> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CoPilot Access Control

> CoPilot Access Control consolidates how gateways and the Controller reach CoPilot into a single card with two modes: CoPilot-Managed (recommended) and Security Group Rules.

<Note>
  CoPilot Access Control is a **Preview** feature in CoPilot 4.35. It requires
  Aviatrix Controller 9.0 or later.
</Note>

CoPilot Access Control is a single card under **Settings > Configuration >
General > Security** that controls how gateways reach CoPilot. You choose one of
two modes:

* **CoPilot-Managed** (recommended). Aviatrix manages access at the CoPilot
  instance using host-level filtering. Broad, generic security-group rules let
  Aviatrix admit traffic from many gateways without creating a separate rule per
  gateway, so this mode scales to large environments without hitting
  cloud-provider rule limits.
* **Security Group Rules**. Aviatrix creates and removes per-gateway inbound
  rules on the CoPilot security group in your cloud provider. Each gateway gets
  its own rules, so this mode is subject to the cloud provider's security-group
  rule limits.

Both modes are Aviatrix-managed; the difference is **where enforcement happens**
(the CoPilot instance vs. the cloud provider's security group) and the **rule
granularity** (broad vs. per-gateway).

CoPilot Access Control is supported on AWS, Azure, and GCP.

<Note>CoPilot Access Control is not supported on Alibaba Cloud or OCI.</Note>

## Ports and Features

<a id="ports-and-features" />

Whichever mode you choose, the following inbound ports must be reachable on
CoPilot for the corresponding feature to work.

| Port        | Protocol | Used For                                                                            | Notes                                                       |
| ----------- | -------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| 5000        | UDP      | Remote syslog from gateways to CoPilot (CoPilot Egress FQDN legacy and audit data). | Default.                                                    |
| 31283       | UDP      | NetFlow from gateways to CoPilot (CoPilot FlowIQ data).                             | Default.                                                    |
| 31284       | TCP      | OpenTelemetry from the Controller and gateways to CoPilot (metrics and logs).       |                                                             |
| 50441–50443 | TCP      | OpenTelemetry-based logs and metrics from gateways to CoPilot and the Controller.   | Required if DCF or OpenTelemetry is enabled on the gateway. |

In **CoPilot-Managed** mode, Aviatrix opens these ports in the CoPilot security
group with broad rules and filters traffic at the CoPilot instance. In
**Security Group Rules** mode, Aviatrix adds per-gateway rules for these ports
as gateways are launched, and removes them when gateways are deleted.

### Limitations of Security Group Rules Mode

Security group rules are subject to cloud-provider rule limits. As your
environment grows, reaching these limits may prevent new rules from being
applied, resulting in gateway connectivity issues or traffic loss. For this
reason, **Security Group Rules** mode is **not recommended for large
environments**.

The following features require ports that are **not supported by default** in
**Security Group Rules** mode:

* **Syslog over TCP** — TCP 5000
* **NetFlow over TCP** — TCP 31282

To use these features without manual configuration, switch to
**CoPilot-Managed** mode, where the required ports are managed automatically. If
you stay on **Security Group Rules**, manually add and maintain the required
security group rules in your cloud provider for the features you use.

## Enabling CoPilot Access Control

When CoPilot Access Control is not yet configured, the **CoPilot Access
Control** card displays an **Enable** button. CoPilot also displays a banner at
the top of the page with a **View Settings** link.

To enable CoPilot Access Control:

<Steps>
  <Step title="Open Security settings">
    Go to **Settings > Configuration > General** and scroll to the
    **Security** section.
  </Step>

  <Step title="Open the CoPilot Access Control card">
    On the **CoPilot Access Control** card, click **Enable**.
  </Step>

  <Step title="Choose a mode">
    Under **Mode**, select **CoPilot-Managed** (recommended) or
    **Security Group Rules**.

    On a greenfield CoPilot, **CoPilot-Managed** is disabled until you have
    enabled **Security Group Rules** at least once.
  </Step>

  <Step title="Confirm the target VPC/VNet and CoPilot instance">
    The **VPC/VNet** where CoPilot is deployed and the **CoPilot** instance
    populate automatically. If they do not, select them from the dropdown
    menus.

    For a clustered CoPilot deployment, select the **Main Server** CoPilot
    instance.
  </Step>

  <Step title="Acknowledge limitations (Security Group Rules only)">
    If you selected **Security Group Rules**, expand **Limitations of
    Security Group Rules Mode** and review the warnings before continuing.
  </Step>

  <Step title="Save">
    Click **Save**.
  </Step>
</Steps>

After CoPilot Access Control is configured, the card shows the active mode and
an **Edit Configuration** button. In **Security Group Rules** mode, the card
also shows a **Gateways Deployed** count. In **CoPilot-Managed** mode, the card
shows a **Custom Rules** count, but only if you have added custom rules.

## Switching Modes

You can switch between modes at any time:

<Steps>
  <Step title="Open Edit Configuration">
    On the **CoPilot Access Control** card, click **Edit Configuration**.
  </Step>

  <Step title="Select the new mode">
    Under **Mode**, select **CoPilot-Managed** or **Security Group Rules**.
  </Step>

  <Step title="Save">Click **Save**.</Step>
</Steps>

Allow a few moments for the new rules to propagate to the cloud provider.

## Disabling CoPilot Access Control

Disabling CoPilot Access Control removes the gateway-specific rules that
Aviatrix added to the CoPilot security group. Rules you manually added to the
base security group are not affected.

<Warning>
  After disabling CoPilot Access Control, you are responsible for adding the
  required inbound rules manually so that gateways and the Controller can reach
  CoPilot. At a minimum, ensure port 443 is open between CoPilot and the
  Controller.
</Warning>

To disable CoPilot Access Control:

<Steps>
  <Step title="Open Security settings">
    Go to **Settings > Configuration > General** and scroll to the
    **Security** section.
  </Step>

  <Step title="Open Edit Configuration">
    On the **CoPilot Access Control** card, click **Edit Configuration**.
  </Step>

  <Step title="Disable">
    Click **Disable** at the bottom of the dialog and confirm.
  </Step>
</Steps>

To select a different VPC/VNet or CoPilot instance, disable CoPilot Access
Control first, then re-enable it with the new selection.

## CSP Security Group Rule Limits

AWS and Azure cap the number of rules in a security group, and GCP caps the
number of rules in a firewall policy. In **Security Group Rules** mode, the
**CoPilot Access Control** card displays a warning as you approach the limit:

> Consider switching to CoPilot-Managed Access as you approach cloud provider
> Security Group Rule Limits.

When the rule count is high, the recommended action is to switch to
**CoPilot-Managed** mode, which uses broad rules and host-level filtering and is
not bound by per-gateway rule counts. As an alternative, you can request a
security-group quota increase from your cloud provider.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-platform-requirements"}>CoPilot Platform Requirements</a>