> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# External Connection (Site2Cloud) and Distributed Cloud Firewall

> Distributed Cloud Firewall (DCF) rules can be pushed to Spoke or Transit Gateways as follows:

Distributed Cloud Firewall (DCF) rules can be pushed to Spoke or Transit Gateways as follows:

* External connection terminating on Spoke (<a href={"/docs/enterprise/" + "10.1" + "/reference/general/general-glossary#firewall"}>L7</a> DCF for Active/Passive; L4 DCF for Active/Active)
* External connection terminating on Transit (<a href={"/docs/enterprise/" + "10.1" + "/reference/general/general-glossary#firewall"}>L4 only</a> for Active/Passive and Active/Active)

<Note>
  If you roll back your 7.2.4820 gateways to 7.1, any DCF rules that include External Connections will no longer be evaluated or enforced. This is expected behavior, because the DCF with External Connections feature was introduced in 7.2.4820.
</Note>

## External Connections with DCF Prerequisites

If the following conditions are met you can enforce Distributed Cloud Firewall (DCF) rules on External Connection (Site2Cloud) interfaces:

* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-enable-feature"}>DCF feature is enabled</a>; this makes the DCF on External Connections feature available.
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-settings#external-connections-enforce"}>Enforcement on External Connections setting is enabled</a>

## External Connections (S2C) with DCF Capabilities

| External Connections (S2C) Capabilities | Supported                                                                                                                                        | Not Supported                                                          |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| Gateways                                | Spoke Gateway<br />Transit Gateway                                                                                                               | Standalone Gateway<br />PSF Gateway                                    |
| Connection Type                         | BGP over LAN<br />BGP over IPsec<br />BGP over GRE<br />Static Route-Based (Mapped)<br />Static Route-Based (ActiveMesh)<br />Static Route-Based | Static Policy-Based (Unmapped)<br />Static Route-Based (Custom Mapped) |
| L4/L7 DCF                               | Spoke Gateway<br />Transit Gateway                                                                                                               | No L7 enforcement on Transit Gateway                                   |
| Cloud Type                              | AWS<br />Azure                                                                                                                                   | AWS GovCloud<br />Azure Government<br />GCP<br />OCI<br />China CSPs   |

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/s2c-configuration-workflow"}>Site2Cloud External Connection Workflow</a>
* [DCF Create Rules](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-ruleset-create.html?expand=true)
* [Distributed Cloud Firewall Field Reference](https://legacy.docs.aviatrix.com/documentation/latest/security/dcf-rule-dialog-reference.html)
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/vpn/s2c-aviatrixgw-to-microsoft-entra"}>Aviatrix Integration with Microsoft's SSE Solution</a>
* [Site2Cloud Configuration with External Devices](https://legacy.docs.aviatrix.com/documentation/latest/network/s2c-externaldevices.html)