> ## Documentation Index > Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt > Use this file to discover all available pages before exploring further. # Required External Access for Aviatrix Products > Reference for the outbound and inbound network access — IP addresses, domains, and ports — that the Aviatrix Controller, gateways, CoPilot, and Aviatrix Edge require to external sites and DNS services. To ensure optimal functionality of Aviatrix products, allow access to the following external sites and configure access to a DNS server for successful name resolution. These requirements apply to the Aviatrix Controller, gateways, CoPilot, and Aviatrix Edge. In most cases, Aviatrix automatically provisions these configurations during deployment. ## Controller | Outbound Destination | Port | Purpose | | ---------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------- | | `release.aviatrix.com` (54.149.28.255, 3.134.6.163, 3.132.107.114, 3.131.87.153, 3.19.35.177) | TCP 443 | Software upgrade | | `license.aviatrix.com` (52.24.131.245, 3.134.6.163, 3.132.107.114, 3.131.87.153, 3.19.35.177) | TCP 443 | License update | | `diag.aviatrix.com` (54.200.59.112) | TCP 443 | Remote debugging | | `customer-bucket.s3-us-west-2.amazonaws.com` | TCP 443 | Diagnostics trace log upload | | AWS SQS (`sqs..amazonaws.com`, where `` is the region where the Controller runs, for example `us-west-2` or `us-east-2`) | TCP 443 | Controller-to-gateway message queue | | AWS API, AWS only (`ec2.amazonaws.com`) | TCP 443 | AWS API access | | Aviatrix gateways | TCP 443 | Software upgrade to gateways | | `54.149.28.255` | TCP 443 | Aviatrix Central Services | ## CoPilot ### CoPilot Inbound Communication | Source | Port | Purpose | | --------------------- | ------------------------ | ----------------------------------------------------------------------- | | Each Aviatrix gateway | UDP 5000 | Gateway remote syslog to CoPilot | | Each Aviatrix gateway | TCP 5000 | Gateway remote syslog to CoPilot when using private mode | | Each Aviatrix gateway | UDP 31283 | Gateway NetFlow data to CoPilot | | Controller | TCP 443, TCP 50441-50443 | Controller reaches CoPilot over HTTPS for browser access and monitoring | For each Aviatrix gateway in your infrastructure: * The CoPilot security group requires 2 rules: port 5000 for syslog and port 31283 for NetFlow. * The Controller security group requires 1 rule: port 443. For example, an infrastructure with 100 gateways requires 200 security group rules on CoPilot and 100 security group rules on the Controller. CoPilot Security Group Management can automate these inbound rules instead of requiring you to add them manually. See{" "} CoPilot Security Group Management . ### CoPilot Outbound IP Addresses and Domains | Outbound Destination | Port | Purpose | | --------------------------------------------------------------------------------------------------------------------- | --------------- | ---------------------------- | | `18.225.29.15` | TCP 443 | CoPilot update server | | `geoip.elastic.co` | TCP 443 | Elasticsearch GeoIP database | | `artifacts.elastic.co` | TCP 443 | Elasticsearch upgrades | | CSP/region-specific Ubuntu archive mirror (for example, `us-east-1.ec2.archive.ubuntu.com`) and `security.ubuntu.com` | TCP 443, TCP 80 | Apt package upgrades | | `security.aviatrix.com` | TCP 443 | Remote support | | `diag.aviatrix.com` | TCP 443 | Remote support | | `release.aviatrix.com` | TCP 443 | Controller upgrade | | `deb.nodesource.com` | TCP 443 | CoPilot upgrade | ## Gateways | Outbound Destination | Port | Purpose | | --------------------------------------------------- | --------------- | --------------------------------------- | | Aviatrix Controller, without application inspection | TCP 443 | Keep-alive messages | | `customer-bucket.s3-us-west-2.amazonaws.com` | TCP 443 | Diagnostics trace log upload | | AWS SQS | TCP 443 | Controller-to-gateway message queue | | External remote sites | UDP 500 | IKE protocol for IPsec negotiation | | External remote sites | UDP 4500 | IPsec data channel | | `www.google.com` and `www.ubuntu.com` | TCP 443, TCP 80 | Required during a gateway image upgrade | ## Aviatrix Edge Access Aviatrix Edge access requirements fall into two rule sets: Aviatrix Edge Gateway access and Aviatrix Edge Platform access. Aviatrix Edge Gateway access rules are required for all deployments. Aviatrix Edge Platform access rules are additionally required when you deploy the Aviatrix Edge Gateway on a hardware device on which Aviatrix manages the software. ### Aviatrix Edge Gateway Access The Aviatrix Edge Gateway requires outbound access to communicate with the Aviatrix Controller. Allow the following on your firewall: 1. MGMT: TCP 443 access to the Aviatrix Controller's public IP address, if you use public connectivity for Edge Gateway management. 2. MGMT: TCP 443 access to the Aviatrix Controller's private IP address. Permit this access only if you selected Management over Private Network for management IP connectivity. 3. WAN: UDP 500 and UDP 4500. | Source | Destination | Port | Purpose | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ------------------------------------------------------------------------------------- | | WAN eth0 | Aviatrix Transit Gateway eth0 private or public IP address (public IP if the transit attachment is over the public internet). If you configure multiple WAN interfaces, allow this access for all WAN links. | UDP 500 | IPsec | | WAN eth0 | Aviatrix Transit Gateway eth0 private or public IP address (public IP if the transit attachment is over the public internet). If you configure multiple WAN interfaces, allow this access for all WAN links. | UDP 4500 | IPsec | | WAN eth0 | `release.aviatrix.com` | TCP 443 | Only if the Transit Edge attachment is over the internet | | Mgmt eth2 | DNS server | UDP 53 | DNS lookup | | Mgmt eth2 / Aviatrix Edge Platform | NTP server | UDP 123 | Time sync | | Mgmt eth2 | Aviatrix CoPilot FQDN, or private or public IP address | UDP 5000 | Syslog | | Mgmt eth2 | Aviatrix CoPilot FQDN, or private or public IP address | UDP 31283 | NetFlow | | Mgmt eth2 | Aviatrix Controller FQDN, or private or public IP address | TCP 443 | Edge Gateway to Controller | | Mgmt eth2 | `ppa.launchpad.net`, `kazooie.canonical.com`, `us.archive.ubuntu.com`, `security.ubuntu.com` | TCP 80 | Download packages. Starting with Controller version 7.1, this access is not required. | If you provide the management egress IP address for the Edge Gateway (for a gateway that connects to the Controller over the public internet) when you create the gateway, Aviatrix programs the required security rules on the Controller's gateway security group to allow the Edge Gateway to connect, and programs the CoPilot security group with the NetFlow and syslog rules. If you do not know the management egress IP address when you create the Edge Gateway, you can add it later. Aviatrix then adds the required rules to the Controller's and CoPilot's security groups to allow the connection. You can also manage the Controller and CoPilot security groups yourself and add the required rules to allow the Edge Gateway to connect to the Controller and CoPilot. ### Aviatrix Edge Platform Access Aviatrix Edge Platform access is required in addition to Aviatrix Edge Gateway access when you deploy the Aviatrix Edge Gateway on a hardware device on which Aviatrix manages the software. | Source | Service | Service IP Address | Port | Purpose | | ------------------------------- | ------------------------------- | ---------------------------------------------------------- | ------- | --------------------------------------------------------------------- | | MGMT interface of the hardware | `controller.edge.aviatrix.com` | 34.111.242.133 | TCP 443 | Onboard the Edge device | | MGMT interface of the hardware | `cdn.aviatrix.com` | 3.134.6.163, 3.132.107.114, 18.162.118.170, 16.162.153.248 | TCP 443 | Download the Edge Gateway base image | | MGMT interface of the hardware | `pool.ntp.org`, resolved by DNS | N/A | UDP 123 | Time sync | | Aviatrix Controller and CoPilot | `api.edge.aviatrix.com` | 34.117.242.133 | TCP 443 | Required by the Aviatrix Controller and CoPilot for device management | ## Customer Management Access | Source | Service | Service IP Address | Port | Purpose | | -------------------------- | ------------------------------ | ------------------ | --------------- | -------------------------------------------------------------------------------------------------------------- | | Customer management access | iDRAC management of the device | iDRAC IP address | TCP 22, TCP 443 | Out-of-band management of the Aviatrix Edge Platform. Required for Aviatrix-driven local access to the device. | Perform a DNS resolution for each destination FQDN listed in the tables on this page. Although the listed IP addresses should not change, Aviatrix recommends keeping IP-based rules up to date. Applies to all Aviatrix Controller versions.