About Spoke Gateway Settings
This document describes the settings that you can configure for an Aviatrix Spoke Gateway.
About Spoke Gateway Settings
This section describes the settings that you configure to create a Spoke Gateway. For instructions on how to create a Spoke Gateway, see Creating a Spoke Gateway.
Account
Your cloud provider account. The Aviatrix Controller uses your cloud provider’s account credentials to launch Aviatrix gateways via cloud provider API calls.
To learn more about cloud provider access accounts, see Accounts and Users.
Instance Size
Instance Size is the gateway instance size.
When selecting the gateway instance size, use the following guidelines of IPsec performance based on IPERF tests conducted between two gateways of the same size:
AWS Performance Numbers
| AWS Instance Size | Expected Throughput |
|---|---|
T2 series |
Not guaranteed; it can burst up to 130Mbps |
c5.2xlarge, c5.4xlarge |
2Gbps - 2.5Gbps |
c5n.4xlarge |
25Gbps (with High Performance Encryption (HPE) Mode) |
c5n.9xlarge |
70Gbps (with HPE Mode) |
c5n.18xlarge |
70Gbps (with HPE Mode) |
Azure Performance Numbers (without High Performance Encryption Mode)
| Azure Instance Size | Expected Throughput |
|---|---|
B series |
Not guaranteed; it can burst up to 260Mbps |
D/Ds series |
480Mbps - 1.2Gbps |
F Series |
approximately 450Mbps - 1.2Gbps |
GCP Performance Numbers (without High Performance Encryption Mode)
| GCP Instance Size | Expected Throughput |
|---|---|
n1-standard-1, n1-standard-2, n1-highcpu-2 |
1.0 - 1.2 Gbps |
n1-standard-4, n1-highcpu-2 |
2.3 - 2.5 Gbps |
OCI Expected Throughput Numbers
| OCI Instance Shape | Throughput with Active Mesh | Throughput without Active Mesh |
|---|---|---|
VM.Standard2.2 or larger |
1.8G |
900 Mbps |
With OCI you can choose a flexible shape to modify the Oracle CPU (OCPU) and memory configurations of your shape after it is deployed.
| OCI Flex Shape | OCPU and RAM |
|---|---|
FLEX4.16 |
E3 4 OCPU 8G RAM |
FLEX8.32 |
E3 8 OCPU 32G RAM |
FLEX16.32 |
E3 16 OCPU 32G RAM |
|
If you need IPsec performance beyond 2Gbps, refer to ActiveMesh HPE Performance Benchmark. |
Gateway Resize
You can change gateway instance size, if needed, to change gateway throughput. The gateway instance will restart with a different instance size.
High Performance Encryption
High Performance Encryption (HPE) is an Aviatrix technology that enables 10Gbps and higher IPsec performance between two single Aviatrix Gateway instances or between a single Aviatrix Gateway instance and on-prem Aviatrix appliance.
When a gateway instance is launched with High Performance Encryption enabled, the Aviatrix Controller will look for a spare /26 subnet segment to create a new public subnet "-insane" and launch the gateway on this subnet.
The instance sizes that support High Performance Encryption are:
| Cloud Provider | Instance Sizes that Support HPE | ||
|---|---|---|---|
AWS |
t3, t3a, c5, c5n, c6in |
||
Azure |
Standard (except for B1ms, B2s, B4ms, B8ms, D1_v2, D2_v2, DS1_v2, DS2_v2, D2s_v3, D4s_v3, F2s_v2, F4s_v2) |
||
GCP |
n1-standard (except for standard-1 and standard-2), n1-highcpu (except for highcpu-2) |
||
OCI |
All instance sizes
|
For an overview of Aviatrix High Performance Encryption, see About High-Performance Encryption.
Attach to Transit Gateway
You attach a Spoke Gateway to a Transit Gateway to create a hub-spoke topology.
When you attach a Spoke Gateway to a Transit Gateway, the Aviatrix Controller attaches the Spoke VPC or VNet to the Transit VPC by building encrypted peering and transitive peering between the Spoke Gateway and the Transit Gateway.
Max Performance
Max Performance provides full High Performance Encryption (HPE) performance. The Max Performance option is available only when both the Spoke and Transit gateways are launched with High Performance Encryption (HPE) enabled and are in the same cloud type.
When Max Performance is On, multiple HPE tunnels are created between the Spoke and Transit gateway. The number of tunnels that are created depends on the gateway instance sizes and the number of instances in the Spoke gateway. Each Spoke gateway instance generates one tunnel each to the Transit gateway to which they are attached. If the Transit gateway is in HA then each Spoke gateway instance forms two tunnels to the Transit (one to the primary Transit and one to the HA Transit).
When Max Performance is Off, only one tunnel each is created even when HPE is enabled for both the Spoke and Transit Gateway.
To switch between multiple tunnels or one tunnel, you need to detach and reattach the Spoke Gateway to the Transit Gateway.
BGP
When BGP is enabled, the Spoke Gateway establishes a BGP connection to an external router to dynamically exchange routes. It also establishes an IPsec tunnel to the router for packet forwarding.
| BGP must be enabled at the creation of the Spoke Gateway. |
A Spoke gateway with BGP enabled has a few restrictions compared to a non-BGP Spoke.
BGP over LAN
In AWS, BGP over LAN feature allows BGP-enabled Spoke Gateways to establish a connection with a pair of third-party instances, that are in the same VPC as the Spoke Gateway, without using the IPsec or GRE tunneling protocol.
In Azure, BGP over LAN allows BGP-enabled Spoke Gateways to establish a connection with a pair of third-party instances, that are in the same VNet but different from the Spoke Gateway VNet, without using the IPsec or GRE tunneling protocol.
Multiple BGP over LAN connections are supported, however, each connection can be connected to one or at most two third-party instances. For Azure, the two third-party instances must be in the same VNet.
| BGP over LAN feature is not supported for GCP, OCI, and Alibaba Cloud. |
For Azure, when configuring BGP over LAN, you must indicate the number of LAN interfaces you need (maximum is eight).
| When you add new or additional LAN interfaces to an Azure Spoke Gateway, the gateway is rebooted and traffic disruption may occur. |
| You cannot delete an interface after the Spoke Gateway is created. |
To learn more about BGP over LAN connections, refer to:
For more information about connecting BGP-enabled Spoke Gateways to an external device, see:
Instances
The Aviatrix Gateway High Availability feature enables you to create High Availability (HA) gateways for Spoke and Transit Gateways to minimize and reduce network downtime and improve network stability and performance.
|
When HA Spoke and Transit gateways are deployed, the Aviatrix Controller monitors your cloud network deployment, detects if a gateway is down and handles failover resolution automatically.
For an overview of the Aviatrix Gateway High Availability feature, see About Gateway High Availability.
Attach to Subnet
Aviatrix Gateways are launched in a public subnet in AWS, GCP, and OCI. A public subnet in AWS VPC is defined as a subnet whose associated route table has a default route entry that points to the Internet gateway (IGW). To learn more about VPC and subnets, refer to this link.
If you do not have a VPC/VCN with public subnet in AWS, GCP, or OCI, you can use our Creating a VPC/VNet using CoPilot tool to create a VPC with fully populated public and private subnets in each AZ.
About Spoke Gateway General Settings
This section describes the settings that you can configure for a Spoke Gateway after the gateway is created. For instructions on how to configure the settings, see Enabling Spoke Gateway General Settings.
Use VPC/VNet DNS Server
The Use VPC/VNet DNS Server feature enables you to set the default DNS server for the Aviatrix gateway.
When this feature is On, it removes the default DNS server for the Aviatrix Gateway and instructs the gateway to use the VPC or VNet DNS server configured in VPC or VNet DHCP option.
When this feature is Off, the Aviatrix Gateway will revert to use its built-in (default) DNS server.
|
When enabling this feature, the Controller checks to make sure the gateway can indeed reach the VPC/VNet DNS server; if not, an error is returned. |
For more information, see Using VPC/VNet DNS Server.
Jumbo Frame
Jumbo Frame improves Aviatrix Gateway throughput performance.
|
GRO/GSO
The GRO/GSO feature enables you to configure the gateway interface and enable or disable Generic Receive Offload (GRO) and Generic Segmentation Offload (GSO).
GRO/GSO is On by default to improve performance. You can set this feature to Off to minimize out of order packets for sensitive applications (like FTP), but there will be a performance throughput penalty.
Gateway Single AZ HA
The Gateway Single AZ HA feature enables the Aviatrix Controller to monitor the health of the gateway instance and restart the gateway instance if it becomes unreachable. Gateway Single AZ HA is enabled by default.
Using Gateway Single AZ HA, you can select the gateway instance to restart.
When Gateway Single AZ HA status is On, the Aviatrix Controller attempts to restart the gateway instance. When status is Off, Controller does not attempt to restart the gateway instance.
| If you’re using Terraform to create Aviatrix gateways, you must enable the single_az_ha flag in the aviatrix_gateway resource. See Aviatrix Provider. |
Change Interface(s) RX Queue Size
Using the Change Interface(s) RX Queue Size, you can select a gateway and set the gateway’s interface(s) RX Queue Size.
-
A larger RX queue size introduces high latency in forwarding packets.
-
A smaller RX queue size has low latency but will drop packets early when forwarding packets.
Active-Standby
This feature enables you to deploy a BGP-enabled Spoke Gateway connection to an external device where the external device, such as an on-premises firewall, does not support asymmetric routing on two tunnels.
Active-Standby mode applies to both BGP and Static Remote Route Based external connections.
When Active-Standby mode is enabled, the BGP-enabled Spoke Gateway connects to the external device with only one active peering connection forwarding network traffic and the other as standby.
If you enable Active-Standby mode, you can select the Failover Mode to determine the network’s behavior when the active peering connection goes down.
-
When Preemptive is enabled, the network automatically switches back to using the active peering connection when the connection is back up.
-
When Non-Preemptive is enabled, the network continues to use the standby peering connection even after the active peering connection is back up, until you initiate a manual switch to the active peering connection.
For more information, see About Active-Standby External Connection Configuration.