> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure CoPilot for the Aviatrix Platform

> As a component in the Aviatrix Platform, CoPilot must communicate with other components in the platform to receive the data it requires. This section details the configuration of CoPilot for the Aviatrix platform.

As a component in the Aviatrix Platform, CoPilot must communicate with other
components in the platform to receive the data it requires. This section details
the configuration of CoPilot for the Aviatrix platform. The integration points
are typically configured for you as part of the CoPilot deployment process. If
you encounter any problems with your CoPilot deployment, you can check to ensure
these integration points are configured.

## Integration with Controller

CoPilot must be able to reach Controller. See
[Associate Controller with CoPilot](#associate-controller-with-copilot).

### Associate CoPilot with Controller

In Aviatrix Controller, go to **Settings > CoPilot** and enable the **CoPilot
Association** option so that your CoPilot will be associated with your
Controller. Once the CoPilot association is enabled, you can click the
dotted-square button in the top right to use single sign-on for CoPilot.

### <a href={"/docs/enterprise/" + "10.1" + "/guides/controlplane/copilot-controller-settings#associate-controller-copilot"}>Associate Controller with CoPilot</a>

1. In the CoPilot UI, go to **Settings > Configuration > General > Associated
   Aviatrix Controller** and click **Reset Association** to associate your
   CoPilot with your Controller.

2. On the **Reset Controller Association** page, check **I understand the
   implications**, and then click **Reset**.

3. When logged out, enter username, password, and Controller IP.

   If the Controller and CoPilot are in the same subnet, VPC, and region of the
   same cloud provider, or if the Controller and CoPilot can use a private IP
   for inbound network access, you can enter the private IP for the Controller.
   Otherwise, enter the Controller's EIP.

4. Click **Log In**.

### Configure Controller's Access for CoPilot

* Assign a static public IP address to CoPilot. For example, in EC2 console, you
  go to the Elastic IP section and assign an EIP to the CoPilot instance.
* On Controller security groups, ensure 443 is open to the public IP of the
  CoPilot instance.
* Configure a dedicated user account on Aviatrix Controller for CoPilot if
  desired.

<Note>
  If you are using RBAC, as of 1.1.5 CoPilot requires read-only access to ping
  and traceroute functions for diagnostic capabilities.
</Note>

<a id="controller-session-timeout" />

### Setting Session Timeout for the Controller

On the Settings > Configuration > General tab, you use the Controller Session
Timeout setting to determine how long sessions connected to the Controller can
remain inactive before the current sessions time out (in minutes).

## Integration with Gateways

CoPilot receives NetFlow data from gateways. Gateways must be able to reach
CoPilot.

In CoPilot, from **Settings > Configuration > General**, you can enable the
CoPilot Security Group Management option so that your Controller can manage your
CoPilot's inbound security group rules and allow gateways to access your CoPilot
virtual machine. If you choose not to enable the CoPilot Security Group
Management option, you must add rules to your CoPilot's inbound security group
for specific ports for Aviatrix gateway IPs. For more information about the
CoPilot Security Group Management option, see

<a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-security-group-management"}>CoPilot Security Group Management</a>
.

<a id="netflow" />

## Integration with NetFlow

CoPilot receives NetFlow data from gateways.

### Enable NetFlow for CoPilot Features

To use some features in CoPilot, such as FlowIQ and CostIQ features, ensure that
the controller is configured to forward NetFlow logs to CoPilot:

1. Log in to Aviatrix CoPilot UI.

2. Go to **Settings > Configuration > Logging Services > NetFlow Agent**, click
   **Enable**.

3. The static IP address of CoPilot will be pre-filled as the NetFlow server IP.
   Use UDP port 31283 (default, port is configurable).

   For TLS encryption of the NetFlow traffic, select TCP as the protocol. See

   <a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-security-group-management"}>TLS Encryption for NetFlow</a>
   for more information.

   <Note>Changing the protocol may result in network disruption.</Note>

4. Use version 9.

5. (Optional) To use the NetFlow L7 mode Preview feature, select L7 mode. See
   [NetFlow L7 Mode](#netflow-l7-mode).

6. Select the Advanced checkbox. In Gateways, verify all of your Aviatrix
   gateways are in the Include List.You can choose any gateways to be excluded

   <Note>
     If you launch new gateways from your controller later, you must transfer the
     newly launched gateways to the Include List also.

     In addition, in your native cloud console, you must open your CoPilot
     security group for UDP 31283 from each newly launched gateway. If you enabled
     the CoPilot Security Group Management option in CoPilot (**CoPilot >
     Settings > Configuration > General > Security > CoPilot Security Group
     Management**) this will happen automatically.
   </Note>

   You should start seeing NetFlow in CoPilot after a few minutes.

<a id="netflow-l7-mode" />

### NetFlow L7 Mode

NetFlow L7 Mode enables the NetFlow agent on spoke gateways to forward L7 data
that are in the flows to your designated NetFlow service point. L7 Mode is a

<a href={"/docs/enterprise/" + "10.1" + "/reference/feature-modes/index"}>Preview Feature</a>
.

When L7 mode is enabled, Internet traffic that traverses spoke gateways is
analyzed for flows that generate L7 data. When these flows are detected, the L7
fields are forwarded to the designated NetFlow service point.

Enabling L7 mode may impact traffic throughput for the spoke gateways. After
enabling L7 mode, monitor your gateway CPU and throughput telemetry statistics
in CoPilot and scale your gateways up if needed.

If you use Aviatrix CoPilot as your NetFlow service point, you can view L7 data
by going to the CoPilot > Monitor > FlowIQ page, clicking on the Application
view, and then opening the Records page.

Note that some flows do not generate L7 data.

## Integration with Syslog

CoPilot receives syslog data.

### Enable Syslog for CoPilot Audit Data

To use audit data in the **CoPilot > Administration > Audit** feature in
CoPilot, configure syslog to be sent to CoPilot:

1. Log in to Aviatrix Controller.

2. Go to **Settings > Logging > Remote Syslog**.

3. Choose Profile Index 9. Do not choose another index number. Index 9 is
   reserved for CoPilot.

4. In Enable Remote Syslog, enter the profile name you want to use, the static
   IP address of CoPilot as the server, and UDP port 5000 (default).

5. Select TCP for TLS encryption of syslog traffic.

   <Note>
     If TCP was enabled before upgrading to Controller version 8.2, manually
     enable TLS encryption.

     If TCP and TLS are enabled through API before upgrading to Controller 8.2,
     the TLS encryption stays after the upgrade.

     Also, verify the custom certificate after upgrading to Controller 8.2.
   </Note>

6. Tick the Advanced check box. In Gateways, verify all of your Aviatrix
   gateways are in the Include List.

   <Note>
     If you launch new gateways from your controller later, you must transfer the
     newly launched gateways to the Include List also.

     In addition, in your native cloud console, you must open your CoPilot
     security group for UDP 5000 from each newly launched gateway. If you enabled
     the CoPilot Security Group Management option in Controller (Controller >
     Settings > CoPilot > CoPilot Security Group Management) this will happen
     automatically.,
   </Note>

7. Click **Enable**.

<a id="reset-controller-ip" />

## Resetting Controller IP in CoPilot

In CoPilot **Settings > Configuration** page, click **Reset Association** to
reset the IP address of the Controller with which CoPilot is associated.

## Resetting Service Account in CoPilot

On the CoPilot Settings > Configuration page, click **Reset** to reset the
account to be used as the CoPilot service account.

<a id="start-help-cp-service-acct" />

For instructions to reset the Service Account see,

<a href={"/docs/enterprise/" + "10.1" + "/guides/controlplane/initial-setup#prereq-initial-cp-setup"}>Initial Setup of CoPilot</a>
and
<a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-user-account-administration"}>CoPilot User Account Administration</a>
.

<Warning>
  Removing the Service Account will limit CoPilot's ability to perform critical
  tasks, including fetching topology data, collecting performance metrics, and
  applying configuration changes.
</Warning>

<a id="controller-fqdn" />

<a id="end-help-cp-service-acct" />

## Setting the Controller FQDN in CoPilot

On the CoPilot Settings > Configuration > General page, you use the **Controller
Public IP/FQDN** configuration option to specify the public IP address or the
FQDN of your Controller.

* If your organization's team members log in to Aviatrix Controller via SAML,
  and you want them to be able to log in to CoPilot via SAML authentication
  also, this value must match the value you specified for the **Single sign on
  URL** SAML setting of your IdP application.
* If you specified the Controller's IP address in the SSO URL, specify the
  Controller IP address here.
* If you specified the Controller's FQDN in the SSO URL, specify the Controller
  FQDN here. For more information, see CoPilot Login via SAML in *Aviatrix
  CoPilot Deployment Guide*.