| Issue | Description |
|---|---|
| AVX-59843 | If you have BGP sessions over IPsec and the BGP peer IPs are non-APIPA (169.254.x.x) IP addresses, the sessions might not be able to be established or reestablished after experiencing tunnel flapping. The BGP peer subnet route is installed by the kernel and this route is synced to a special route table which is used by BGP to send BGP packets to a peer. There is a failure to sync this route, therefore BGP packets can not reach remote BGP peer. |
| Issue | Description |
|---|---|
| AVX-63016 | In Aviatrix Controller, newly added **Additional CIDRs** in OpenVPN split tunnel mode are not pushed to OpenVPN clients. This occurs because the OpenVPN service does not automatically restart after CIDR updates. **Impact:** \_ Additional CIDRs configured in **OpenVPN > Edit Config > Modify Split Tunnel > Additional CIDRs** are not propagated to clients \_ VPN clients do not receive updated routes \* Administrators must restart the OpenVPN service manually on affected gateways **Workaround 1:** Stop and restart the gateway instance from the CSP console. **Workaround 2:** Request Support to restart the OVPN service on the gateway. **Note:** Both workarounds are traffic-impacting and must be performed during a scheduled maintenance window. **Resolution:** Fixed in versions 8.0.10 and 8.1.0. The OpenVPN service now automatically restarts when Additional CIDRs are updated, ensuring routes are pushed to clients. |
| AVX-64136 | In OCI environments, new CIDRs added to a VCN via the OCI console may not be reflected in the Controller after the initial spoke-transit attachment. As a result, users cannot create gateways in the newly added CIDRs, and the CIDR will not appear in the subnet selection dropdown. **Workaround:** \_ Add both the original and newly added CIDRs to the **Customized Spoke Advertised VPC CIDRs** field in the Controller. **Impact:**
|
| AVX-64447 | Site2Cloud High Availability (HA) tunnels may not behave correctly when toggling between Active/Active and Active/Standby modes. **Problem 1:** When disabling Active/Active HA, the HA Gateway (HAGW) may retain metric 100 routes pointing to tunnel interfaces in the Gateway Route table, even though they should be removed. **Problem 2:** When enabling Active/Active HA from Active/Standby, the HA Gateway tunnel may not be properly enabled. This can result in missing routes despite the UI showing Active/Active status. **Impact:**
If you encounter this issue, contact [Aviatrix Support](https://support.aviatrix.com) for assistance. |
| AVX-64741 | After an image upgrade on a Transit Gateway that is attached to an edge gateway, while the transit peering connections may establish successfully, the status may not reach the controller due to an IP address parsing exception. This may impact route propagation. **Symptoms:**
**Impact:**
**Workaround:** Contact Aviatrix Support if you need to perform an image upgrade of a Transit Gateway (attached to an edge gateway) to software version 7.2.5090. **Resolution Status:** Fixed in version 8.0.10 and 8.1. |
| AVX-64868 | In some scenarios involving rapid VRRP state transitions, the keepalived VRRP state may not be reported accurately to the Controller. This can result in temporary discrepancies between the actual VRRP status and what is displayed in the Controller UI, leading to confusion and difficulties during troubleshooting. **Workaround:** \_ Use diagnostic logs to verify actual VRRP state **Impact:**
|
| AVX-65016 | In some environments, the Firewall state may not recover from **Unaccessible** after the first vendor integration failure. This issue has been observed when integrating with third-party firewall vendors, leaving the gateway firewall state stuck even after the environment stabilizes. **Impact:** \_ Firewall integration appears stuck in **Unaccessible** state \_ Recovery does not occur automatically after initial failure \* May require manual intervention to restore proper firewall state reporting **Workaround:** Contact Aviatrix Support for manual correction. |
| AVX-65213 | In earlier versions, system diagnostics could fail with an AttributeError (`'NoneType' object has no attribute 'role'`) during migration or health check operations. The issue occurred when CloudXD process data returned None during the system info collection. **Workaround:**
Fixed in 8.0.10 and 8.1.0. Diagnostic logic now handles null values safely. |
| AVX-71135 | When upgrading to Controller 8.1, the database migration may fail if VPC tunnel records contain string values in the **timestamp** field instead of numeric values. During migration, the process attempts to convert these non-numeric timestamp strings to floating-point values, which results in a conversion error and causes the upgrade to fail. **Impact:** The upgrade to Controller 8.1 cannot complete and the system remains on the previous version. **Workaround:** Contact [Aviatrix Support](https://support.aviatrix.com/) for assistance. |
| AVX-80983 | When Azure Security Group Management reads the current state of a security group rule before adding a new gateway's IP address to it during gateway launch, an Azure API throttling response on that read can be misinterpreted as the rule not existing. In that case, the existing rule is deleted and a new rule is created instead of the existing rule being updated. **Impact:** Azure security group rules can be unexpectedly deleted and recreated during gateway launch when the Azure API throttles the read call. The delete-and-recreate sequence can result in a brief gap in security group coverage for the affected rule, or in duplicate rules if the sequence does not fully complete. **Workaround:** Contact [Aviatrix Support](https://support.aviatrix.com/) if you observe unexpected security group rule changes on gateway launch in an Azure environment. |