> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling Local Egress

> On the Security > Egress > Egress VPC/VNets tab you can enable Local Egress on selected Spoke VPC/VNets that do not already have Egress enabled, and that are not attached to a Transit FireNet gateway.

On the Security > Egress > Egress VPC/VNets tab you can enable Local Egress on
selected Spoke VPC/VNets that do not already have Egress enabled, and that are
not attached to a Transit FireNet gateway.

<img src="https://mintcdn.com/aviatrix-14b37c43/mOZ0lmP7pRPIryx3/images/guides/security/egress/egress-vpc-vnets-tab.png?fit=max&auto=format&n=mOZ0lmP7pRPIryx3&q=85&s=75211d6ec21b1e1655fcac489ac48cd9" alt="egress vpc vnets tab" width="2972" height="1180" data-path="images/guides/security/egress/egress-vpc-vnets-tab.png" />

The following occurs when you add Local Egress on a VPC/VNet:

* The default route on the VPC/VNet changes to point to the Spoke Gateway.
* SNAT is enabled.

If a WebGroup is already configured on a VPC/VNet, make sure its instances
meet at least the following instance size before enabling Local Egress:

* VPC (AWS): t3.medium
* VNet (Azure): Standard\_B2ms

Ensure that additional CPU resources are created on the Spoke gateway to support
Local Egress.

<a id="end-help-local-egress-configure" />

<Note>
  Controller 8.0 and the enablement of the DCF feature are required to enable
  Local Egress as described below. If neither of these is present, you click
  the *Local Egress on VPC/VNets* button on the Egress VPC/VNets tab and then
  select the VPC/VNets.
</Note>

To enable Local Egress:

<a id="start-help-local-egress-configure" />

1. Ensure that you have deployed a Spoke gateway in the VPC/VNet that you want
   to enable Local Egress on. If you have not done this, see
   [Deploying a Spoke Gateway in a VPC/VNet for Secure Egress](https://legacy.docs.aviatrix.com/documentation/latest/security/egress-deploy-spoke-gateway.html).

2. On the Security > Egress > Egress VPC/VNets tab, do one of the following:

   * Select one or more VPC/VNets and then select *Enable Local Egress* from the
     Actions menu.
   * Click the vertical ellipsis next to a VPC/VNet and select *Enable Local
     Egress*.

   The Enable Local Egress on VPC (VNets) dialog displays.

   <img src="https://mintcdn.com/aviatrix-14b37c43/mOZ0lmP7pRPIryx3/images/guides/security/egress/local-egress.png?fit=max&auto=format&n=mOZ0lmP7pRPIryx3&q=85&s=192b9c9acd806e62f1066102387e873c" alt="300" width="1098" height="584" data-path="images/guides/security/egress/local-egress.png" />

3. Click *Enable* to acknowledge that enabling local egress changes the default
   route and enables SNAT.

After enabling local egress, the status of the VPC/VNet changes from No Egress
to Unprotected.

<Note>
  If you select a VPC/VNet that is part of a Transit Egress, enabling Local
  Egress overrides the Transit Egress. For a GCP Global VPC, you can now enable
  Local Egress on a
  per-region basis instead of routing all egress through Transit FireNet; see{" "}

  <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/gcp-global-vpc#configuring-regional-spoke-egress-mode"}>Configuring Regional Spoke Egress Mode</a>
  .
</Note>

<a id="remove-local-egress" />

## Disabling Local Egress

The following occurs when you disable Local Egress:

* SNAT is disabled
* Default route is reset to Transit Egress (if the Spoke gateway is attached to
  a Transit FireNet that has Egress enabled) or Native Cloud Egress
* VPC/VNets are removed from Monitored and Protected SmartGroups
* (in Controller 8.0) The status of the VPC/VNet changes back to No Egress after
  the hourly reconciliation of the Egress status

<a id="start-help-local-egress-remove" />

To disable Local Egress on a Spoke gateway:

1. On the Security > Egress > Egress VPC/VNets tab, do one of the following:

   * Select one or more VPC/VNets and then select *Disable Local Egress* from
     the Actions menu.
   * Click the vertical ellipsis next to a VPC/VNet and select *Disable Local
     Egress*.

   The Disable Local Egress on VPC (VNets) dialog displays.

2. In the Disable Egress on VPC/VNet dialog, select the *I understand that
   \<vpc/vnet name> may no longer be able to reach the Internet* checkbox.

3. Click *Disable*.

<a id="end-help-local-egress-remove" />

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/egress/egress-monitor-vpc-vnets"}>Monitoring Egress Traffic</a>
* [Egress Traffic Overview](https://legacy.docs.aviatrix.com/documentation/latest/security/egress-traffic-overview.html?expand=true)