Skip to main content
This document describes how that behavior differs from releases before Controller version 9.0, what the Controller programs in GCP, and how to enable Single IP SNAT, verify VPC routes, and disable the feature. Starting with Controller version 9.0, enabling Single IP SNAT on an Aviatrix spoke or standalone gateway in a GCP Regional VPC programs an additional tagless default route (0.0.0.0/0 with priority 1000) toward the gateway. That route applies to all workloads in the VPC that do not match a higher-priority tagged route, including Cloud Run, Cloud Functions, App Engine, and untagged VMs, without requiring the avx-snat-noip network tag on every instance.
  • Regional VPC only: Tagless default routing applies when the spoke uses a Regional VPC (Global VPC disabled). Global VPC continues to use regional tag-based routes; see Enabling GCP Global VPC Routing.
  • Controller 9.0 or later is required for tagless default route programming with Single IP SNAT on Regional VPC spokes.
  • In Global VPC mode, the SNAT tag format is avx-snat-noip-{region} (for example, avx-snat-noip-us-west1). Tagless default routing is not supported in Global VPC mode.
For related GCP routing and VPC topics, see:

​
Prerequisites

  • Needs Aviatrix Controller 9.0 or later.
  • Needs an Aviatrix Spoke or standalone Gateway in a GCP Regional VPC (not Global VPC mode).
  • The GCP account onboarded in the Controller should have IAM permissions to create and delete VPC routes.

​
Background and Route Behavior

Before Controller version 9.0, Single IP SNAT on a GCP spoke relied on instances using the avx-snat-noip GCP network tag so the tagged default route applied. Network tags are not supported on serverless compute (Cloud Run, Cloud Functions, and App Engine), so those workloads could not be steered through the gateway the same way as tagged VMs. Starting with Controller version 9.0 on a Regional VPC, the Controller installs both the existing tagged SNAT route and a tagless default route. The tagged route remains for explicitly tagged VMs; the tagless route covers the rest of the VPC.

​
Route priorities when Single IP SNAT is enabled

When Single IP SNAT is enabled on a Regional VPC spoke gateway, Aviatrix manages these VPC routes:

​
Enable Single IP SNAT on a GCP Spoke Gateway

To enable Single IP SNAT and activate tagless default route behavior:
  1. In CoPilot, go to Cloud Fabric > Gateways > Spoke Gateways.
  2. Click the GCP Spoke or standalone Gateway name to open the Gateway Details page.
  3. Click the Settings tab.
  4. Expand Network Address Translation (NAT) and turn Source NAT to On.
  5. Click Single IP.
  6. Click Save.
When Single IP SNAT is enabled, the Controller automatically:
  • Programs a SNAT route (priority 991, tagged avx-snat-noip) in the VPC pointing to the Spoke Gateway.
  • Programs a tagless default route (priority 1000, no network tags) in the VPC pointing to the Spoke Gateway.
  • Adjusts tagging on the existing GCP internet gateway route so the routing hierarchy stays consistent.
You do not need to assign GCP network tags on VM instances for default routing behavior through the tagless Route.

​
Verify Routes in Google Cloud Console

After you enable Single IP SNAT, confirm routes in Google Cloud Console:
  1. In the Google Cloud Console, go to VPC network > Routes.
  2. Filter routes by the VPC network attached to the Spoke Gateway.
  3. Confirm a route to 0.0.0.0/0 with priority 991 and source tag avx-snat-noip, with next hop pointing to the Aviatrix Gateway instance.
  4. Confirm a second route to 0.0.0.0/0 with priority 1000, no network tags, with next hop pointing to the same Aviatrix Gateway instance.

​
Verifying Serverless Egress (Optional)

From a serverless workload in the same VPC (for example, a Cloud Run service), initiate an outbound connection to an external endpoint and confirm that traffic reaches the expected destination and Source NAT behavior matches your policy.

​
Disable Single IP SNAT

When you disable Single IP SNAT on the gateway, the Controller removes both the tagged SNAT route and the tagless default route from the VPC. Normal GCP routing resumes through the default internet gateway.
  1. Go to Cloud Fabric > Gateways > Spoke Gateways.
  2. Click the gateway name to open the gateway details page.
  3. Click the Settings tab.
  4. Under Network Address Translation (NAT), turn Source NAT to Off.
  5. Click Save.

​
Limitations

  • GCP Regional VPC only. Tagless default route programming applies only when the spoke uses a Regional VPC. Global VPC continues to use regional tag-based routes (avx-snat-noip-{region}); serverless workloads in Global VPC are not covered.
  • Legacy VPC required. Single IP SNAT applies only to GCP VPCs configured as legacy VPCs.
  • One Single IP SNAT gateway per VPC. Only one gateway in a VPC can have Single IP SNAT enabled. You cannot enable Single IP SNAT on a different gateway in the same VPC if FQDN egress control is already enabled on another gateway in that VPC, and vice versa.