. - [Aviatrix Gateway to Sonicwall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-aviatrixgw-to-sonicwall.md): This document describes how to build an IPsec tunnel based Site2Cloud connection between Aviatrix Gateway and Sonicwall. - [Site2Cloud Certificate-Based Authentication](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-cacert.md): If you want to use certificate-based authentication when establishing a Site2Cloud (external) connection between your Aviatrix gateways, or between an Aviatrix gateway and an external device, you use the CA Certificate tab to: - [Connect Networks With Overlapping CIDRs](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-cidrs-overlap-connect.md): This document illustrates an example solution to a use case where a customer needs to: - [Site2Cloud External Connection Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-configuration-workflow.md): This document describes how to establish connectivity between an Aviatrix gateway in AWS, Azure, or GCP and your on-premises router or firewall using Aviatrix Site2Cloud (S2C) external connection. - [Connect Overlapping VPC/VNet to On-prem](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-connect-overlap-vpc.md): Organizations usually plan out their cloud network address ranges. But there are times when a VPC/VNet CIDR overlaps with an on-prem network address range, yet still requires connectivity to on-prem. - [Site2Cloud With Customized SNAT](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-customized-snat.md): This document demonstrates how to create a Site2Cloud connection between two VPCs by using a VGW and an Aviatrix gateway. The Aviatrix gateway also serves as a Source NAT device and translates source IPs of traffic initiated from a peering VPC to an IP address selected by users. - [Site2Cloud with NAT to fix Overlapping VPC Subnets](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-nat-overlapping.md): This document describes how to reach VMs in two overlapping subnets within three different VPCs. - [Site2Cloud to a Public IP Address](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/s2c-public-ip.md): This document addresses the scenario where a customer on-prem firewall device needs to route encrypted traffic to a partner network in the cloud (AWS/Azure/GCP). - [Building Site to Site IPsec VPN Connection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/site-to-site-vpn.md): You can use Aviatrix gateways to connect one site to another. This solution requires one Aviatrix gateway in each location that needs to be connected. These on-premises gateways can be deployed as virtual machines on VMware, KVM or Hyper-V. - [Troubleshooting Transit Gateway Connections](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/tgw-activemesh-troubleshoot.md): To Troubleshoot Transit Gateway Connections: - [Transit Gateway GRE Tunneling in AWS Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-aws-gre-tunneling.md): Connecting to on-prem network over the GRE tunneling protocol in AWS is an alternative to IPsec. When GRE tunneling is used, Aviatrix Multicloud Transit Gateways interoperate directly with on-prem network devices over AWS Direct Connect. - [Transit Gateway Integration with AWS VGW Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-aws-vgw.md): Aviatrix automates the process of discovering and connecting Aviatrix Transit Gateway to AWS VGW. - [Transit Gateway Integration with Azure VNG Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-azure-vng.md): Currently, Aviatrix Multicloud Transit solution requires encryption for connectivity over Azure ExpressRoute or when connecting directly from an external device to on-premises. - [BGP-Enabled Spoke Gateway to External Devices](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-bgpspoke.md): You can connect an external (or 3rd party) device ( Router or Firewall) to Aviatrix Spoke gateways that are enabled with BGP (and NAT). - [Transit Gateway to Cisco ASA Over the Internet Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-ciscoasa.md): 2. Create a Transit gateway that will connect to the Cisco ASA. 3. To connect the Transit VPC gateway to the Cisco ASA, navigate to Networking > Connectivity > External Connections (S2C) and follow these instructions. 4. Download the configuration. 5. - [Transit Gateway to Cisco Router over the Internet Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-ciscorouter.md): 2. Create a Transit gateway that will connect to the Cisco Router. 3. To connect the Transit VPC gateway to the Cisco Router, go to Networking > Connectivity > External Connections (S2C) and follow these instructions. 4. Download the configuration. 5. - [Transit Gateway to FortiGate Over the Internet Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-fortigate.md): This is not a common scenario. You would only set up this type of connection if you want to connect an Aviatrix Transit gateway to a firewall that is outside your Cloud service provider (for example, in a branch office or warehouse). - [Transit Gateway to JuniperSRX over the Internet Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-junipersrx.md): This document describes how to build a Transit connection between an Aviatrix Transit gateway and a Juniper SRX. - [Transit Gateway to Palo Alto VM-Series Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-paloalto.md): This is not a common scenario. You would only set up this type of connection if you want to connect an Aviatrix Transit gateway to a firewall that is outside your Cloud service provider (for example, in a branch office or warehouse). - [Transit Gateway to External Devices Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/transit-externaldevice-workflow.md): This document describes the workflow to connect an Aviatrix Transit Gateway to an external (or third party) router or firewall. - [Troubleshooting IPsec VPN Connection with IKEv2](https://docs.aviatrix.com/docs/enterprise/10.1/guides/connectivity/vpn/troubleshooting-ipsec-vpn-ikev2.md): This article describes how to troubleshoot IPsec VPN connection with IKEv2 on Aviatrix gateway. ### Control Plane - [CoPilot Deployment Methods](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/deployment-methods.md): For AWS and Microsoft Azure deployments, use the Aviatrix launch experience at launch.aviatrix.com. For more information, see the AWS Getting Started Guide and Azure Getting Started Guide. - [Planning Your Controller Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/planning-deployment.md): The information in this topic applies to deployments on the marketplaces for Google Cloud and Oracle Cloud Infrastructure (OCI). - [Aviatrix Licensing](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/aviatrix-licensing.md): Aviatrix offers licenses (unique customer IDs) to customers via Cloud Service Providers. A valid license is required to access and use Aviatrix Cloud Network Controller and Aviatrix Cloud Network CoPilot. #### Controller Deployment - [Planning Your Controller Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/controller-planning-deployment.md): The information in this topic applies to deployments on the marketplaces for Google Cloud and Oracle Cloud Infrastructure (OCI). - [Planning AWS Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/planning-aws-deployment.md): You can subscribe to the required Aviatrix Cloud Networking Platform license and subscriptions by using the Launch Aviatrix experience, accessible at launch.aviatrix.com. - [Subscribing Gateway and Firewall Offers to Private Azure Marketplace for Aviatrix Deployments](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/azure-powershell-deploy.md): Depending on your company's security policies, you may need to add and subscribe to Aviatrix gateway and firewall offers in your private Azure Marketplace using PowerShell. - [Controller High Availability in AWS](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/controller-ha-aws.md): Aviatrix Controller HA in AWS leverages an auto-scaling group and a Lambda function to perform monitoring the health of the current Controller, launching a new Controller and restoring the configuration when the active Controller instance becomes unreachable. - [Configuring an AWS Load Balancer with SSL in Front of Aviatrix Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/aws-ssl-lb.md): The Aviatrix Controller supports adding an SSL certificate. However, sometimes you may prefer to put an AWS Load Balancer (ALB) in front of the Controller. #### CoPilot Deployment - [Planning Your CoPilot Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/copilot-planning-deployment.md): This section discusses prerequisite information and tasks for deploying Aviatrix CoPilot only with Google Cloud (GCP) and OCI (Oracle Cloud Infrastructure). - [CoPilot Simple Deployment](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/simple-deployment.md): You can launch a simple deployment on AWS or Azure by using the Launch Aviatrix experience. - [Deploying Your CoPilot](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/copilot-deployment.md): This section discusses how to deploy Aviatrix CoPilot. - [Deploy CoPilot from Your Controller UI (AWS Only)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/deploy-copilot-controller.md): You can deploy CoPilot from the Aviatrix Controller user interface with AWS. However, the recommended deployment method is by using the Launch Aviatrix setup assistant. See the AWS Getting Started Guide for more information. - [Deploy CoPilot from the Marketplace](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/deploy-copilot-marketplace.md): CoPilot is the management interface for Aviatrix Platform. It is required if you want to implement features such as Distributed Cloud Firewall (DCF) or Network Insights API. - [Deploy CoPilot Using Terraform](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/deploy-copilot-terraform.md): If you are knowledgeable in deploying infrastructure-as-code using Terraform, you can deploy the Aviatrix CoPilot using a Terraform script rather than via the CSP marketplace. - [Verify the CoPilot Deployment and the Connectivity with Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/copilot-deployment-verification.md): You are now successfully logged into CoPilot. To verify Copilot has connected successfully to your Aviatrix Controller, perform the following steps: - [Deleting a CoPilot Instance](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/delete-copilot.md): This section discusses deleting a deployed CoPilot instance. #### Initial Setup - [Initial Setup of CoPilot](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/initial-setup.md): Perform initial setup of CoPilot after you have launched the instance/virtual machine in the cloud provider environment. - [Logging in to CoPilot](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/ui-login.md): This section covers how to log in to a running CoPilot. If this is your initial login to CoPilot, see Initial Setup of CoPilot. - [Onboard Your AWS Access Account in Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/onboard-account-controller-aws.md): You can onboard an AWS account to your Aviatrix Controller from the Controller UI. - [Post-Deployment Tasks for the Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/post-deploy-controller.md): After deploying your Controller through the CSP (Cloud Service Provider) marketplaces or Terraform, use this document to set up your Controller. #### Settings and Configuration - [CoPilot Settings You Can Enable in Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/copilot-controller-settings.md): By default, CoPilot is already associated with your Controller after CoPilot deployment. If you want to reset this association, such as to point Controller to a different CoPilot instance or to recover from a lost association, use the following steps. - [Migrating CoPilot Data](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/copilot-migrate.md): This section discusses migrating CoPilot data from old CoPilot to new CoPilot. It includes: - [CoPilot Disk (Volume) Management](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/disk-management.md): Allocate data disks (volumes) to your Aviatrix CoPilot deployment to be used for expandable storage. - [CA Certificate Rotation of Internal Service](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/internal-service-ca-rotation.md): Aviatrix gateways receive X.509 certificate identities from an internal Certificate Authority (CA) running on the Controller. This identity is used for securing the control-plane connections between gateway and controller, and certificate-based authentication for Site-to-Cloud (S2C)... - [Configure CoPilot for the Aviatrix Platform](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/platform-integration-points.md): As a component in the Aviatrix Platform, CoPilot must communicate with other components in the platform to receive the data it requires. This section details the configuration of CoPilot for the Aviatrix platform. - [Re-Encrypt Existing Controller and CoPilot Volumes Using a Custom Key](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/reencrypt-custom-key.md): You can re-encrypt your existing Controller and CoPilot volumes using a custom key. #### Migration - [Migrate CoPilot to Appliance V3 (AWS)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/migrate-to-appliance-v3.md): The CoPilot migration to Appliance v3 on AWS is a necessary and essential step to enhance the security, availability, and performance of your CoPilot deployment. As the old version of CoPilot images will soon be deprecated, it is highly recommended to migrate your CoPilot to Appliance V3. - [Troubleshoot the CoPilot Migration](https://docs.aviatrix.com/docs/enterprise/10.1/guides/controlplane/migrate-to-appliance-v3-troubleshoot.md): When performing the CoPilot migration to Appliance V3, you may encounter certain issues or challenges. Here are some troubleshooting steps to help address potential challenges during the migration process: ### Gateways - [High Availability Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/gateways/gateway-ha-about.md): This document provides an overview of the high availability configuration options for Aviatrix Transit Gateway and Spoke Gateway. - [Deploy Gateways Without Public IPs](https://docs.aviatrix.com/docs/enterprise/10.1/guides/gateways/deploy-gateways-without-public-ips.md): This guide explains how to deploy an Aviatrix gateway without a public IP address using the Assign Private IP Only setting, covering prerequisites, the CoPilot procedure, and connectivity verification. ### Maintenance - [Back Up and Restore Your Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-backup-restore.md): The Aviatrix Controller is not in the data path, as packet processing and encryption is done by the Aviatrix gateways. - [Back Up and Restore Your Controller from the Minimum Controller UI](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/min-controller-ui-maintenance.md): Configure external storage, schedule automatic backups, and restore your Aviatrix Controller from the Minimum Controller UI Maintenance page. - [Overview of the Aviatrix Controller and Gateways Upgrade](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/upgrade-overview.md): Aviatrix encourages you to keep your platform Controller and gateways up to date to ensure you are operating the most secure and highest performing versions available. To facilitate less disruptive upgrades and reduce maintenance windows Aviatrix provides a rolling selective upgrade process. - [Upgrade OpenVPN Users](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-openvpn-user-upgrade.md): Most upgrades do not impact connected OpenVPN users. In some cases, OpenVPN service needs to be restarted as part of software upgrade. For example, upgrading to a new SSL version for security patch. - [Upgrade HA Gateways in An ActiveMesh Topology](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-hagateway-activemesh-topolog.md): Gateway traffic is briefly affected and there is a drop in throughput when you perform a gateway image upgrade, and when a gateway software upgrade is rolled back. - [Unattended Upgrades](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/unattended-upgrade.md): Aviatrix unattended upgrades automatically apply operating system security updates to Aviatrix Controllers and Gateways. This capability helps you maintain a strong security posture by ensuring that critical OS‑level vulnerabilities are patched without requiring manual intervention. - [Upgrade Checklist of the Controller and Gateway Upgrade](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-upgrade-checklist.md): This topic provides an overview of the upgrade to-do list of the tasks before you begin your upgrade, during your upgrade, and after the upgrade. - [Pre-Upgrade Tasks for Controller and Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-upgrade-planning.md): Check the following prerequisites before you upgrade your controller and gateways: - [Readiness Check for the Aviatrix Controller Upgrade](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-upgrade-readiness-check.md): Run the CoPilot Readiness Check before a Controller upgrade to surface compatibility and prerequisite issues before the maintenance window. - [Procedures for Upgrading Aviatrix Controller and Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-upgrade-workflow.md): This section outlines the general Controller and gateway upgrade instructions. - [Single-Version Upgrade for Controller and Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-upgrade-steps.md): A single-version Controller and Gateway upgrade refers to: - [Upgrade Your Controller and Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-upgrade-controller.md): This page explains how to perform single-version Controller and Gateway upgrade using either CoPilot (recommended) or Controller UI. Choose a tab below. - [Upgrade Gateways in Groups](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/gateway-upgrade-groups.md): The gateway group upgrade feature optimizes the gateway upgrade process by allowing you to categorize and manage gateway upgrades more efficiently. It enables the predefined grouping of gateways based on Cloud, Account, Region, Gateway type, Current image version, and Kernel version. - [Upgrading Your Gateway Image](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/gateway-image-upgrade.md): A gateway image is a virtual resource or template that contains all the information required to launch, backup, or restore a gateway in your cloud network. Aviatrix periodically releases new gateway images that include updates, enhancements, and security improvements. - [Gateway Drain and Undrain During Image Upgrade and Maintenance](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/gateway-drain-undrain-upgrades.md): In 9.0, the Aviatrix Controller drains HA gateway pairs before image upgrade, delete, and resize operations, and undrains them only after the data plane has converged. - [Upgrade Your Aviatrix Controller Image Overview](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/upgrade-controller-image-overview.md): Aviatrix strongly recommends that you contact Aviatrix Support before upgrading your Controller image. - [Upgrade your Controller and Gateways to the Latest Aviatrix Supported Images (AWS and Azure Only)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-upgrade-latest-image.md): This auto-upgrade process only applies to AWS and Azure. Contact Aviatrix Support if your Controller and Gateways are deployed on other cloud service providers. - [Upgrade Your Controller to the Latest Aviatrix Supported Images (AWS and Azure Only)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-upgrade-latest-image.md): This documentation aims at providing steps on upgrading your Controller to the latest Aviatrix images. - [Upgrade Gateways for the Latest Aviatrix Supported Images (AWS and Azure Only)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/gateway-upgrade-latest-image.md): Before upgrading your Controller and Gateways, it is highly recommended to check the Upgrade Overview. - [Troubleshooting Controller and Gateway Upgrades](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-upgrade-troubleshooting.md): This section provides some solutions for resolving some commonly encountered issues during the upgrade process for your Controller and Gateways. - [Verify Your Upgrade Status](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-gateway-upgrade-verify.md): After performing an upgrade, it is important to verify the upgrade status to ensure that it has been completed successfully. - [Controller Migration](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/controller-migration.md): Aviatrix strongly recommends that you contact Aviatrix Support before migrating your Controller. - [Upgrading Gateway Image](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/gateway-image-migration.md): A gateway image is a virtual resource or template that contains all the information required to launch, backup, or restore a gateway in your cloud network. Aviatrix periodically releases new gateway images that include updates, enhancements, and security improvements. - [Installing Software and Security Patches](https://docs.aviatrix.com/docs/enterprise/10.1/guides/maintenance/copilot-installing-patches.md): The CoPilot > Settings > Maintenance > Upgrade tab > Install Patches section in Aviatrix CoPilot lists all available security and software patches and indicates whether or not they have been installed. ### Monitoring - [Controller and Gateway Logging](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/aviatrix-logging.md): The Aviatrix Controller and all of its managed gateways can be configured to forward their logs to well known log management systems. The Controller and all the managed gateways will forward the logs directly to the logging server. - [AWS CloudWatch Integration](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/logging-integration-cloudwatch.md): If you use CloudWatch, the Aviatrix platform offers a CloudWatch agent for sending syslog from Aviatrix Controller and Aviatrix gateways to your configured AWS CloudWatch instance. - [External Monitoring with the Metrics and Status APIs](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/metrics-api-enable.md): The Aviatrix Metrics and Status APIs allow you to integrate CoPilot with third-party monitoring platforms such as Datadog, Splunk, Grafana, or Prometheus. - [Monitoring Business Unit Costs with CostIQ](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/network-costs.md): This section describes the CostIQ feature of Aviatrix CoPilot. - [Viewing Recent Changes Made to Your Network](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/topology-replay.md): Shortly after a problem occurs in the network, you can use CoPilot to see if recent changes to network constructs may have caused the problem. Using the CoPilot Topology Replay feature, you can pinpoint when changes occurred and analyze the details of changed constructs. - [Gaining Visibility into Your Network Topology](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/topology-visibility.md): When you build your Aviatrix Multicloud Transit Network by launching Aviatrix Gateways and other constructs, Aviatrix CoPilot automatically draws a topology map that shows your current network environment. - [Monitoring Traffic Flows](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/traffic-flows.md): FlowIQ provides you with critical visibility capability to the traffic that traverses your network. You access FlowIQ in CoPilot by going to Monitor > FlowIQ or typing FlowIQ in the navigation search. - [Notifications (Alerts) About Network Events](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/user-alerts-network.md): The CoPilot Notifications page enables you to configure alerts so that you can be notified about changes in your Aviatrix transit network, see all triggered alerts, pause alerts, and set preferred notification channels for receiving alerts. - [Configure Telemetry Export Profiles](https://docs.aviatrix.com/docs/enterprise/10.1/guides/monitoring/otel-export-profiles.md): Create and manage Telemetry Export Profiles to forward Aviatrix telemetry from the Universal OTEL Export pipeline to your external SIEM, observability, or archival systems. ### Platform Administration - [Setting Up Azure Account Credentials](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/account-azure.md): Aviatrix Controller uses Azure APIs extensively to launch Aviatrix gateways and configure features. - [Admin Users and Duo Sign in](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/admin-users-duo.md): This document describes a reference design using the Aviatrix Controller console's user management and Duo authentication capability to manage multiple users with admin privileges. - [Setting up Alibaba Cloud Account Credentials](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/aviatrix-account-alibaba.md): Access your Alibaba account info in the Alibaba UI. Click on the User Icon so you can access the Alibaba Cloud Account ID, Cloud Access Key ID, and Cloud Secret Key. You need the Alibaba account information to create the Alibaba Primary Access Account in the Aviatrix Controller. - [Managing Access Accounts](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/aviatrix-account.md): You can download the full set of logs to audit user access activities: - [Connecting a Cloud Account](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/cloud-account-create.md): To connect accounts for edge platforms, see Setting up Accounts for Edge Platforms. - [DNS Server Configurations for the Aviatrix Controller](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/copilot-dns-controller.md): This page provides guidance on configuring the DNS server for the Aviatrix Controller. The Aviatrix Controller requires DNS resolution to communicate with various services, including: Licensing, CoPilot services, telemetry services, Public APIs, and optional integrations. - [CoPilot SAML Authentication](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/copilot-saml-authentication.md): This guide explains how to use Aviatrix CoPilot to configure your Aviatrix Controller to authenticate to an IdP. When SAML is used for Controller access authentication, the Controller acts as the Identity Service Provider (ISP) that redirects browser traffic from the client to the IdP (e.g.,... - [Use Azure IAM Custom Role](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/custom-role-azure.md): When Aviatrix Controller uses Azure API to manage networking and gateway resources, an application must be first created in Azure AD with an identity of Service Principal. - [DNS Server Configuration for Aviatrix Services](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/dns-server-general.md): This document provides an overview of how DNS (Domain Name System) servers are configured within Aviatrix services. DNS is a critical infrastructure component that translates domain names into IP addresses, enabling communication between Aviatrix components and external systems. - [GCP Account Onboarding](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/gcp-account-onboarding.md): Before creating a cloud account for Google Cloud (GCP) on Aviatrix CoPilot, follow the steps below to make sure you have the credentials set up for API calls. - [IP Whitelist AWS Azure](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/ip-whitelist-aws-azure.md): This document describes how to configure IAM policies (AWS) and Conditional Access (Azure) to prevent a malfunctioning Controller mistakenly restored from a backup assuming control of onboarded CSP accounts. - [Admin Users and Duo Sign in](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/objective-duo.md): This document describes a reference design using the Aviatrix Controller console's user management and Duo authentication capability to manage multiple users with admin privileges. - [Role-Based Access Control (RBAC) or User Access Overview](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/rbac-faq.md): The Aviatrix Platform is a multicloud and multi-tenant enterprise platform. As such, the Aviatrix Platform manages multiple cloud accounts by requiring access by multiple administrators. - [Set Up SAML Login for CoPilot](https://docs.aviatrix.com/docs/enterprise/10.1/guides/platform-administration/saml-login-setup.md): If you use an identity provider (IdP) to allow your organization's team members to log in to Aviatrix Controller via SAML, they can log in to Aviatrix CoPilot via SAML authentication also provided the following setup is in place. ### Security - [Blocking Traffic from Countries using Geoblocking](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/geoblocking.md): The Geoblocking tab is only displayed if you had Geoblocking enabled and configured prior to Controller version 7.2.4820. - [Detecting Network Anomalies using Network Behavior Analytics](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/network-anomalies.md): Aviatrix CoPilot can perform continuous network behavior analysis on your cloud workloads on a per VPC/VNet basis to learn the routine behaviors of the VPC/VNets based on a group of metrics. - [Network Segmentation](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/network-segmentation-secured.md): Aviatrix Multicloud Transit Network Segmentation provides network isolation and better security on your IPv4 and IPv6 networks. It does this through network domains and connection policies. These apply to the Aviatrix Transit network. - [Platform Security Hardening Guidelines](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/security-hardening-guidelines.md): Secure the Aviatrix platform by hardening controllers, gateways, and CoPilot instances. Covers public IP mitigation, egress controls, WAF deployment, authentication, and a shared responsibility matrix. - [General Guidelines for Migrating from Legacy ThreatIQ and Geoblocking to Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/threatiq-geo-dcf-migration-guidelines.md): If you configured ThreatIQ and/or Geoblocking, you can upgrade to Distributed Cloud Firewall (DCF) and its ExternalGroup functionality. This migration requires Controller 8.1 or greater. - [Blocking Known Threat IP Traffic using ThreatIQ](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/threatiq.md): ThreatIQ is only visible in Aviatrix CoPilot if you configured ThreatIQ prior to Controller version 7.2.4820. #### DCF - [Creating Groups for Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-create-groups.md): A Distributed Cloud Firewall (DCF) SmartGroup contains one or more filters to identify cloud endpoints that map to an app domain. A filter specifies resource matching criteria. - [Disabling the Distributed Cloud Firewall Feature](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-disable-feature.md): If you disable Distributed Cloud Firewall (DCF), the following occurs: - [Distributed Cloud Firewall Setup and Default Action Rule](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-enable-feature.md): Distributed Cloud Firewall (DCF) provides advanced traffic management capabilities to enforce zero trust principles across your network. This document focuses on enabling the DCF feature and configuring the Default Action Rule, ensuring secure and consistent traffic handling in the absence of... - [About Distributed Cloud Firewall Settings](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-settings.md): On the Security > Distributed Cloud Firewall > Settings tab, you can configure the following: - [Extending Distributed Cloud Firewall to your Network Edge](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/edge-dcf.md): Distributed Cloud Firewall (DCF) allows you to define granular policies for the distributed applications in the cloud. In addition to Network Segmentation Domains, you can leverage the DCF feature for additional security to allow or deny network traffic from cloud and on-premises. - [Migrating from Legacy Egress to Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/egress-migration.md): If you configured Egress FQDN filtering in the Aviatrix Controller, Aviatrix strongly recommends that you upgrade to Distributed Cloud Firewall (DCF) with its accompanying WebGroups functionality. This migration requires Controller 8.1 or greater. - [Onboarding Kubernetes Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-onboard.md): Onboard EKS, AKS, GKE, or self-managed Kubernetes clusters to the Aviatrix Controller for Distributed Cloud Firewall. Pick the cluster type to see the step-by-step flow. - [Onboard EKS Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-onboard-eks.md): Step-by-step EKS onboarding for the Aviatrix Distributed Cloud Firewall. Two authentication paths: AWS Cloud Account (recommended) and service-account kubeconfig. - [Onboard AKS Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-onboard-aks.md): Step-by-step AKS onboarding for the Aviatrix Distributed Cloud Firewall. Three authentication paths: Azure Cloud Account with Entra ID (recommended), Azure Cloud Account with local accounts, and service-account kubeconfig. - [Onboard GKE Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-onboard-gke.md): Step-by-step GKE onboarding for the Aviatrix Distributed Cloud Firewall. Terraform-only registration; two authentication paths. - [Onboard Self-Managed or Custom Kubernetes Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-onboard-custom.md): Onboard kops, kubeadm, k3s, Rancher, or any cluster running in a supported cloud where the Aviatrix Controller authenticates via a service-account kubeconfig. - [Onboarding Private Kubernetes Clusters](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/private-kubernetes-cluster-onboard.md): Private Kubernetes clusters have an API server not exposed to the public internet. The Aviatrix Controller needs a private network path to the cluster API before you can onboard it. This page covers the connectivity options. - [Discovery of Kubernetes Resources](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/kubernetes-resource-discovery.md): This card is only visible if the Distributed Cloud Firewall feature is enabled. - [Distributed Cloud Firewall for Kubernetes](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-kubernetes.md): Aviatrix Distributed Cloud Firewall (DCF) for Kubernetes extends Zero Trust security to containerized workloads across AWS EKS, Azure AKS, Google GKE, and self-managed clusters. - [Kubernetes Intra-Cluster Inspection](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-kubernetes-intra-cluster.md): Enable Distributed Cloud Firewall (DCF) intra-cluster inspection to enforce pod-to-pod security policies inside Kubernetes clusters using native NetworkPolicy objects translated from DCF rules. - [Distributed Cloud Firewall Logging](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-logging.md): Aviatrix Controller 8.2 introduces configurable session-level logging for Distributed Cloud Firewall (DCF) policies, providing granular control over logging points and richer session insights. - [OCI Support for Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-oci.md): Starting with Aviatrix Controller version 8.2, Distributed Cloud Firewall (DCF) supports Oracle Cloud Infrastructure (OCI) in addition to AWS, Azure, and GCP. This enhancement allows enterprises to enforce consistent security policies across multicloud environments, including OCI workloads. - [Distributed Cloud Firewall for Serverless Resources (Early Access)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/dcf-serverless-resources.md): Aviatrix Distributed Cloud Firewall discovers serverless compute resources across AWS, GCP, and Azure, and lets you target them with SmartGroups by type, region, name, account, or tag. - [Intrusion Prevention System (IPS)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/ips.md): Aviatrix Controller 9.0 introduces Intrusion Prevention System (IPS) capabilities, extending beyond detection to active enforcement. IPS operates inline on the data path, enabling real-time threat prevention for workloads across multicloud environments. - [MultiWriter Policy via Terraform](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/multiwriter-policy-terraform.md): The MultiWriter Policy (MWP) feature introduces hierarchical policy structure and attachment points for distributed policy management via Terraform. MWP enables large enterprises to scale policy governance across multiple teams while maintaining a unified enforcement model. - [Policy Audit Enhancement for Distributed Cloud Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/policy-audit.md): Aviatrix Controller 8.2 introduces Policy Audit Enhancements for Distributed Cloud Firewall (DCF), delivering change tracking and structured diffs for policy entities. - [Centralized Security Hub VPC (Early Access)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/dcf/centralized-security-hub-vpc.md): Deploy Aviatrix DCF gateways behind an AWS Gateway Load Balancer in a dedicated security hub VPC to enforce firewall policy across hub-and-spoke networks connected to a user-managed AWS Transit Gateway. #### Egress - [Implementing Egress in an Aviatrix-Managed Network](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-introduction.md): The Aviatrix Distributed Cloud Firewall (DCF) Egress solution offers a comprehensive approach to securing egress traffic to the internet in cloud environments. - [Managing Egress Security for VPC/VNets](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-vpc-vnets-tab.md): Controller 8.0 is required for all features and functionality on this tab except for applying local egress to VPC/VNets. - [Protecting Egress Traffic with the Egress Protection Workflow](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-protect-vpc-vnets.md): Controller 8.0 and the enablement of the Distributed Cloud Firewall feature is required to protect VPC/VNets with the egress protection workflow. - [Enabling Local Egress](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-enabling-local.md): On the Security > Egress > Egress VPC/VNets tab you can enable Local Egress on selected Spoke VPC/VNets that do not already have Egress enabled, and that are not attached to a Transit FireNet gateway. - [Monitoring Egress Traffic](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-monitor-vpc-vnets.md): Controller 8.0 and the enablement of the DCF feature is required to monitor VPC/VNets. - [Unprotecting and Monitoring a VPC/VNet](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-unprotect-monitor.md): There are several scenarios where you might want to unprotect a previously protected VPC/VNet while still maintaining monitoring: - [Aviatrix Cloud Firewall Secure Egress Implementation Guide](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/aviatrix-cloud-firewall-implementation.md): The Aviatrix Cloud Firewall™ Secure Egress Implementation Guide outlines the steps required to implement the Aviatrix secure egress use case in Aviatrix CoPilot. - [Egress FQDN Filtering (Legacy)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/egress-legacy-overview.md): Egress FQDN Filtering is a security feature available in the Aviatrix Controller prior to Controller version 7.1. This feature is designed to filter Internet-bound egress traffic initiated from workloads in a VPC/VNet by specifying fully qualified domain names (FQDNs) that are allowed or... - [Configure MCP Server Egress Containment with Obot on EKS](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/mcp-egress-containment-obot-aws.md): Step-by-step instructions for enabling Aviatrix DCF egress containment for MCP servers managed by Obot on Amazon EKS: cluster onboarding, DCF policy setup, and per-server domain declaration. - [Configure MCP Server Egress Containment with Obot on AKS](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/mcp-egress-containment-obot-azure.md): Step-by-step instructions for enabling Aviatrix DCF egress containment for MCP servers managed by Obot on Azure Kubernetes Service: IP masquerade configuration, cluster onboarding, DCF policy setup, and per-server domain declaration. - [Configure MCP Server Egress Containment for Self-Hosted MCP Servers](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/mcp-egress-containment-self-hosted.md): Step-by-step instructions for applying Aviatrix DCF egress containment to self-hosted MCP servers: prerequisites, cluster onboarding, and authoring containment policies alongside server deployment manifests. - [Secure AWS Bedrock AgentCore Agent Workloads](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/ai-agent-containment-aws-bedrock.md): Step-by-step instructions for applying Aviatrix DCF containment to AWS Bedrock AgentCore agent workloads: spoke gateway insertion, IAM guardrails, SmartGroup and WebGroup policy, selective TLS decryption, and East-West containment. - [Secure Microsoft Foundry Agents with Enterprise Transit](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/ai-agent-containment-azure-foundry-transit.md): Apply Aviatrix AgentGuard containment to Microsoft Foundry agent workloads in BYOVNet mode using an existing Aviatrix Enterprise Transit: spoke gateway insertion, UDR enforcement, ACA runtime exclusions, selective TLS inspection, and East-West containment across the transit fabric. - [Secure Microsoft Foundry Agents with a Standalone Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/ai-agent-containment-azure-foundry-standalone.md): Apply Aviatrix AgentGuard containment to Microsoft Foundry agent workloads in BYOVNet mode using a standalone spoke gateway — no Aviatrix Enterprise Transit required. Covers spoke gateway insertion, UDR enforcement, ACA runtime exclusions, and selective TLS inspection. - [Secure Self-Hosted AI Agent Workloads on Kubernetes](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/egress/ai-agent-containment-self-hosted.md): Step-by-step instructions for applying Aviatrix DCF containment to self-hosted AI agent workloads on Kubernetes: cluster onboarding, workload-scoped egress policy, and East-West containment for LangGraph, AutoGen, CrewAI, and custom agent runtimes. #### East-West - [East-West Traffic Inspection Overview](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/east-west/east-west-overview.md): Compare Aviatrix's two approaches to east-west traffic inspection: Transparent DCF Protection with AWS Transit Gateway, and East-West Inspection with Aviatrix Transit. Learn which one applies to your deployment. - [Transparent DCF Protection with AWS Transit Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/east-west/transparent-dcf-protection-aws-tgw.md): Aviatrix Distributed Cloud Firewall inspects East-West and egress traffic across AWS spoke VPCs without modifying the existing AWS Transit Gateway architecture. - [Enable East-West Inspection with Aviatrix Transit](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/east-west/ips-east-west.md): Enable Suricata intrusion prevention (IPS/IDS) and TLS man-in-the-middle (MITM) inspection for east-west traffic between spoke VPCs and VNets, a Preview feature in Aviatrix Controller 10.1. #### Firenet - [Configuring Transit FireNet](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-overview.md): With Aviatrix Transit FireNet you can insert firewalls into the Aviatrix Transit VPC/VNet for any supported cloud. Transit FireNet provides simplified firewall instance deployment and scaling, and allows the firewall instances to inspect East-West traffic (VPC/VNet to VPC/VNet), VPC/VNet to... - [Managing Firewalls in Transit FireNet](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-overview.md): FireNet supports three types of firewall vendors: Check Point CloudGuard, Fortinet FortiGate, and Palo Alto VM-Series. Panorama (firewall manager) is also supported for Palo Alto VM-Series firewalls. - [Transit FireNet Workflow for AWS](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-aws.md): Follow the procedures in this document to apply FireNet to an AWS Transit gateway. - [Transit FireNet Workflow for AWS TGW](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-aws-tgw.md): Follow the procedures in this document to apply FireNet to an AWS TGW. - [Transit FireNet Workflow for Azure](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-azure.md): Follow the procedures in this document to apply FireNet to an Azure Transit gateway. - [Horizontal Transit Scaling with FireNet for Azure (Early Access)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-azure-scaling.md): Scale Azure Transit FireNet beyond the two-gateway limit by deploying additional Transit gateway instances behind an internal load balancer. Covers new deployments and migration of existing deployments. - [Transit FireNet Workflow for GCP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-gcp.md): Procedures to apply Transit FireNet to a GCP Transit gateway, including prerequisites, firewall deployment, inspection policies, and vendor integration. - [Transit FireNet Workflow for OCI](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-oci.md): Follow the procedures in this document to apply FireNet to an OCI Transit gateway. - [Transit FireNet Workflow for Egress](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-workflow-egress.md): By default, FireNet inspects traffic between North South (on-prem and VPC/VNet) and East West (VPC/VNet to VPC/VNet). You can use this workflow to ensure that a Transit gateway sends trafic to the Internet and does not perform any traffic inspection. - [Attaching a Spoke to a Transit FireNet](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-attach-spoke.md): After adding a Transit FireNet, you can attach Spoke gateways. The GCP Spoke gateways can have Global VPC enabled. - [Subscribing to a Firewall Instance (AWS)](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-subscribe-aws.md): Before setting up Transit FireNet, AWS customers must subscribe to a firewall instance from a specific vendor in the AWS Marketplace. - [Deploying a Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-launch-attach.md): You can also associate an existing firewall. - [Disassociating or Deleting Firewall Association](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-delete-disassociate.md): To remove the firewall association, you can either disassociate or delete the firewall. Disassociating a firewall removes its association with its FireNet instance, but keeps the firewall available for future use. - [Checking the Health of Your Firewall](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firenet-health.md): Firewalls play a critical role in securing cloud network environments by inspecting and controlling traffic between resources. This document explains how Aviatrix monitors the health of firewall instances across different cloud providers, detailing the mechanisms used to detect failures and... - [Transit FireNet Vendor Integration](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firenet-vendor-integration.md): The Vendor Integration function allows you to log into a firewall or firewall manager and change the route table on the firewall to program the routing for Transit FireNet, or to change routing if a gateway in Transit FireNet fails. - [Transit FireNet Diagnostics](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/transit-firenet-diagnostics.md): You can run diagnostics on a Transit FireNet Gateway from the Security > FireNet Gateways tab. - [Managing VM-Series by Panorama](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-panorama-configure.md): If Panorama is used to manage your Palo Alto VM-Series firewalls, any dynamic route updates initiated by Aviatrix CoPilot are sent to Panorama. CoPilot does not check the health of Panorama; it only checks the health of the VM-Series instances. - [Migrating from Individual VM to Panorama](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/firewall-panorama-migrate.md): Assuming you have existing individually managed VM-Series in CoPilot and have prepared your Panorama, follow the instructions below to migrate individual VMs to Panorama. - [Deploying Check Point CloudGuard](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/config-checkpoint.md): Ensure that you have completed all Transit FireNet steps up to but not including the launch of the Check Point firewall instance. - [AWS Ingress Firewall Setup Solution](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/ingress-firewall-example.md): This document illustrates a simple architecture for Ingress traffic inspection firewall that leverages AWS Load Balancers and Aviatrix TGW Orchestrator. The solution also allows you to view the client IP address. - [Azure Ingress Firewall Setup Solution](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/azure-ingress-firewall-example.md): Step-by-step guide to set up an Azure ingress firewall solution using Aviatrix Transit FireNet for traffic inspection. - [Ingress Protection via Aviatrix Transit FireNet with Palo Alto in GCP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/paloalto-ingress-gcp.md): This document describes how to configure ingress in GCP with traffic inspection, deployed directly in Transit FireNet. In this configuration you use the native GCP load balancers in Transit FireNet. - [Restrictive Firewall Management Security Groups](https://docs.aviatrix.com/docs/enterprise/10.1/guides/security/firenet/restrictive-firewall-management-security-groups.md): Aviatrix scopes inbound rules on Azure and GCP firewall management interfaces to the Aviatrix Controller IP address for Palo Alto Networks, Check Point, and Fortinet firewalls deployed through FireNet. ### Troubleshooting - [CoPilot Support and Troubleshooting](https://docs.aviatrix.com/docs/enterprise/10.1/guides/troubleshooting/copilot-support.md): If you cannot resolve a problem encountered in your CoPilot deployment, contact Aviatrix Support. - [Troubleshooting Routing Issues in Your Aviatrix-Managed Network](https://docs.aviatrix.com/docs/enterprise/10.1/guides/troubleshooting/diagnose-cloud-routes.md): This section describes the Cloud Routes feature of Aviatrix CoPilot. - [Interpreting Gateway Diagnostic Results](https://docs.aviatrix.com/docs/enterprise/10.1/guides/troubleshooting/troubleshoot-diagnostic-result.md): This page explains the major items to examine while doing a Run diagnostics on a gateway. ### UserVPN - [Migrating to Azure VPN Load Balancer Standard SKU](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/migrate-lb-sku.md): Follow these steps to migrate from the Basic Azure VPN Load Balancer SKU to the Standard Azure VPN Load Balancer SKU. - [Deploying Aviatrix UserVPN with AWS TGW](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-aws-tgw.md): This document describes how to deploy the Aviatrix UserVPN solution with an AWS TGW (Transit Gateway). See Overview of AWS Transit Gateway Orchestrator Features for more information about AWS TGW. - [CA Certificate Rotation of UserVPN](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-ca-rotation.md): Rotate the UserVPN CA certificate in the Aviatrix Controller with either a simple or a staged workflow to keep client and server certificates trusted. - [Download the Aviatrix VPN Client](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-client-download.md): The Aviatrix VPN solution is the only VPN solution that provides SAML authentication from the client itself. The solution is built on OpenVPN®. The Aviatrix VPN Client provides a seamless user experience when authenticating a VPN user through a SAML IDP. - [Aviatrix VPN Client User Guide](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-client-user-guide.md): 2. Run the installer and follow the onscreen instructions to install the application. - [Aviatrix VPN User Authentication with Duo IdP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-duo-authentication.md): The Aviatrix UserVPN solution provides Duo authentication integration. This document helps you to set up Duo to connect with Aviatrix. - [Creating a UserVPN Default Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-gateway-default-vpn-create.md): The gateway instance must be launched from a public subnet. - [Editing VPN Gateways](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-gateway-edit.md): To edit a VPN gateway: - [Deleting a VPN Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-gateway-delete.md): To delete a VPN gateway, in CoPilot: - [Creating a Geo VPN Gateway](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-gateway-geo-vpn-create.md): If you have a global workforce that needs to access the cloud with the best user experience, build a cloud network with Geo VPN access capability. - [UserVPN Gateway Guide](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-gateway-guide.md): You can review VPN gateways in Aviatrix CoPilot > CloudFabric > UserVPN. - [Aviatrix LDAP-Based Authentication](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-ldap-authenticaton.md): Aviatrix provides integration with an LDAP/AD server for the authentication of users logging into the VPN services. This guide walks you through the configuration steps. - [Aviatrix VPN User Authentication with an Okta API Token](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-okta-authentication.md): There are two methods to authenticate a VPN user against Okta: using an Okta API Token or using the Aviatrix VPN SAML Client. This document shows you how to set up authentication using the Okta API Token. - [Aviatrix SAML Authentication on Microsoft Entra ID IdP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-authentication-entra-id.md): Azure Active Directory (AD) is now Microsoft Entra ID. - [Aviatrix SAML Authentication on Microsoft Entra Id IdP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-authentication-entra-id1.md): Azure Active Directory (AD) is now Microsoft Entra ID. - [Aviatrix SAML Authentication on Okta IdP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-authentication-okta.md): Aviatrix allows for centralized management of user access by integrating with your chosen Identity Provider (IdP) (in this case, Okta) via SAML. This allows you to control user access to Controller and CoPilot, as well as user access to the cloud environment using Aviatrix UserVPN (if desired). - [Aviatrix SAML Authentication on OneLogin IdP](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-authentication-onelogin.md): This guide provides an example on how to configure Aviatrix to authenticate against a OneLogin IdP. When SAML client is used, your Aviatrix CoPilot acts as the Identity Service Provider (ISP) that redirects browser traffic from client to IdP (e.g., OneLogin) for authentication. - [Aviatrix SAML-Based Authentication](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-authentication.md): This step-by-step guide shows you how to use the Aviatrix VPN Client to authenticate an IdP. When SAML is configured, your Aviatrix CoPilot acts as the Service Provider (SP) that redirects browser traffic from client to IdP (such as Entra ID) for authentication. - [Setting Up Okta SAML with Profile Attribute](https://docs.aviatrix.com/docs/enterprise/10.1/guides/uservpn/user-vpn-saml-okta-set-profile-attribute.md): This guide demonstrates the use of the Profile attribute in Okta so each SAML user can be assigned a different VPN profile.