Skip to main content
CoPilot Access Control is a Preview feature in CoPilot 4.35. It requires Aviatrix Controller 9.0 or later.
CoPilot Access Control is a single card under Settings > Configuration > General > Security that controls how gateways reach CoPilot. You choose one of two modes:
  • CoPilot-Managed (recommended). Aviatrix manages access at the CoPilot instance using host-level filtering. Broad, generic security-group rules let Aviatrix admit traffic from many gateways without creating a separate rule per gateway, so this mode scales to large environments without hitting cloud-provider rule limits.
  • Security Group Rules. Aviatrix creates and removes per-gateway inbound rules on the CoPilot security group in your cloud provider. Each gateway gets its own rules, so this mode is subject to the cloud provider’s security-group rule limits.
Both modes are Aviatrix-managed; the difference is where enforcement happens (the CoPilot instance vs. the cloud provider’s security group) and the rule granularity (broad vs. per-gateway). CoPilot Access Control is supported on AWS, Azure, and GCP.
CoPilot Access Control is not supported on Alibaba Cloud or OCI.

​
Ports and Features

Whichever mode you choose, the following inbound ports must be reachable on CoPilot for the corresponding feature to work. In CoPilot-Managed mode, Aviatrix opens these ports in the CoPilot security group with broad rules and filters traffic at the CoPilot instance. In Security Group Rules mode, Aviatrix adds per-gateway rules for these ports as gateways are launched, and removes them when gateways are deleted.

​
Limitations of Security Group Rules Mode

Security group rules are subject to cloud-provider rule limits. As your environment grows, reaching these limits may prevent new rules from being applied, resulting in gateway connectivity issues or traffic loss. For this reason, Security Group Rules mode is not recommended for large environments. The following features require ports that are not supported by default in Security Group Rules mode:
  • Syslog over TCP — TCP 5000
  • NetFlow over TCP — TCP 31282
To use these features without manual configuration, switch to CoPilot-Managed mode, where the required ports are managed automatically. If you stay on Security Group Rules, manually add and maintain the required security group rules in your cloud provider for the features you use.

​
Enabling CoPilot Access Control

When CoPilot Access Control is not yet configured, the CoPilot Access Control card displays an Enable button. CoPilot also displays a banner at the top of the page with a View Settings link. To enable CoPilot Access Control:
1

Open Security settings

Go to Settings > Configuration > General and scroll to the Security section.
2

Open the CoPilot Access Control card

On the CoPilot Access Control card, click Enable.
3

Choose a mode

Under Mode, select CoPilot-Managed (recommended) or Security Group Rules.On a greenfield CoPilot, CoPilot-Managed is disabled until you have enabled Security Group Rules at least once.
4

Confirm the target VPC/VNet and CoPilot instance

The VPC/VNet where CoPilot is deployed and the CoPilot instance populate automatically. If they do not, select them from the dropdown menus.For a clustered CoPilot deployment, select the Main Server CoPilot instance.
5

Acknowledge limitations (Security Group Rules only)

If you selected Security Group Rules, expand Limitations of Security Group Rules Mode and review the warnings before continuing.
6

Save

Click Save.
After CoPilot Access Control is configured, the card shows the active mode and an Edit Configuration button. In Security Group Rules mode, the card also shows a Gateways Deployed count. In CoPilot-Managed mode, the card shows a Custom Rules count, but only if you have added custom rules.

​
Switching Modes

You can switch between modes at any time:
1

Open Edit Configuration

On the CoPilot Access Control card, click Edit Configuration.
2

Select the new mode

Under Mode, select CoPilot-Managed or Security Group Rules.
3

Save

Click Save.
Allow a few moments for the new rules to propagate to the cloud provider.

​
Disabling CoPilot Access Control

Disabling CoPilot Access Control removes the gateway-specific rules that Aviatrix added to the CoPilot security group. Rules you manually added to the base security group are not affected.
After disabling CoPilot Access Control, you are responsible for adding the required inbound rules manually so that gateways and the Controller can reach CoPilot. At a minimum, ensure port 443 is open between CoPilot and the Controller.
To disable CoPilot Access Control:
1

Open Security settings

Go to Settings > Configuration > General and scroll to the Security section.
2

Open Edit Configuration

On the CoPilot Access Control card, click Edit Configuration.
3

Disable

Click Disable at the bottom of the dialog and confirm.
To select a different VPC/VNet or CoPilot instance, disable CoPilot Access Control first, then re-enable it with the new selection.

​
CSP Security Group Rule Limits

AWS and Azure cap the number of rules in a security group, and GCP caps the number of rules in a firewall policy. In Security Group Rules mode, the CoPilot Access Control card displays a warning as you approach the limit:
Consider switching to CoPilot-Managed Access as you approach cloud provider Security Group Rule Limits.
When the rule count is high, the recommended action is to switch to CoPilot-Managed mode, which uses broad rules and host-level filtering and is not bound by per-gateway rule counts. As an alternative, you can request a security-group quota increase from your cloud provider.