Skip to main content
Aviatrix offers two approaches to inspecting east-west traffic (traffic between spoke VPCs and VNets), depending on how your spokes reach each other.

​
Transparent DCF Protection with AWS Transit Gateway

For AWS environments that already route spoke-to-spoke traffic through a user-managed AWS Transit Gateway (TGW), Transparent DCF Protection (also called Bump-in-the-Wire, or BITW) inserts Aviatrix spoke gateways into the traffic path through automated route programming, without a TGW replacement, re-IP, or downtime. See Transparent DCF Protection with AWS Transit Gateway .

​
East-West Inspection with Aviatrix Transit

East-West Inspection with Aviatrix Transit is in Preview in Controller 10.1.
For spoke VPCs and VNets that route east-west traffic across the Aviatrix transit fabric instead of a TGW, East-West Inspection with Aviatrix Transit applies Suricata IPS/IDS and TLS MITM inspection to that traffic once Symmetric Routing guarantees a flow’s forward and return traffic uses the same spoke gateway. See Enable East-West Inspection with Aviatrix Transit .

​
Which Approach Applies to You

  • If your spokes attach to a user-managed AWS TGW, use Transparent DCF Protection with AWS Transit Gateway.
  • If your spokes attach to an Aviatrix Transit and you need Suricata IPS/IDS or TLS MITM inspection on east-west traffic, use East-West Inspection with Aviatrix Transit.
  • The two approaches address different transit architectures and are not interchangeable. Apply DCF policy independently of which one you use.