> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Transit Gateway to External Devices Workflow

> This document describes the workflow to connect an Aviatrix Transit Gateway to an external (or third party) router or firewall.

This document describes the workflow to connect an Aviatrix Transit Gateway to
an external (or third party) router or firewall.

<a id="configure-external-device" />

## Deploy a Transit Gateway

If you have not launched an Aviatrix Transit Gateway, then follow the
instructions for
[deploying an Aviatrix Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-gateway-about.html?expand=true)
in the Multicloud Transit Network Workflow.

<a id="setting-up-external-device-connection" />

## Set up the External Device Connection

To set up an external connection from a Transit Gateway to an external device,
select one of the following:

* [BGP over IPsec](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-bgp-over-ipsec.html):
  connect to an external device using IPsec tunneling protocol and Border
  Gateway Protocol (BGP) routing.
* [BGP over GRE](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-bgp-over-gre.html):
  connect to an external device using GRE tunneling protocol and BGP routing.
* [BGP over LAN](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-bgp-over-lan.html):
  connect to an external device using BGP routing without any tunneling
  protocol.
* [Static Route-Based (ActiveMesh)](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-route-based-activemesh.html):
  connect to an external device using IPsec tunneling protocol and Static Route
  configuration with full mesh peering from the primary and highly availalble
  (HA) gateway instances.

<Note>
  Starting with **Controller 9.0**, **Static Routing over IPSec** ActiveMesh
  connections to an external device can enable **Proxy-ID** when routing
  protocol is **Static** and tunnel protocol is **IPSec**. See{" "}
  <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/proxy-id-routed-ipsec-connections"}>Proxy-ID for Routed IPSec Connections</a>
  .
</Note>

## Download an External Connection Configuration

If you are connecting an Aviatrix gateway and an on-premises router or firewall,
Aviatrix can generate a configuration file that you can apply to your remote
router or firewall. The configuration file contains the Aviatrix gateway tunnel
details, such as the Public IPv4 and IPv6 addresses, VPC/VNet CIDR, pre-shared
key, and encryption algorithm. You can download the configuration file and then
import the details to your remote router or firewall to configure the other end
of the VPN tunnel.

After creating an external connection, to download an external connection
configuration:

1. In Aviatrix CoPilot, go to **Networking > Connectivity > External Connections
   (S2C)** tab.

2. On the External Connections (S2C) tab, locate the connection you created and
   click the vertical ellipsis <img src="https://mintcdn.com/aviatrix-14b37c43/Y73dDPMr0NB7yfrH/images/guides/connectivity/vpn/vertical-ellipsis-icon.png?fit=max&auto=format&n=Y73dDPMr0NB7yfrH&q=85&s=dfa275cca2e54747ed314060d27d437d" alt="vertical ellipsis icon" style={{display: 'inline', verticalAlign: 'middle', height: '1em'}} width="26" height="26" data-path="images/guides/connectivity/vpn/vertical-ellipsis-icon.png" /> icon
   on the right side of the row.

3. Select the following values:

   **Vendor**: Select your remote site device.

   * Select **Generic** for anything that is not an Aviatrix gateway.
   * Select **Aviatrix**, if you are connecting two Aviatrix gateways.

   **Platform and Software**:

   * If you selected a Generic vendor, the Platform field is populated as
     Generic, and the Software field is populated with Vendor Independent.
   * If you selected the Aviatrix vendor, the Platform field is populated with
     UCC, and the Software version is 1.0.
   * If you selected a specific hardware vendor (such as Cisco), select from the
     available platforms belonging to that vendor are displayed in the Platform
     field (ISR, ASR, and CSR are for Cisco routers), and the Software field is
     populated with the related software version.

4. Click **Download**.

## Configure the External Device

Use the information provided in the configuration file to configure the other
end of the tunnel on the remote router or firewall.

See:

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-ciscorouter"}>Transit Gateway to Cisco Router</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-ciscoasa"}>Transit Gateway to Cisco ASA</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-paloalto"}>Transit Gateway to PaloAlto</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-fortigate"}>Transit Gateway to FortiGate</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/transit-externaldevice-junipersrx"}>Transit Gateway to JuniperSRX</a>

## Disconnect the External Connection

To disconnect an external connection:

1. In Aviatrix CoPilot, go to **Networking > Connectivity > External Connections
   (S2C)** tab.

2. In the table, locate the external connection and click the Delete icon <img src="https://mintcdn.com/aviatrix-14b37c43/1zOMu4WXCFpEtXhJ/images/guides/connectivity/vpn/delete-icon.png?fit=max&auto=format&n=1zOMu4WXCFpEtXhJ&q=85&s=59603279dfa3e866cdcd178c41de3347" alt="delete icon" style={{display: 'inline', verticalAlign: 'middle', height: '1em'}} width="26" height="26" data-path="images/guides/connectivity/vpn/delete-icon.png" /> on the
   right side of the row.

3. To confirm that you want to delete the external connection, click **Delete**.

The external connection is deleted.