FireNet

This section provides the purpose, elements, and actions performed on the FireNet pages.

FireNet
Firewall

Purpose

The FireNet page provides centralized management for firewall insertion into Aviatrix Transit architecture, enabling advanced security inspection across multicloud environments.

Controller version 9.0 extends IPv6 FireNet vendor support to Fortinet and Check Point, in addition to Palo Alto Networks (supported from Controller version 8.2).

Elements

+ FireNet split button: Opens the Add FireNet to Transit Gateway dialog. Its dropdown offers Add Egress Transit FireNet and Add AWS TGW FireNet as alternate FireNet types to create.
Select columns button: Button to customize visible columns. VPC/VNet and Cloud Load Balancer are hidden by default.
Show filters / Export buttons: Filter and export the table.
FireNet table: Lists Transit Gateways with FireNet configured, along with their firewall attachment and inspection status.

Actions

View FireNet

To view FireNet instances and their status:

Go to Security > FireNet > FireNet.
The FireNet page appears with the table of Transit Gateways configured for FireNet.
Click a Transit Gateway name to open its FireNet detail page.

Parameter Details

CoPilot Parameter Name	Description
Transit Gateway	Name of the Transit Gateway. Click to open the FireNet detail page.
Type	The FireNet type: Transit Firenet, Egress Transit Firenet, or TGW Firenet.
Cloud	The cloud provider of the Transit Gateway.
Region	The cloud region of the Transit Gateway.
VPC/VNet (hidden by default)	The VPC/VNet of the Transit Gateway.
Cloud Load Balancer (hidden by default)	Whether a cloud-native load balancer (for example, AWS Gateway Load Balancer) is used to distribute traffic to the firewalls.
Firewalls	Number of firewall instances attached, with a status indicator if any are down or degraded.
Inspection	The inspection mode configured for the FireNet.
Egress	The egress status for the FireNet.

Create a FireNet

Before creating a FireNet, ensure the target Transit Gateway exists and (for AWS TGW FireNet) the AWS TGW is attached.To create a FireNet:

Go to Security > FireNet > FireNet.
Click + FireNet to create a Transit FireNet, or use the dropdown to choose Add Egress Transit FireNet or Add AWS TGW FireNet.
In the dialog, select the Transit Gateway, configure the firewall instance size, and complete the remaining fields for the selected FireNet type.
Click Add.

The new FireNet appears in the table once provisioning completes.

Manage Firewall Attachment

To attach or detach firewall instances from a FireNet:

Go to Security > FireNet > FireNet.
In the row’s action menu, click Manage Firewall Attachment.
The Manage Firewall Attachment dialog appears.
In Firewall, add or remove firewall instances to attach or detach them.
Click Save.

View FireNet Details

To view or manage the details of a FireNet:

Go to Security > FireNet > FireNet.
Click the Transit Gateway name for the FireNet.

The FireNet detail page opens with the following tabs:

Tab	Description
Details	Overview information for the FireNet, including its Transit Gateway and attached firewalls.
Firewall	Firewall instances attached to this FireNet.
Policy	Traffic inspection policy for the FireNet. Not shown for Egress Transit Firenet, or for TGW Firenet with a native Gateway Load Balancer.
VPC/VNet Route Tables	Route tables associated with the FireNet’s VPC/VNet.
Vendor Integration	Firewall vendor integration configuration (shown when a vendor integration is available). See Vendor Integration through Firewall Manager below.
Settings	FireNet-level settings.

Vendor Integration through Firewall Manager

Before configuring vendor integration through Firewall Manager, ensure you have:

A Transit FireNet gateway with firewall instances attached
(For Palo Alto Networks Panorama) Panorama management IP address and administrator credentials
(For Palo Alto Networks Panorama) Panorama template and template stack names to assign to each firewall

To configure vendor integration through Firewall Manager:

Go to Security > FireNet > FireNet.
Click the Transit Gateway name for the FireNet, then open its Vendor Integration tab.
Click Through Firewall Manager as the integration path.
In Firewall Manager Vendor, click the Firewall Manager Vendor dropdown. Select Palo Alto Networks Panorama to configure Custom Firewall Mapping.
In Management IP Address, enter the management IP address of the Panorama instance.
In Username, enter the Panorama administrator username.
In Password, enter the corresponding password.
In FireNet Instance Template Name, select or enter the template to assign to this firewall.
Enable Custom Firewall Mapping to configure more than one firewall template.
Click Save.

A notification appears confirming the vendor integration configuration.

Remove a FireNet

To remove a FireNet:

Go to Security > FireNet > FireNet.
In the row’s action menu, click Remove.
Confirm the removal.

Removing a FireNet is available only for AWS. For other clouds, Remove is disabled with a tooltip explaining that the FireNet must be removed through Terraform or the Controller.

Use FireNet Diagnostics

To run FireNet diagnostics for troubleshooting:

Go to Security > FireNet > FireNet.
In the row’s action menu, click FireNet Diagnostics.
Run Ping, Traceroute, or view logs for the selected FireNet.

Diagnostics help troubleshoot connectivity and operational issues with FireNet instances.

Purpose

The Firewall page manages firewall instances used with FireNet, including creating, associating, and removing firewall instances, and accessing each firewall’s management interface.

Elements

+ Firewall split button: Opens a dialog to create a new firewall instance. Its dropdown offers Associate Existing Firewall to associate an already-deployed firewall instance instead.
Select columns button: Button to customize visible columns. Instance ID and VPC/VNet are hidden by default.
Firewall table: Lists firewall instances, their vendor, association, and management information. A colored dot next to the Name shows the firewall’s status (up, down, or unreachable).

Actions

View Firewalls

To view firewall instances integrated with FireNet:

Go to Security > FireNet > Firewall.
The Firewall page appears with the table listing firewall instances.
Click a firewall’s Name to open its details drawer, which shows the firewall’s vendor configuration and a Sync Routes to Firewall button.

The Firewall Table displays firewall instances and their integration status with FireNet.

Parameter Details

CoPilot Parameter Name	Description
Name	Displays the name of the firewall instance. A colored dot indicates the firewall’s status (up, down, or unreachable). Click the name to open the firewall’s details drawer.
Instance ID (hidden by default)	Displays the cloud provider instance ID of the firewall.
VPC/VNet (hidden by default)	Displays the VPC or VNet where the firewall is deployed.
Vendor	Displays the firewall vendor.
Vendor Integration	Displays the integration type used with the firewall vendor.
Association	Displays the name of the FireNet gateway the firewall is associated with, if any.
Management Private IP	Displays the private IP address used to manage the firewall.
Management UI	Provides a link to the firewall’s management user interface.

Create or Associate a Firewall

To create a new firewall instance:

Go to Security > FireNet > Firewall.
Click + Firewall.
Complete the firewall creation dialog and click Add.

To associate an already-deployed firewall instance instead:

Go to Security > FireNet > Firewall.
Click the dropdown arrow next to + Firewall, and then click Associate Existing Firewall.
Complete the dialog and click Add.

Delete or Remove Association for a Firewall

To delete a firewall instance:

Go to Security > FireNet > Firewall.
In the row’s action menu, click Delete.
Confirm the deletion.

To remove a firewall’s association with a FireNet gateway without deleting the instance:

Go to Security > FireNet > Firewall.
In the row’s action menu, click Remove Association.
This option is available only when the firewall is associated with a FireNet gateway.
Confirm the removal.

Download Access Key

To download a firewall instance’s access key:

Go to Security > FireNet > Firewall.
In the row’s action menu, click Download Access Key.
This option is available only when a key is available for download.

Sync Routes to Firewall

To view a firewall’s vendor configuration and synchronize routes:

Go to Security > FireNet > Firewall.
Click the firewall’s Name to open its details drawer.
The drawer displays the firewall’s current vendor configuration.
Click Sync Routes to Firewall to push the latest route configuration to the firewall.

Concepts & Architecture

Guides

Reference

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details