Skip to main content
On the Security > Egress > Egress VPC/VNets tab you can enable Local Egress on selected Spoke VPC/VNets that do not already have Egress enabled, and that are not attached to a Transit FireNet gateway. egress vpc vnets tab The following occurs when you add Local Egress on a VPC/VNet:
  • The default route on the VPC/VNet changes to point to the Spoke Gateway.
  • SNAT is enabled.
If a WebGroup is already configured on a VPC/VNet, make sure its instances meet at least the following instance size before enabling Local Egress:
  • VPC (AWS): t3.medium
  • VNet (Azure): Standard_B2ms
Ensure that additional CPU resources are created on the Spoke gateway to support Local Egress.
Controller 8.0 and the enablement of the DCF feature are required to enable Local Egress as described below. If neither of these is present, you click the Local Egress on VPC/VNets button on the Egress VPC/VNets tab and then select the VPC/VNets.
To enable Local Egress:
  1. Ensure that you have deployed a Spoke gateway in the VPC/VNet that you want to enable Local Egress on. If you have not done this, see Deploying a Spoke Gateway in a VPC/VNet for Secure Egress.
  2. On the Security > Egress > Egress VPC/VNets tab, do one of the following:
    • Select one or more VPC/VNets and then select Enable Local Egress from the Actions menu.
    • Click the vertical ellipsis next to a VPC/VNet and select Enable Local Egress.
    The Enable Local Egress on VPC (VNets) dialog displays. 300
  3. Click Enable to acknowledge that enabling local egress changes the default route and enables SNAT.
After enabling local egress, the status of the VPC/VNet changes from No Egress to Unprotected.
If you select a VPC/VNet that is part of a Transit Egress, enabling Local Egress overrides the Transit Egress. For a GCP Global VPC, you can now enable Local Egress on a per-region basis instead of routing all egress through Transit FireNet; seeConfiguring Regional Spoke Egress Mode .

​
Disabling Local Egress

The following occurs when you disable Local Egress:
  • SNAT is disabled
  • Default route is reset to Transit Egress (if the Spoke gateway is attached to a Transit FireNet that has Egress enabled) or Native Cloud Egress
  • VPC/VNets are removed from Monitored and Protected SmartGroups
  • (in Controller 8.0) The status of the VPC/VNet changes back to No Egress after the hourly reconciliation of the Egress status
To disable Local Egress on a Spoke gateway:
  1. On the Security > Egress > Egress VPC/VNets tab, do one of the following:
    • Select one or more VPC/VNets and then select Disable Local Egress from the Actions menu.
    • Click the vertical ellipsis next to a VPC/VNet and select Disable Local Egress.
    The Disable Local Egress on VPC (VNets) dialog displays.
  2. In the Disable Egress on VPC/VNet dialog, select the I understand that <vpc/vnet name> may no longer be able to reach the Internet checkbox.
  3. Click Disable.