Configuration

This section provides the purpose, elements, and actions performed on the Configuration pages.

Purpose

The General tab displays and changes general CoPilot system settings, including security, feature, and advanced settings.

Elements

Associated Aviatrix Controller: Section for managing controller association with fields for Public IP/FQDN, Controller IP, and Service Account.
Reset Association button: Resets the controller association.
Reset button: Resets the service account.
Support for IPv6:
Controller Session Timeout: Numeric input for session timeout in minutes.
Sharing Metrics with Aviatrix: Section with toggles for Health Metrics and Usage Analytics.
Security: CoPilot Access Control (Controller 9.0 and later) or CoPilot Security Group Management and CoPilot IP Access List Management (Controller versions earlier than 9.0), Controller Security Group Management, Certificate Domain, Controller IP Access, CoPilot Certificate, Controller Certificate.
Features: CoPilot UI Experiences (Billing Insights), Network Insights API.
Advanced: Tunnel Down Detection Time, Tunnel TCP MSS, Tunnel Anti-Replay Window, Gateway to Controller Communication (Keep-Alive Speed), DNS Servers for CoPilot, DNS Server for Controller, FIPS 140-2.

Actions

Enable IPv6 on Controller

Turning on Support for IPv6 lets the Controller configure IPv6 on Aviatrix gateways and on the customer VPC/VNets where those gateways are deployed. It does not place IPv6 on the Controller or CoPilot management networks.

Note: The Support for IPv6 toggle is labeled Preview in the CoPilot UI.

Management VPC/VNets: Deploy the Aviatrix Controller and Aviatrix CoPilot only in VPC/VNets that use IPv4 addressing for those appliances. Do not associate IPv6 address space with the VPC/VNet subnets where Controller or CoPilot run.

To enable Support for IPv6 on the Controller:

Go to Settings > Configuration > General.
Locate Support for IPv6. Turn On the Support for IPv6 toggle.
Click Save.

Parameter Details

CoPilot Parameter Name	Description
Public IP/FQDN	Enter the public IP address or fully qualified domain name of the associated Aviatrix Controller.
Controller IP	Displays the IP address of the associated controller (read-only).
Service Account	Displays the service account name used for controller association (read-only).
Support for IPv6	Enable IPv6 configuration for gateways and the VPC/VNets where those gateways are deployed. Does not enable IPv6 on Controller or CoPilot VPC/VNets.
Session timeout (Minute)	Set the controller session timeout duration in minutes.
Health Metrics	Enable or disable sharing system health data (Controllers and Gateways) with Aviatrix.
Usage Analytics	Enable or disable sharing UI usage data with Aviatrix.

Configure CoPilot Access Control (Controller 9.0 and later)

Note: CoPilot Access Control is labeled Preview in the CoPilot UI.

On Controller 9.0 and later, the CoPilot Access Control card replaces the separate CoPilot Security Group Management and CoPilot IP Access List Management cards, and lets you choose a single access control mode for CoPilot.To configure CoPilot Access Control:

Go to Settings > Configuration > General.
In CoPilot Access Control, click Enable (or Edit Configuration if already configured).
In the CoPilot Access Control dialog, select a mode: Security Group Rules (adds Aviatrix-managed security group rules for a selected VPC/VNet and CoPilot instance) or CoPilot-Managed (CoPilot manages access using custom rules you define, by CIDR/protocol/port).
Acknowledge the mode-change warning, then click Save.

Switching modes starts a background migration task, visible in Notifications > Tasks. To turn off CoPilot Access Control, open Edit Configuration and click Disable.

Parameter Details

CoPilot Parameter Name	Description
Mode	Shows the configured access control mode: Security Group Rules or CoPilot-Managed.
Gateways Deployed	Security Group Rules mode only. Number of gateways covered by the Aviatrix-managed security groups.
Custom Rules	CoPilot-Managed mode only. Number of custom access rules configured.

Configure CoPilot Security Group Management or IP Access List Management (Controller versions earlier than 9.0)

To configure security settings on Controller versions earlier than 9.0:

Go to Settings > Configuration > General.
Turn On CoPilot Security Group Management or CoPilot IP Access List Management, and configure the associated fields. Click Save.

Changes take effect per the selected options.

Parameter Details

CoPilot Parameter Name	Description
CoPilot Security Group Management	Enable or disable CoPilot security group management.
CoPilot IP Access List Management	Enable or disable CoPilot IP access list management.

Configure Controller Security Group Management, Certificate Domain, or Controller IP Access

To configure the remaining security settings:

Go to Settings > Configuration > General.
Turn On Controller Security Group Management, select an Account, and (Controller 10.1 and later) optionally add NAT-ed Gateway IP Address CIDRs for access from Private IP-only gateways. Click Save.
To change the certificate domain, edit Certificate Domain, or click Reset To Default to restore the default domain.
To restrict Controller access by IP, turn On Controller IP Access, then click Create Access List to add one or more IP Address/CIDR + Description rows (port 443 is fixed), and optionally turn on Enforcement. Click Save.
To replace the default self-signed certificates, click Upload Certificate under CoPilot Certificate or Controller Certificate.

Changes take effect per the selected options.

Parameter Details

CoPilot Parameter Name	Description
Controller Security Group Management	Enable or disable controller security group management.
Account	Select the cloud account for controller security group management.
NAT-ed Gateway IP Address CIDRs	Controller 10.1 and later only. Add CIDRs used for access to Private IP-only gateways.
Certificate Domain	Enter the certificate domain name, or click Reset To Default to restore it.
Controller IP Access	Enable or disable controller IP access restrictions.
IP Address/CIDR	In the Access List dialog, enter an allowed IP address or CIDR (port 443).
Description	In the Access List dialog, enter a description for the entry.
Enforcement	In the Access List dialog, enable to enforce the access list.
CoPilot Certificate	Upload a certificate to replace CoPilot’s default self-signed certificate.
Controller Certificate	Upload a certificate to replace the Controller’s default self-signed certificate.

Configure Feature Settings

To configure feature settings:

Go to Settings > Configuration > General.
In CoPilot UI Experiences, turn On or Off Billing Insights. Click Save.
In Network Insights API, use the header toggle to enable or disable the API. When enabled, select an entry in API Specifications and click Download to download it, or click Reset API Key to generate a new key.

The selected features are enabled or disabled for the CoPilot instance.

Parameter Details

CoPilot Parameter Name	Description
Billing Insights	Enable or disable the Billing Insights UI experience.
Network Insights API (header toggle)	Enable or disable Network Insights API access.
API Specifications	When enabled, select which API specification file to download.
Reset API Key	Generate a new Network Insights API key, invalidating the previous one.

Configure Advanced Settings

To configure advanced settings:

Go to Settings > Configuration > General.
Set Tunnel Down Detection Time, Tunnel TCP MSS, Tunnel Anti-Replay Window, Keep-Alive Speed, DNS options, or FIPS 140-2 as needed. Click Save.

Advanced settings are applied per the configuration.

Parameter Details

CoPilot Parameter Name	Description
Gateway	Select the gateway for tunnel configuration (Controller or specific gateway).
Detection Time	Set the tunnel down detection time in seconds (minimum: 20 seconds).
Maximum Segment Size (MSS)	Set the tunnel TCP maximum segment size in bytes (recommendation: < 1370 bytes).
Window	Set the tunnel anti-replay window in packets (range: 0-4096 packets).
Keep-Alive Speed	Select the keep-alive speed for gateway to controller communication.
DNS Servers for CoPilot	Select DNS server option for CoPilot (Cloud VPC/VNet DNS Server or Custom DNS Servers).
DNS Server for Controller	Select DNS server option for Controller (Aviatrix Default DNS Server or Cloud VPC/VNet DNS Server).
Federal Information Processing Standard (FIPS) 140-2	Enable or disable FIPS 140-2 compliance mode.

Purpose

The License page displays license information, including license type, license details, customer ID, and feature preview status.

Elements

License Type: Section displaying the license type (e.g., Universal).
License Details table: Table showing License ID, Controller ID, Issue Date, Allocated, and Total.
Customer ID: Text field displaying the masked customer ID with Reset button.
Feature Previews: Section with a table showing Feature, Status, and an unlabeled actions column (an Enable button for features that can be self-service enabled directly from this table), with a Refresh button.

Actions

View License Information

To view license information:

Go to Settings > Configuration > License.
The page appears with License Type, License Details table, Customer ID, and Feature Previews. Optionally, click Refresh for Feature Previews.

The license and feature preview status are displayed.

Parameter Details

CoPilot Parameter Name	Description
License ID	Shows the unique identifier for the license.
Controller ID	Shows the unique identifier for the controller associated with the license.
Issue Date	Shows the date when the license was issued.
Allocated	Shows the number of licenses allocated.
Total	Shows the total number of licenses available.
Customer ID	Displays the masked customer ID associated with the license.
Feature	Shows the name of the feature preview.
Status	Shows the status of the feature preview (e.g., Preview, Early Access, or a requirement such as “Requires Distributed Cloud Firewall”). Blank for features enabled via the Enable button in this table.
(actions)	Shows an Enable button for features you can self-service enable directly from this table. Disabled or blank when a feature must be enabled elsewhere, or has an unmet prerequisite.

Purpose

The Logging Services page allows you to configure and manage various logging services including Remote Syslog, Datadog Agent, CloudWatch Agent, and NetFlow Agent.

Elements

Remote Syslog: Section for configuring remote syslog with Profile dropdown, server details, Edit Profile button, and a More Options button (Delete Profile).
Datadog Agent: Section for configuring Datadog agent with Enable button.
CloudWatch Agent: Section for configuring CloudWatch agent with Enable button.
NetFlow Agent: Section for configuring NetFlow agent with configuration details, an Edit Configuration button, and a More Options button (Disable).

Actions

Configure Logging Services

To configure logging services:

Go to Settings > Configuration > Logging Services.
Configure Remote Syslog (Profile, Edit Profile), Datadog Agent, CloudWatch Agent, or NetFlow Agent as needed. Save or enable each section.

Logging services are configured per the selected options.

Parameter Details

CoPilot Parameter Name	Description
Profile	Select the syslog profile for remote syslog configuration.
Server	Displays the syslog server address.
Protocol / Port	Displays the protocol and port used for syslog (e.g., UDP / 5000).
TLS	Displays whether TLS is enabled or disabled for syslog.
Certificate	Displays the certificate status for syslog.
Gateways Included	Shows the number of gateways included in the syslog profile.
NetFlow Server	Displays the NetFlow server address.
NetFlow Version	Displays the NetFlow version (e.g., 9).
Mode	Displays the NetFlow mode (e.g., IPT).
Protocol / Port	Displays the protocol and port used for NetFlow (e.g., UDP / 31283).
TLS	Displays whether TLS is enabled or disabled for NetFlow.
Sampling Rate	Displays the NetFlow sampling rate percentage.

Purpose

The Telemetry Export tab lets you create and manage Telemetry Export Profiles that forward Aviatrix telemetry data to external OTLP-compatible collectors, such as SIEMs and observability platforms, over gRPC or HTTP.

Telemetry Export is available on Controller 10.1 and later.

Elements

+ Profile button: Button to create a new Telemetry Export Profile.
Show filters button: Button to show filters for the profiles table.
Select columns button: Button to select columns for the profiles table.
Export button: Export button to download profile data.
Search: Search box for filtering profiles table content.
Profiles table: Table displaying configured profiles with columns for Profile Name, Data Sources, Gateway, Endpoint, and Status. Each row includes Edit and Delete actions. Clicking a profile name opens a detail panel.

Actions

View Telemetry Export Profile Details

To view a profile’s details:

Go to Settings > Configuration > Telemetry Export.
Click a profile name in the Profiles table.
The detail panel appears with Data Source, OTLP Destination, and Status, followed by a table of gateways matched by the profile’s scope (Gateway Name, Region, Status).

Parameter Details

CoPilot Parameter Name	Description
Profile Name	Name of the Telemetry Export Profile.
Data Sources	Telemetry data types forwarded by the profile (DCF Logs, Gateway Metrics).
Gateway	Scope of gateways the profile applies to (All Gateways, Gateways by Name, or Gateway by Conditions).
Endpoint	OTLP destination host:port that receives the exported telemetry.
Status	Whether the profile is Enabled or Disabled.
Gateway Name (detail table)	Name of a gateway matched by the profile’s scope.
Region (detail table)	Cloud region of the matched gateway.
Status (detail table)	Forwarding status of the matched gateway.

Create Telemetry Export Profile

To create a profile:

Go to Settings > Configuration > Telemetry Export.
Click + Profile.
On the Profile step, fill the form. Refer to the parameter details below.
Click Next.
On the Connection step, fill the form. Refer to the parameter details below.
Click Save.

The profile is created and appears in the Profiles table.

For Gateways by Name, select one or more gateways from Select Gateways. For Gateway by Conditions, build one or more condition rows (field, operator, value) and choose whether the profile Matches all conditions (AND) or Matches any condition (OR). Use + Add condition or + Add group to add more rows, and Preview to check matching gateways before saving.

Parameter Details

CoPilot Parameter Name	Description
Name	Enter a name for the Telemetry Export Profile.
Data Sources	Select DCF Logs (security events, including L4/L7 rule hits and intrusion detection alerts), Gateway Metrics (performance and network telemetry from gateways), or both.
Select Scope	Choose which gateways the profile applies to: All Gateways, Gateways by Name, or Gateway by Conditions.
Select Gateways	Gateways by Name only. Select one or more gateways by name.
Condition field	Gateway by Conditions only. Cloud, Region, Gateway Name, or Gateway Name (Regex).
Condition operator	Gateway by Conditions only. Equal or Not Equal.
Match type	Gateway by Conditions only. Matches all conditions (AND) or Matches any condition (OR).
Forwarding Status	Turn On to have the profile forward telemetry; turn Off to pause forwarding without deleting the profile.
Method	Connection method used to reach the collector: gRPC with Server TLS (server authentication only — gateway verifies remote collector identity), gRPC with Mutual TLS (mutual authentication — both sides verify each other’s certificates), or HTTP with TLS (server authentication only). Cannot be changed after the profile is created.
OTLP Destination URL	Enter the collector endpoint. For gRPC methods, enter the endpoint in host:port format with no URL scheme.
CA Certificate	Upload the CA certificate (PEM) used to verify the collector’s identity.
Client Certificate	gRPC with Mutual TLS only. Upload the client certificate (PEM/KEY) presented to the collector.
Client Private Key	gRPC with Mutual TLS only. Upload the private key (PEM/KEY) matching the client certificate.
Server Name Override	gRPC with Mutual TLS only. Optional override for the TLS server name used during certificate verification.
Authentication Method	HTTP with TLS only, optional. Bearer Token, Basic Authentication, or API Key.
Bearer Token	Authentication Method: Bearer Token. Token sent in the request’s Authorization header.
Username / Password	Authentication Method: Basic Authentication. Credentials sent for basic authentication.
API Key Header Name / API Key	Authentication Method: API Key. Header name (for example, X-API-Key) and value sent with each request.
Custom Headers	Optional key/value HTTP headers sent with the exported telemetry.

Edit Telemetry Export Profile

To edit a profile:

Go to Settings > Configuration > Telemetry Export.
Click the Edit icon next to the profile name.
Update the Profile or Connection fields as needed. Click Save.

To change Method, you need to delete the profile and create a new one.

Delete Telemetry Export Profile

To delete a profile:

Go to Settings > Configuration > Telemetry Export.
Click the Delete icon for the profile, or open the profile and click the Delete icon in the detail panel.
In the Delete Profile confirmation dialog, click Delete.

Deleting a Telemetry Export Profile cannot be undone.

Purpose

The Private Mode page allows you to enable private data plane capability and configure proxy server settings for private mode operation.

Private Mode is deprecated on Controller 10.0 and later. The Private Mode tab is removed from CoPilot’s Configuration page once the associated Controller is on version 10.0 or later — existing Private Mode configurations must be removed before upgrading the Controller to 10.0 or later. This tab remains available, as documented below, only for Controllers on versions earlier than 10.0.

Elements

Private Mode: Toggle switch to enable or disable private mode.
HTTP Proxy: Text field for entering HTTP proxy server address.
HTTPS Proxy: Text field for entering HTTPS proxy server address.
Proxy CA Certificate: File upload field for proxy CA certificate with Upload button.
Remove Proxy: Button to clear the configured HTTP and HTTPS proxy servers.

Actions

Configure Private Mode

To configure private mode:

Go to Settings > Configuration > Private Mode.
Turn On Private Mode if needed. Enter HTTP Proxy and HTTPS Proxy. Optionally, upload Proxy CA Certificate. Click Save.

Private mode and proxy settings are applied.

Parameter Details

CoPilot Parameter Name	Description
Private Mode	Enable or disable private data plane capability that does not require any Public IP association.
HTTP Proxy	Enter the HTTP proxy server address for private mode communication.
HTTPS Proxy	Enter the HTTPS proxy server address for private mode communication.
Proxy CA Certificate	Upload the CA certificate for the proxy server to enable secure communication.

Disable Private Mode

Delete all gateways and other private mode resources before you disable private mode. Disabling private mode while dependent resources still exist returns an error.

To disable private mode:

Go to Settings > Configuration > Private Mode.
Clear the HTTP Proxy field, then click Remove Proxy. Click Save.
Turn Off Private Mode. Click Save.

Private mode is disabled, and the data plane requires Public IP association again.

Purpose

The Certificate Store page displays and manages certificates used by CoPilot, including certificate details such as name, subject, expiration, key type, and associated services. You can view certificates and add new ones.

Elements

Certificate button: Button to add a new certificate.
Show filters button: Button to show filters for the certificate table.
Select columns button: Button to select columns for the certificate table.
Export button: Export button to download certificate data.
Search: Search box for filtering certificate table content.
Certificates table: Table displaying certificate information with columns for Name, Subject, Expires, Key Type, Key Specification, and Services, plus a per-row actions menu (Edit Name, Actions; a disabled Certificate is in use label appears when the certificate cannot be removed).

Actions

View Certificates

To view certificates:

Go to Settings > Configuration > Certificate Store.
The page appears with the certificates table (Name, Subject, Expires, Key Type, Key Specification, Services) and Certificate, Show filters, Select columns, Export, Search.
Optionally, use Search, Show filters, or Select columns to narrow the list.

The Certificate Store table shows all certificates and their details.

Parameter Details

Certificates table:

CoPilot Parameter Name	Description
Name	Shows the name of the certificate.
Subject	Shows the certificate subject (distinguished name).
Expires	Shows the certificate expiration date and time remaining.
Key Type	Shows the certificate key type (e.g., EC, RSA).
Key Specification	Shows the key specification details (e.g., prime256v1, 2048 bit).
Services	Shows the services associated with the certificate (e.g., Internal, Uservpn).
(actions)	Per-row Edit Name button, a disabled Certificate is in use indicator (shown when the certificate cannot be removed), and an Actions button for further certificate management options.

Create Certificate

To create a certificate:

Go to Settings > Configuration > Certificate Store.
Click Certificate.
In the dialog, enter Name, upload Certificate File and Private Key File (if required), select Key Type and Services. Click Save.

The new certificate is added to the Certificate Store.

Parameter Details

Create Certificate dialog:

CoPilot Parameter Name	Description
Name	Enter a name for the certificate.
Certificate File	Upload the certificate file.
Private Key File	Upload the private key file (if required).
Key Type	Select the certificate key type (EC or RSA).
Services	Select the services that will use this certificate.

Concepts & Architecture

Guides

Reference

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Parameter Details

​Parameter Details

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details