> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Spoke Single IP SNAT and Tagless Default Routes (Regional VPC)

> Starting with Controller 9.0, Single IP SNAT on a GCP Regional VPC spoke or standalone gateway supports tagless default routes so serverless workloads and untagged VMs can egress through the Aviatrix gateway without the avx-snat-noip network tag.

This document describes how that behavior differs from releases before
Controller version 9.0, what the Controller programs in GCP, and how to enable
Single IP SNAT, verify VPC routes, and disable the feature.

Starting with Controller version 9.0, enabling **Single IP SNAT** on an Aviatrix
spoke or standalone gateway in a **GCP Regional VPC** programs an additional
tagless default route (`0.0.0.0/0` with priority 1000) toward the gateway. That
route applies to all workloads in the VPC that do not match a higher-priority
tagged route, including Cloud Run, Cloud Functions, App Engine, and untagged
VMs, without requiring the `avx-snat-noip` network tag on every instance.

<Note>
  * **Regional VPC only:** Tagless default routing applies when the spoke uses a **Regional VPC** (Global VPC disabled). Global VPC continues to use regional tag-based routes; see <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/gcp-global-vpc"}>Enabling GCP Global VPC Routing</a>.
  * **Controller 9.0 or later** is required for tagless default route programming with Single IP SNAT on Regional VPC spokes.
  * In **Global VPC** mode, the SNAT tag format is `avx-snat-noip-{region}` (for example, `avx-snat-noip-us-west1`). Tagless default routing is **not** supported in Global VPC mode.
</Note>

For related GCP routing and VPC topics, see:

* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/gcp-global-vpc"}>Enabling GCP Global VPC Routing</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/routing/transit-externaldevice-gcp-multipeer-bgpolan"}>Transit Gateway Multi-Peer BGP Over LAN in GCP Workflow</a>

## Prerequisites

* Needs Aviatrix Controller **9.0** or later.
* Needs an Aviatrix Spoke or standalone Gateway in a **GCP Regional VPC** (not
  Global VPC mode).
* The GCP account
  <a href={"/docs/enterprise/" + "10.1" + "/guides/platform-administration/gcp-account-onboarding"}>onboarded</a>
  in the Controller should have IAM permissions to create and delete VPC routes.

## Background and Route Behavior

Before Controller version 9.0, Single IP SNAT on a GCP spoke relied on instances
using the `avx-snat-noip` GCP network tag so the tagged default route applied.
Network tags are not supported on serverless compute (Cloud Run, Cloud
Functions, and App Engine), so those workloads could not be steered through the
gateway the same way as tagged VMs.

Starting with Controller version 9.0 on a **Regional VPC**, the Controller
installs both the existing tagged SNAT route and a **tagless** default route.
The tagged route remains for explicitly tagged VMs; the tagless route covers the
rest of the VPC.

### Route priorities when Single IP SNAT is enabled

When Single IP SNAT is enabled on a Regional VPC spoke gateway, Aviatrix manages
these VPC routes:

| GCP route priority | Network tag        | Next hop               | Traffic affected                                                        |
| ------------------ | ------------------ | ---------------------- | ----------------------------------------------------------------------- |
| 991                | `avx-snat-noip`    | Aviatrix spoke gateway | VM instances explicitly tagged for SNAT (Regional VPC)                  |
| 1000               | *(none — tagless)* | Aviatrix spoke gateway | All remaining instances, including serverless services and untagged VMs |

<a id="enable-single-ip-snat-on-a-gcp-spoke-gateway" />

## Enable Single IP SNAT on a GCP Spoke Gateway

To enable Single IP SNAT and activate tagless default route behavior:

1. In CoPilot, go to **Cloud Fabric** > **Gateways** > **Spoke Gateways**.
2. Click the GCP Spoke or standalone Gateway name to open the Gateway Details
   page.
3. Click the **Settings** tab.
4. Expand **Network Address Translation (NAT)** and turn **Source NAT** to
   **On**.
5. Click **Single IP**.
6. Click **Save**.

When Single IP SNAT is enabled, the Controller automatically:

* Programs a SNAT route (priority 991, tagged `avx-snat-noip`) in the VPC
  pointing to the Spoke Gateway.
* Programs a tagless default route (priority 1000, no network tags) in the VPC
  pointing to the Spoke Gateway.
* Adjusts tagging on the existing GCP internet gateway route so the routing
  hierarchy stays consistent.

You do not need to assign GCP network tags on VM instances for default routing
behavior through the tagless Route.

## Verify Routes in Google Cloud Console

After you enable Single IP SNAT, confirm routes in Google Cloud Console:

1. In the **Google Cloud Console**, go to **VPC network** > **Routes**.
2. Filter routes by the VPC network attached to the Spoke Gateway.
3. Confirm a route to `0.0.0.0/0` with priority 991 and source tag
   `avx-snat-noip`, with next hop pointing to the Aviatrix Gateway instance.
4. Confirm a second route to `0.0.0.0/0` with priority 1000, **no** network
   tags, with next hop pointing to the same Aviatrix Gateway instance.

### Verifying Serverless Egress (Optional)

From a serverless workload in the same VPC (for example, a Cloud Run service),
initiate an outbound connection to an external endpoint and confirm that traffic
reaches the expected destination and Source NAT behavior matches your policy.

## Disable Single IP SNAT

When you disable Single IP SNAT on the gateway, the Controller removes both the
tagged SNAT route and the tagless default route from the VPC. Normal GCP routing
resumes through the default internet gateway.

1. Go to **Cloud Fabric** > **Gateways** > **Spoke Gateways**.
2. Click the gateway name to open the gateway details page.
3. Click the **Settings** tab.
4. Under **Network Address Translation (NAT)**, turn **Source NAT** to **Off**.
5. Click **Save**.

## Limitations

* **GCP Regional VPC only.** Tagless default route programming applies only when
  the spoke uses a Regional VPC. Global VPC continues to use regional tag-based
  routes (`avx-snat-noip-{region}`); serverless workloads in Global VPC are not
  covered.
* **Legacy VPC required.** Single IP SNAT applies only to GCP VPCs configured as
  legacy VPCs.
* **One Single IP SNAT gateway per VPC.** Only one gateway in a VPC can have
  Single IP SNAT enabled. You cannot enable Single IP SNAT on a different
  gateway in the same VPC if FQDN egress control is already enabled on another
  gateway in that VPC, and vice versa.

## Related topics

* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/gcp-global-vpc"}>Enabling GCP Global VPC Routing</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/routing/transit-externaldevice-gcp-multipeer-bgpolan"}>Transit Gateway Multi-Peer BGP Over LAN in GCP Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/platform-administration/gcp-account-onboarding"}>GCP Account Onboarding</a>