Enabling Transit Egress
|
You must have at least Controller version 7.0.1577 to use this feature. Aviatrix recommends that you only use the Transit Egress feature in CoPilot if you are currently using the Egress FQDN Filtering (Legacy) feature in Aviatrix Controller. New users should use the Distributed Cloud Firewall for Egress. |
On the Transit Egress tab, you can enable Egress Control on Transit Gateways that:
-
have Transit Egress Capability selected but do not have firewalls attached as per the FireNet workflow.
-
have attached Spoke Gateways that do not already have Egress enabled.
This Transit Gateway can then send its attached Spoke Gateway traffic to the Internet. The Spoke Gateways will own all routes but send all egress traffic to this Transit Gateway.
| You can only edit AWS Transit gateways (on the Cloud Fabric > Gateways > Transit Gateways tab) to add Transit Egress Capability. The other cloud Transit gateways (Azure, GCP, OCI) cannot be edited to add this functionality. You must select the Transit Egress Capability when first creating Transit gateways in those cloud providers. |
Configuring Transit Egress
-
On the Security > Egress > Transit Egress tab, click Enable Egress on Transit.
-
Configure the following:
Field Description Transit Gateway
Select a Transit gateway from the list.
Primary Egress (AWS only)
Enable the selected Transit gateway to provide Egress control for its attached Spoke gateways.
Secondary Egress (AWS only)
Enable the selected Transit gateway to send traffic to the Primary Egress Transit gateway that is providing Egress control.
Attach Secondary Egress (AWS only)
Select the Secondary Egress Transit gateways that will send traffic to the Primary Egress Transit gateway.
Gateway Load Balancer
Off by default.
Egress
On by default.
Egress Instance Size
Select the instance size for the Egress instance. The size you select is applied to all Egress Subnets you select.
Egress Subnet
Select the Egress Subnet(s).
-
Click Enable. This adds FQDN capability to the selected Transit gateway, which handles egress traffic for the Spokes that send traffic to this Transit gateway.