Skip to main content
East-West Inspection with Aviatrix Transit is in Preview in Controller 10.1. Symmetric Routing, which this feature depends on, is generally available (GA) in Controller 10.1. Only the east-west inspection layer described on this page is Preview.
East-West Inspection with Aviatrix Transit lets Distributed Cloud Firewall (DCF) apply Suricata intrusion prevention (IPS), intrusion detection (IDS), and TLS man-in-the-middle (MITM) inspection to east-west traffic (traffic between spoke VPCs and VNets that crosses the Aviatrix transit fabric). It requires Symmetric Routing to guarantee that a flow’s forward and return traffic uses the same spoke gateway. This guide covers the steps to turn on inspection for east-west traffic. For an overview of the underlying design, see East-West Suricata IPS and TLS MITM Inspection Architecture.

​
Prerequisites

  • Symmetric Routing is enabled on the spoke gateway group for every spoke VPC or VNet whose east-west traffic you want inspected. Symmetric Routing is generally available (GA) in Controller 10.1; enabling it is outside the scope of this guide.
  • AZ Affinity is optional. Symmetric Routing does not require it.
  • Deployment is limited to AWS in Controller 10.1.
  • No more than one spoke gateway is allowed per Availability Zone in the spoke gateway group.
  • Familiarity with configuring Distributed Cloud Firewall (DCF) policies, IPS profiles, and TLS decryption. See Intrusion Prevention System (IPS) and Configuring Distributed Cloud Firewall .
This Deny fallback specifically affects a spoke gateway that has an HA peer and whose gateway group is attached to an Aviatrix Transit. If Symmetric Routing is not enabled on that group, the controller clears the IPS, IDS, or MITM action from a DCF policy rule that targets east-west traffic (traffic to another VPC or VNet) for that gateway and enforces a Deny action for that traffic instead. CoPilot shows a notification for the affected policy. Confirm Symmetric Routing is enabled before you rely on east-west inspection.

​
Enable East-West Inspection

1

Confirm Symmetric Routing is active

In CoPilot, verify that Symmetric Routing shows as enabled for the spoke gateway group whose east-west traffic you want to inspect. There is no separate control to turn on east-west inspection. Symmetric Routing is the only prerequisite setting.
2

Author or update a DCF policy rule for east-west traffic

Create or edit a Distributed Cloud Firewall rule whose source and destination groups both resolve to spoke gateways in a Symmetric-Routing-enabled group. Set the rule’s Action to Permit, then turn on Intrusion Analysis to apply Suricata IPS/IDS, and turn on Ensure TLS and TLS Decryption (with a TLS Profile) to apply MITM inspection (the same toggles you use to configure IPS, IDS, and MITM for north-south traffic). See Creating Distributed Cloud Firewall Rules for the full rule dialog reference.
3

Apply and enforce the rule

Set the rule’s Enforcement to On and save. DCF begins evaluating matching east-west traffic against the rule immediately.

​
Verify Inspection Is Active

To confirm east-west inspection is working, generate east-west traffic that matches your rule, then check Security > Distributed Cloud Firewall > Monitor > Intrusion Logs in CoPilot for corresponding entries. Entries with a source and destination in different spoke VPCs or VNets confirm the policy is inspecting east-west traffic.
If you expect inspection events but do not see any, confirm that Symmetric Routing is still enabled for both spoke gateways in the flow. Disabling Symmetric Routing after you configure an east-west DCF rule stops IPS, IDS, and TLS MITM enforcement for that traffic without deleting the rule.

​
Limitations (Preview)

  • East-West Inspection with Aviatrix Transit is available for AWS deployments only in Controller 10.1.
  • It supports at most one spoke gateway per Availability Zone in a Symmetric-Routing-enabled spoke gateway group.
  • It is not supported alongside customized advertised CIDRs or a legacy active-standby Site2Cloud connection on the spoke gateway group. A modern (active-active) Site2Cloud connection does not block enabling Symmetric Routing.
  • Symmetric Routing is what allows east-west IPS, IDS, and MITM inspection on a spoke gateway group with HA gateways at all. Without it, forward and return traffic for an east-west flow can land on different gateways in an HA pair, so an HA VPC/VNet deployment cannot reliably support east-west inspection. See Configuring Distributed Cloud Firewall , which documents the existing restriction that IDS cannot be applied to east-west traffic when HA VPC/VNets are used. Enabling Symmetric Routing on an HA-enabled, Aviatrix-Transit-attached spoke gateway group removes that restriction for that group by guaranteeing that forward and return east-west traffic uses the same gateway. If Symmetric Routing is not enabled, the original HA VPC/VNet restriction still applies (see the Warning above).
  • IPS rule management, custom Suricata rulesets, and TLS MITM certificate configuration work the same for east-west and north-south traffic. See Intrusion Prevention System (IPS) for those procedures.