> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What's New in the Aviatrix Controller

> Summary of new features and enhancements in the Aviatrix Controller.

# 10.1.0

Release Date: 17 September 2026

Follow these links to learn about what's new in this release:

[Deprecation Notices / Removals in Release 10.1.0](#deprecation-notices)

[New and Enhanced Features in Release 10.1.0](#new-enhanced-features)

[Preview and Early Access Features in Release 10.1.0](#preview-features)

[Behavior Changes in Release 10.1.0](#behavior-changes)

## Deprecation Notices / Removals in Release 10.1.0

<a id="deprecation-notices" />

### Private Mode Fully Removed

Private Mode is removed in Controller 10.1.0. Flexible Gateway Deployment
replaces it and covers a wider set of no-public-IP use cases:

* Deployments still on Private Mode cannot upgrade in place. Rebuild them as
  Flexible Gateway deployments.
* New deployments should use Flexible Gateway Deployment directly. See New and
  Enhanced Features below.

### Controller UI Feature Migration to CoPilot

Controller UI feature parity continues to move into CoPilot. In this release:

* The first tranche of Controller UI features is now managed exclusively from
  CoPilot.
* The Controller UI is reduced to the minimum surface required for initial
  onboarding and recovery.
* Onboarding flows for new and existing deployments now route through CoPilot.

## New and Enhanced Features in Release 10.1.0

<a id="new-enhanced-features" />

### Flexible Gateway Deployment (Private Subnet, No Public IP)

Aviatrix Gateways can now be deployed in private subnets without a public IP.
The gateway reaches the Controller and CoPilot through existing outbound
connectivity, and egress for image downloads and threat feeds is routed through
a customer-owned path: a transit gateway, NAT gateway, or shared egress
firewall.

* Enabled per gateway group at creation time. The setting is per group and
  cannot be flipped after creation.
* Existing deployments are unaffected.
* Supported on AWS (including GovCloud) and Azure, in CoPilot and Terraform.
* Launch validation checks that the subnet has a valid default route.
* HPE attachments auto-peer within the same cloud service provider.

### Independent Gateway Instance Sizing

Individual gateways in an HA pair or gateway group can now use different
instance sizes. If a cloud service provider runs out of capacity for the group's
default size in a given availability zone, the surviving peer or the replacement
instance can be launched at a smaller size in the same AZ instead of failing.

* Resize a single instance from CoPilot at **Cloud Fabric > Gateways > (transit
  or spoke) > gateway group > Instances tab**.
* Scoped to one instance. No HA cascade, and the group's default size is
  unchanged. New instances added later still inherit the group default.
* The group edit view surfaces "Multiple Sizes" when a group has diverged.

### Azure v6 Instance Support

Aviatrix Gateways now support Azure v6 VM families (Dsv6, Dasv6, Dadsv6) in
CoPilot, the API, and Terraform. v6 instances offer better price/performance and
relieve v5 capacity constraints.

* Supported on Controller 10.1.0 and later. Fabrics must upgrade before creating
  or resizing gateways to v6.
* v6 SKU availability varies by Azure region. Check region availability before
  deploying.

### FIPS 140-3 Validated IPsec Data Plane

The Aviatrix Cloud Native Security Fabric Cryptographic Module is listed on the
NIST Cryptographic Module Validation Program (CMVP certificate #5231, FIPS
140-3, Level 1, software). In this release, the FIPS 140-3 validated
cryptography covers the IPsec overlay data plane: gateway-to-gateway and
Site2Cloud ESP traffic.

* FIPS mode is offered as a separate FIPS-validated gateway build. Non-FIPS
  customers are unaffected.
* Existing gateways must be replaced (not toggled) to enter FIPS mode.
* Additional FIPS-validated scope will be added in later releases.

### VRF for Multi-Tenancy (End-to-End Propagation)

Virtual Routing and Forwarding (VRF) gives each tenant or segment its own
routing table so overlapping IP ranges can be reused safely without mixing
traffic. Controller 9.0 delivered first-hop VRF; Controller 10.1.0 propagates
the segment identity across the whole fabric.

* Works across transit-to-transit peering, BGP-spoke-to-transit peering, and
  intra-group backup links.
* Enabled by a Controller feature flag (off by default) plus a per-attachment
  opt-in. Every gateway on the attachment must run Controller 10.1.0 or later.
* Up to 200 network domains are supported.
* UDP and ICMP fragmentation are not supported when VRF is enabled.
* FireNet inspection between VRFs and route leaking between VRFs are not
  delivered in this release.

### DCF East-West Layer 7 Inspection (AWS)

Layer 7 Distributed Cloud Firewall inspection now works on east-west
(VPC-to-VPC) traffic on AWS. This covers Suricata IDS/IPS, TLS decryption
(MITM), and WebGroup filtering. Symmetric routing at the spoke group level
guarantees that the forward and return paths of an east-west flow traverse the
same spoke gateway so stateful L7 inspection can complete.

* Enable symmetric routing per spoke group in CoPilot or Terraform.
* Requirements: AWS, spoke gateways in a spoke group with at most one gateway
  per AZ, no legacy active/standby Site2Cloud connections, no customized spoke
  advertised CIDRs, DCF enabled.
* East-west symmetric routing also reduces cross-AZ data transfer cost and
  latency.
* Multicloud coverage for symmetric routing is planned as a follow-up.

### AZ Affinity Across Transit

Spoke-to-transit and transit-to-spoke traffic now prefers same-AZ peers, with
cross-AZ peers as fallback. This reduces cross-AZ data transfer cost and
delivers predictable low-latency east-west paths.

* Enabled per peering, disabled by default.
* Available on AWS, same-region, HPE peerings in this release.

### AWS Inter-Region Jumbo Frame Support for Transit Peering

Transit-to-transit and transit-to-spoke peerings across AWS regions can now use
jumbo frames (MTU up to 9000 bytes) for higher-throughput inter-region
transfers.

* Opt-in. Existing peerings keep working at their standard MTU.
* AWS only. AWS partitions that do not support jumbo frames (for example, AWS
  GovCloud) are excluded.

### GCP Global VPC: Regional Spoke Egress (Phase 2)

Local Egress (spoke-based SNAT) can now be enabled on individual regions inside
a GCP Global VPC. Earlier releases blocked SNAT on Global VPCs entirely, so
customers had to use FireNet Egress for the whole VPC or migrate to Regional
VPCs.

* Pick which regions egress locally and which keep going through FireNet. Both
  modes can coexist in the same Global VPC.
* The CoPilot Egress page now surfaces Global VPCs (previously filtered out)
  with a nested tree that shows each region's egress mode.
* GCP serverless workloads (Cloud Run, Cloud Functions) are not covered. This is
  a pre-existing GCP platform limitation, unchanged in 10.1.0.

### SNAT and HPE on Azure Spokes with Subnet Groups

Single IP SNAT, customized SNAT, and DNAT can now be enabled on Azure spoke
gateways that use High-Performance Encryption (HPE) together with Azure Subnet
Groups for east-west segmentation. Prior releases rejected this combination.

* Applies to both HPE and non-HPE deployments.
* Configure through the existing Controller API/CLI or Terraform. Azure only.

### AKS Onboarding with Microsoft Entra ID

AKS onboarding now supports clusters that use Microsoft Entra ID authentication,
including clusters with local Kubernetes accounts disabled (Microsoft's
recommended posture). The Controller uses short-lived tokens for each Kubernetes
API session. No static cluster credentials are required.

* Controller auto-detects the Entra ID setting on the AKS cluster. No new UI
  screens or settings.
* Kubernetes RBAC bindings must map the Aviatrix identity to a Kubernetes role
  with the required permissions.
* Existing AKS clusters onboarded with local accounts continue to work as-is.

### Kubernetes Discovery and SmartGroups Are Now Generally Available

Discovery of Kubernetes resources and Kubernetes-based SmartGroups, previously
Preview features, are now generally available.

* Discovers Kubernetes Pods and Services and makes them available as SmartGroup
  members, so Distributed Cloud Firewall (DCF) rules can enforce policy across
  both Kubernetes and VM workloads.
* No configuration change is required for existing deployments already using
  these features.

### DCF for Kubernetes: Intra-Cluster Enforcement (EKS)

Distributed Cloud Firewall enforcement now extends inside Kubernetes clusters,
covering pod-to-pod and namespace-to-namespace microsegmentation, managed from
CoPilot alongside your existing DCF policies. Generally available for EKS in
this release; AKS and GKE end-to-end test coverage is in progress.

* Per-cluster enablement from CoPilot under **Security > Distributed Cloud
  Firewall > Settings > Intra-Cluster**.
* Works with CNI plugins that enforce Kubernetes NetworkPolicy: Calico, Cilium,
  Antrea, AWS VPC CNI (v1.14+), Weave Net, and Canal.
* Enablement takes full ownership of NetworkPolicy inside the target cluster.
  Audit existing NetworkPolicies and re-create every needed flow as a DCF permit
  rule before enabling in production.

### Premium IPS Feed for Distributed Cloud Firewall IPS

Distributed Cloud Firewall IPS now supports multiple concurrent Suricata rule
feeds. The Premium IPS Feed is a built-in feed that is updated daily.

* Applied alongside any custom Suricata rulesets you upload. Actions on matched
  traffic are governed by the severity thresholds configured in your active IPS
  Profile.
* Listed as the default entry under **Security > Distributed Cloud Firewall >
  IPS > Rule Feeds** (labeled ET Pro in CoPilot). You can add additional rule
  feeds alongside it from the same page.

### DCF Quick Time-to-Value: Threat Intelligence Ruleset and Value Dashboard

Distributed Cloud Firewall now activates with a pre-built, Proofpoint-powered
threat intelligence ruleset in Watch Mode, and CoPilot 4.37 adds a
workload-centric DCF value dashboard so operators can see threats, geo-traffic,
SaaS services, and workload coverage at a glance.

* The system-defined ruleset is Aviatrix-managed and read-only, and defaults to
  Watch Mode. Promotion to Protect Mode is user-initiated.
* Ten Recommended Security Control cards ship out of the box, covering common
  threat categories such as ToR traffic, sanctioned-country traffic, cleartext
  legacy protocols, cryptomining pools, and outbound proxy/relay.
* Requires Controller 8.2 or later plus CoPilot 4.37.

### DCF Spoke Local Breakout

A Distributed Cloud Firewall rule can now direct inspected traffic to break out
directly from the spoke gateway instead of hairpinning through a centralized
FireNet or Transit egress path, reducing cost, latency, and blast radius for
high-volume trusted egress.

* Existing rules keep their current behavior on upgrade.
* Requires Single IP SNAT (or customized SNAT) on the spoke gateway, the 10.1
  gateway image, and a supported instance size. URL-based WebGroups additionally
  require TLS Decryption.
* Every DCF log entry now records which egress path a flow took.
* Supported on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.
  Transit gateway local egress and transparent-inspection topologies are planned
  as follow-ups.

### DCF CSP Exclusion List Is Now Generally Available

The Distributed Cloud Firewall CSP Exclusion List, which lets you exclude
specific cloud service providers from DCF enforcement globally, is now generally
available. The Preview badge is removed from CoPilot and from the Preview
Features list. AWS China and Azure China regions are supported.

### Universal Installer for the Aviatrix OpenVPN Client

The Aviatrix OpenVPN Client is now distributed as a single installer that runs
on both Intel and Apple Silicon on macOS. Customers no longer need to select an
architecture-specific installer.

## Preview and Early Access Features in Release 10.1.0

<a id="preview-features" />

### Make Before Break Gateway Replacement (Preview)

Gateway replacement (resize or image upgrade) can now build and verify the
replacement instance before touching the original, reducing traffic loss during
the cut-over.

* The replacement is provisioned in a drained state and only takes over from the
  original after the Controller has verified its configuration and tunnels.
* If any pre-cut-over step fails, the operation aborts and the original gateway
  is untouched.
* The gateway's external IP is preserved through cut-over, so partners and
  firewalls need no reconfiguration. The private IP is not preserved in this
  release. Review any configuration anchored to a gateway's private IP (such as
  partner Site2Cloud) before using this feature in production.
* Eligibility is checked automatically per gateway. NAT, HPE, Site2Cloud,
  FireNet, and Edge gateways fall back to the existing replacement path with the
  drain and undrain protections introduced in Controller 9.0.

### DCF for Private Kubernetes Clusters (Preview)

DCF resource inventory, monitoring, and policy enforcement can now be enabled
for private Kubernetes clusters whose API server has no public endpoint, and
without requiring VPC peering, transit connectivity, PrivateLink, or a VPN. The
Controller reaches the cluster through the Aviatrix spoke gateway already
deployed in the cluster VPC.

* Enable per cluster in CoPilot or Terraform.
* Prerequisite: an Aviatrix spoke gateway in the same VPC as the private
  cluster, with a security-group rule allowing the gateway to reach the
  Kubernetes API server on TCP port 443. The spoke gateway does not need to be
  attached to transit.
* Cloud-agnostic. Supports EKS, AKS, and GKE.

### Smart Gateways Phase 3 (Preview)

Smart Gateways moves route computation for the underlay from a central
Controller loop into the gateways themselves. Each gateway resolves overlay
CIDRs to underlay next-hops locally and converges active-tunnel failures in
sub-second time without Controller involvement.

* Preview scope in this release: transit gateways, Edge as Spoke, Edge as
  Transit, and BGP spoke gateways.
* Enabled by three tiered feature flags (a fabric-wide kill switch, a per-group
  underlay flag, and a per-group route-resolver flag) that are all off by
  default.
* Small-sized spoke gateways may hit memory constraints.

### DCF Security Group Orchestration for AWS GovCloud (Preview)

DCF Security Group Orchestration is extended to AWS GovCloud, so DCF policies
can now program native AWS security groups on GovCloud accounts in addition to
commercial AWS.

### DCF Granular Deployment Scope (Early Access)

Distributed Cloud Firewall rulesets and policy groups can now be constrained to
specific cloud service providers, regions, cloud accounts, or VPC/VNets. A
ruleset's scope can only narrow the scope of its parent. It cannot widen it.

* The Root Policy Group is attached to a system-default global scope for
  backward compatibility. Existing deployments see no behavior change on
  upgrade.
* The CoPilot UI for scope creation and assignment is behind a feature flag in
  CoPilot 4.37. Until enabled, scopes can be managed through the API and
  Terraform.

### Route Filtering per Gateway (Early Access)

Directional CIDR filtering, previously available only on transit-to-transit
peering and external BGP connections, is extended to spoke-to-transit and
transit-to-spoke peerings. The filter is applied as an outbound deny list per
gateway per peering.

* Configure in CoPilot under **Manage Gateway Attachments > Outbound filtered
  routes** on the destination gateway.
* Deny-only in this release. General availability is planned as a follow-up.

### Edit Managed Route Tables Without Reattach (Early Access)

The set of cloud route tables managed by a spoke attachment can now be edited in
place, without detach and reattach. This eliminates the data plane outage
previously required for routine growth tasks such as adding an availability zone
or migrating from AWS TGW to Aviatrix Transit.

* CoPilot 4.37 exposes a dedicated **Manage Route Tables** card on the spoke.
  The previous customize-in-attachment-modal path is deprecated.
* AWS and Azure only.

### Horizontal Transit Scaling with FireNet on Azure (Early Access)

Azure Transit FireNet is no longer limited to two gateways (primary plus HA).
Post-inspection return traffic now flows through an internal Azure load balancer
back into the transit pool, so inspected traffic can land on many transit
instances.

* Greenfield deployments built on Controller 10.1.0 or later support up to 15
  transit gateways and 27 firewalls per group.
* Brownfield deployments can migrate to the new topology once. Migrated
  brownfield deployments are limited to 8 transit gateways and 11 firewalls
  after migration.
* Azure only in this release.

## Behavior Changes in Release 10.1.0

<a id="behavior-changes" />

### Access Account Duplicate Prevention

Starting in Controller 10.1.0, the Controller blocks new onboarding of Aviatrix
access accounts that map to the same underlying cloud service provider (CSP)
account. Duplicate is defined per CSP as follows:

* **AWS** (including AWS GovCloud and AWS China): same account number, for both
  IAM role and access/secret key authentication.
* **Azure** (including Azure Government and Azure China): same subscription.
* **GCP**: same project.
* **OCI** (including OCI Government): same tenancy and compartment combination.
* **Alibaba**: same account number.

Existing duplicate access accounts onboarded on earlier Controller versions
continue to operate as-is and are not automatically removed. Aviatrix recommends
consolidating them to a single Aviatrix access account per CSP account.

### Skip-Version Upgrades: Groundwork

Controller 10.1.0 introduces the compatibility groundwork that a future
Controller can build on to let gateways skip an intermediate version during an
upgrade. No customer-visible skip-upgrade capability ships in 10.1.0 itself.