> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CoPilot Security Group Management

> CoPilot Security Group Management automates CoPilot inbound rules for gateway and Controller access. Supported on AWS, Azure, and GCP; enabled by default on AWS when CoPilot is deployed through the Controller.

The CoPilot Security Group Management feature automates the inbound
security-group rules on the CoPilot instance so that gateways and the Controller
can reach CoPilot. It is supported on AWS, Azure, and GCP, and is enabled by
default on AWS when CoPilot is deployed through the Controller. On Azure, GCP,
and other AWS deployment methods, you enable it manually from the CoPilot UI.
The feature is not supported on Alibaba Cloud or OCI.

If CoPilot Security Group Management needs to be disabled or re-enabled, you can
do so from the CoPilot UI at Settings > Configuration > General and scroll to
Security.

<Warning>
  AWS and Azure have rule limits that impact the CoPilot Security Group
  Management feature. This CoPilot feature will not work if the AWS security
  group quota or Azure Network Security Group (NSG) rule limit is reached.
</Warning>

It is recommended that you monitor the AWS or Azure security group quota and
update your rules configuration before the rule limit is reached. See

<a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-ip-access-management"}>Security Group Management Rule Limit</a>
for more information.

If the AWS or Azure rules are nearing their rule limits, you can do one of the
following:

1. For AWS only: In CoPilot, turn off CoPilot Security Group Management and turn
   on CoPilot IP Access List Management.

   See

   <a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-ip-access-management#enable-copilot-ip-access-list-management"}>Enabling CoPilot IP Access List Management.</a>

2. For AWS or Azure: Request an increase for the security group quota/limit from
   AWS or Azure and then re-enable the CoPilot Security Group Management
   feature.

Please refer to the AWS VPC or Azure VNet product documentation for information
about viewing and alerting on security group quotas/limits.

## When Security Group Management Is Enabled

When CoPilot Security Group Management is enabled, the Controller creates a
security group for the specified CoPilot virtual machine to manage its inbound
security-group rules.

The feature adds gateway IP rules to customer-attached CoPilot security groups
as well as CoPilot-created security groups. CoPilot comes with a base security
group when it is first launched.

<a id="ports-and-features" />

The Controller adds inbound rules to the CoPilot security group for each managed
gateway IP. The following table lists each port that the feature opens and which
CoPilot or gateway capability it supports.

| Port        | Protocol | Used For                                                                                             | Notes                                                       |
| ----------- | -------- | ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| 5000        | UDP      | Syslog for CoPilot Egress FQDN (Legacy) and Audit Data. Gateways send remote syslog data to CoPilot. | Default.                                                    |
| 31283       | UDP      | NetFlow for CoPilot FlowIQ Data. Gateways send NetFlow to CoPilot.                                   | Default.                                                    |
| 31284       | TCP      | OpenTelemetry in CoPilot receives Controller and gateway metrics and logs.                           |                                                             |
| 50441–50443 | TCP      | CoPilot and Controller receive OpenTelemetry-based logs and metrics from gateways.                   | Required if DCF or OpenTelemetry is enabled on the gateway. |

The Controller adds the above rules for the following:

* New gateways launched from the Controller *after* the feature is enabled.
* Existing gateways launched from the Controller *before* the feature was
  enabled.

**Related Topics**

* [Enable Security Group Management in CoPilot](#enable-security-group-management-in-copilot)

## Enable Security Group Management in CoPilot

CoPilot Security Group Management is enabled by default. You can disable or
re-enable the feature from Settings > Configuration > General.

For more information about Security Group Management, see
[When Security Group Management Is Enabled](#when-security-group-management-is-enabled).

To enable the CoPilot Security Group Management feature from the CoPilot UI,
complete the following steps:

1. Go to **Settings > Configuration > General**.

2. Under **Security > Controller Security Group Management**, do the following:
   * Set the slider to **On**.
   * Select the name of the CoPilot account from the dropdown menu and click
     **Save**.

3. Under **Security > CoPilot Security Group Management**, do the following:
   * Set the slider to **On**.
   * In **VPC ID**, select the ID of the VPC or VNet in which your CoPilot is
     located.
   * Select the ID of the CoPilot instance for which you want the Controller to
     manage security groups. For a clustered CoPilot deployment, this is the ID
     of the Main Server CoPilot instance. You can obtain the CoPilot instance ID
     from the CSP portal.
   * Click **SAVE**.

## When Security Group Management Is Disabled

When CoPilot Security Group Management is disabled, the Controller removes all
gateway-specific inbound rules that it previously added to the CoPilot security
group.

CoPilot comes with a base security group when it is first launched. The feature
does *not* remove rules that were manually added to the base security group.

If CoPilot Security Group Management is turned off, ensure that port 443 allows
0.0.0.0/0 (open to all) to maintain connectivity between Aviatrix CoPilot and
Controller.

**Related Topics**

* [Disable CoPilot Security Group Management](#disable-copilot-security-group-management)

## Disable CoPilot Security Group Management

When CoPilot Security Group Management is on, a rule is automatically added to
the CoPilot instance's inbound rule to allow the gateway to reach CoPilot. This
feature is set to On by default.

If you turn this feature off, or if the

<a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-ip-access-management"}>Security Group rule limit</a>
is reached, you will have to either manually create inbound rules for any new
gateways or you can
<a href={"/docs/enterprise/" + "10.1" + "/reference/controlplane/copilot-ip-access-management"}>enable CoPilot IP Access List Management</a>
to handle inbound access.

<Warning>
  Read [When Security Group Management Is
  Disabled](#when-security-group-management-is-disabled) before disabling this
  feature, to understand the potential impact.
</Warning>

To disable CoPilot Security Group Management:

1. Go to **Settings > General** and scroll to the Security section.
2. On the CoPilot Security Group Management card, move the slider to **Off** and
   click **Save**.