Important Notices for Aviatrix Release 7.0
Egress FQDN Migration: Aviatrix strongly recommends migrating from Egress FQDN Filtering (Legacy) to the Distributed Cloud Firewall (DCF) feature in CoPilot to enforce Egress network security policy. The DCF feature requires Controller 7.1.3006 or greater. Operations Checklist: Aviatrix strongly recommends you perform the tasks in the operations checklist including a dry run upgrade before upgrading your deployment of the Aviatrix network platform.7.0.2250 Release Notes
Release Date: 21 March 2024Corrected Issues in Aviatrix Release 7.0.2250
| Issue | Description |
|---|---|
| AVX-50895 | Fixed a software defect where the Aviatrix software might raise a false positive warning about duplicated CIDRs when using AWS Transit Gateways (TGWs) with TGW peering between them. The false positive warning could impact route propagation. |
7.0.2239 Release Notes
Release Date: 10 January 2024Corrected Issues in Aviatrix Release 7.0.2239
| Issue | Description |
|---|---|
| AVX-26567 | Fixed an issue where a FireNet Egress FQDN gateway was dropping traffic. |
| AVX-36054 | Fixed an issue where a gateway created in a newer Controller software version might have been rolled back to an older software version under certain conditions. |
| AVX-36996 | (Azure) Fixed an issue where after an Azure FireNet FQDN Egress gateway image upgrade, the gateway goes into the “config_fail” state. |
| AVX-38843 | Fixed an issue in Site2Cloud connections with single IP HA Gateway where the standby gateway continuously sent out IPsec connection requests to a remote peer, creating a stale state in the CSP underlay. |
| AVX-39477 | Fixed an issue where image upgrade or software rollback for a BGP-enabled gateway with the “remove-unnecessary-packages-from-gateway” software patch applied could fail. |
| AVX-39662 | (GCP) Fixed an issue where upgrading a GCP Transit Gateway with BGPoLAN and Firenet features enabled might have resulted in the loss of direct connectivity to the on-site firewall appliance. |
| AVX-41223 | Fixed an issue where gateway initialization could fail if SSM agents were configured to patch Ubuntu servers automatically during the early stage of gateway initialization. |
| AVX-41361 | Fixed an issue where attaching an Egress FQDN tag to a gateway could fail if a domain name used in the tag had a long DNS record. |
| AVX-41555 | Fixed an issue where in Private Mode, when opening the Firewall page and trying to select a subnet, nothing appeared in the dropdown menu. |
| AVX-41693 | Fixed an issue where Linux auditd logs filled the disk space of some instances. |
| AVX-41976 | Fixed an issue where upgrading a Controller using older Controller images could fail with a zstd package installation failure. |
| AVX-42269 | (GCP) Fixed an issue where if gateway deployment fails due to CSP errors, the rollback fails due to the configuration being in an inconsistent state. |
| AVX-42706 | Fixed an issue where FortiGate Firewalls failed to launch due to using an incorrect template on the Controller. |
| AVX-42789 | Increased the timeout length for “Encrypt Existing Gateways” operations to avoid encryption failures due to premature timeouts. |
| AVX-43028 | Fixed an issue where on a newly registered CloudN, users could not create attachments to multiple transits from a single CloudN Gateway. |
| AVX-43362 | Fixed a timing issue with the Single AZ HA feature that could cause gateways to go into a repeated stop-and-start loop. |
| AVX-43663 | Fixed a memory leak in a firewall monitoring task that was proportional to the number of firewalls in the network. |
| AVX-44255 | Fixed an issue where dry run for Controller software version upgrade with multiple versions pending would incorrectly run the dry run for the last version instead of the next upgrade version. |
| AVX-44526 | Fixed VPN NAT for gateway traffic that didn’t work as expected due to NAT-related misconfiguration in iptable rules. Action required: If you experience a VPN NAT issue after upgrading, disable and reenable your UserVPN NAT configuration. |
| AVX-44812 | Fixed an issue where deployments with a Utility license were unable to view some license details. |
| AVX-44974 | (Azure) Fixed an issue where when Transit Gateways had Active-Standby enabled and the Active Transit Gateway was down, the attached Azure Native Spoke VNet route tables failed to switchover routes. |
| AVX-45598 | (AWS) Fixed an exception that could occur when adding a UserVPN Load Balancer to the UserVPN User Accelerator before the Load Balancer state became active in the CSP. |
| AVX-45873 | Fixed an issue where using a link local address as an IPSec peer address would drop traffic after Controller upgrade to release 6.8.1148. |
| AVX-45897 | Fixed an issue where the Site2Cloud Details page displayed “Authentication Type: null” for Site2Cloud connections that had PSK authentication. |
| AVX-46098 | Fixed an issue where an Egress Filtering Gateway with a base Stateful Firewall policy of DENY incorrectly added the DROP rule instead of allowing packets to flow to the egress filter. |
| AVX-46462 | Fixed an issue where HPE gateway resize could fail if the gateway had a peering with a gateway from release 6.7.1148 or earlier. |
| AVX-46788 | Fixed an issue where the Controller would not disable the Access Security feature during a Controller restore if the feature was not enabled in the backup configuration. |
| AVX-46873 | (Azure) Fixed permission issues with Security Group orchestration when VNets using Intra-VNet micro-segmentation didn’t have correct user permissions. |
| AVX-47027 | (OCI Gov) Fixed an issue where OCI Gov gateways failed to launch. |
| AVX-47234 | Extended S2C RX Balancing feature support to AWS C6in instances (previously only supported C5 and C5n). |
| AVX-47361 | (AWS) Fixed a rare race condition that caused AWS TGW data migration in the Controller database to fail during a gateway upgrade. |
| AVX-47486 | (AWS) Fixed an issue where image upgrades and new gateway creations would fail if tag keys in the instance metadata did not meet AWS requirements. |
| AVX-47764 | (AWS) Fixed an issue where when a VPC was attached to an AWS TGW, deleting one of the Spoke VPC Advertised CIDRs would not correctly update routes in associated Transit Gateways. |
| AVX-47795 | Fixed an issue with reading the Controller time zone that caused the Controller to send false alerts about expired PKI agent certificates on gateways. |
| AVX-48193 | Fixed an issue where creating or deleting BGP connections on a Transit Gateway with Stateful Firewall policy configured using tags could fail. |
| AVX-48457 | (AWS) Fixed an issue where AWS Gateways with tags that didn’t match new AWS requirements caused metadata service to fail to turn on. |
| AVX-48931 | Fixed an issue where detaching and reattaching a CloudN attachment to an Aviatrix Transit Gateway with Stateful Firewall rules using tags would incorrectly leave BGP configuration on the gateways. |
| AVX-49236 | (OCI) Fixed an issue where after an OCI gateway image upgrade, several routing tables within several VCNs were missing the default route (0.0.0.0/0). |
Known Issues in Aviatrix Release 7.0.2239
| Issue | Description |
|---|---|
| AVX-48903 | (AWS and OCI) In all 7.0 Controller software versions, when you upgrade an image for a non-HPE Transit Gateway with a Site2Cloud GRE connection and Jumbo Frame, the upgrade can fail. Workaround: Turn off Jumbo Frame on the gateway and then run the image upgrade. |
| AVX-49375 | When creating a GCP Palo Alto firewall instance using certain versions of Palo Alto images containing the letter “h” (such as “8.1.25-h1”), the instance creation fails. Workaround: Choose a Palo Alto Networks image version that does not contain the letter “h.” |
| AVX-50076 | The Aviatrix Controller now only displays metrics for the last hour in Dashboard > Controller Metrics or Gateway Metrics. For detailed Gateway metrics, please use Aviatrix CoPilot. |
7.0.2004 Release Notes
Release Date: 29 August 2023Corrected Issues in Aviatrix Release 7.0.2004
| Issue | Description |
|---|---|
| AVX-39662 | (GCP) Fixed an issue where upgrading a GCP Transit Gateway with BGPoLAN and Firenet features enabled might have resulted in the loss of direct connectivity to firewall appliance management. |
| AVX-43545 | Fixed an issue where when cloud access account credentials were updated, the Aviatrix Controller could no longer get the latest status of resources in Cloud Service Providers. |
| AVX-43547 | Fixed an issue where on a newly registered CloudN, users could not create attachments to multiple transits from a single CloudN Gateway. |
| AVX-43550 | Fixed an issue where a Stateful Firewall rule allowing reverse-path traffic flows was temporarily removed during a software upgrade. |
| AVX-43552 | Resolved performance issues with adding new metrics to interface RRD files. You must upgrade to software version 7.0.2004 or 7.1.2131 or later to access the new metrics. |
| AVX-43863 | (GCP) Fixed a tag issue that prevented the Global VPC feature for Spoke Gateways from being enabled or disabled properly. |
| AVX-44818 | Fixed an issue where bootstrap configuration for a firewall took longer than expected, causing traffic loss from the Transit Gateway. |
| AVX-45566 | Fixed VPN NAT for gateway traffic that didn’t work as expected because one of the NAT-related chains was missing in the iptables. Action required: Upgrade your gateway image. |
| AVX-45567 | (GCP) Fixed an issue where simultaneous, multiple GCP gateway image upgrades in the same GCP project might fail. |
| AVX-45569 | Fixed an issue where Linux auditd logs filled the disk space of some instances. |
| AVX-45571 | (Azure) Fixed an issue where after an Azure FireNet-enabled gateway image upgrade, the gateway went into the “config_fail” state. |
Known Issues in Aviatrix Release 7.0.2004
| Issue | Description |
|---|---|
| AVX-45156 | On an AEP Dell device, when you configure a Transit Gateway attachment with HPE mode, you cannot set the tunnel count to more than 2. Workaround: Contact Aviatrix Support if you have higher bandwidth/performance requirements that require more tunnels. |
| AVX-45682 | A rare issue with a gateway software upgrade may cause the BGP neighbor status to go down. Workaround: Restart the gateway to resolve this issue. |
| AVX-45684 | When doing a dry run for Controller software version upgrade with multiple versions pending and choosing “latest” as the default version, the Controller incorrectly runs the dry run for the last version instead of the next upgrade version. Workaround: Manually enter the next upgrade version instead of leaving the default “latest.” |
7.0.1307 Release Notes
Release Date: 08 December 2022Important Notices in Aviatrix Release 7.0.1307
AWS Gateways Enable Tags in Instance Metadata Service: Starting with release 7.0.1307, AWS Gateways will enable tags in the instance metadata service. Tag keys must match the pattern: ([0-9a-zA-Z\-_+=,.@:]{1,255}) and must not be reserved names. CloudN Hardware Requirements: Before upgrading to 7.0.1307, ensure CloudN hardware is version 2.1 or later. Hardware version 2.0 or earlier requires a hardware refresh. CoPilot Controller Migration: When migrating your Controller to 7.0.1307, your Controller’s private IP address will change. CoPilot users must perform prerequisite tasks before migration. AWS Policy Updates: AWS access accounts have new required permissions. Update your account permissions to access CoPilot or use the Distributed Cloud Firewall feature. Memory Alert Configuration Changes: The system metric Memory Free (memory_free) definition has changed to be consistent with the OS definition. Change alert configurations from mem_free to memory_available.Key Corrected Issues in Aviatrix Release 7.0.1307
| Issue | Description |
|---|---|
| AVX-20197 | Fixed an issue where after Single AZ HA setting was enabled and GSO/GRO setting was disabled, the gateway could auto-restart multiple times. |
| AVX-20868 | Fixed an issue where the Controller did not display bell notifications for gateway and tunnel up/down events. Added option to enable/disable bell alerts. |
| AVX-25209 | Fixed an issue where Aviatrix rsyslog could unexpectedly stop forwarding logging packets to remote servers. |
| AVX-26004 | Resolved an issue involving AWS accounts and permissions that could cause excessive traceback logs when Controller didn’t have permission for some regions. |
| AVX-27653, AVX-27869 | Resolved two critical issues that could cause gateways to crash: conduit binary becoming overwhelmed by Linux kernel netlink messages, and IP fragmented packets triggering kernel crashes. |
| AVX-27657 | Fixed an issue where full memory would cause gateway tunnels to flap. |
| AVX-27820 | Resolved an issue where Controller could read VPC CIDR of a gateway incorrectly, causing OpenVPN initialization errors. |
| AVX-28175 | Fixed an error when creating Azure Transit Gateway of size Dv4 and Dsv4 with BGP over LAN interfaces and HPE. |
| AVX-28242 | Fixed an issue preventing OpenVPN users from connecting after adding a second search domain separated by a comma. |
| AVX-28898 | Fixed an issue where a large number of Site2Cloud connections degraded Controller responsiveness. |
| AVX-29002 | Fixed an issue where if Site2Cloud was mapped to a Spoke Gateway and gateway image was upgraded with version 6.8 software, traffic to Site2Cloud remote would break. |
| AVX-32807 | Resolved asymmetric traffic flow issue with rxhash network setting, essential for customers upgrading Azure Gateway images from v8 to v13. |
Known Issues in Aviatrix Release 7.0.1307
| Issue | Description |
|---|---|
| AVX-31857 | In Azure, when two Aviatrix DFW policies have the same priority, the Controller may not honor the order in which they appear, causing NSG rule order confusion. Solution: Ensure unique priority for each AVX rule to maintain proper order. |
| AVX-32968 | (AWS China) During image upgrade or software rollback of an AWS China Gateway, the EBS volume may not be deleted after the old gateway instance is deleted. Manual deletion may be required. |
| AVX-43180 | If your Controller is using an outdated image, a software upgrade may fail. Contact Aviatrix Support if this occurs. |
| AVX-45386 | On a gateway with multiple mapped Site2Cloud connections with Forward Traffic to Transit Gateway enabled, after a successful gateway image upgrade, some connections may not work. Workaround: Disable and re-enable “Forward Traffic to Transit Gateway” for each impacted connection. |