Enabling Transit Egress

You must have at least Controller version 7.0.1577 to use this feature.

Aviatrix recommends that you only use the Transit Egress feature in CoPilot if you are currently using the Egress Control feature in Aviatrix Controller. New users should use the Distributed Cloud Firewall for Egress.

On the Transit Egress tab, you can enable Egress Control on Transit Gateways that:

have Transit Egress Capability selected but do not have firewalls attached as per the FireNet workflow.
have attached Spoke Gateways that do not already have Egress enabled.

This Transit Gateway can then send its attached Spoke Gateway traffic to the Internet. The Spoke Gateways will own all routes but send all egress traffic to this Transit Gateway.

You can edit AWS Transit gateways (on the Cloud Fabric > Gateways > Transit Gateways tab) to add Transit Egress Capability, but you cannot edit other cloud Transit gateways to add this functionality. You must select the Transit Egress Capability when first creating Transit gateways in those cloud providers.

Configuring Transit Egress

On the Security > Egress > Transit Egress tab, click Enable Egress on Transit.

Configure the following:

Field	Description
Transit Gateway	Select a Transit gateway from the list.
Primary Egress (AWS only)	Enable the selected Transit gateway to provide Egress control for its attached Spoke gateways.
Secondary Egress (AWS only)	Enable the selected Transit gateway to send traffic to the Primary Egress Transit gateway that is providing Egress control.
Attach Secondary Egress (AWS only)	Select the Secondary Egress Transit gateways that will send traffic to the Primary Egress Transit gateway.
Gateway Load Balancer	Off by default.
Egress	On by default.
Egress Instance Size	Select the instance size for the Egress instance. The size you select is applied to all Egress Subnets you select.
Egress Subnet	Select the Egress Subnet(s).

Field

Description

Transit Gateway

Select a Transit gateway from the list.

Primary Egress (AWS only)

Enable the selected Transit gateway to provide Egress control for its attached Spoke gateways.

Secondary Egress (AWS only)

Enable the selected Transit gateway to send traffic to the Primary Egress Transit gateway that is providing Egress control.

Attach Secondary Egress (AWS only)

Select the Secondary Egress Transit gateways that will send traffic to the Primary Egress Transit gateway.

Gateway Load Balancer

Off by default.

Egress

On by default.

Egress Instance Size

Select the instance size for the Egress instance. The size you select is applied to all Egress Subnets you select.

Egress Subnet

Select the Egress Subnet(s).

Click Enable. This adds FQDN capability to the selected Transit gateway, which handles egress traffic for the Spokes that send traffic to this Transit gateway.