​

9.0.0

​

Deprecation Notices / Removals in Release 9.0.0

​

S2C Telemetry / RRD from Controller

​

New and Enhanced Features in Release 9.0.0

​

Gateway Drain/Undrain

• The gateway is removed from Aviatrix routing and from cloud route tables before the operation, so traffic flows through the HA peer.
• The gateway returns to service only after tunnels and routing are stable.
• Drain and undrain require an HA peer. Single-gateway operations are not protected by this sequence.

​

Upgrade Plan and Upgrade Groups

​

Validated Upgrade Path Framework

​

DCF East-West with AWS TGW (Bump-in-the-Wire)

• Aviatrix spoke gateways are inserted into the traffic path with no re-architecture of the existing TGW.
• Supports East-West inspection and selective egress NAT in the same VPC.
• AWS only in 9.0; no Terraform support.

​

DCF IPS (Ingress/Egress) & TLS Inspection

• Three operational modes: IPS Only, TLS Decrypt Only, IPS + TLS Decrypt for full encrypted threat visibility
• IPS profile is global with one active at a time; default feed is ET Open with custom rule feed support
• TLS profile is per-rule with per-rule trust bundles
• MITM CA is global with bring-your-own or Aviatrix-generated default
• Terraform and API automation supported

​

Explicit Azure Route Table Selection for DCF Egress

• Select which Azure route tables receive the default route via the Aviatrix spoke gateway when Single IP SNAT is enabled.
• On upgrade from 8.2, previously implicit private route tables are migrated in CoPilot and surfaced as explicit selections. Existing Terraform configurations are not auto-migrated; update them after the provider upgrade to declare private_route_table_config and avoid plan drift.
• The Controller saves and restores the original default route on disable or deselect.
• Terraform support is added on aviatrix_spoke_gateway, aviatrix_transit_gateway, aviatrix_spoke_group, aviatrix_transit_group, and aviatrix_azure_spoke_native_peering.

​

Automated Default Route Management for GCP DCF Egress

• Programs the default route without the avx-snat-noip tag, so all VMs egress via the Aviatrix spoke when enabled.
• On software upgrade from 8.2, the existing behavior is preserved. New behavior is triggered by routing changes.
• Regional VPCs only. GCP Global VPCs are unchanged.

​

DCF Logging Enhancements (Session & L4 Logging)

​

K8S Discovery (Enabled by Default)

​

Smart Gateways Phase 2

• GoBGP policy support for cloud network route advertisement
• MTT (Multi-Tier Transit) support for cloud network routes
• Best route computation on each gateway
• Overlay CIDR collection with segmentation support
• Supports headless mode; controller only needed for bringing new gateways into the fabric

​

IPv6 Capability Phase 2

• GCP gateway support
• Telemetry support
• AWS-Gov and Azure-Gov support
• Equinix Edge support (LAN interface only)
• ULA (Unique Local Address) support
• S2C segmentation support
• FireNet egress support
• Dual-stack with IPv4 cloud network including High Performance Encryption (HPE) for spokes and transits

​

Active Mesh 4.0 Phase 2

• All gateways in a group are equal; primary gateway can be safely deleted
• Dynamic HPE toggle at gateway group level with rolling transition
• Mixed HPE/non-HPE mode supported during transition if address space is insufficient
• Unified Gateway API with Terraform support

​

First-Hop VRF Support for Overlapping CIDRs

• Enables overlapping CIDRs from multiple S2C connections in different segments
• Each domain gets its own kernel VRF namespace
• First-hop only. S2C on Transit GW with Cloud Transit and Edge Transit support.
• No FireNet support.

​

Proxy ID for Route-Based Site2Cloud

• Configures specific local and remote traffic selectors instead of default 0.0.0.0/0
• Enables route-based tunnels to interoperate with policy-based peers
• Toggle on/off and edit CIDRs on existing connections without tunnel recreation
• Terraform, API, and CoPilot support

​

S2C on Horizontally Scaled Transit

• S2C can be enabled on a scaled transit group with 3 or more gateways.
• S2C tunnels terminate on the first two gateways in the scaled group.
• FireNet on horizontally scaled transit is not supported in 9.0.

​

Dell R470 for AEP Edge

• Broadcom NICs with new EvE OS image and g4 gateway image.
• 25G NIC support in 9.0.
• Transit Edge and Spoke Edge supported.
• Requires Controller 8.0 or later.

​

Image Upgrade for Self-Managed and Equinix Edge Gateways

• Regenerate cloud-init data and launch a new Edge VM with a compatible image
• Image upgrade pushes all configuration to the new gateway VM
• CoPilot and API support; cloud-init downloadable for all edge gateways
• Must complete in the same maintenance window. Not hitless; requires traffic drain.

​

Per-Firewall Vendor Integration through Firewall Manager

• Each firewall attached to the same FireNet gateway can have its own template and template stack
• Enables heterogeneous firewall configurations within the same FireNet gateway

​

Restrictive Firewall Management Security Groups for Azure

• Applies to Palo Alto Networks, Check Point, and Fortinet firewalls in Azure
• Egress and LAN interface rules are unchanged
• Controller IP source is updated automatically when the Controller IP changes

​

Default Route from Transit FireNet to Edge Spoke

​

Early Access Features in Release 9.0.0

​

Centralized Security Hub VPC (AWS)

• Aviatrix auto-provisions all VPC infrastructure including subnets, GWLB, endpoint services, route tables, and cross-zone load balancing.
• Supports AZ affinity to reduce cross-zone transfer charges.
• API only in this release.

​

DCF on Edge (Spoke & Transit)

• Edge as Spoke: L4 filtering, L7 filtering (SNI-based hostname), TLS Decryption
• Edge as Transit: L4 filtering only

​

BGPoLAN for Azure China

• Same BGPoLAN architecture as global Azure regions
• Transit GW with BGP over LAN for DC-to-cloud connectivity

​

DCF Policy Audit

• Exportable via API for compliance and CI governance pipelines

​

DCF for Serverless Resources

• Supports AWS Lambda, AWS ECS/Fargate, Azure Functions, Azure Container Apps, GCP Cloud Functions, and GCP Cloud Run.
• SmartGroups define serverless resources by name, tags, region, and account.
• SmartGroup membership updates automatically for ephemeral workloads.

​

Behavior Changes in Release 9.0.0

​

Gateway Drain/Undrain on Operations

​

Active Mesh 4.0 High Performance Encryption (HPE) Toggle

​

Edge Image Upgrade Workflow

​

GCP Regional VPCs: Local Egress by Default

​

Upgrade Impact

​

Azure VNET: Explicit Route Table Selection for Local Egress

​

Upgrade Impact

resource "aviatrix_spoke_gateway" "azure_spoke" {
  snat_enabled               = true
  private_route_table_config = ["rtb1:resource-group-1", "rtb2:resource-group-2"]
}