> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Explicit Azure Route Table Selection for Single IP SNAT

> Pick which Azure route tables receive the 0/0 default route when Single IP SNAT is enabled on an Aviatrix spoke gateway, replacing the previous auto-detection behavior.

Starting March 31, 2026, Microsoft is retiring default outbound internet access
for Azure virtual machines. Subnets in new VNets that rely on Azure-provided
outbound access lose connectivity unless an explicit outbound method (NAT
gateway, public IP, or load balancer rule) is configured.

Before 9.0, Aviatrix identified Azure private route tables by the presence of a
`0/0 → None` route and programmed those tables with `0/0 → avx-gateway`. This
did not work for brownfield deployments where existing route tables had no
default route, or used an outbound mechanism such as a NAT gateway.

In 9.0, you select which Azure route tables receive `0/0 → avx-gateway` when
Single IP SNAT is enabled on an Aviatrix spoke gateway. The Controller saves the
original default route for each selected table and restores it when SNAT is
disabled or the table is deselected.

## Supported Configurations

| Configuration                        | Supported |
| ------------------------------------ | --------- |
| Azure spoke gateway (Single IP SNAT) | Yes       |
| Azure ARM spoke gateway              | Yes       |
| Azure transit gateway                | Yes       |
| Gateway groups                       | Yes       |
| Centralized egress (FireNet)         | No        |

## Prerequisites

* Aviatrix Controller 9.0 or later.
* An Azure VNet with one or more route tables already created and associated to
  subnets.
* Azure RBAC permissions to modify route tables in the target resource group.

## Migration from 8.2

Existing Azure spoke gateways that had Single IP SNAT enabled before 9.0 keep
working. The Controller migrates the previously auto-detected private route
tables and surfaces them as explicitly selected, so traffic continues to flow
without disruption.

For Terraform deployments, the migration is not automatic. After upgrading the
Aviatrix provider to 9.0, `terraform plan` shows a diff because the new
`private_route_table_config` attribute is unset. Update your Terraform
configuration to declare the route tables that should be programmed; if you
apply the plan without updating the configuration, Terraform deselects the route
tables that previously received `0/0 → avx-gateway`.

## Behavior Notes

* Original route preservation: when Aviatrix programs `0/0 → avx-gateway` on a
  route table that already had a default route, the original is saved. When SNAT
  is disabled or the route table is deselected, the original is restored.
* Route tables without a default route: Aviatrix adds `0/0 → avx-gateway` and
  removes it when SNAT is disabled.
* No selection, no default route: if no route tables are selected, no default
  route is programmed on the CSP. This matches the egress FireNet and
  transit-propagated default route behavior.
* Backward compatibility: explicit selection and the previous auto-detection
  method coexist. Existing implicit selections are migrated on upgrade.
* Gateway failover: route table programming is preserved across gateway restart
  and failover.

## Terraform Configuration

The `private_route_table_config` attribute is available on these resources in
the 9.0 provider:

* `aviatrix_spoke_gateway`
* `aviatrix_transit_gateway`
* `aviatrix_spoke_group`
* `aviatrix_transit_group`
* `aviatrix_azure_spoke_native_peering`

### Identifier Format

Route tables are specified using a combined identifier:

```
route_table_name:resource_group_name
```

For example: `my-route-table:my-resource-group`

### Example

```hcl theme={null}
resource "aviatrix_spoke_gateway" "azure_spoke" {
  # ... existing configuration ...
  snat_enabled               = true
  private_route_table_config = ["rtb1:resource-group-1", "rtb2:resource-group-2"]
}
```

Each list entry follows the `route_table_name:resource_group_name` format.

## Limitations

* Route tables must already exist in Azure. Aviatrix does not create route
  tables.
* Azure subnets without an associated route table cannot be managed by this
  feature.
* Centralized egress (FireNet) is not supported.
* Existing Terraform configurations are not migrated automatically. After the
  provider upgrade to 9.0, update your configuration to declare
  `private_route_table_config` and avoid plan drift.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/spoke-gateway-snat-dnat"}>Spoke Gateway SNAT and DNAT</a>