Corrected Issues in Aviatrix Release 10.0.10
| Issue | Description |
|---|---|
| AVX-79855 | Fixed an issue where disabling Distributed Cloud Firewall (DCF) on a transit gateway with Site-to-Cloud (S2C) or other external connections could leave existing DCF filtering rules in effect on the interface when no policy change was queued at the time, allowing traffic to continue to be filtered by DCF after DCF was disabled. |
| AVX-79866 | Fixed an issue where NAT rules could fail to install on gateways with legacy tunnel peerings that predated recent tunnel-peering enhancements. |
| AVX-79905 | Fixed an issue where Automatic Controller Access Security Group Management enforcement could unintentionally disable Security Group Management when a transient error occurred during an enforcement check. When Security Group Management became disabled, all gateways experienced keep-alive failures and new gateways could not come up. |
| AVX-80347 | Fixed an issue where a packet capture that had been stopped from the CoPilot UI (Gateway Diagnostics > Packet Capture) could continue running in the background on the affected gateway. This could cause any subsequent packet capture attempted on the same gateway to silently return no data, and in more severe cases could leave the Controller unresponsive. |
| AVX-80983 | Fixed an issue where Azure Security Group Management could unexpectedly delete and recreate a security group rule during gateway launch when an Azure API throttling response on a rule-existence check was misinterpreted as the rule not existing. |
| AVX-80992 | Fixed an issue where Cloud Asset Inventory (CAI) could time out when a GCP service account was linked to a very large number of project IDs, which could leave cleanup of deleted GCP resources incomplete and cause stale resource entries to accumulate. |
| AVX-81091 | Fixed an issue where the Controller’s GCP event monitoring could fail to query event logs for a GCP account when that account’s associated service account was linked to a very large number of GCP projects, causing the query to fail with an error indicating the event filter was too long. |
| AVX-81892 | Fixed a rare deadlock in the internal policy-update path on gateways enforcing Distributed Cloud Firewall (DCF) policies that include SmartGroups with FQDN selectors. The deadlock could previously cause the gateway data-plane process to stop forwarding traffic while remaining alive. The gateway process did not exit and was not marked unhealthy by existing watchdogs. This was more likely when the FQDN selector resolved to a set of addresses that rotated frequently (short DNS TTL), because each resolution change triggered a policy reload that raced with an internal hit-counter update. Recovery previously required manually restarting the affected gateway. WebGroup (SNI-based) policies and gateways not using FQDN-selector SmartGroups were not affected by the deadlock. |
Known Issues in Aviatrix Release 10.0.10
| Issue | Description |
|---|---|
| AVX-73436 | When using the update_spoke_vpc_route_table API to onboard an Azure route table, the default route (0.0.0.0/0) is not programmed in the spoke VNET route table if the Spoke Gateway has learned the default route from any of the following sources:
Impact:
Manually add the default route to the Azure route table. Contact Aviatrix Support for assistance. |
| AVX-75452 | In Azure environments, when Distributed Cloud Firewall (DCF) Security Group Orchestration attaches a Network Security Group (NSG) to a subnet, the subnet name is changed to all lowercase. Although Azure resource names are generally case-insensitive, this modification causes issues with Infrastructure as Code tools such as Terraform, which treat resource names as case-sensitive. Terraform may flag affected subnets for replacement, potentially disrupting existing deployments. Impact:
In Terraform, add a lifecycle block with ignore_changes for subnet_id (as well as id in the azurerm_subnet resource) to prevent forced resource replacement. Note that this workaround does not restore the original subnet name casing. |
| AVX-78500 | When Distributed Cloud Firewall (DCF) is disabled on a gateway, DCF policy enforcement may not be fully removed from all gateway interfaces. As a result, traffic can continue to be evaluated against the previously applied DCF policy even though DCF appears disabled. This can occur when DCF is disabled without any accompanying policy change. Impact: * After DCF is disabled, a gateway may continue enforcing the last applied DCF policy on some interfaces. * This residual enforcement is not reflected in the DCF status shown for the gateway and may persist until DCF is re-enabled or the gateway configuration changes. Workaround: When disabling DCF, also make a minor DCF policy change (for example, add and then remove a rule) so enforcement is fully cleared from all interfaces. If you suspect DCF policy is still being enforced after disabling DCF, contact Aviatrix Support. |
| AVX-78524 | Due to delays in the Azure Marketplace publishing process, the Azure China Gateway VM image (Azure China North 3, publisher cbcnetworks, offer aviatrix-gateway) will not be available in Azure China when Controller 10.0.10 is released. Attempting to launch a new Azure China Gateway on Controller 10.0.10 fails with a marketplace-offer-not-found error (AVXERR-TRANSIT-0067).Impact: Customers with Azure China (China North 3) gateways cannot deploy new Azure China Gateways on Controller 10.0.10. Workaround: Customers with Azure China gateways should remain on the Controller 9.0 series until the Azure Marketplace offer is published and this Known Issue is resolved. |
| AVX-78671 | Enabling Logging on the Default Action Rule and then disabling it can cause the Monitor tab to continue showing log entries for that rule for up to one hour after Logging is turned off. Impact: * After you disable Logging on the Default Action Rule (following a period when Logging was enabled and traffic was flowing), the Monitor tab continues to display log entries for that rule for up to one hour. * Excess log volume during that hour can make it harder to review logs for other Distributed Cloud Firewall (DCF) rules. Workaround: No action is required. Logging for the Default Action Rule stops automatically once the one-hour period elapses. Until then, you can filter Monitor tab entries by rule name to distinguish residual Default Action Rule logs from current rule activity. |
| AVX-79012 | Some gateways may become stuck in a failed configuration-push state for an extended period after an Image Upgrade to Aviatrix 10.0.10 (from 9.0.10). This has been observed primarily on lower-memory gateway instance types (for example, AWS t3.micro). Impact: Affected gateways may show a “Not Up-To-Date” config status and a down backup tunnel hours after the image upgrade completes. The root cause is a Distributed Cloud Firewall (DCF) configuration push failure caused by insufficient available memory on memory-constrained instance types. Workaround: Retry the gateway Image Upgrade. If the gateway remains stuck in this state, increase the gateway’s instance size for additional memory headroom, or contact Aviatrix Support. |
| AVX-79521 | On Controller versions prior to 10.1.0, it is possible to onboard multiple Aviatrix access accounts that map to the same underlying cloud service provider (CSP) account. Because several Controller features assume a one-to-one relationship between an Aviatrix access account and a CSP account, duplicate access accounts can lead to unpredictable configuration and operational behavior. Duplicate is defined per CSP as follows:
Impact:
Onboard only one Aviatrix access account per underlying CSP account. If duplicate access accounts have already been onboarded and are causing issues, contact Aviatrix Support for assistance with identifying and removing the duplicates. |
| AVX-80977 | A VPN user’s profile assignment could appear as N/A immediately after the user was attached to a profile through the API, until the user’s next reconnection. Impact:
Have the affected user reconnect to update the displayed profile assignment. Contact Aviatrix Support for assistance. |
| AVX-80997 | GCP event logging can fail with an InvalidArgument error when a Cloud Asset Inventory service account is linked to a large number of GCP projects, causing the logging filter to exceed the Google Cloud Logging API 20,000-character limit. Impact:
Reduce the number of GCP projects linked to a single Cloud Asset Inventory service account to fewer than 100. Contact Aviatrix Support for assistance. |
| AVX-81230 | Enabling both Policy-Based Routing (PBR) and NAT logging under User VPN settings can cause high CPU utilization on the User VPN gateway during data-plane traffic. The high CPU usage occurs because NAT log entries generated by PBR are written to the gateway’s serial console. Impact: User VPN gateways with both PBR and NAT logging enabled may experience elevated CPU utilization while passing data-plane traffic, which can degrade VPN gateway performance. Workaround: Disable NAT logging on the affected User VPN gateway. If NAT logging must remain enabled, contact Aviatrix Support to apply a backend workaround. |
| AVX-81576 | During a Gateway resize operation (for example, changing the Gateway’s underlying instance or VM size), the Gateway can experience a temporary period of traffic loss during the resize. This has been observed during testing on GCP, AWS, and Azure Gateways, where a resize between certain instance sizes produced approximately 2 minutes of packet loss. Impact:
No workaround is currently available. A fix is planned for a future 10.1.x maintenance release. |