Skip to main content
This document records Aviatrix error messages, possible root causes and solutions.
This is probably caused by two firewall domains both wanting to inspect the same VPC traffic. Only one firewall domain can inspect east-west traffic the other inspects egress. You can fix this by going to Firewall Network → Advanced. Select the firewall domain, disable “Traffic Inspection, and enable “Egress through Firewall”. Then go back and execute Step 6 in Firewall Network workflow.
TGW VPN configuration downloading is not supported from the Aviatrix Controller console. You can download the configuration by going to the AWS Console → VPC → Site-to-Site VPN Connections to download the configuration file. Once the file is downloaded, use the information in the file to configure the remote end of the IPSec VPN.
You must go to the Peering page to delete the peering first before you can delete the gateway.
It’s possible the named gateway is stopped or a security group rule blocked access from the Controller.
Syntax:[port | fromport-toport]. Range “fromport” to “toport” inclusive. The maximum port range is 100.
It is likely that the Controller was not launched by the CloudFormation script provided by Aviatrix. Follow the Getting Started guide for your CSP.
A Site2Cloud connection established in the Transit Network Workflow.
It is likely your gateway is in a stopped state. Go to AWS Console to start the gateway instance.
Follow the instructions here to update the IAM policy account.
Transit DMZ deployment requires 3 Ethernet interfaces. t2.micro has only 2. At the Aviatrix Controller console, go to Gateway. Highlight the transit gateway with the size error, click Edit. Scroll down to Gateway Resize. In the drop down menu, select t3.large or a more powerful instance size.
Go to Peering page to delete the peer first.
The peering relationship was most likely established by the Transit Network workflow attaching a Spoke VPC to the Transit Gateway, therefore you should detach the Spoke VPC from the Transit VPC to delete the peering.
It is likely you need to update IAM policies. Fore more information, see here
If you see this error message when you launch an Azure ARM gateway, chances are you have not subscribed to the Aviatrix gateway during the Azure onboarding process. For more information, see Azure IAM Custom Role
If you see this error message when launching an AWS gateway, the potential root causes are:
  • If you used AWS IAM roles for the Aviatrix account, it is likely that your IAM role policies are not up to date. Follow this link to update both IAM policies on both your primary account and secondary account.
  • If you used an AWS access key and secret ID for the Aviatrix account, it is possible that this pair of credentials is incorrect. Re-enter these two fields.
This error message says you must first detach the Aviatrix Transit GW from the TGW before you can delete the gateway.
You may have exceeded AWS VPC limits on this account. You can file a support ticket to increase the limit.
The gateway instance is either stopped or a security group rule of the gateway instance was added that prevents the Controller from reaching the gateway.
This instance size is not supported in the AZ you selected. Select a different one.
You have reached your AWS EIP limit. Release some of your unallocated EIPs from the AWS EC2 Console or submit a support ticket to AWS to increase the limit.
You should go to Peering page to delete all peerings on the gateway before you can delete the gateway.
High Performance Encryption Mode only supports AWS C5 series. For performance, see this link.
Your primary Aviatrix Transit Gateway is not the active one. Please follow the steps below to switchover from backup Transit Gateway to primary Transit Gateway:
  • For DMZ Main Transit Gateway, go to “Transit DMZ” → “Advanced”. At “Main gateway” section, click “Switchover” button and make sure “HA Status” of primary Main Gateway is in “Active” state.
  • For a Transit Gateway with BGP connections, go to “Troubleshoot” → “Diagnostics” → “BGP”, click “Switch Over” button along with backup Transit Gateway.
You may have exceeded GCP IN_USE_ADDRESSES limits on this account. By default in GCP, the in-use IP address of a region is 8 (Different GCP project has different quotas limit setting), you can ask for a new quota limit by following this GCP instruction.
When you try to associate firewall instance to FireNet gateway, the firewall’s LAN instance must stay in the same subnet with FireNet gateway’s firewall subnet. It is recommended to use Aviatrix controller to launch and associate firewall, which guarentee all the subnets and interfaces are correct. If you launch your own firewall, you need to make sure the firewall interfaces are correct. The firewall subnets/interfaces are created when enable FireNet function on the gateway. If you create firewall instance before enable FireNet function, those instances can not associate with gateway due to mismatched interface. One way to solve this is to use API to enable FireNet function, and provide existing subnets as option. Please refer to API doc.
This error may be found in Aviatrix VPN Client logs. It will be returned in the event a TCP OpenVPN Gateway is deployed behind an AWS NLB, but port 943 is not open to the preserved source IP’s. We recommend opening port 943 to 0.0.0.0/0 to prevent connectivity issues like this. Please refer to the following Aviatrix Support site for more information.
This error will be returned when there are 0 available IP addresses in a subnet that is being attached to the TGW. You must have at least one available IP address in each subnet that will be attached.
You may have exceeded GCP IN_USE_ADDRESSES limits on this account. By default in GCP, the In-use IP address of a region is 8 (Different GCP project has different quotas limit setting), you can ask for a new quota limit by following this GCP instruction.
This issue occurs because the gateway you attempted to downsize does not have enough network interfaces or NICs (Network Interface Cards) for the size of your Azure virtual machine with Aviatrix FireNet enabled. Azure virtual machines with the Standard_B1 size can have up to 2 NICs. However, when you use Aviatrix Transit FireNet for a gateway, you need 3 NICs. To resolve this issue, you can either:
  • Resize the Azure virtual machine to Standard-B2 or larger.
  • Disable Transit FireNet on this gateway. In your Controller, go to Firewall Network > Setup > Detach > Disable Transit Firenet Function for Aviatrix Transit Gateway > select the gateway > click Disable.