> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Deep Visibility and Enforcement With a Gateway

> Add a gateway and Distributed Cloud Firewall to analyze AI traffic in full detail and enforce allow, block, and inspect rules. Onboard your VPC, enable egress, then configure groups, a policy, and traffic analytics.

This guide covers onboarding the VPC, enabling egress, creating groups and a
policy, trusting the Aviatrix certificate, and reviewing the resulting AI
traffic.

Add a gateway when you require more than basic visibility. A gateway provides
full-detail AI traffic analysis and rule enforcement, in addition to the
workload inventory and risk levels available in
[basic visibility](/docs/cloud/security/agentguard/getting-started/agentguard-without-gateway).

## Requirements for Deep Visibility and Enforcement

The **Security > AgentGuard > AI Traffic Flows** page displays data only after
all of the following conditions are met:

1. Egress is enabled.
2. A WebGroup policy rule has **AI Inspection** enabled.
3. For HTTPS traffic, **TLS Decryption** is also enabled.

<Frame title="AI Traffic Flows">
  <img src="https://mintcdn.com/aviatrix-14b37c43/viuzwLiPfKgpTD5k/docs/cloud/images/ai-traffic-flows.png?fit=max&auto=format&n=viuzwLiPfKgpTD5k&q=85&s=7b9d49068d1fdc686dbf4aae81aa0c96" alt="AI Traffic Flows" width="2390" height="2296" data-path="docs/cloud/images/ai-traffic-flows.png" />
</Frame>

## Prerequisites

* [AgentGuard setup](/docs/cloud/security/agentguard/getting-started/agentguard-setup)
  is complete: your AWS account shows **Status = UP** and your workloads appear
  under **Cloud Resources > Cloud Assets**.

## Step 1: Onboard Your VPC

Onboarding a VPC enables Aviatrix to inspect the VPC and your Kubernetes
workloads, and to resolve workloads to names rather than IP addresses.
Onboarding a VPC automatically creates a High-Availability (HA) gateway pair.

<Frame title="Onboard Your VPC">
  <img src="https://mintcdn.com/aviatrix-14b37c43/H76wwOjEOUjdu5SW/docs/cloud/images/onboard-vpc.png?fit=max&auto=format&n=H76wwOjEOUjdu5SW&q=85&s=ad9528371965340ed998963285023503" alt="Onboard Your VPC" width="5120" height="2880" data-path="docs/cloud/images/onboard-vpc.png" />
</Frame>

<Steps>
  <Step title="Open the VPCs list">
    From the Aviatrix Cloud Console, navigate to **Cloud Resources > Cloud Assets > VPCs**.
  </Step>

  <Step title="Confirm that the VPCs are discovered">
    Confirm that each VPC shows **Status = Discovered**, with the VPC ID, CIDR,
    and region populated.
  </Step>

  <Step title="Onboard the VPC">
    For the complete procedure, see
    [Onboard a VPC/VNet](/docs/cloud/platform-administration/onboard-offboard/vpc-vnet-onboard).
    Confirm that **VPC Status = Onboarded** and, if you run Kubernetes, that
    cluster shows **Onboarded = Yes**. A gateway is created automatically and
    shows **Status = UP**.
  </Step>
</Steps>

<Tip>
  The gateway is fully managed by Aviatrix. You cannot create, delete, or log in
  to it. Kubernetes pods appear only after the cluster is onboarded.
</Tip>

## Step 2: Enable Egress

Egress routes the VPC's outbound traffic through the Aviatrix gateway.

<Frame title="Enable Egress">
  <img src="https://mintcdn.com/aviatrix-14b37c43/H76wwOjEOUjdu5SW/docs/cloud/images/enable-egress.png?fit=max&auto=format&n=H76wwOjEOUjdu5SW&q=85&s=bd01b2c872d4e85e9747b1526cbb55c1" alt="Enable Egress" width="5120" height="2880" data-path="docs/cloud/images/enable-egress.png" />
</Frame>

<Steps>
  <Step title="Enable egress for the VPC">
    From the Aviatrix Cloud Console, navigate to **Security > Egress > Egress VPCs**, select
    your VPC, and set **Egress = ON**.
  </Step>

  <Step title="Wait for egress to be enabled">
    Wait for **Egress Status = Enabled**. The gateway and its network settings
    are configured automatically.
  </Step>

  <Step title="Send a test call">
    From an AI pod, send a test call — for example, to `api.anthropic.com` — and
    confirm that it returns **HTTP 200**. Pod settings do not change.
  </Step>
</Steps>

<Warning>
  Enabling egress alone does not populate the **AI Traffic Flows** page. You
  must also add a rule with **AI Inspection** enabled, as described in
  [Step 4: Create the Policy](#step-4-create-the-policy) below.
</Warning>

<Tip>
  Egress routing and address translation are configured automatically; no manual
  configuration is required.
</Tip>

## Step 3: Create Your Groups

<Frame title="Create Your Groups">
  <img src="https://mintcdn.com/aviatrix-14b37c43/H76wwOjEOUjdu5SW/docs/cloud/images/smartgroups-create.png?fit=max&auto=format&n=H76wwOjEOUjdu5SW&q=85&s=4a93db05803376f4e8b04f216d251362" alt="SmartGroups Creation" width="5120" height="2880" data-path="docs/cloud/images/smartgroups-create.png" />
</Frame>

<Steps>
  <Step title="Create a SmartGroup for your agents">
    From the Aviatrix Cloud Console, navigate to **Groups > Smart Groups > +
    SmartGroups**. Assign a name, such as `Agents`, and match the label
    `ai-type=llm-client`. Matching pods join the group automatically. For the
    complete procedure, see
    [Create SmartGroups](/docs/cloud/resource-groups/smartgroup/smartgroups-create).
  </Step>

  <Step title="Use the built-in WebGroups for AI providers">
    For destinations, use the built-in `avx-ai-*` WebGroups (for OpenAI,
    Anthropic, AWS, Google, and others). These WebGroups require no additional
    configuration.
  </Step>

  <Step title="Create WebGroups for your own destinations">
    Create a WebGroup for internal or restricted destinations. For the complete
    procedure, see
    [Create WebGroups](/docs/cloud/resource-groups/webgroups/webgroups-create).
  </Step>
</Steps>

## Step 4: Create the Policy

<Frame title="Create the Policy">
  <img src="https://mintcdn.com/aviatrix-14b37c43/viuzwLiPfKgpTD5k/docs/cloud/images/dcf-policy-create.png?fit=max&auto=format&n=viuzwLiPfKgpTD5k&q=85&s=f7ed9971ac15db9e634fb1dc94ddf475" alt="Create the Policy" width="5120" height="2880" data-path="docs/cloud/images/dcf-policy-create.png" />
</Frame>

<Steps>
  <Step title="Create the block rule">
    From the Aviatrix Cloud Console, navigate to **Security > DCF > Policies > + Rule** and create
    **Rule 0 — Block-Untrusted**, using the values in the table.
  </Step>

  <Step title="Create the monitor rule">
    Create **Rule 1 — Monitor-AI-to-DB**. Enable IPS only if you require PII
    detection on database queries.
  </Step>

  <Step title="Create the allow-and-inspect rule">
    Create **Rule 2 — Agent-Guardrails** with **Action = PERMIT**. Click
    **Edit**, set **TLS Decryption = DECRYPT\_ALLOWED**, and set **AI Inspection
    \= ON**. Click **Save**. For the TLS configuration procedure, see
    [Configure TLS Decryption](/docs/cloud/security/dcf/tls-decryption-configure).
  </Step>

  <Step title="Create the east-west rule">
    Create the **E/W rule** to permit private-to-private traffic. This rule
    covers agent-to-MCP-server traffic across VPCs.
  </Step>

  <Step title="Verify the policy order">
    Confirm that the policy list shows the rules in priority order — 0, 1, 2, 6,
    then **DefaultDenyAll** — and that **Rule 2** shows the **AI Inspection =
    ON** indicator.
  </Step>
</Steps>

<Warning>
  Rule 0 is a DENY rule at the highest priority, and a lower-priority PERMIT
  rule cannot override it. Confirm that your intended destinations are not
  matched by the block rule.
</Warning>

## Step 5: Trust the Certificate

TLS inspection decrypts HTTPS calls of your pods, so the pods must trust the
Aviatrix certificate authority (CA). Without the CA, pods report TLS certificate
errors after AI Inspection is enabled.

<Frame title="Trust the Certificate">
  <img src="https://mintcdn.com/aviatrix-14b37c43/viuzwLiPfKgpTD5k/docs/cloud/images/dcf-ca-certificate.png?fit=max&auto=format&n=viuzwLiPfKgpTD5k&q=85&s=ee4145c59c180a789959085ba6b454d6" alt="Trust the Certificate" width="5120" height="2880" data-path="docs/cloud/images/dcf-ca-certificate.png" />
</Frame>

<Steps>
  <Step title="Download the CA bundle">
    From the Aviatrix Cloud Console, navigate to **Security > DCF > Settings** and
    download the Aviatrix CA bundle. See
    [Download the Decryption CA Certificate](/docs/cloud/security/dcf/decryption-ca-certificate).
  </Step>

  <Step title="Create a Kubernetes secret">
    Create a secret from the CA file:

    ```bash theme={null}
    kubectl create secret generic aviatrix-ca \
      --from-file=ca.crt=aviatrix-ca.crt \
      -n <namespace>
    ```
  </Step>

  <Step title="Mount the secret in your pods">
    Mount the secret as a volume in the agent pod deployment spec so that the
    pods trust the CA.
  </Step>

  <Step title="Test a call from a pod">
    From a pod, confirm that `curl https://api.anthropic.com` returns **HTTP
    200** with no TLS errors.
  </Step>
</Steps>

## Step 6: Review the Traffic

<Frame title="Review the Traffic">
  <img src="https://mintcdn.com/aviatrix-14b37c43/viuzwLiPfKgpTD5k/docs/cloud/images/ai-traffic-flows-flows.png?fit=max&auto=format&n=viuzwLiPfKgpTD5k&q=85&s=ffe0255854101079f052020da4c3d6ab" alt="Review the Traffic" width="5120" height="2880" data-path="docs/cloud/images/ai-traffic-flows-flows.png" />
</Frame>

<Steps>
  <Step title="Open the Flows list">
    From the Aviatrix Cloud Console, navigate to **Security > AgentGuard > AI Traffic Flows > Flows**. Confirm that
    the **Source** column shows
    workload names rather than IP addresses. Internal IP addresses resolve to
    workload names after they are enriched with cloud resource inventory data.
  </Step>

  <Step title="Review both directions of traffic">
    Review both types of traffic: agent to internal MCP server (east-west) and
    agent to external provider (north-south). Check the **Vendor** and
    **Action** columns.
  </Step>

  <Step title="Open the Map">
    Open the **Map** tab. The diagram has three columns: your workloads on the
    left, internal services in the center, and external providers on the right.
    Internal servers appear in the center column, not the right.
  </Step>

  <Step title="Open the Overview dashboard">
    Open the **Overview** tab. Review the summary cards, the vendor donut chart,
    and the graphs. Apply a filter, such as **Vendor = Anthropic**, and confirm
    that it carries across the tabs.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The test call does not return HTTP 200">
    Confirm that **Egress Status = Enabled** and that the gateway shows **Status
    \= UP**. Egress routing is applied automatically after egress is enabled.
  </Accordion>

  <Accordion title="No gateway was created">
    Confirm that the VPC shows **Status = Onboarded**. The HA gateway pair is
    created automatically during VPC onboarding.
  </Accordion>

  <Accordion title="The AI Traffic Flows page stays empty">
    Check the requirements in order: **Egress Status = Enabled**, then at least
    one DCF rule with **AI Inspection = ON**, then at least one matching AI
    call. Policy changes take effect in under a minute, but the first matching
    flow can take a couple of minutes to appear after the call is made.
  </Accordion>

  <Accordion title="Flows show IP addresses instead of workload names">
    This is expected for a short time after a VPC or Kubernetes cluster is
    onboarded — internal IP addresses resolve to workload names once they are
    enriched with cloud resource inventory data. If names do not appear after a
    few minutes, confirm that the VPC shows **Status = Onboarded** and, for
    Kubernetes workloads, that the cluster shows **Onboarded = Yes**.
  </Accordion>

  <Accordion title="Pods report TLS certificate errors after AI Inspection is enabled">
    Confirm that the Aviatrix CA secret is created and mounted in the pod, and
    that the rule has **TLS Decryption = DECRYPT\_ALLOWED**. If pods report
    `unable to get local issuer certificate` even with the CA installed,
    re-download the current CA bundle from **Security > DCF > Settings** rather
    than reusing a previously saved certificate file — an outdated or
    incomplete certificate produces this exact error.
  </Accordion>

  <Accordion title="Flow details are missing fields, such as URL path or model">
    URL path, HTTP method, and model detail require **AI Inspection** and **TLS
    Decryption** together on the matching rule, plus a trusted CA on the pod. A
    flow with only one of these enabled shows limited detail instead of the
    full breakdown.
  </Accordion>

  <Accordion title="A rule you expect to allow traffic is blocking it instead">
    Confirm that **Rule 0 (Block-Untrusted)** does not match the destination.
    Rule 0 runs at the highest priority, and a lower-priority PERMIT rule
    cannot override a higher-priority DENY rule.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.