Corrected Issues in Aviatrix Release 7.2.5097
| Issue | Description |
|---|---|
| AVX-63522 | Fixed an issue where GCP gateways with FireNet or BGPoLAN enabled were incorrectly configured with subnet-based netmasks instead of the required /32 prefix. This caused routing failures and connectivity issues with firewall appliances. |
| AVX-63608 | Fixed an issue where gateway resize operations could fail with a KeyError: ‘src’ during validation. This occurred when resizing gateways, including attempts to resize to the same instance size for recovery. The fix improves peer data handling to ensure resize operations complete successfully. |
| AVX-64741 | Fixed an issue where transit peering status was shown as UNKNOWN in the Controller even though tunnels were established. The problem was caused by Edge gateways sending invalid peer values (“<nil>”), which blocked route exchange. The fix adds proper validation of peer IP values so that transit status is reported correctly and routes are exchanged as expected. |
| AVX-65554 | Fixed an issue where DNAT (Destination NAT) configuration updates failed on gateways that had policy-based Site-to-Cloud tunnels. The NAT validation logic did not correctly identify the tunnel interfaces associated with these connections, causing configuration updates to fail. The validation logic has been enhanced to properly resolve interface mappings for policy-based Site-to-Cloud tunnels, ensuring DNAT rules can now be created, modified, and deleted successfully through the Controller UI without manual intervention. |
| AVX-65698 | Fixed a memory leak in the DCF Traffic Server (TS_MAIN process) that could cause gateway reboots during high-volume threat IP traffic processing. The issue occurred when multiple DCF rules with ThreatIQ external groups were triggered by continuous probing to inactive threat IPs. Memory usage now stabilizes under sustained load. |
| AVX-66162 | Fixed an issue where DNAT and SNAT configuration updates failed on gateways with policy-based Site2Cloud tunnels. The NAT validation logic has been corrected to properly resolve interfaces, ensuring DNAT and SNAT rules can now be created, modified, or deleted through the Controller UI without errors. |
| AVX-66961 | Fixed a memory leak in the DCF Traffic Server (TS_MAIN process) that could cause gateway memory exhaustion and potential traffic impact. The issue occurred on gateways running Distributed Cloud Firewall (DCF) with WebGroups enabled. |
| AVX-68308 | Fixed an issue in UserConnect 7.2 where gateway resize operations could fail with a KeyError: 'src' exception. This occurred in deployments upgraded from version 6.6 with non-HPE peering configurations and prevented users from resizing gateways once they entered a config_fail state. |
Known Issues in Aviatrix Release 7.2.5097
| Issue | Description |
|---|---|
| AVX-64502 | Resolved an issue where, under certain conditions, the eth0 interface on an HPE-enabled Azure gateway could go down, causing the DHCP-assigned primary IP address to be released and a static IP to be promoted as the primary address, which causes traffic disruption. With this fix, the primary IP address is retained even if the interface temporarily goes down, preventing traffic disruption and gateway connectivity issues. |
| AVX-71122 | In some environments, after the Identity Provider (IdP) rotates its SAML signing certificate, the Aviatrix Controller may fail to fetch and update the new certificate from the configured metadata URL. As a result, the Controller continues to use a stale certificate, which causes signature verification errors during SAML authentication. Impact: SAML single sign-on (SSO) authentication fails. Users may experience repeated login failures or timeouts and are unable to access the Controller dashboard using SAML. Workaround: Contact Aviatrix Support to manually update the SAML certificate on the Controller. |
| AVX-80983 | When Azure Security Group Management reads the current state of a security group rule before adding a new gateway’s IP address to it during gateway launch, an Azure API throttling response on that read can be misinterpreted as the rule not existing. In that case, the existing rule is deleted and a new rule is created instead of the existing rule being updated. Impact: Azure security group rules can be unexpectedly deleted and recreated during gateway launch when the Azure API throttles the read call. The delete-and-recreate sequence can result in a brief gap in security group coverage for the affected rule, or in duplicate rules if the sequence does not fully complete. Workaround: Contact Aviatrix Support if you observe unexpected security group rule changes on gateway launch in an Azure environment. |