Aviatrix Controller 8.0.50 Release Notes

Release Date: 05 March 2026 Release Notes Last Updated: 5 October 2026

​

Corrected Issues in Aviatrix Release 8.0.50

Issue	Description
AVX-71630	Resolved an issue where incorrect eBPF filters could be applied to the eth1 interface on Azure gateways with Accelerated Networking enabled during upgrades from versions earlier than 7.2.2994. The upgrade process now properly handles interface filter configuration to prevent unintended traffic drops.
AVX-72847	Resolved an issue where the gateway state synchronization service leaked internal connections on gateways. The implementation has been updated to use a shared internal connection that is properly managed and cleaned up, preventing connection exhaustion during gateway operations.
AVX-73036	Resolved an issue where duplicate iptables mangle table MARK rules and remote gateway route tables were not properly cleaned up during Site-to-Cloud mapped tunnel failover, gateway upgrade, or rollback scenarios. This issue could occur when migrating environments between releases or during tunnel role transitions. The cleanup logic has been corrected to ensure redundant rules are removed and route tables are properly maintained.

​

Known Issues in Aviatrix Release 8.0.50

Issue	Description
AVX-62003	Azure gateway image upgrades may fail when the Controller does not have the required Azure image subscription access. During the upgrade, the system deletes the existing gateway before validating subscription availability, which can result in gateway deletion without a replacement being created. This leaves dangling gateways in the Controller and can cause potential service outages. Impact: Existing gateways may be deleted during image upgrade Replacement gateway creation fails due to missing subscription Customers may experience connectivity loss and dangling gateway entries in the Controller Manual intervention required, leading to support escalations Workaround: None. To avoid outages, ensure the Controller subscription includes access to the required Azure image before attempting upgrades.
AVX-62299	When upgrading from Controller version 7.1 to 7.2 or 8.0, Spoke Gateways with routing through a Public Subnet Filtering (PSF) Gateway may fail to upgrade and become unreachable if the PSF Gateway has not been upgraded first. This issue affects AWS environments where Spoke Gateway route tables are configured to point to a PSF Gateway. Workaround: To avoid this issue, follow the correct upgrade sequence:1. Upgrade the PSF Gateway first. 2. Wait for the PSF Gateway upgrade to complete successfully. 3. Then upgrade the dependent Spoke Gateways.
AVX-62506	During a gateway software upgrade, traffic matching DCF WebGroup rules may be briefly dropped during the upgrade. This impacts both Layer 7 (HTTP/HTTPS) and Layer 4 traffic and occurs across all supported cloud providers (AWS, Azure, and GCP). The disruption typically lasts a few seconds but may vary depending on gateway load and policy complexity. Workaround: None Recommendations: Schedule gateway upgrades during maintenance windows or low-traffic periods. Use HA deployments and upgrade gateways one at a time in HA pairs. Monitor logs for “Failed to load policy” messages to confirm when policies are reloaded.
AVX-64868	In some scenarios involving rapid VRRP state transitions, the keepalived VRRP state may not be reported accurately to the Controller. This can result in temporary discrepancies between the actual VRRP status and what is displayed in the Controller UI, leading to confusion and difficulties during troubleshooting. Impact: Controller UI may show incorrect VRRP status such as both peers reporting Primary or Initializing No impact on actual VRRP traffic handling or failover behavior. Workaround: Use diagnostic logs to verify actual VRRP state
AVX-65016	In some environments, the Firewall state may not recover from Unaccessible after the first vendor integration failure. This issue has been observed when integrating with third-party firewall vendors, leaving the gateway firewall state stuck even after the environment stabilizes. Impact: Firewall integration appears stuck in Unaccessible state Recovery does not occur automatically after initial failure May require manual intervention to restore proper firewall state reporting Workaround: Contact Aviatrix Support for manual correction.
AVX-66631	When performing image upgrades on Transit gateways with a large number of tunnels (1300+ tunnels), traffic loss occurs after the upgrade completion. Affected Scenario: Transit gateways with scale number of tunnels during image upgrade operations. Impact: Traffic disruption lasting approximately 9 minutes after upgrade completion Affects high-scale Transit gateway deployments Service interruption during critical upgrade windows Workaround: Schedule image upgrades during maintenance windows to minimize business impact. Consider upgrading Transit gateways with fewer tunnels first to reduce exposure time.
AVX-67126	Dry-run validation may fail when upgrading the Controller from version 8.0.10 to 8.1.0 due to a gateway version mismatch error. This occurs when the upgrade path starts from 8.0.0, progresses to 8.0.10 successfully, but encounters a dry-run failure when proceeding to 8.1.0. Workaround: None.
AVX-67571	In Oracle Cloud Infrastructure (OCI) environments, OpenVPN clients cannot connect to VPN gateways configured with DUO multi-factor authentication (MFA). Connection attempts fail with ECONNREFUSED errors during tunnel establishment, preventing authentication from completing. Impact: VPN tunnels cannot be established to DUO-enabled OCI gateways Only affects OCI deployments with DUO MFA Other authentication methods (OKTA, LDAP) work normally Workaround: No current workaround. Users may temporarily switch to OKTA or LDAP authentication if feasible.
AVX-68561	When DCF S2C is enabled in large scale deployments with 1300+ gateways, all gateway configurations become out of sync with the Controller. Affected Scenario: Large scale environments with DCF S2C enabled and high gateway counts (1300+ gateways). Impact: Gateway configurations show as out of sync in the Controller UI Controller CPU utilization increases significantly Conduit process consumes high CPU resources Workaround: Disable DCF S2C feature in large scale deployments until the issue is resolved. Monitor gateway sync status and Controller CPU usage when re-enabling the feature.
AVX-68887	When attaching VPN users to profiles using the attach_vpn_user_to_profile API, the CoPilot or Controller UI may continue to display the user profile as N/A even though the attachment operation completes successfully. In some cases, users later reappear as active but still show no profile association in the UI. This results in a display inconsistency between the UI and the backend state. Impact: VPN user profile assignments may appear unsuccessful in the UI, which can cause confusion during profile management. There is no functional impact: the VPN profile is correctly assigned in the backend, and users can connect to the VPN as expected. Affected Scenario: OpenVPN profile management operations that use API-based user-to-profile attachment. Workaround: None.
AVX-69649	The migration dry-run EIP accounting does not include public IPs that are not part of the Elastic IP quota, potentially producing inaccurate dry-run results. Impact: Dry-run migration reports may show incorrect EIP usage Actual migration may encounter unexpected EIP limitations Workaround: Manually verify EIP allocation and quotas before performing the migration. Contact Aviatrix Support for assistance.
AVX-71087	When upgrading to Controller versions 8.0 or 8.1, ICMP traffic may be blocked by default due to updated access control rules that do not include allowances for ICMP-based debugging. Affected Scenario: Environments where ICMP is used for network troubleshooting and diagnostic workflows. Impact: ICMP-based debugging tools may stop functioning Network troubleshooting capabilities may be limited Existing workflows that depend on ICMP may be disrupted Workaround: Manually add access control rules to the Controller to explicitly allow ICMP traffic for debugging. Contact Aviatrix Support for assistance if needed.
AVX-71672	When upgrading the Controller to version 8.1, the database migration may fail if the tunnel rtt_avg field contains None values. The migration logic expects either a numeric value or the string "N/A", and encountering a None value causes the upgrade to stop. Impact: Upgrade to 8.1 cannot complete Controller remains on the previous version Workaround: Contact Aviatrix Support for assistance in correcting the database values before retrying the upgrade.
AVX-71804	The NFQ (Network Filter Queue) process could stall due to the timer handler using non-signal-safe functions, potentially causing traffic processing interruptions. Workaround: Contact Aviatrix Support for assistance.
AVX-71820	When deploying a load balancer–enabled VPN gateway with an overlapping VPN CIDR on Controller versions 8.0, 8.1, or 8.2, the gateway creation fails. Impact: VPN gateway deployment fails Error message does not clearly indicate the root cause Affected Scenario: Load balancer–enabled VPN gateway deployments on Controller versions 8.0, 8.1, and 8.2. Workaround: Ensure that the VPN CIDR does not overlap with existing gateways behind the load balancer before deployment. Contact Aviatrix Support for assistance.
AVX-72363	The Controller may display an incorrect warning message during a platform upgrade, stating the release is under development or unsupported. Workaround: Contact Aviatrix Support for assistance.
AVX-72369	When multiple syslog profiles are configured on the Controller, performing a gateway image upgrade results in gateways being removed from syslog profiles that have only a subset of gateways specified in the include list. Impact: Remote syslog logs are no longer forwarded to the configured syslog servers for the affected gateways Workaround: Manually re-add the required gateways to the affected syslog profiles after the upgrade.
AVX-72871	Controller software upgrade to version 8.1 may fail with the error Please reload the page in order to upgrade due to an issue with the database migration when the database contains string values instead of integers for the cloud_type field. Impact: The upgrade to version 8.1 will not be completed The Controller will remain on the previous version Workaround: Contact Aviatrix Support for assistance in correcting the database values before retrying the upgrade.
AVX-72966	Launching an AWS gateway may fail the public subnet validation check due to a delay in subnet route table association updates from the cloud provider. Workaround: Contact Aviatrix Support for assistance.
AVX-73061	The Cloud Asset Inventory (CAI) service has a memory leak in its L1 cache. When cloud instances such as VMs are removed from the cloud provider, the associated network interfaces remain cached and are never cleaned up. Impact: In environments that regularly cycle VMs (such as those using spot instances), the CAI service memory consumption grows over time and is never reclaimed. This can lead to high memory usage by the CAI service, potentially affecting Controller performance. Workaround: Contact Aviatrix Support for assistance with periodic CAI service restarts to reclaim memory.
AVX-73589	Resolved an issue where the Legacy Egress FQDN process could stall due to a deadlock when flushing IP data nightly. The implementation has been updated to prevent the deadlock condition and ensure the process continues to process traffic normally under high load.
AVX-73629	The VPC name field could be overwritten with incorrect data during the AM4.0 migration, causing affected VPC records to become unfindable via index lookups. The migration logic now correctly preserves the VPC name field. Workaround: Contact Aviatrix Support for assistance.
AVX-73742	Two issues with single IP HA tunnel failover in Site-to-Cloud deployments. The Controller no longer sends stale IPsec session teardown messages to gateways that temporarily lost connectivity, and now stops failover of pending tunnels to the HA gateway if the active gateway reconnects quickly, reducing unnecessary tunnel downtime. Workaround: Contact Aviatrix Support for assistance.
AVX-74226	CoPilot deployments and migrations may fail with “Unsupported instance size” errors when selecting valid instance types. The instance type validation incorrectly blocks supported sizes during CoPilot deployment or migration operations. Impact: CoPilot deployment or migration may fail when selecting certain valid instance types Error message “Unsupported instance size” is displayed even for supported sizes Workaround: Contact Aviatrix Support for assistance with CoPilot deployment using the affected instance types.
AVX-74711	The gateway firewall may leave an unnecessary TCP port open due to a misconfiguration in the routing service. Workaround: Contact Aviatrix Support for assistance.
AVX-74719	When a Controller running version 8.0.x or later is restored from a backup taken on a pre-8.0 release (e.g., 7.2.x or earlier), BGP-learned routes from gateways with BGP connections (including Edge, Transit, and Spoke gateways) may be temporarily removed from the Controller route database and cloud provider route tables. Routes are automatically re-added shortly after the restore completes. Impact: Temporary removal of BGP-learned routes across gateways with BGP connections (Edge, Transit, or Spoke gateways). Corresponding routes may also be removed from cloud provider route tables. Traffic disruption may occur during the route re-convergence period (20-40 seconds). Workaround: To minimize the potential impact, schedule Controller migrations and backup restores during a planned maintenance window. Contact Aviatrix Support for assistance.
AVX-74739	For Controllers with large-scale deployments (for example, several thousand gateways and tunnels), the database migration during upgrade can exceed the current hard-coded 15-minute timeout, causing the Controller upgrade to fail and roll back. The migration timeout is not configurable in affected versions, so customers with very large environments are more likely to encounter this issue during Controller upgrades. Impact: Controller upgrade fails and rolls back due to migration timeout Large-scale environments with thousands of gateways and tunnels are most affected Workaround: Contact Aviatrix Support for assistance with adjusting the migration timeout for large-scale deployments.
AVX-74988	On Edge-as-a-Transit (EaT) gateways with HPE peering to transit using many-to-one IP addressing (multiple source private IPs peering to a single transit IP), the tunnel status monitoring job may raise an exception due to duplicate tunnel ping IP pairs. This causes the tunnel status report to fail periodically. Impact: Tunnel status reports may not be sent to the Controller Controller and CoPilot may show stale or missing tunnel status for affected gateways No impact on actual tunnel connectivity or data plane traffic Workaround: None. This is a monitoring-only issue with no traffic impact. Contact Aviatrix Support for assistance.
AVX-75256	After upgrading the Aviatrix Controller from version 7.2.x to 8.0 or later, gateways with FQDN tags attached may no longer be visible in the Egress FQDN Gateway View tab. The list_fqdn_gateways API returns an empty list despite the gateways being present and properly associated with their FQDN tags. Impact: Egress FQDN-enabled gateways are not displayed in the Controller UI after upgrade The list_fqdn_gateways API returns an empty list Gateways remain operational and FQDN tag associations are intact Workaround: Contact Aviatrix Support for assistance.
AVX-75301	Certain license types are unable to enable Distributed Cloud Firewall (DCF) on Controller versions 8.0.10 through 8.0.50. A license validation check that was removed in 8.1+ was not backported to the 8.0.x branch, causing a controller error when users with affected license types attempt to enable DCF. Impact: Users with affected license types cannot enable DCF on Controller versions 8.0.10 through 8.0.50 Most customers on ABU licenses are not affected Workaround: Upgrade to Controller version 8.0.60 or later where this issue is corrected.
AVX-75872	During a Controller upgrade, a locking race condition between the initial setup process and post-upgrade actions can cause post-upgrade configuration steps to fail or require manual intervention. Impact: Post-upgrade configuration may not complete automatically. Manual intervention may be required to bring the Controller to a fully configured state after the upgrade. Workaround: Contact Aviatrix Support to manually complete the post-upgrade configuration.
AVX-75944	When migrating an existing Controller to a new Controller VM, a database migration issue can cause configuration changes to be applied to gateways too early during the migration process. Impact: Gateways with NAT configured may experience a temporary datapath disruption during Controller migration. Workaround: There is no workaround. Upgrade to a version that includes the fix (8.0.60, 8.1.30, 8.2.10, or 9.0.0). Contact Aviatrix Support for assistance.
AVX-76296	During routine gateway operations (such as resize or image upgrade) in GCP global VPC environments, traffic may be blackholed due to incorrect route handling. Impact: Traffic through the affected gateway may be dropped during operations GCP global VPC routing may be temporarily disrupted Workaround: Schedule gateway operations during maintenance windows. Contact Aviatrix Support for assistance.
AVX-76413	When the Controller’s state synchronization service starts up and finds gateways stored as “Down” in its internal state store, the controller reprograms the network as if those gateways are down, without allowing time for the gateways to connect and prove they are up. This can occur when the controller has previously lost connectivity to gateways (for example, during a transient network issue) and the service then restarts while the gateways themselves remain healthy and continue forwarding traffic. Impact: A temporary data plane disruption occurs while the controller has the gateways marked as down. The controller automatically detects the gateways are up and reprograms the network correctly immediately afterward. In a large-scale user deployment (~1,400 gateways), full recovery completed in approximately 6 minutes. The underlying behavior has existed for 4+ years and has been observed in a user environment only once. Workaround: Not applicable. The system recovers automatically, no user action required. Recovery typically completes within minutes (~6 min observed in a ~1,400-gateway deployment; smaller deployments recover faster).
AVX-78500	When Distributed Cloud Firewall (DCF) is disabled on a gateway, DCF policy enforcement may not be fully removed from all gateway interfaces. As a result, traffic can continue to be evaluated against the previously applied DCF policy even though DCF appears disabled. This can occur when DCF is disabled without any accompanying policy change. Impact: After DCF is disabled, a gateway may continue enforcing the last applied DCF policy on some interfaces. This residual enforcement is not reflected in the DCF status shown for the gateway and may persist until DCF is re-enabled or the gateway configuration changes. Workaround: When disabling DCF, also make a minor DCF policy change (for example, add and then remove a rule) so enforcement is fully cleared from all interfaces. If you suspect DCF policy is still being enforced after disabling DCF, contact Aviatrix Support.
AVX-79855	When Distributed Cloud Firewall is disabled on a transit gateway with Site2Cloud (S2C) or other external connections landing on it, and no policy change is queued at the time, existing DCF filtering rules on the interface are not removed. The disable path is skipped when there is no policy difference to push. Impact: After DCF is disabled on the affected transit gateway, previously installed DCF filtering rules remain in effect on the interface and continue to filter traffic. Customers may see traffic still being subject to DCF filtering long after the feature was disabled. Workaround: Restart the Aviatrix gateway to remove the stale DCF filter rules. Alternatively, contact Aviatrix Support to have the stale DCF filter rules manually removed.
AVX-80983	When Azure Security Group Management reads the current state of a security group rule before adding a new gateway’s IP address to it during gateway launch, an Azure API throttling response on that read can be misinterpreted as the rule not existing. In that case, the existing rule is deleted and a new rule is created instead of the existing rule being updated. Impact: Azure security group rules can be unexpectedly deleted and recreated during gateway launch when the Azure API throttles the read call. The delete-and-recreate sequence can result in a brief gap in security group coverage for the affected rule, or in duplicate rules if the sequence does not fully complete. Workaround: Contact Aviatrix Support if you observe unexpected security group rule changes on gateway launch in an Azure environment.
AVX-80977	A VPN user’s profile assignment could appear as N/A immediately after the user was attached to a profile through the API, until the user’s next reconnection. Impact: The user’s profile displays as N/A until the user’s next reconnection, even though the profile attachment succeeded. This can cause confusion when auditing or verifying profile-based access policies shortly after attachment. Workaround: Have the affected user reconnect to update the displayed profile assignment. Contact Aviatrix Support for assistance.