Connectivity

This section provides the purpose, elements, and actions performed on the Connectivity pages.

Purpose

The Network Attachment page creates and manages Transit-to-Transit peering, Spoke-to-Spoke encrypted peering, and Azure VNet-to-Transit attachment connections for multicloud and hybrid network deployments.

Elements

View selector: Built-in table views (default Transit Peering) to switch the table and add control between Transit Peering, Encrypted Peering (Spoke), and Azure VNet Attachment.
+ Transit Peering, + Encrypted Peering, or + Azure VNet button: Opens the create dialog for the selected view (admin only; label matches the selected view).
Network Attachment table: Displays existing connections for the selected view.
Edit button and Delete button: Modify or remove a Transit Peering or Encrypted Peering row (admin only; not available for Azure VNet Attachment).
Actions menu: View Peering Details and Run Ping Test for a Transit Peering or Encrypted Peering row (admin only).
Detach button: Removes an Azure VNet Attachment row (admin only).
Filter button, Columns button, Download button, Open, and Clear: Standard table toolbar and saved-view controls.
Total N Network Attachments footer and Refresh status: Row count and manual refresh for the table.

Actions

Create a Transit Peering or Encrypted Peering (Spoke) Attachment

To create a Transit-to-Transit or Spoke-to-Spoke network attachment:

Go to Networking > Connectivity > Network Attachment.
In the view selector, choose Transit Peering or Encrypted Peering (Spoke).
Click + Transit Peering or + Encrypted Peering.
Select the Source Gateway.
Add one or more destination gateways to attach to the source gateway.
Click Save.

The new attachment appears in the table.

Parameter Details

CoPilot Parameter Name	Description
Source Gateway	The Transit or Spoke gateway that initiates the attachment. Read-only when editing.
Transit Gateway 1 / Spoke Gateway 1	The source gateway in the attachment connection (Transit Peering or Encrypted Peering view).
Transit Gateway 2 / Spoke Gateway 2	The destination gateway in the attachment connection (Transit Peering or Encrypted Peering view).
Connection Status	The current status of the attachment connection.

Create an Azure VNet Attachment

To attach an Azure VNet to a Transit Gateway:

Go to Networking > Connectivity > Network Attachment.
In the view selector, choose Azure VNet Attachment.
Click + Azure VNet.
Select the Source Gateway (an Azure Transit Gateway).
Select one or more Azure VNets to attach.
Click Save.

The new attachment appears in the table.

Parameter Details

CoPilot Parameter Name	Description
Transit Gateway	The Azure Transit Gateway the VNet is attached to.
Azure VNet	The name of the attached Azure VNet.
Resource Group	The Azure resource group containing the VNet.
Account	The cloud account that owns the VNet.
Region	The Azure region of the VNet.
VNet ID	The Azure VNet GUID.
Route Tables	The private route table configuration for the attachment.

Edit, Delete, or View Details for a Transit Peering or Encrypted Peering Attachment

To edit, delete, or view details for an existing attachment:

Go to Networking > Connectivity > Network Attachment.
In the view selector, choose Transit Peering or Encrypted Peering (Spoke).
Locate the connection in the table.
Click Edit to change the destination gateways, or Delete to remove the connection (confirm when prompted).
Click the Actions menu and select View Peering Details to view peering configuration, or Run Ping Test to test connectivity between the two gateways.

Changes take effect after saving; deletions are removed from the table immediately.

Detach an Azure VNet Attachment

To remove an Azure VNet attachment:

Go to Networking > Connectivity > Network Attachment.
In the view selector, choose Azure VNet Attachment.
Locate the attachment in the table and click Detach.
Confirm the removal.

The Azure VNet attachment is removed from the table.

Purpose

The External Connections (Site2Cloud) page configures and manages Site2Cloud connections between Aviatrix Gateways and external devices.

Elements

Connectivity: External Connections (S2C)

+ External Connection button: Split control (admin only) that starts the create workflow for External Device, AWS Virtual Gateway, Azure Virtual Network Gateway, or Microsoft’s SSE Solution.
BGP Settings button: Configures BGP settings to receive notifications on overlapping BGP address and route limitations, and to set the maximum BGP AS path length.
View selector: Preset table views All Connections (default) and BGP Connections; use Open to apply saved column or filter layouts.
External Connections (S2C) table: Displays existing Site2Cloud connections. The Name link opens the connection detail page.
Edit button and Delete button: Modify or remove a connection row (admin only; Edit appears only for static route-based connection types).
Actions menu: Download Configuration, connectivity diagnostics, BGP Diagnostics, and Manage Connections (Edge Spoke BGP over LAN connections only, admin only).
Filter button, Columns button, Download button, and Open: Standard table toolbar controls.
Total N External Connections footer and Refresh status: Row count and manual refresh for the table.

Actions

Create External Connection

To create an external Site2Cloud connection:

Go to Networking > Connectivity > External Connections (S2C).
Click + External Connection and choose the connection type.
Select the connection type (External Device, AWS Virtual Gateway, Azure Virtual Network Gateway, or Microsoft SSE Solution).
Configure the connection parameters (Name, Tunnel Type, Local Gateway, Remote Device IP, subnets, and BGP settings as applicable).
Click Save.

The new external connection appears in the External Connections (S2C) table.

Parameter Details

CoPilot Parameter Name	Description
Name	A name for the connection (all four workflows).
Type	BGP over IPsec: connect to an external device using IPsec tunneling protocol and Border Gateway Protocol (BGP) routing. BGP over GRE: connect to an external device using GRE tunneling protocol and BGP routing. BGP over LAN: connect to an external device using BGP routing without any tunneling protocol. Static Route-Based (ActiveMesh): connect to an external device using IPsec tunneling protocol and Static Route configuration with full mesh peering from the primary and highly availalble (HA) gateway instances.
Local Gateway	The Aviatrix gateway that connects to the remote device. BGP over IPsec and Static Route-Based (ActiveMesh): Spoke Gateways appear only if BGP is enabled on the Spoke (AWS/Azure). BGP over GRE: Spoke Gateways appear only if BGP is enabled on the Spoke (AWS). BGP over LAN: select the Local Gateway per the KB workflow.
Static Routing Type	When Type is Static Routing over IPsec, set to ActiveMesh for the Static Route-Based (ActiveMesh) workflow. Not used for the three BGP Types.
Remote Subnet CIDR(s)	Static Route-Based (ActiveMesh) only: remote network CIDR(s) to route toward the remote destination; use commas to separate multiple CIDRs.
Attach Over	BGP over IPsec, BGP over GRE, and Static Route-Based (ActiveMesh): choose Private Network or Public Network (for example Direct Connect / ExpressRoute vs internet); controls whether IPsec or GRE traffic uses private or public addresses. BGP over LAN is only supported over private networks—this field does not appear in that workflow.
Jumbo Frame	BGP over IPsec and BGP over GRE: improves throughput between the Local Gateway and the remote device; enable Jumbo Frame on the gateway first; only on private connections that support jumbo frames. Not applicable to BGP over LAN or Static Route-Based (ActiveMesh) per those KB workflows.
Algorithms	BGP over IPsec and Static Route-Based (ActiveMesh): Default or Custom encryption for IPsec. BGP over GRE: Default or Custom algorithms for authenticating traffic between the Local Gateway and the on-premises device. Not applicable to BGP over LAN.
Internet Key Exchange	BGP over IPsec, BGP over GRE, and Static Route-Based (ActiveMesh): IKEv1 or IKEv2 (recommended for BGP over IPsec with IPv6). If IKEv1 with certificate authentication to another Aviatrix device, include intermediate CAs; when an intermediate CA renews, re-authentication fails until the new certificate is added. Not applicable to BGP over LAN.
Local ASN	BGP over IPsec, BGP over GRE, and BGP over LAN: BGP AS number the Local Gateway uses to exchange routes with the remote device. Static Route-Based (ActiveMesh) does not include a BGP Configuration section in the KB workflow.
ActiveMesh	BGP over IPsec, BGP over GRE, and BGP over LAN: when On, full mesh peering from primary and HA Local Gateways to remote devices; when Off, point-to-point tunnels. The KB notes BGP over LAN ActiveMesh only for Azure Route Server Integration. Static Route-Based (ActiveMesh) describes ActiveMesh behavior in the document intro; the workflow does not list this toggle as a separate field.
BFD	BGP over IPsec, BGP over GRE, and BGP over LAN: toggle BFD for rapid detection of link or node failure between the Local Gateway and the remote BGP peer. Not applicable to Static Route-Based (ActiveMesh) in the KB workflow.
Manual Learned CIDR Approval	BGP over IPsec, BGP over GRE, and BGP over LAN: when On, email administrators to approve dynamically learned CIDRs before propagation to Spoke VPC/VNet route tables; when Off, learned CIDRs propagate automatically. Not applicable to Static Route-Based (ActiveMesh) in the KB workflow.
Advertise BGP Communities	BGP over IPsec, BGP over GRE, and BGP over LAN: BGP communities to advertise to the BGP peer. Not applicable to Static Route-Based (ActiveMesh) in the KB workflow.
BGP Multihop	BGP over IPsec, BGP over GRE, and BGP over LAN: enables BGP with a remote device that is not directly connected; must match multihop on the remote device. Not applicable to Static Route-Based (ActiveMesh) in the KB workflow.
Support for IPv6	Toggle to enable IPv6 for that connection type.
Advertise IPv6 via IPv4 Peer	When enabled, advertises IPv6 routes over an IPv4 BGP session.
Authentication Method	Static Route-Based (ActiveMesh) only: Pre-Shared Key or Certificate; for certificate authentication, select the Remote CA Certificate uploaded from the remote device.
Remote Device Tunnel Destination IP	BGP over IPsec, BGP over GRE, and Static Route-Based (ActiveMesh): remote device interface IP address for the tunnel row. BGP over LAN uses Remote Device IP instead (see below).
Remote Device IP	BGP over LAN only (LAN Configuration): remote device interface IP address.
Remote ASN	BGP over IPsec, BGP over GRE, and BGP over LAN: BGP AS number the remote device uses with the Local Gateway (use the same value for primary and HA gateways). BGP over LAN uses the same semantics for Primary and HA instances. Not applicable to Static Route-Based (ActiveMesh) in the KB workflow.
Advertise IPv6 via IPv4 Peer	BGP over IPsec only: when enabled, advertises IPv6 routes over an IPv4 BGP session.
BGP Local IP (Optional)	BGP over IPsec: local tunnel inner CIDR allowed over the VPN tunnel. BGP over GRE: local tunnel inner CIDR allowed over the GRE tunnel. Not applicable to BGP over LAN or Static Route-Based (ActiveMesh) (which use Local Tunnel IP / Remote Tunnel IP instead).
BGP Neighbor IP (Optional)	BGP over IPsec: remote tunnel inner CIDR allowed over the VPN tunnel. BGP over GRE: remote tunnel inner CIDR allowed over the GRE tunnel. Not applicable to BGP over LAN or Static Route-Based (ActiveMesh) (which use Local Tunnel IP / Remote Tunnel IP instead).
BGP Neighbor IPv6	BGP over IPsec only: remote tunnel inner IPv6 CIDR range.
Local Gateway Instances	BGP over LAN only: Primary or HA Local Gateway instance for the LAN row.
Local LAN IP	BGP over LAN only: Local Gateway interface IP address.
Remote LAN IP	BGP over LAN only: remote device interface IP address.
Local LAN IPv6 (Optional)	BGP over LAN only: Local Gateway interface IPv6 address.
Remote LAN IPv6	BGP over LAN only: remote device interface IPv6 address.
Local Tunnel IP	Static Route-Based (ActiveMesh) only: local tunnel inner CIDR allowed over the tunnel.
Remote Tunnel IP	Static Route-Based (ActiveMesh) only: remote tunnel inner CIDR allowed over the tunnel.
Tunnel Source IP	BGP over IPsec, BGP over GRE, and Static Route-Based (ActiveMesh): Edge Transit Gateway can use multiple WAN interfaces—select which WAN to use; Transit Gateway defaults to the eth0 IP. Not applicable to BGP over LAN in the KB workflow.
Pre-Shared Key (Optional)	BGP over IPsec, BGP over GRE, and Static Route-Based (ActiveMesh): PSK configured on the remote/external device; auto-generated if omitted. Not applicable to BGP over LAN in the KB workflow.
Remote Identifier SAN	Static Route-Based (ActiveMesh) only with certificate authentication: Subject Alternative Name (SAN) of the remote CA certificate.
Add remote peers	BGP over IPsec and BGP over GRE: click + Remote Device and enter the next remote IP, ASN, and tunnel fields. BGP over LAN: click + Remote Device and enter the next remote IP, ASN, and LAN fields. Static Route-Based (ActiveMesh): click + Remote Device and enter the next remote tunnel and authentication details.

AWS Virtual Gateway

CoPilot Parameter Name	Description
Name	Identifier for the connection to the AWS VGW.
Local Gateway	Transit Gateway that peers with the VGW.
Local ASN	BGP AS number the Transit Gateway uses with the VGW.
VGW Account Name	AWS account (access account) where the VGW was created.
VGW Region	AWS Region that contains the VGW.
VGW ID	Unique identifier of the target Virtual Private Gateway.
Manual CIDR Approval	When the selected gateway requires learned CIDR approval at connection level, this follows that policy; otherwise it stays off by default.

Azure Virtual Network Gateway

CoPilot Parameter Name	Description
Name	Identifier for the connection to the Azure VPN Gateway.
Aviatrix Gateway	Transit Gateway that connects to the VNG (must be in the Transit VNet where the VNG is deployed).
VNG Name	Azure Virtual Network Gateway to use for the connection.

Microsoft’s SSE Solution

CoPilot Parameter Name	Description
Name	Identifier for the BGP over IPsec connection to Microsoft’s SSE Solution.
Local Gateway	Aviatrix Gateway (BGP-enabled) that connects to Microsoft’s SSE Solution.

Configure BGP Settings

To configure BGP settings for Site2Cloud connections:

Go to Networking > Connectivity > External Connections (S2C).
Click BGP Settings.
Configure notifications for overlapping BGP address and route limitations.
Set the maximum BGP AS path length.
Save your changes.

BGP settings apply to all Site2Cloud connections using BGP.

Delete External Connection

To delete an external Site2Cloud connection:

Go to Networking > Connectivity > External Connections (S2C).
Locate the connection in the External Connections (S2C) table.
Click the Delete button for the connection.
Confirm the deletion.

The connection is removed from the table.

Download Configuration or Run Diagnostics

To download configuration files or run diagnostics for an S2C connection:

Go to Networking > Connectivity > External Connections (S2C).
Locate the connection in the External Connections (S2C) table.
Click the Actions button for the connection.
Select Download Configuration, connectivity diagnostics, or BGP Diagnostics as needed.

Configuration files and diagnostic results are downloaded or displayed.

BGP over LAN: In AWS, BGP over LAN allows BGP-enabled Spoke Gateways to connect to third-party instances in the same VPC without IPsec or GRE. In Azure, it allows connection to third-party instances in the same VNet. Each connection can connect to one or at most two third-party instances. BGP over LAN is not supported for GCP, OCI, and Alibaba Cloud. For Azure, you must indicate the number of LAN interfaces (maximum eight). Adding new LAN interfaces to an Azure Spoke Gateway reboots the gateway and may cause traffic disruption. You cannot delete an interface after the Spoke Gateway is created.

AWS TGW
Attachments

Purpose

The AWS TGW view creates AWS Transit Gateways and manages the integration by attaching an Aviatrix Transit Gateway and other AWS resources, reviewing TGW attachments, and controlling routing and network domain connections for hybrid and multicloud deployments.

Elements

AWS TGW / Attachments toggle: Switches the page between the AWS TGW table and the Attachments view.
+ AWS TGW button: Starts the workflow to create a new AWS Transit Gateway (admin only).
Audit Settings button: Turns On or Off Auto Audit (Every night) for TGW attachments.
AWS TGW table: Displays the list of existing AWS TGWs and their details (Name, Account, Region, FireNet Inspection Mode, Peered AWS TGWs, TGW CIDR). TGW ID and Cloud are hidden by default; enable them from Columns.
Name link: Opens the detail page for that AWS TGW.
Edit button: Modifies an existing AWS TGW from the table.
Delete button: Removes an existing AWS TGW from the table.
Actions (⋮) button: Opens a menu with Audit AWS TGW to run a TGW attachment audit.
Filter button, Columns button, and Download button: Standard table toolbar controls.
Total N AWS TGWs footer and Refresh status: Row count and manual refresh for the table.

Actions

Create AWS TGW

To create an AWS Transit Gateway:

Go to Networking > Connectivity > AWS TGW.
Click + AWS TGW.
Configure the AWS TGW parameters (Name, Account, Region, TGW CIDR, and other settings).
Save the configuration.

The new AWS TGW appears in the AWS TGW table.

Parameter Details

CoPilot Parameter Name	Description
Name	Name assigned to the AWS Transit Gateway.
TGW ID	AWS-generated identifier of the AWS Transit Gateway (hidden by default).
Account	AWS account where the AWS Transit Gateway is created.
Cloud	Cloud provider associated with the Transit Gateway (hidden by default).
Region	AWS region where the Transit Gateway resides.
FireNet Inspection Mode	Inspection mode used when integrating the AWS Transit Gateway with FireNet.
Peered AWS TGWs	Number or list of AWS Transit Gateways peered with this gateway.
TGW CIDR	CIDR block assigned to the AWS Transit Gateway.

Configure Audit Settings

To configure audit settings for TGW attachments:

Go to Networking > Connectivity > AWS TGW.
Click Audit Settings.
Turn Auto Audit (Every night) On or Off for TGW attachments.
Save your changes.

Audit settings apply to all AWS TGW attachments.

Edit AWS TGW

To edit an existing AWS TGW:

Go to Networking > Connectivity > AWS TGW.
Locate the AWS TGW in the table and click the Edit button.
Update the desired parameters.
Save your changes.

Changes take effect after saving.

Delete AWS TGW

To delete an AWS TGW:

Go to Networking > Connectivity > AWS TGW.
Locate the AWS TGW in the table and click the Delete button.
Confirm the deletion.

The AWS TGW is removed from the table.

Audit AWS TGW

To audit an AWS TGW:

Go to Networking > Connectivity > AWS TGW.
Locate the AWS TGW in the table and click the Actions (⋮) button.
Select Audit AWS TGW to run the TGW attachment audit.

The audit results are displayed.

View AWS TGW Details

To view details for a specific AWS TGW:

Go to Networking > Connectivity > AWS TGW.
Click the Name link for the AWS TGW.

The AWS TGW detail page opens with its own set of tabs: Attachments (attachments for this TGW only, grouped by Transit Gateway, VPC, VPN, Direct Connect, AWS TGW Peering, and TGW Connection), Network Domains, Connection Policies, TGW Routes, and Approval.

Purpose

The Attachments view lists every resource attached to any AWS TGW, across all AWS Transit Gateways, in one table.

Elements

AWS TGW / Attachments toggle: Switches the page between the AWS TGW table and the Attachments view.
View selector: Built-in attachment-type views (VPC Attachments default, Transit Gateway Attachments, VPN Attachments, Direct Connect Attachments, AWS TGW Peering Attachments, or TGW Connection Attachments). All views share the same table columns; the add control label and dialog change per selected view.
+ Attach VPC, + Attach Transit Gateway, + Attach VPN, + Attach Direct Connect, + Attach AWS TGW Peering, or + Attach TGW Connection button: Starts the attach workflow for the selected view (admin only).
Attachments table: Displays attached resources for the selected view.
Edit button and Detach button: Modify or remove an attachment (admin only; Edit is not available for VPN, AWS TGW Peering, or TGW Connection attachments).
Filter button, Columns button, and Download button: Standard table toolbar controls.
Clear button and Open button: Icons inside the view selector that clear the current view selection or open the list of views. The list also includes a Manage Views link.
Save As New View button and More Options button: Appear only after you change the filters, columns, or sort order for a view. Save As New View saves the modified layout as a new view (prompts for a name); More Options > Discard Changes reverts to the previously applied view.
Total N Attachments footer and Refresh status: Row count and manual refresh for the table.

Actions

Manage Attachments

Attach VPC

To attach a VPC to an AWS TGW:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select VPC Attachments (the default view).
Click + Attach VPC.
In the Attach VPC to AWS TGW dialog, select the AWS TGW, VPC, and Network Domain (defaults to Default_Domain). Optionally expand Advanced Settings for additional options.
Click Save.

The new attachment appears in the Attachments table.

Parameter Details

CoPilot Parameter Name	Description
Name	The VPC, VNet, or connection name of the attached resource.
Gateway Name	The Aviatrix Transit Gateway attached to the AWS TGW (Transit Gateway Attachments view; hidden by default).
AWS TGW	The AWS Transit Gateway the resource is attached to.
CIDR	The CIDR block(s) associated with the attachment.
Network Domain	The TGW route domain (network domain) the attachment belongs to.
Transport Attachment	The underlying AWS TGW attachment type used to carry traffic.
Property	Additional attachment-specific properties.
Account	The cloud account that owns the attached resource.
Attachment ID	The AWS-generated identifier for the attachment.

Attach Transit Gateway

To attach an Aviatrix Transit Gateway to an AWS TGW:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select Transit Gateway Attachments.
Click + Attach Transit Gateway.
In the Attach Transit Gateway dialog, select the AWS TGW and Transit Gateway. The AWS TGW can only be attached to a Transit Gateway in the same AWS region; Network Domain is read-only (Aviatrix Edge Domain).
Click Save.

The new attachment appears in the Attachments table.

Attach VPN

To attach a VPN connection to an AWS TGW:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select VPN Attachments.
Click + Attach VPN.
In the Create VPN Attachment dialog, configure the connection name, public IP, protocol (BGP or static), route domain, and tunnel settings.
Click Save.

The new attachment appears in the Attachments table. VPN attachments cannot be edited after creation.

Attach Direct Connect

To attach an AWS Direct Connect gateway to an AWS TGW:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select Direct Connect Attachments.
Click + Attach Direct Connect.
In the Create Direct Connect Attachment dialog, select the Direct Connect gateway and configure the allowed prefixes.
Click Save.

The new attachment appears in the Attachments table. To modify the allowed prefixes later, click the attachment’s Edit button (opens Edit Direct Connect Attachment).

Attach AWS TGW Peering

To peer two AWS TGWs:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select AWS TGW Peering Attachments.
Click + Attach AWS TGW Peering.
In the Create AWS TGW Peering dialog, select the first AWS TGW, then the second AWS TGW and its region.
Click Save.

The new peering attachment appears in the Attachments table. AWS TGW Peering attachments cannot be edited after creation.

Attach TGW Connection

To attach a TGW Connection to an AWS TGW:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select TGW Connection Attachments.
Click + Attach TGW Connection.
In the Create TGW Connection Attachment dialog, select the AWS TGW and configure the connection name, attachment name, and network domain.
Click Save.

The new attachment appears in the Attachments table. TGW Connection attachments cannot be edited after creation.

Edit or Detach an Attachment

To modify or remove an attachment (admin only):

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, select the view containing the attachment.
To modify an existing VPC, Transit Gateway, or Direct Connect attachment, locate it in the table and click its Edit button (not available for VPN, AWS TGW Peering, or TGW Connection attachments).
To remove any attachment, click its Detach button and confirm.

Switch Attachment View

To change the attachment type shown in the table:

Go to Networking > Connectivity > AWS TGW > Attachments.
In the View selector, choose VPC Attachments, Transit Gateway Attachments, VPN Attachments, Direct Connect Attachments, AWS TGW Peering Attachments, or TGW Connection Attachments.

The table and attach control update for the selected attachment type.

Manage Saved Views

Save As New View

To save the current filter, column, or sort layout as a new view:

Go to Networking > Connectivity > AWS TGW > Attachments.
Use Filter, Columns, or a column header to change the filters, visible columns, or sort order.
Click Save As New View.
Enter a name and click Save.

The new view is added to the view selector.

Discard Changes

To discard unsaved changes to the current view:

Go to Networking > Connectivity > AWS TGW > Attachments.
After changing the filters, columns, or sort order, click More Options (next to Save As New View).
Select Discard Changes.

The table reverts to the previously applied view.

Manage Views

To review or switch between the built-in attachment views:

Go to Networking > Connectivity > AWS TGW > Attachments.
Open the view selector and click Manage Views.
Click Apply next to any of the six views (VPC Attachments, Transit Gateway Attachments, VPN Attachments, Direct Connect Attachments, AWS TGW Peering Attachments, or TGW Connection Attachments) to switch the table to that view.
Click Close.

Purpose

The Native Peering page manages native cloud VPC or VNet peering connections to enable direct connectivity without using Transit Gateways.

Elements

+ Native Peering button: Starts the workflow to create a new native peering connection (admin only).
Native Peering table: Displays existing native peering connections (Name, VPC/VNet 1, VPC/VNet 1 CIDR, VPC/VNet 2, VPC/VNet 2 CIDR by default). The Region 1, Account 1, Region 2, and Account 2 columns are hidden by default; enable them from Columns.
Name link: Opens a detail drawer for the peering connection.
Delete button: Removes an existing native peering connection from the table or from the detail drawer (admin only).
Filter button, Columns button, Download button, and Open: Standard table toolbar controls.
Total N Native Peerings footer and Refresh status: Row count and manual refresh for the table.

Actions

Create Native Peering

To create a native peering connection:

Go to Networking > Connectivity > Native Peering.
Click + Native Peering.
Select the Cloud (AWS or Azure). For AWS, also select the partition (Standard, GovCloud, or China).
Select VPC/VNet 1 and VPC/VNet 2 from the available VPCs or VNets.
For AWS, optionally turn on Select Route Tables for either VPC to choose specific route tables to propagate the peering route to.
Click Save.

The new native peering connection appears in the Native Peering table.

Parameter Details

CoPilot Parameter Name	Description
Cloud	The cloud provider of the VPCs or VNets to peer (AWS or Azure).
VPC/VNet 1	First VPC or VNet in the peering connection.
Select Route Tables (VPC/VNet 1)	AWS only. When on, selects specific route tables on VPC/VNet 1 to update with the peering route.
VPC/VNet 2	Second VPC or VNet in the peering connection.
Select Route Tables (VPC/VNet 2)	AWS only. When on, selects specific route tables on VPC/VNet 2 to update with the peering route.

View Native Peering Details

To view details for a native peering connection:

Go to Networking > Connectivity > Native Peering.
Click the Name link for the connection. A detail drawer opens, showing the Name, CIDR, Cloud, Region, and Account (and Route Table, for AWS) for both VPC/VNet 1 and VPC/VNet 2.
Click Delete in the drawer title to remove the connection.

Parameter Details

CoPilot Parameter Name	Description
Name	Name of the VPC or VNet on each side of the peering connection.
CIDR	CIDR block of the VPC or VNet.
Cloud	Cloud provider of the peering connection.
Region	Cloud region of the VPC or VNet.
Account	Cloud account that owns the VPC or VNet.
Route Table	AWS only. The route tables selected to propagate the peering route, if any.

Delete Native Peering

To delete a native peering connection:

Go to Networking > Connectivity > Native Peering.
Locate the connection in the Native Peering table and click the Delete button, or open the connection and click Delete in the detail drawer title.
Confirm the deletion.

The native peering connection is removed from the table.

Purpose

The External CA Certificates page manages external certificate authority certificates used to authenticate and secure Aviatrix connections.

Elements

+ Certificate button: Starts the workflow to add a new external CA certificate (admin only).
Download Aviatrix CA Certificate button: Downloads the Aviatrix CA certificate for external use.
External CA Certificates table: Displays existing external CA certificates and their details.
Delete button: Removes an existing external CA certificate from the table (admin only).
Filter button, Columns button, Download button, and Refresh status: Standard table toolbar controls.
Total N CA Certificates footer: Row count for the table.

Actions

Add External CA Certificate

To add an external CA certificate:

Go to Networking > Connectivity > External CA Certificates.
Click + Certificate.
Enter a Name and click Upload to select the CA certificate file.
Click Save.

The new certificate appears in the External CA Certificates table.

Parameter Details

CoPilot Parameter Name	Description
Name	Name assigned to the external CA certificate.
Unique Serial	Unique serial number of the certificate.
Issuer Name	Certificate authority that issued the certificate.
Common Name	Common name defined in the certificate.
Expiration	Date and time when the certificate expires.

Download Aviatrix CA Certificate

To download the Aviatrix CA certificate for external use:

Go to Networking > Connectivity > External CA Certificates.
Click Download Aviatrix CA Certificate.

The Aviatrix CA certificate is downloaded for external use.

Delete External CA Certificate

To delete an external CA certificate:

Go to Networking > Connectivity > External CA Certificates.
Locate the certificate in the External CA Certificates table and click the Delete button.
Confirm the deletion.

The certificate is removed from the table.

Purpose

The Settings page manages the internal Certificate Authority (CA) configuration used to secure external connections.

Elements

CA Rotation Guide link: Opens the Aviatrix CA rotation guide documentation in a new tab.
Rotate Certificate button: Starts the workflow to prepare a new internal Certificate Authority (CA) certificate for the external connection service.
Download Trust Bundle button: Downloads the trust bundle containing the active and any prepared internal CA certificates.
Certificate table: Displays the internal CA certificate(s) and their details.
Total N Certificate footer and Refresh status: Row count and manual refresh for the certificate table.

Actions

Rotate Certificate

To prepare a new internal Certificate Authority (CA) certificate:

Go to Networking > Connectivity > Settings.
Click Rotate Certificate.
In the Certificate dropdown, select the CA certificate to prepare.
Click Prepare.
Click Download Trust Bundle and provision the trust bundle on all external devices.
After provisioning, activate the new certificate.

Parameter Details

CoPilot Parameter Name	Description
Name	Name of the internal CA certificate.
Subject	The certificate subject (distinguished name), for example organization, location, and email.
Expires	The certificate expiration date, with the remaining validity period.
Key Type	The cryptographic key type used by the certificate, for example EC or RSA.
Key Specification	The specific key curve or size used by the certificate, for example prime256v1.
Status	The current status of the certificate, for example Active or Prepared.

Download Trust Bundle

To download the trust bundle containing the internal CA certificate(s):

Go to Networking > Connectivity > Settings.
Click Download Trust Bundle.

The trust bundle is downloaded for external use.

Concepts & Architecture

Guides

Reference

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

AWS Virtual Gateway

Azure Virtual Network Gateway

Microsoft’s SSE Solution

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​AWS Virtual Gateway

​Azure Virtual Network Gateway

​Microsoft’s SSE Solution

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

​Purpose

​Elements

​Actions

​Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

AWS Virtual Gateway

Azure Virtual Network Gateway

Microsoft’s SSE Solution

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details

Parameter Details

Purpose

Elements

Actions

Parameter Details

Purpose

Elements

Actions

Parameter Details