> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> Subscribe to Azure secure NAT gateway with Aviatrix PaaS
This guide provides information to get you signed up for the Azure Secure NAT
Gateway by Aviatrix. The NAT Gateway is part of the Platform-as-a-Service
offering.
The Secure NAT Gateway provides security on outbound traffic for any Azure
VNet-based workload, including Kubernetes.
For more information about how Aviatrix PaaS and the Secure NAT Gateway can help
make your network more secure, see:
[Aviatrix PaaS Description](/docs/cloud/platform-administration/overview/paas-description)
You must use a valid corporate Azure account to sign up.
You can subscribe, onboard, and secure your cloud resources in four simple
steps:
## Subscribe to Azure Secure NAT Gateway
Subscribe to the Aviatrix Secure NAT Gateway offer on the Azure Marketplace.
1. Go to the
[Aviatrix Secure NAT Gateway listing](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/aviatrix-systems.aviatrix-paas-secure-nat?tab=Overview)
on Azure Marketplace and click *Get it now*.
2. Accept the Azure terms of use and privacy policy and click *Continue*.
3. On the Aviatrix Secure NAT Gateway page, do one of the following.
Both options open a subscription page.
* From the *Plan* field, select the plan suitable to your needs and click
*Subscribe*.
* Click *Plans + Pricing*, review the details of each plan, and then click
*Subscribe* for the plan suitable to your needs.
If you select the Developer Evaluation Trial plan, you can upgrade to a
paid plan at any time.
4. On the Subscribe to Aviatrix Secure NAT Gateway page, do the following:
1. Under *Project details > Resource group*, click *Create New* and enter a
name for the group.
Microsoft requires a resource group to contain the resource metadata.
2. Select a *Resource group location*.
3. Under *SaaS details*, enter a descriptive *Name* for the subscription.
You can leave other fields with their defaults.
4. Click *Review + Subscribe*, and then click *Subscribe* on the next page.
5. On the *Subscription progress* page, click *Configure account now* when the
process completes.
Alternatively, you can click the Configure Account button in the email you
receive from Azure Marketplace.
6. On the Sign Up screen that displays, enter your name.
The email address you used for your Azure account is auto-populated.
7. Agree to the Aviatrix Terms of Service and Privacy Policy and click *Finish
Sign Up*.
You are signed in to the Aviatrix Platform UI and a Welcome screen displays,
from which you can onboard your Azure cloud account.
Only one account is permitted per company email domain.
If you subscribe to an Aviatrix PaaS offering when another user has already
subscribed and set up Single Sign-on (SSO), you will be redirected to the
Aviatrix PaaS Platform.
If you are subscribing without SSO and another account already exists for your
email domain, you will receive an email acknowledgement, but your subscription
will be denied.
To access an existing Aviatrix PaaS account, you must ask an administrator on
that account to invite you as a user.
## Next Steps
After subscribing to Aviatrix Secure NAT Gateway, onboard your cloud account and
VNets.
### Onboard Cloud Account
Onboarding connects your cloud account to Aviatrix Platform and allows the
platform to discover your cloud resources, such as VNets, subnets, and VMs.
After signing up with Aviatrix PaaS, the Aviatrix Platform opens to a Welcome
page. From this page you can connect your cloud accounts with the Aviatrix
Platform. After you have onboarded a cloud account, the Welcome page no longer
displays when you sign in.
The onboarding process creates the Azure roles and resources required for
Aviatrix Platform to monitor and manage your Azure network. It also allows
Aviatrix PaaS to discover the resources in your cloud account.
1. On Welcome to Aviatrix PaaS, click *Begin*.
2. In Begin Aviatrix Journey Step 1, click *Onboard Cloud Account* and select
*Azure*.
3. Select one of the following methods and complete the related tasks:
The CLI method automates creation of and connection to an application in Azure,
so it is easy and quick.
*Prerequisite*: The Azure CLI and the jq command-line processor must already be
installed on your system.
*Perform the following steps to onboard Azure.*
1. In a terminal window, log in to the Azure CLI.
Example: `az login`
2. Copy the command provided in the Onboard dialog, paste it into the terminal,
and press *Enter* to run the script.
3. When prompted, enter unique names for the custom role and for the Aviatrix
Service Principal.
If the custom role already exists, it will use the existing role.
4. Copy and save the client secret from the decoded JSON output.
The client secret is not saved in Azure or Aviatrix, so this is the only
opportunity to save it. Keep it in a safe place for future reference.
Example of the command and the command output:
```
$ /bin/bash -c "$(curl -fsSL --compressed https://console.avx-cloud.com/assets/scripts/onboarding_azure/azure-cloud-account-onboarding.sh)" (1)
###################################################################################
Starting Aviatrix PaaS Onboarding Configuration
###################################################################################
###################################################################################
Checking for system pre-requisites
###################################################################################
Checking for Azure CLI...
Checking for jq...
Checking for Azure CLI login...
System pre-requisites checks completed.
###################################################################################
Checking for azure account pre-requisites
###################################################################################
Permissions check passed.
Azure account pre-requisites checks completed.
###################################################################################
Setting up Azure Aviatrix Service Principal with Contributor Role
###################################################################################
Subscription ID detected: a1b2c3d4 (2)
Creating custom role for Aviatrix Paas
Enter the name for the custom role (e.g., Aviatrix PaaS Role): Aviatrix PaaS Role (3)
Custom role 'Aviatrix PaaS Role' already exists. Will use existing role.
Enter a user-friendly name for the Aviatrix Service Principal: Aviatrix PaaS SP (4)
You entered: Aviatrix PaaS SP
This name will appear in the Azure Portal under:
Home > Your Subscription > Access control (IAM) > Check Access > Aviatrix PaaS SP
Creating Azure Service Principal
WARNING: Creating 'contributor' role assignment under scope '/subscriptions/a1b2c3d4-ef56-78gh-i901-23456j7kl89m' (5)
WARNING: The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
Azure Service Principal created successfully.
Service Principal details saved to: aviatrix_sp_11111111111111.json (6)
IMPORTANT: Keep the file (aviatrix_sp_11111111111111.json) safe!
Assigning custom role 'Aviatrix PaaS Role' to Service Principal '11aa22bb-33cc-4455-dd66-ee77ff88gg99' (7)
Role assigned successfully.
The following is the decoded JSON output (pre-base64 encoding):
{
"subscription_id":
"",
"tenant_id": "",
"client_id": "",
"client_secret": "" (8)
}
###################################################################################
Paste the following base64-encoded value into the PaaS console to onboard your Azure account: (9)
abCdeFGhI1JklMNop23qrSTu4vWx5YZaGcDeFg6hIjK7...
###################################################################################
```
1. Use this command to run the script to onboard your Azure cloud account.
2. Verify your Azure subscription ID, which the script detects.
3. Enter a name for the custom role. If the custom role already exists, it
will use the existing role.
4. Provide a user-friendly name for the Aviatrix Service Principal.
5. The script creates a 'contributor' role assignment under the specified
subscription scope with your unique ID. Note the associated warning about
protecting credentials.
6. The Service Principal details are saved to a JSON file for future
reference, with a unique file name.
7. The script assigns the custom role to the Service Principal, displaying
the principal's unique ID. Note the important warning about keeping the
JSON file safe.
8. Copy and save the client secret.
9. Copy the value and paste it into the Aviatrix PaaS console.
5. Copy the base64-encoded value from the terminal output and paste it into the
*Command Output* field in the Onboard dialog box.
6. Click *Next*.
You will see a Discovering Cloud Resources message that changes to a success
message after resources are discovered.
7. Click *Close*.
8. Verify that the new cloud account displays in the list on *Cloud Accounts >
Overview*.
It can take a couple of minutes before your VNets display under *Cloud
Resources > Cloud Assets*. These resources need to be onboarded to Aviatrix
Platform.
*Next Step*:
[Onboard Your VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard)
The Aviatrix Console method requires manually collecting several IDs from Azure
Portal and entering them in Aviatrix Platform to create the connection.
Have the following information available for the Azure application you will
associate with Aviatrix PaaS:
* Subscription ID
* Directory ID
* Application ID
* Client Secret
If you are uncertain how to collect this information, see [Gather Information
for Azure
Onboarding](/docs/cloud/platform-administration/onboard-offboard/azure-onboard-info).
*Perform the following steps to onboard Azure.*
1. If you have not already created an Azure application and gathered the
necessary IDs, click *Launch Microsoft Azure Portal* and create an
application.
See [Create a New Application in
Azure](/docs/cloud/platform-administration/onboard-offboard/azure-onboard-info#create-a-service-principal-in-azure),
if you need more information.
2. Enter the following IDs from your Azure account.
* Subscription ID
* Directory ID
* Application ID
* Client Secret
3. Click *Next*.
As your account is onboarded, the cloud assets in your account are
discovered. When the discovery process completes, a success message displays.
4. Click *Close*.
Your onboarded account is named *aviatrix-account* and displays on the Cloud
Resources pages and in the Dashboard.
It can take a couple of minutes before your VNets display under *Cloud
Resources > Cloud Assets*.
Your onboarded regions will also display in the Dashboard geographic map.
If you want to onboard another cloud account, you can do so from Cloud
Resources > Cloud Accounts.
*Next Steps*
[Onboard Your VNets](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard)
### Onboard VNets
Onboarding VNets allows Aviatrix Platform to manage the cloud resources you
select.
After onboarding your cloud account in Aviatrix, the VPCs or VNets associated
with the account display as unmanaged resources in the Aviatrix PaaS console.
You can see a list of VPCs and VNets, and associated VM resources, on the Cloud
Assets page.
To bring the resources under Aviatrix management, you must onboard the VPCs or
VNets. The recommended (default) performance size for VPCs and VNets is Medium.
It is recommended that you deploy each VPC or VNet with at least two subnets in
two different zones to provide high availability. You can select one subnet per
availability zone.
For information about Kubernetes clusters, see [Onboard Kubernetes
Clusters](/docs/cloud/platform-administration/kubernetes/kubernetes-onboard).
During onboarding, an Aviatrix Spoke Gateway is created on each subnet in the
managed VPC or VNet. This gateway is displayed on the Topology map, along with
other network resources.
The Aviatrix PaaS console will onboard only one VPC or VNet at a time, but you
can begin the onboarding process for multiple VPCs or VNets at the same time.
You do not have to wait until a VPC or VNet finishes onboarding to start the
onboarding process for another one.
You can also onboard, monitor, and protect VPCs and VNets from Security >
Egress > Protected VPC/VNets.
To view the status of individual subnets, expand the VPC or VNet listing.
To display related route tables, click the Name of a VPC or VNet.
To onboard your VPCs or VNets, do the following.
1. Go to *Cloud Resources > Cloud Assets > VPC/VNets & Subnets*.
2. Click the *Onboard* link for a VPC or VNet you want Aviatrix to manage.
You can only onboard resources that have public IPs. By default, the
10.0.0.0/16 CIDRs are private.
3. On *Onboard a VPC/VNet* you can do the following:
1. From *Performance Size*, select the instance size for your VPC or VNet.
The recommended default size is Medium.
2. Remove a subnet from the onboarding list by clicking the "*x*" next to the
subnet IP address.
This action only removes the subnet from being managed, it does not remove
the subnet from the VPC or VNet.
3. Add a subnet to the list by clicking the down arrow and selecting the
subnet IP address.
4. Click *Onboard*.
The *Aviatrix Managed* column changes status to *In Progress*. When
onboarding of all subnets for the VPC or VNet is complete, status changes
to *Yes*.
4. Expand the VPC or VNet listing to see the status of individual subnets in the
VPC or VNet.
5. Click the Name of the VPC or VNet to display related route tables.
As subnets are onboarded, they also appear in the
[Cloud Fabric > Topology map](/docs/cloud/monitoring/topology-working-with) as
managed resources.
You can monitor and protect onboarded VPCs and VNets from Security > Egress >
Protected VPC/VNets.
You can [offboard a VPC or
VNet](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-offboard)
from the Aviatrix console by using the Manage menu.
### Secure Your Network
Use either the Distributed Cloud Firewall (DCF) or Egress Security workflow.
* [About Distributed Cloud Firewall Security](/docs/cloud/security/dcf/about-dcf-security)
DCF provides granular network security rules for distributed applications in
the cloud.
* [About Egress Security](/docs/cloud/security/egress-nat/about-egress-security)
Egress Security involves monitoring network traffic to the Internet and
protecting the traffic using DCF Rules, SmartGroups, and WebGroups.
## Related Topics
[Upgrade a Developer Evaluation Trial to a Paid Plan on Azure](/docs/cloud/getting-started/azure/azure-upgrade-subscription)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.