Skip to main content
Starting March 31, 2026, Microsoft is retiring default outbound internet access for Azure virtual machines. Subnets in new VNets that rely on Azure-provided outbound access lose connectivity unless an explicit outbound method (NAT gateway, public IP, or load balancer rule) is configured. Before 9.0, Aviatrix identified Azure private route tables by the presence of a 0/0 → None route and programmed those tables with 0/0 → avx-gateway. This did not work for brownfield deployments where existing route tables had no default route, or used an outbound mechanism such as a NAT gateway. In 9.0, you select which Azure route tables receive 0/0 → avx-gateway when Single IP SNAT is enabled on an Aviatrix spoke gateway. The Controller saves the original default route for each selected table and restores it when SNAT is disabled or the table is deselected.

​
Supported Configurations

​
Prerequisites

  • Aviatrix Controller 9.0 or later.
  • An Azure VNet with one or more route tables already created and associated to subnets.
  • Azure RBAC permissions to modify route tables in the target resource group.

​
Migration from 8.2

Existing Azure spoke gateways that had Single IP SNAT enabled before 9.0 keep working. The Controller migrates the previously auto-detected private route tables and surfaces them as explicitly selected, so traffic continues to flow without disruption. For Terraform deployments, the migration is not automatic. After upgrading the Aviatrix provider to 9.0, terraform plan shows a diff because the new private_route_table_config attribute is unset. Update your Terraform configuration to declare the route tables that should be programmed; if you apply the plan without updating the configuration, Terraform deselects the route tables that previously received 0/0 → avx-gateway.

​
Behavior Notes

  • Original route preservation: when Aviatrix programs 0/0 → avx-gateway on a route table that already had a default route, the original is saved. When SNAT is disabled or the route table is deselected, the original is restored.
  • Route tables without a default route: Aviatrix adds 0/0 → avx-gateway and removes it when SNAT is disabled.
  • No selection, no default route: if no route tables are selected, no default route is programmed on the CSP. This matches the egress FireNet and transit-propagated default route behavior.
  • Backward compatibility: explicit selection and the previous auto-detection method coexist. Existing implicit selections are migrated on upgrade.
  • Gateway failover: route table programming is preserved across gateway restart and failover.

​
Terraform Configuration

The private_route_table_config attribute is available on these resources in the 9.0 provider:
  • aviatrix_spoke_gateway
  • aviatrix_transit_gateway
  • aviatrix_spoke_group
  • aviatrix_transit_group
  • aviatrix_azure_spoke_native_peering

​
Identifier Format

Route tables are specified using a combined identifier:
For example: my-route-table:my-resource-group

​
Example

Each list entry follows the route_table_name:resource_group_name format.

​
Limitations

  • Route tables must already exist in Azure. Aviatrix does not create route tables.
  • Azure subnets without an associated route table cannot be managed by this feature.
  • Centralized egress (FireNet) is not supported.
  • Existing Terraform configurations are not migrated automatically. After the provider upgrade to 9.0, update your configuration to declare private_route_table_config and avoid plan drift.