> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Distributed Cloud Firewall and Transit Egress

> Aviatrix supports Distributed Cloud Firewall (DCF) enforcement on Transit Egress, allowing you to apply DCF rules on a centralized egress gateway. This feature is designed to enhance egress traffic management in multi-cloud environments by enabling consistent policy enforcement and inspection...

Aviatrix supports Distributed Cloud Firewall (DCF) enforcement on Transit
Egress, allowing you to apply DCF rules on a centralized egress gateway. This
feature is designed to enhance egress traffic management in multi-cloud
environments by enabling consistent policy enforcement and inspection across all
connected gateways.

This feature is useful for customers who previously used Aviatrix legacy FQDN to
create centralized egress gateways, either with an Aviatrix Transit Gateway with
FireNet enabled or an AWS Transit Gateway (TGW) with FireNet enabled.

The Enforcement on Transit Egress feature allows you to enforce DCF rules on a
centralized gateway—typically a standalone (FQDN) gateway deployed in a Transit
FireNet—rather than at the edge. DCF rules are enforced on traffic from Spoke
and Transit gateways connected to the Transit Egress gateway, ensuring
consistent policy enforcement and inspection across your environment.

<Note>
  Ensure the Controller version is 8.1 or later to use the DCF on Transit Egress
  feature.
</Note>

## Key Capabilities

* Centralized Deployment: DCF can be deployed on a Transit gateway with egress
  enabled, which enforces both Layer 4 and Layer 7 egress policies at a single
  point.
* Policy Enforcement: All Transit Egress gateways will receive the full set of
  DCF egress policies. This ensures consistent inspection across multi-region
  deployments.
* Proximity-Based Routing: Traffic is inspected based on proximity—workloads
  exit through the nearest Transit Egress gateway, which enforces the
  appropriate policies.

## Logging and Visibility

* Permit Logging: Logging is currently functional for permitted and denied
  traffic.
* Log Details: Logs from the centralized egress gateway include SNI information
  and web group matches, confirming that enforcement is occurring at the gateway
  level.

## Prerequisites

* Enable Transit Egress Capability on your Transit gateway and configure it as a
  Transit FireNet gateway.

## Key Enforcement Behaviors

If the Enforcement on Transit Egress feature is enabled, the following behaviors
apply:

* **Automatic Rule Enforcement**: Once a DCF rule is created and enforced, it is
  automatically pushed to Transit Egress gateways configured for outbound
  inspection.
* **Centralized Policy, Distributed Execution**: DCF policies are enforced on
  the Transit Egress gateway. This means that the rules are enforced on traffic
  from connected Spoke and Transit gateways, ensuring consistent security across
  all egress traffic without needing to deploy rules on each individual gateway.

  If there are multiple Transit FireNets, the egress rules are pushed to all
  gateways in all Transit FireNets, ensuring consistent enforcement across the
  network.

## Centralized Egress Use Case

In Transit Egress scenarios:

* A single set of SNAT rules are applied across all connected gateways,
  simplifying policy management and reducing operational complexity.
* A default route (0.0.0.0/0) is programmed to send outbound traffic from Spoke
  VPCs to a centralized egress gateway.
* DCF rules applied to this gateway determine whether traffic is allowed,
  denied, or logged.

## Best Practices

* Use the `Public Internet` SmartGroup instead of `0.0.0.0/0` for egress
  destinations.
* Place catch-all rules (for example, `Global-Catch-All`) at the bottom of the
  rule hierarchy to ensure specific rules are evaluated first.
* Log deny and egress rules for visibility.

## Known Limitations

* This feature is designed for egress traffic only. It does not support ingress
  inspection or east-west traffic filtering.
* While this feature leverages components of FireNet, it does not offer full
  FireNet capabilities such as traffic redirection or ingress inspection.
* If Enforcement on Transit Egress is disabled, any DCF rules that contain
  WebGroups will not enforce L7 traffic on Spoke gateways.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-settings#transit-egress-enforce"}>Enforcing DCF on Transit Egress</a>
* [Enabling Transit Egress](https://legacy.docs.aviatrix.com/documentation/latest/security/transit-egress-configure.html)
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/egress-migration"}>Migrating from Legacy Egress to Distributed Cloud Firewall</a>
* [Creating a Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-gateway-about.html?expand=true)
* [Adding FireNet to a Transit Gateway](https://legacy.docs.aviatrix.com/documentation/latest/security/transit-firenet-create.html)
* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/dcf/dcf-overview"}>Distributed Cloud Firewall Overview</a>
* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/security/firenet-design-patterns"}>FireNet Design Patterns</a>
* <a href={"/docs/enterprise/" + "10.1" + "/reference/dcf/dcf-psf"}>
    Public Subnet Filtering and Distributed Cloud Firewall
  </a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/dcf/dcf-logging"}>Distributed Cloud Firewall Logging</a>