> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable East-West Inspection with Aviatrix Transit

> Enable Suricata intrusion prevention (IPS/IDS) and TLS man-in-the-middle (MITM) inspection for east-west traffic between spoke VPCs and VNets, a Preview feature in Aviatrix Controller 10.1.

<Note>
  East-West Inspection with Aviatrix Transit is in Preview in Controller 10.1.
  Symmetric Routing, which this feature depends on, is generally available (GA)
  in Controller 10.1. Only the east-west inspection layer described on this
  page is Preview.
</Note>

East-West Inspection with Aviatrix Transit lets Distributed Cloud Firewall (DCF)
apply Suricata intrusion prevention (IPS), intrusion detection (IDS), and TLS
man-in-the-middle (MITM) inspection to east-west traffic (traffic between
spoke VPCs and VNets that crosses the Aviatrix transit fabric). It requires Symmetric
Routing to guarantee that a flow's forward and return traffic uses the same spoke
gateway. This guide covers the steps to turn on inspection for east-west
traffic. For an overview of the underlying design, see <a href={"/docs/enterprise/" + "10.1" +
"/concepts-architectures/architecture/security/ips-east-west-design-patterns"}>East-West
Suricata IPS and TLS MITM Inspection Architecture</a>.

## Prerequisites

* Symmetric Routing is enabled on the spoke gateway group for every spoke VPC
  or VNet whose east-west traffic you want inspected. Symmetric Routing is
  generally available (GA) in Controller 10.1; enabling it is outside the scope
  of this guide.
* AZ Affinity is optional. Symmetric Routing does not require it.
* Deployment is limited to AWS in Controller 10.1.
* No more than one spoke gateway is allowed per Availability Zone in the
  spoke gateway group.
* Familiarity with configuring Distributed Cloud Firewall (DCF) policies, IPS
  profiles, and TLS decryption. See
  <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/ips"}>
    Intrusion Prevention System (IPS)
  </a>
  and
  <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>
  .

<Warning>
  This Deny fallback specifically affects a spoke gateway that has an HA peer
  and whose gateway group is attached to an Aviatrix Transit. If Symmetric
  Routing is not enabled on that group, the controller clears the IPS, IDS, or
  MITM action from a DCF policy rule that targets east-west traffic (traffic to
  another VPC or VNet) for that gateway and enforces a Deny action for that
  traffic instead. CoPilot shows a notification for the affected policy. Confirm
  Symmetric Routing is enabled before you rely on east-west inspection.
</Warning>

## Enable East-West Inspection

<Steps>
  <Step title="Confirm Symmetric Routing is active">
    In CoPilot, verify that Symmetric Routing shows as enabled for the
    spoke gateway group whose east-west traffic you want to inspect. There
    is no separate control to turn on east-west inspection. Symmetric
    Routing is the only prerequisite setting.
  </Step>

  <Step title="Author or update a DCF policy rule for east-west traffic">
    Create or edit a Distributed Cloud Firewall rule whose source and
    destination groups both resolve to spoke gateways in a
    Symmetric-Routing-enabled group. Set the rule's **Action** to **Permit**,
    then turn on **Intrusion Analysis** to apply Suricata IPS/IDS, and turn on
    **Ensure TLS** and **TLS Decryption** (with a **TLS Profile**) to apply
    MITM inspection (the same toggles you use to configure IPS, IDS, and MITM
    for north-south traffic). See <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring#creating-distributed-cloud-firewall-rules"}>Creating Distributed Cloud Firewall Rules</a> for
    the full rule dialog reference.
  </Step>

  <Step title="Apply and enforce the rule">
    Set the rule's Enforcement to On and save. DCF begins evaluating
    matching east-west traffic against the rule immediately.
  </Step>
</Steps>

## Verify Inspection Is Active

To confirm east-west inspection is working, generate east-west traffic that
matches your rule, then check **Security > Distributed Cloud Firewall >
Monitor > Intrusion Logs** in CoPilot for corresponding entries. Entries with a
source and destination in different spoke VPCs or VNets confirm the policy is
inspecting east-west traffic.

<Note>
  If you expect inspection events but do not see any, confirm that Symmetric
  Routing is still enabled for both spoke gateways in the flow. Disabling
  Symmetric Routing after you configure an east-west DCF rule stops IPS, IDS,
  and TLS MITM enforcement for that traffic without deleting the rule.
</Note>

## Limitations (Preview)

* East-West Inspection with Aviatrix Transit is available for AWS deployments
  only in Controller 10.1.

* It supports at most one spoke gateway per Availability Zone in a
  Symmetric-Routing-enabled spoke gateway group.

* It is not supported alongside customized advertised CIDRs or a legacy
  active-standby Site2Cloud connection on the spoke gateway group. A modern
  (active-active) Site2Cloud connection does not block enabling Symmetric
  Routing.

* Symmetric Routing is what allows east-west IPS, IDS, and MITM inspection on a
  spoke gateway group with HA gateways at all. Without it, forward and return
  traffic for an east-west flow can land on different gateways in an HA pair, so
  an HA VPC/VNet deployment cannot reliably support east-west inspection. See

  <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>

  , which documents the existing restriction that IDS cannot be applied to
  east-west traffic when HA VPC/VNets are used. Enabling Symmetric Routing on
  an HA-enabled, Aviatrix-Transit-attached spoke gateway group removes that
  restriction for that group by guaranteeing that forward and return
  east-west traffic uses the same gateway. If Symmetric Routing is not
  enabled, the original HA VPC/VNet restriction still applies (see the
  Warning above).

* IPS rule management, custom Suricata rulesets, and TLS MITM certificate
  configuration work the same for east-west and north-south traffic. See
  <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/ips"}>
    Intrusion Prevention System (IPS)
  </a>
  for those procedures.

## Related Resources

* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/security/ips-east-west-design-patterns"}>East-West Suricata IPS and TLS MITM Inspection Architecture</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/ips"}>
    Intrusion Prevention System (IPS)
  </a>
* <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-configuring"}>Configuring Distributed Cloud Firewall</a>