10.1.0
Release Date: 17 September 2026 Follow these links to learn about what’s new in this release: Deprecation Notices / Removals in Release 10.1.0 New and Enhanced Features in Release 10.1.0 Preview and Early Access Features in Release 10.1.0 Behavior Changes in Release 10.1.0Deprecation Notices / Removals in Release 10.1.0
Private Mode Fully Removed
Private Mode is removed in Controller 10.1.0. Flexible Gateway Deployment replaces it and covers a wider set of no-public-IP use cases:- Deployments still on Private Mode cannot upgrade in place. Rebuild them as Flexible Gateway deployments.
- New deployments should use Flexible Gateway Deployment directly. See New and Enhanced Features below.
Controller UI Feature Migration to CoPilot
Controller UI feature parity continues to move into CoPilot. In this release:- The first tranche of Controller UI features is now managed exclusively from CoPilot.
- The Controller UI is reduced to the minimum surface required for initial onboarding and recovery.
- Onboarding flows for new and existing deployments now route through CoPilot.
New and Enhanced Features in Release 10.1.0
Flexible Gateway Deployment (Private Subnet, No Public IP)
Aviatrix Gateways can now be deployed in private subnets without a public IP. The gateway reaches the Controller and CoPilot through existing outbound connectivity, and egress for image downloads and threat feeds is routed through a customer-owned path: a transit gateway, NAT gateway, or shared egress firewall.- Enabled per gateway group at creation time. The setting is per group and cannot be flipped after creation.
- Existing deployments are unaffected.
- Supported on AWS (including GovCloud) and Azure, in CoPilot and Terraform.
- Launch validation checks that the subnet has a valid default route.
- HPE attachments auto-peer within the same cloud service provider.
Independent Gateway Instance Sizing
Individual gateways in an HA pair or gateway group can now use different instance sizes. If a cloud service provider runs out of capacity for the group’s default size in a given availability zone, the surviving peer or the replacement instance can be launched at a smaller size in the same AZ instead of failing.- Resize a single instance from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab.
- Scoped to one instance. No HA cascade, and the group’s default size is unchanged. New instances added later still inherit the group default.
- The group edit view surfaces “Multiple Sizes” when a group has diverged.
Azure v6 Instance Support
Aviatrix Gateways now support Azure v6 VM families (Dsv6, Dasv6, Dadsv6) in CoPilot, the API, and Terraform. v6 instances offer better price/performance and relieve v5 capacity constraints.- Supported on Controller 10.1.0 and later. Fabrics must upgrade before creating or resizing gateways to v6.
- v6 SKU availability varies by Azure region. Check region availability before deploying.
FIPS 140-3 Validated IPsec Data Plane
The Aviatrix Cloud Native Security Fabric Cryptographic Module is listed on the NIST Cryptographic Module Validation Program (CMVP certificate #5231, FIPS 140-3, Level 1, software). In this release, the FIPS 140-3 validated cryptography covers the IPsec overlay data plane: gateway-to-gateway and Site2Cloud ESP traffic.- FIPS mode is offered as a separate FIPS-validated gateway build. Non-FIPS customers are unaffected.
- Existing gateways must be replaced (not toggled) to enter FIPS mode.
- Additional FIPS-validated scope will be added in later releases.
VRF for Multi-Tenancy (End-to-End Propagation)
Virtual Routing and Forwarding (VRF) gives each tenant or segment its own routing table so overlapping IP ranges can be reused safely without mixing traffic. Controller 9.0 delivered first-hop VRF; Controller 10.1.0 propagates the segment identity across the whole fabric.- Works across transit-to-transit peering, BGP-spoke-to-transit peering, and intra-group backup links.
- Enabled by a Controller feature flag (off by default) plus a per-attachment opt-in. Every gateway on the attachment must run Controller 10.1.0 or later.
- Up to 200 network domains are supported.
- UDP and ICMP fragmentation are not supported when VRF is enabled.
- FireNet inspection between VRFs and route leaking between VRFs are not delivered in this release.
DCF East-West Layer 7 Inspection (AWS)
Layer 7 Distributed Cloud Firewall inspection now works on east-west (VPC-to-VPC) traffic on AWS. This covers Suricata IDS/IPS, TLS decryption (MITM), and WebGroup filtering. Symmetric routing at the spoke group level guarantees that the forward and return paths of an east-west flow traverse the same spoke gateway so stateful L7 inspection can complete.- Enable symmetric routing per spoke group in CoPilot or Terraform.
- Requirements: AWS, spoke gateways in a spoke group with at most one gateway per AZ, no legacy active/standby Site2Cloud connections, no customized spoke advertised CIDRs, DCF enabled.
- East-west symmetric routing also reduces cross-AZ data transfer cost and latency.
- Multicloud coverage for symmetric routing is planned as a follow-up.
AZ Affinity Across Transit
Spoke-to-transit and transit-to-spoke traffic now prefers same-AZ peers, with cross-AZ peers as fallback. This reduces cross-AZ data transfer cost and delivers predictable low-latency east-west paths.- Enabled per peering, disabled by default.
- Available on AWS, same-region, HPE peerings in this release.
AWS Inter-Region Jumbo Frame Support for Transit Peering
Transit-to-transit and transit-to-spoke peerings across AWS regions can now use jumbo frames (MTU up to 9000 bytes) for higher-throughput inter-region transfers.- Opt-in. Existing peerings keep working at their standard MTU.
- AWS only. AWS partitions that do not support jumbo frames (for example, AWS GovCloud) are excluded.
GCP Global VPC: Regional Spoke Egress (Phase 2)
Local Egress (spoke-based SNAT) can now be enabled on individual regions inside a GCP Global VPC. Earlier releases blocked SNAT on Global VPCs entirely, so customers had to use FireNet Egress for the whole VPC or migrate to Regional VPCs.- Pick which regions egress locally and which keep going through FireNet. Both modes can coexist in the same Global VPC.
- The CoPilot Egress page now surfaces Global VPCs (previously filtered out) with a nested tree that shows each region’s egress mode.
- GCP serverless workloads (Cloud Run, Cloud Functions) are not covered. This is a pre-existing GCP platform limitation, unchanged in 10.1.0.
SNAT and HPE on Azure Spokes with Subnet Groups
Single IP SNAT, customized SNAT, and DNAT can now be enabled on Azure spoke gateways that use High-Performance Encryption (HPE) together with Azure Subnet Groups for east-west segmentation. Prior releases rejected this combination.- Applies to both HPE and non-HPE deployments.
- Configure through the existing Controller API/CLI or Terraform. Azure only.
AKS Onboarding with Microsoft Entra ID
AKS onboarding now supports clusters that use Microsoft Entra ID authentication, including clusters with local Kubernetes accounts disabled (Microsoft’s recommended posture). The Controller uses short-lived tokens for each Kubernetes API session. No static cluster credentials are required.- Controller auto-detects the Entra ID setting on the AKS cluster. No new UI screens or settings.
- Kubernetes RBAC bindings must map the Aviatrix identity to a Kubernetes role with the required permissions.
- Existing AKS clusters onboarded with local accounts continue to work as-is.
Kubernetes Discovery and SmartGroups Are Now Generally Available
Discovery of Kubernetes resources and Kubernetes-based SmartGroups, previously Preview features, are now generally available.- Discovers Kubernetes Pods and Services and makes them available as SmartGroup members, so Distributed Cloud Firewall (DCF) rules can enforce policy across both Kubernetes and VM workloads.
- No configuration change is required for existing deployments already using these features.
DCF for Kubernetes: Intra-Cluster Enforcement (EKS)
Distributed Cloud Firewall enforcement now extends inside Kubernetes clusters, covering pod-to-pod and namespace-to-namespace microsegmentation, managed from CoPilot alongside your existing DCF policies. Generally available for EKS in this release; AKS and GKE end-to-end test coverage is in progress.- Per-cluster enablement from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster.
- Works with CNI plugins that enforce Kubernetes NetworkPolicy: Calico, Cilium, Antrea, AWS VPC CNI (v1.14+), Weave Net, and Canal.
- Enablement takes full ownership of NetworkPolicy inside the target cluster. Audit existing NetworkPolicies and re-create every needed flow as a DCF permit rule before enabling in production.
Premium IPS Feed for Distributed Cloud Firewall IPS
Distributed Cloud Firewall IPS now supports multiple concurrent Suricata rule feeds. The Premium IPS Feed is a built-in feed that is updated daily.- Applied alongside any custom Suricata rulesets you upload. Actions on matched traffic are governed by the severity thresholds configured in your active IPS Profile.
- Listed as the default entry under Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot). You can add additional rule feeds alongside it from the same page.
DCF Quick Time-to-Value: Threat Intelligence Ruleset and Value Dashboard
Distributed Cloud Firewall now activates with a pre-built, Proofpoint-powered threat intelligence ruleset in Watch Mode, and CoPilot 4.37 adds a workload-centric DCF value dashboard so operators can see threats, geo-traffic, SaaS services, and workload coverage at a glance.- The system-defined ruleset is Aviatrix-managed and read-only, and defaults to Watch Mode. Promotion to Protect Mode is user-initiated.
- Ten Recommended Security Control cards ship out of the box, covering common threat categories such as ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay.
- Requires Controller 8.2 or later plus CoPilot 4.37.
DCF Spoke Local Breakout
A Distributed Cloud Firewall rule can now direct inspected traffic to break out directly from the spoke gateway instead of hairpinning through a centralized FireNet or Transit egress path, reducing cost, latency, and blast radius for high-volume trusted egress.- Existing rules keep their current behavior on upgrade.
- Requires Single IP SNAT (or customized SNAT) on the spoke gateway, the 10.1 gateway image, and a supported instance size. URL-based WebGroups additionally require TLS Decryption.
- Every DCF log entry now records which egress path a flow took.
- Supported on Aviatrix Transit (FireNet) and AWS TGW centralized topologies. Transit gateway local egress and transparent-inspection topologies are planned as follow-ups.
DCF CSP Exclusion List Is Now Generally Available
The Distributed Cloud Firewall CSP Exclusion List, which lets you exclude specific cloud service providers from DCF enforcement globally, is now generally available. The Preview badge is removed from CoPilot and from the Preview Features list. AWS China and Azure China regions are supported.Universal Installer for the Aviatrix OpenVPN Client
The Aviatrix OpenVPN Client is now distributed as a single installer that runs on both Intel and Apple Silicon on macOS. Customers no longer need to select an architecture-specific installer.Preview and Early Access Features in Release 10.1.0
Make Before Break Gateway Replacement (Preview)
Gateway replacement (resize or image upgrade) can now build and verify the replacement instance before touching the original, reducing traffic loss during the cut-over.- The replacement is provisioned in a drained state and only takes over from the original after the Controller has verified its configuration and tunnels.
- If any pre-cut-over step fails, the operation aborts and the original gateway is untouched.
- The gateway’s external IP is preserved through cut-over, so partners and firewalls need no reconfiguration. The private IP is not preserved in this release. Review any configuration anchored to a gateway’s private IP (such as partner Site2Cloud) before using this feature in production.
- Eligibility is checked automatically per gateway. NAT, HPE, Site2Cloud, FireNet, and Edge gateways fall back to the existing replacement path with the drain and undrain protections introduced in Controller 9.0.
DCF for Private Kubernetes Clusters (Preview)
DCF resource inventory, monitoring, and policy enforcement can now be enabled for private Kubernetes clusters whose API server has no public endpoint, and without requiring VPC peering, transit connectivity, PrivateLink, or a VPN. The Controller reaches the cluster through the Aviatrix spoke gateway already deployed in the cluster VPC.- Enable per cluster in CoPilot or Terraform.
- Prerequisite: an Aviatrix spoke gateway in the same VPC as the private cluster, with a security-group rule allowing the gateway to reach the Kubernetes API server on TCP port 443. The spoke gateway does not need to be attached to transit.
- Cloud-agnostic. Supports EKS, AKS, and GKE.
Smart Gateways Phase 3 (Preview)
Smart Gateways moves route computation for the underlay from a central Controller loop into the gateways themselves. Each gateway resolves overlay CIDRs to underlay next-hops locally and converges active-tunnel failures in sub-second time without Controller involvement.- Preview scope in this release: transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways.
- Enabled by three tiered feature flags (a fabric-wide kill switch, a per-group underlay flag, and a per-group route-resolver flag) that are all off by default.
- Small-sized spoke gateways may hit memory constraints.
DCF Security Group Orchestration for AWS GovCloud (Preview)
DCF Security Group Orchestration is extended to AWS GovCloud, so DCF policies can now program native AWS security groups on GovCloud accounts in addition to commercial AWS.DCF Granular Deployment Scope (Early Access)
Distributed Cloud Firewall rulesets and policy groups can now be constrained to specific cloud service providers, regions, cloud accounts, or VPC/VNets. A ruleset’s scope can only narrow the scope of its parent. It cannot widen it.- The Root Policy Group is attached to a system-default global scope for backward compatibility. Existing deployments see no behavior change on upgrade.
- The CoPilot UI for scope creation and assignment is behind a feature flag in CoPilot 4.37. Until enabled, scopes can be managed through the API and Terraform.
Route Filtering per Gateway (Early Access)
Directional CIDR filtering, previously available only on transit-to-transit peering and external BGP connections, is extended to spoke-to-transit and transit-to-spoke peerings. The filter is applied as an outbound deny list per gateway per peering.- Configure in CoPilot under Manage Gateway Attachments > Outbound filtered routes on the destination gateway.
- Deny-only in this release. General availability is planned as a follow-up.
Edit Managed Route Tables Without Reattach (Early Access)
The set of cloud route tables managed by a spoke attachment can now be edited in place, without detach and reattach. This eliminates the data plane outage previously required for routine growth tasks such as adding an availability zone or migrating from AWS TGW to Aviatrix Transit.- CoPilot 4.37 exposes a dedicated Manage Route Tables card on the spoke. The previous customize-in-attachment-modal path is deprecated.
- AWS and Azure only.
Horizontal Transit Scaling with FireNet on Azure (Early Access)
Azure Transit FireNet is no longer limited to two gateways (primary plus HA). Post-inspection return traffic now flows through an internal Azure load balancer back into the transit pool, so inspected traffic can land on many transit instances.- Greenfield deployments built on Controller 10.1.0 or later support up to 15 transit gateways and 27 firewalls per group.
- Brownfield deployments can migrate to the new topology once. Migrated brownfield deployments are limited to 8 transit gateways and 11 firewalls after migration.
- Azure only in this release.
Behavior Changes in Release 10.1.0
Access Account Duplicate Prevention
Starting in Controller 10.1.0, the Controller blocks new onboarding of Aviatrix access accounts that map to the same underlying cloud service provider (CSP) account. Duplicate is defined per CSP as follows:- AWS (including AWS GovCloud and AWS China): same account number, for both IAM role and access/secret key authentication.
- Azure (including Azure Government and Azure China): same subscription.
- GCP: same project.
- OCI (including OCI Government): same tenancy and compartment combination.
- Alibaba: same account number.