Important Notices for Upgrading to Aviatrix Release 7.1
Upgrade Options: This release version is available as an upgrade option only if you have already upgraded to the following:- 7.1.3956 or 7.1.4101 (older Linux OS)
- 7.1.3958, 7.1.4105, 7.1.4139, or 7.1.4183 (newer Linux OS)
7.1.4208 Release Notes
Release Date: 19 May 2025Corrected Issues in Aviatrix Release 7.1.4208
| Issue | Description |
|---|---|
| AVX-62067 | Fixed an issue where Aviatrix Transit Gateways with large number of tunnels (>800) and running for a long time could encounter an unresponsive IPSec process leading to all IPsec tunnels going DOWN. This was caused by an internal counter reaching its maximum value and overflowing. The fix prevents this overflow condition. |
Known Issues in Aviatrix Release 7.1.4208
| Issue | Description |
|---|---|
| AVX-61310 | In an Aviatrix multi-transit design with Transit Peering, where one of the Transit Gateways has BGP S2C enabled and learns a default route (0.0.0.0/0), an issue occurs following a controller upgrade where incorrect metrics are applied to PeerS2c routes. |
| AVX-63334 | Aviatrix Edge Gateways deployed on Equinix Network Edge and certain VMware environments may experience issues with root disk resizing during initial setup. The root filesystem might not expand to use the full allocated disk space. Workaround: Customers running Aviatrix Edge Gateways on Equinix Edge or VMware environments with version 7.1.4191 should contact Aviatrix Support for assistance. |
| AVX-63846 | In the CoPilot UI, Groups > SmartGroups and Groups > ExternalGroups with multiple filters may not appear as originally configured after being saved. This occurs when creating groups with multiple sets of any resource type. Workaround: Avoid using multiple filter sets in a single group until the issue is resolved. |
| AVX-64196 | IPSec diagnostics in the Controller UI do not display logs for non-Equinix Edge Gateways (such as AEP or self-managed Edge Gateways). Note: This is a UI diagnostic issue only. IPSec tunnel functionality is not impacted. |
| AVX-64213 | When deploying Edge Gateways using images g3-202504251522 and g3-202504251525, the root disk may be incorrectly sized after the VM boots. Even if the VM is created with a 64GB disk, the root filesystem may be limited to only 12GB. Workaround: Manual resizing of the root partition and filesystem is required. Contact Aviatrix Support for assistance. |
7.1.4191 Release Notes
Release Date: 19 December 2024Corrected Issues in Aviatrix Release 7.1.4191
| Issue | Description |
|---|---|
| AVX-57922 | Security Notice: CVE-2024-50603 has been permanently patched. |
| AVX-58286 | Fixed an issue where gateways using Legacy Egress FQDN filtering could experience traffic interruptions when processing very large data packets (approximately 4000 bytes or larger). This could result in halting all network traffic through the affected gateway. |
| AVX-58757 | Fixed an error condition whereby upon upgrading from 7.0 to 7.1, the Controller was not able to update gateway configuration, resulting in the affected gateway being flagged as not up-to-date. |
| AVX-59149 | Addressed a regression in 7.1 with TCP maximum segment size (MSS) clamping support, which is now supported on standalone gateways. |
Known Issues in Aviatrix Release 7.1.4191
| Issue | Description |
|---|---|
| AVX-61310 | In an Aviatrix multi-transit design with Transit Peering, where one of the Transit Gateways has BGP S2C enabled and learns a default route (0.0.0.0/0), an issue occurs following a controller upgrade where incorrect metrics are applied to PeerS2c routes. |
| AVX-63608 | In earlier versions, gateway resize operations may fail with a KeyError: ‘src’ during the resize process. This occurred when peer tunnel data lacked the expected structure, blocking resize attempts. Workaround: If urgent, delete and recreate the gateway. Contact Aviatrix Support for assistance. |
| AVX-65698 | In earlier versions, gateways running Distributed Cloud Firewall (DCF) could reboot due to a memory leak in the Traffic Server (TS_MAIN process). This occurred in environments with ThreatIQ external groups and a high number of DCF rules. Workaround: Reduce the number of active DCF threat rules where possible and monitor memory usage closely. |
7.1.4139 Release Notes
Release Date: 14 August 2024Corrected Issues in Aviatrix Release 7.1.4139
| Issue | Description |
|---|---|
| AVX-55256 | Fixed an issue where running packet capture resulted in an error, preventing generation of packet captures for troubleshooting. |
| AVX-55290 | Fixed connectivity issues when custom DNS/NTP entries are configured in Cloud Service Provider DHCP options and those destinations are not reachable on the local VPC/VNet. |
| AVX-55499 | Fixed gateway PKI service issues during software rollback from 7.1.4105 (newer operating system) to 7.1.3956 or 7.1.4101 (older operating system) that caused lost communication between gateway and Controller. |
Known Issues in Aviatrix Release 7.1.4139
| Issue | Description |
|---|---|
| AVX-62067 | All Spoke, Transit peering, and external VPN tunnels on one Transit Gateway in a High Availability (HA) deployment pair may drop simultaneously when the 32-bit Netlink sequence counter overflows to 0 on Gateways running strongSwan versions earlier than 5.9.14. Solutions: Reboot the affected Gateway to re-establish tunnels, or upgrade Gateways to the latest version. |
7.1.4105 Release Notes
Release Date: 18 July 2024Corrected Issues in Aviatrix Release 7.1.4105
| Issue | Description |
|---|---|
| AVX-37706 | (GCP) Resolved an issue that could cause gateway image upgrades to fail if Aviatrix Gateways were configured as Router Appliance spokes in the GCP Network Connectivity Center (NCC). |
| AVX-37982 | Fixed an issue where clearing bell notifications resulted in the error, “Command to execute is too long”. |
| AVX-42518 | Resolved an issue where adding and deleting a large number of stateful firewalls increased memory usage to more than 80%. |
| AVX-48386 | (OCI Gov) Resolved an issue where gateway creation in OCI Gov failed. |
| AVX-48707 | (AWS) AWS configurable timeouts for security group connection tracking are now properly configured on gateway interfaces for Nitro-based instance types. |
| AVX-48764 | Corrected product telemetry for intra tunnels count. |
| AVX-48903 | Resolved an issue where upgrade could fail when upgrading an image for a non-HPE Transit Gateway that has a Site2Cloud GRE connection and Jumbo Frame. |
| AVX-48917 | Resolved an issue where traffic from the Spoke CIDR was incorrectly routed to FireNet, despite exclusion of the Spoke CIDR from the Inspection Policy. |
| AVX-50194 | (GCP) Resolved an issue with FireNet BGP over LAN on GCP by correcting the routing for the firewall_rtb table. |
| AVX-50640 | Enhanced single IP HA Site2Cloud to avoid CSP underlay NAT issues during gateway failover. |
| AVX-50752 | Corrected product telemetry in private mode implementations. |
| AVX-50897 | Resolved an issue where the Controller did not restore peered tunnels that were deleted during the resizing process when HPE Gateway resizing failed due to CSP errors. |
| AVX-50941 | (Azure) When a new Azure HPE gateway is provisioned, the Controller now creates appropriate route tables that are properly cleaned up when the gateway is torn down. |
| AVX-51027 | The VPC Tracker Overlap Detection tool in Aviatrix CoPilot now works correctly with Edge devices. |
| AVX-51147 | Resolved an issue that could cause Site2Cloud connection disruptions by validating tunnel IPs prior to assignment to ensure they do not overlap with existing connections. |
| AVX-51314 | (Azure) Resolved an issue where Azure VNets created out-of-band (OOB) were not populating on the Controller when creating a Gateway. |
| AVX-51407 | Resolved an issue that caused disruptions in Site2Cloud tunnel configurations where the local IP address was incorrectly changed to the standby gateway IP after upgrading the image on the standby gateway. |
| AVX-51703 | Fixed an issue where an extra route table was created when a gateway without HPE was initially deployed, which was causing issues during gateway deletion. |
| AVX-52360 | Fixed dependency violation error when disabling Controller Security Group Management after a Controller image upgrade. |
| AVX-52640 | Resolved an issue where Security Group Orchestration incorrectly counted existing user security groups, leading to creation of new groups that could exceed the Security Group mapping limit. |
| AVX-52808 | Fixed an issue where the eth1 interface went down after upgrade to Controller 7.0. |
| AVX-53450 | Corrected an issue that sometimes resulted in receiving an email about an exception in export_tf during migration (this did not affect the actual migration). |
| AVX-54729 | Resolved memory leak issue when deploying Layer 7 Distributed Cloud Firewall rules to a gateway. |
Known Issues in Aviatrix Release 7.1.4105
| Issue | Description |
|---|---|
| AVX-54874 | (Azure) The message “Agent status: Not ready” might display in the Azure portal when viewing the Aviatrix Controller. This is by design and does not affect Controller functionality. |
| AVX-55256 | Running packet capture may result in an error, preventing generation of packet captures for troubleshooting. Contact Aviatrix Support if you encounter this issue. |
| AVX-55290 | If custom DNS/NTP entries are configured in Cloud Service Provider DHCP options and those destinations are not reachable on the local VPC/VNet, traffic to those destinations might be blocked. |
| AVX-55499 | Software rollback from 7.1.4105 (newer OS) to 7.1.3956 or 7.1.4101 (older OS) causes gateway PKI service to go down, resulting in lost communication between gateway and Controller. Contact Aviatrix Support for assistance. |
7.1.483 Release Notes
Release Date: 15 October 2024Corrected Issues in Aviatrix Release 7.1.483
| Issue | Description |
|---|---|
| AVX-52626 | Fixed an issue when modifying the remote subnet CIDR range of an existing Site2Cloud (S2C) connection using Terraform provider version 3.1.4 where the change was incorrectly applied to the local subnet CIDR range instead of the remote subnet. |
| AVX-53986 | Fixed an issue where the Aviatrix Controller was using excessive memory when managing large numbers of access accounts. |
| AVX-54732 | Fixed an issue where Aviatrix Edge Platform (AEP) Gateway upgrade status displayed incorrectly after a successful image upgrade. |
| AVX-55012 | Fixed an issue where certain SNAT IP addresses were not properly advertised to connected networks when manual connection summaries were configured after upgrading to version 7.1. |
| AVX-55434 | Resolved an issue where attaching a virtual network with both IPv4 and IPv6 address spaces could cause invalid routes to be added to the network, losing management connectivity. |
| AVX-56022 | Fixed an issue that resulted in loss of expected network connectivity between VNets when an Aviatrix Gateway originating the default route experienced a disruption. |
| AVX-56032 | Fixed an issue where Security Group Orchestration was not functioning as expected in some Azure environments with multiple instances in the same virtual network. |
| AVX-56466 | Resolved an issue affecting Azure Transit Gateways where upgrading to 7.1.4139 resulted in additional routes being added to the Gateways’ secondary network interfaces. |
| AVX-56779 | Fixed an issue where restore from backup fails during controller image upgrades. |
| AVX-56921 | Resolved an issue where, during Azure service outages, resource handling incorrectly deleted all Azure resources from its database. |
Known Issues in Aviatrix Release 7.1.483
| Issue | Description |
|---|---|
| AVX-45480 | Distributed Cloud Firewall rules are not properly applied to non-encrypted (non-TLS), non-web (non-HTTP) traffic when processed by Gateways with High Performance Encryption (HPE) enabled. Workaround: Configure DCF rules for non-TLS/non-HTTP traffic with higher priority to ensure proper handling. |
| AVX-51456 | Destination network address translation (DNAT) rules cannot be configured on Aviatrix Gateways using Terraform provider version 3.1.4. Workaround: Configure DNAT rules through the Aviatrix CoPilot interface. |
| AVX-53179 | When the “Ensure TLS” setting on a Distributed Cloud Firewall rule is enabled, non-encrypted HTTP traffic is incorrectly passed to the next rule instead of being dropped. |
| AVX-55015 | An issue can occur in handling Site2Cloud Mapped NAT connections when the local CIDR is set to 0.0.0.0/0. When a user edits or deletes a connection mapped to this CIDR, the corresponding IP table rule is not properly removed. |
| AVX-56811 | After restoring a Controller configuration, restarting Gateways that were offline could fail re-attestation. Solution: Ensure that all Gateways are up before restoring a Controller configuration. |
| AVX-60731 | BGP Event Monitor on gateways may crash when receiving BGP route updates containing AS-SET or AS_CONFED_SET values in the AS-PATH attribute. Workaround: Add a route-map on the upstream sender to strip or reject AS-SET entries. |