8.2.0 Release Notes

Fixed an issue where toggling between Active/Active HA and Active/Standby modes for Site2Cloud connections was not working properly. Users can now successfully switch between these high availability modes as expected.

Fixed an issue where the traffic count displayed in the Controller interface could be inaccurate when using Distributed Cloud Firewall (DCF) with external groups that include multiple IP ranges.

The Controller now reports traffic statistics correctly for DCF rules involving external groups, providing accurate visibility for monitoring, analysis, and validation of firewall policy behavior.

Fixed an issue where upgrading the Controller from version 8.0.30 to 8.1.10 would display a "Service temporarily unavailable" error message. The system now properly handles the service restart during the upgrade process.

Resolved an issue where Edge gateway upgrades from version 8.1 to 8.1.10 could cause temporary traffic disruption due to service restarts during the upgrade process.

The upgrade workflow now handles service restarts more effectively, reducing traffic impact during Edge gateway upgrades, including in large-scale deployments.

Resolved an issue where the ESTABLISHED rule disappeared after a Public Subnet Filtering (PSF) gateway image upgrade.

This issue affected PSF gateways using the legacy stateful firewall on Controller versions 7.1 and later, and could result in traffic disruption after the upgrade. The rule is now preserved during PSF gateway image upgrades.

Fixed an issue with database schema type definitions that could trigger migration errors during the Controller upgrade process.

The schema now uses the correct database type definition, ensuring compatibility with migration logic and preventing upgrade failures.

Fixed an issue where FireNet deployments with bootstrap enabled could fail in Google Cloud due to changes in how GCP credentials were handled during the bootstrap process.

The bootstrap workflow has been updated to correctly retrieve and use GCP credentials, ensuring FireNet deployments with bootstrap complete successfully in Google Cloud environments.

Fixed an issue where deploying multiple GCP gateways through Terraform resulted in ResourceDuplicateId errors. Users can now successfully deploy multiple gateways in GCP regions without encountering resource ID conflicts.

Fixed an issue where the default access control rules did not properly allow ICMP traffic used for debugging. The updated rules ensure ICMP-based troubleshooting continues to work after upgrades.

Resolved an issue where upgrading to Controller 8.1 failed during database migration if VPC tunnel records contained non-numeric values in the timestamp field.

The migration logic now correctly handles timestamp values, preventing conversion errors and allowing the upgrade to complete successfully.

Resolved an issue where eBPF packet marking could fail on transit gateways with Network Segmentation enabled, causing traffic to be associated with incorrect network domains.

The packet marking logic has been corrected to ensure Network Segmentation policies are enforced consistently without requiring service restarts.

Azure gateway image upgrades may fail when the Controller does not have the required Azure image subscription access. During the upgrade, the system deletes the existing gateway before validating subscription availability, which can result in gateway deletion without a replacement being created. This leaves dangling gateways in the Controller and can cause potential service outages.

Impact:

Workaround:

None. To avoid outages, ensure the Controller subscription includes access to the required Azure image before attempting upgrades.

When upgrading from Controller version 7.1 to 7.2 or 8.0, Spoke Gateways with routing through a Public Subnet Filtering (PSF) Gateway may fail to upgrade and become unreachable if the PSF Gateway has not been upgraded first. This issue affects AWS environments where Spoke Gateway route tables are configured to point to a PSF Gateway.

To avoid this issue, follow the correct upgrade sequence:

During a gateway software upgrade, traffic matching DCF WebGroup rules may be briefly dropped during the upgrade. This impacts both Layer 7 (HTTP/HTTPS) and Layer 4 traffic and occurs across all supported cloud providers (AWS, Azure, and GCP). The disruption typically lasts a few seconds but may vary depending on gateway load and policy complexity.

Workaround:

None

Recommendations:

In Controller release 8.0, gateway software upgrades take longer to complete compared to earlier versions. On average, the upgrade rate drops from approximately 14 gateways per minute in version 7.2 to approximately 11 gateways per minute in 8.0, which is an increase of about 20% in execution time.

Affected Scenarios:

Impact:

Only the upgrade duration is affected. Gateway functionality remains unaffected after a successful upgrade.

Recommendations:

In some scenarios involving rapid VRRP state transitions, the keepalived VRRP state may not be reported accurately to the Controller. This can result in temporary discrepancies between the actual VRRP status and what is displayed in the Controller UI, leading to confusion and difficulties during troubleshooting.

Impact:

Workaround:

In some environments, the Firewall state may not recover from Unaccessible after the first vendor integration failure. This issue has been observed when integrating with third-party firewall vendors, leaving the gateway firewall state stuck even after the environment stabilizes.

Impact:

Workaround:

Contact Aviatrix Supportfor manual correction.

Transit gateways with large-scale tunnel deployments (1300+ tunnels) may experience extended traffic loss during image upgrades. Although the image upgrade completes successfully, traffic may remain down for several minutes afterward due to delayed tunnel reconfiguration.

Impact:

Workaround:

When DCF processes high volumes of logging messages, rsyslogd rate-limiting may cause message loss. The system drops messages exceeding 500 per 5-second interval, with rsyslogd logging "messages lost due to rate-limiting" notifications.

Affected Scenario: High-traffic environments generating intensive logging activity

Impact:

Workaround: Monitor rsyslogd logs for rate-limiting messages and consider implementing log aggregation strategies to distribute message processing load across multiple collection points.

Dry-run validation may fail when upgrading the Controller from version 8.0.10 to 8.1.0 due to a gateway version mismatch error. This occurs when the upgrade path starts from 8.0.0, progresses to 8.0.10 successfully, but encounters a dry-run failure when proceeding to 8.1.0.

In Oracle Cloud Infrastructure (OCI) environments, OpenVPN clients cannot connect to VPN gateways configured with DUO multi-factor authentication (MFA). Connection attempts fail with ECONNREFUSED errors during tunnel establishment, preventing authentication from completing.

Impact:

Workaround:

No current workaround. Users may temporarily switch to OKTA or LDAP authentication if feasible.

In large-scale deployments with 1300+ gateways, enabling Distributed Cloud Firewall Site-to-Cloud (DCF S2C) can cause gateway configurations to become out of sync with the Controller. Even after disabling DCF S2C, the issue may persist and lead to elevated Controller resource usage.

Impact:

Workaround:

When attaching VPN users to profiles using the attach_vpn_user_to_profile API, the CoPilot or Controller UI may continue to display the user profile as N/A even though the attachment operation completes successfully.

In some cases, users later reappear as active but still show no profile association in the UI. This results in a display inconsistency between the UI and the backend state.

Impact: VPN user profile assignments may appear unsuccessful in the UI, which can cause confusion during profile management. There is no functional impact: the VPN profile is correctly assigned in the backend, and users can connect to the VPN as expected.

Affected Scenario: OpenVPN profile management operations that use API-based user-to-profile attachment.

Workaround: None.

When a Controller experiences out-of-memory conditions followed by upsizing and restart, duplicate resource ID entries may be created in the database. This prevents the Controller from starting properly and blocks access to the web UI.

Impact:

Affected Scenario:

Controllers that have experienced memory issues, been upsized, and restarted may encounter this database corruption.

Workaround:

Connect directly to the Controller database and manually remove the duplicate resource ID entries to restore normal operation.

In Controller version 8.2.0, gateways may remain in a Configuration Not Up-to-Date state when applying Distributed Cloud Firewall (DCF) policies under certain conditions.

This issue can occur when DCF policies with Web Groups and IDS or IPS enabled are pushed to gateways. The configuration update does not complete within the expected time, which may leave the gateway out of sync.

Impact:

Affected Scenario:

Gateways running Controller 8.2.0 with DCF policies that include IDS or IPS features, particularly on smaller gateway instance sizes.

Workaround: Restart the affected gateway to clear the condition and allow the configuration to be applied successfully. If the issue persists, contact Aviatrix Support for assistance.

When clients use HTTP/2 connections, TrafficServer incorrectly reuses origin connections, potentially causing connection handling issues in MITM SNI verification scenarios.

Impact:

Affected Scenario:

HTTP/2 client connections with MITM SNI verification enabled

Workaround:

Use both IP address and SNI instead of IP alone to ensure proper connection isolation.

When a gateway is downsized in environments with IPS (Intrusion Prevention System) enabled, L7 traffic (HTTP/HTTPS) is dropped instead of being allowed through. The system blocks traffic when it detects that security policies cannot be properly enforced due to insufficient gateway resources, preventing the traffic-server from running.

Affected Scenario: Gateways with IPS enabled that undergo downsizing operations.

Impact:

Workaround: Resize the gateway back to adequate specifications that support IPS functionality and traffic-server operations.

In some environments, after the Identity Provider (IdP) rotates its SAML signing certificate, the Aviatrix Controller may fail to fetch and update the new certificate from the configured metadata URL.

As a result, the Controller continues to use a stale certificate, which causes signature verification errors during SAML authentication.

Impact: SAML single sign-on (SSO) authentication fails. Users may experience repeated login failures or timeouts and are unable to access the Controller dashboard using SAML.

Workaround: Contact Aviatrix Support to manually update the SAML certificate on the Controller.

When upgrading gateway software from version 7.2 to 8.0.30, the VRRP state file becomes empty on AEP edge gateways configured in active-active HA pairs. The keepalived service continues running and the keepalived.conf file retains correct configuration, but /etc/localgateway/vrrp_state.json loses primary/backup information.

Affected Scenario: AEP edge gateways with VRRP configuration during software upgrade from 7.2.x to 8.0.30

Impact:

Workaround: Reconfigure VRRP settings on affected gateways after the upgrade to repopulate the state file with correct primary/backup information.

Additional Distributed Cloud Firewall (DCF) log support records end-session events for IDS and IPS signature matches. These logs include a reason field indicating the match type (IPS_POLICY_DENY or IDS_POLICY_ALERT) along with the Signature ID (SID) of the matched rule.

Due to a bug, the end-session log is omitted when Decryption is not enabled for Intrusion Analysis.

Impact:

Affected Version: 8.2.0

Workaround: Enable Decryption under Intrusion Analysis to ensure end-session logs are generated.

When upgrading gateways from version 8.1.20 to 8.2.0 in rare cases, we have seen the gateway could enter an infinite retry loop attempting to download a non-existent configuration file from the Controller, causing the upgrade process to fail completely.

Impact:

Workaround: Retry the gateway upgrade operation from the Controller UI or Copilot UI. If the issue persists, perform an image upgrade of the impacted gateway.

When the Controller processes inventory data across multiple accounts and inventory types, the public.inventory table in the database continuously grows by inserting new entries for each inventory operation instead of updating existing records. This results in excessive database storage consumption and potential performance degradation as the table can accumulate millions of unnecessary duplicate entries.

Impact:

Workaround: Monitor database size regularly and consider periodic cleanup of old inventory entries through database maintenance windows until the fix is implemented.

When CoPilot Asset Inventory (CAI) performs queries on the inventory table, the existing database indexes are not utilized effectively, causing performance degradation during inventory operations.

Affected Scenario: CAI inventory queries for retrieving resource counts and metadata across cloud service providers experience slower response times.

Impact:

Workaround: None.

When upgrading the Controller to version 8.1, the database migration may fail if the tunnel rtt_avg field contains None values. The migration logic expects either a numeric value or the string "N/A", and encountering a None value causes the upgrade to stop.

Impact:

Workaround: Contact Aviatrix Support for assistance in correcting the database values before retrying the upgrade.

Azure controllers using default P6 disk tier (240 IOPS) may experience performance issues, particularly with 8.x containerized controllers. This limitation can cause system instability and processing delays during high-load operations.

Affected Scenario: Controllers launched from Azure marketplace AMI with default disk configuration.

Impact:

Workaround: Upgrade the Azure controller disk tier from default P6 to minimum P10 (500 IOPS) through Azure portal disk configuration settings.

When ICMP traffic passes through Suricata inspection on gateways, alert rules trigger only once until the Suricata process restarts. This limitation affects the eBPF → proxyPcap → Suricata traffic path and likely impacts UDP and other non-TCP protocols as well.

Impact:

Affected Scenario: Gateways with Suricata-based security inspection enabled for ICMP and potentially UDP traffic.

Workaround: Contact Aviatrix Support to restore the alert functionality for ICMP traffic.

When processing decrypted POST traffic through the ATS tee plugin on PSF gateways, the gateway may crash during request body processing. This occurs specifically with decrypted traffic that contains POST requests being processed by the tee plugin functionality.

Impact:

Affected Scenario: PSF gateways processing decrypted POST traffic through ATS tee plugin

Workaround: Avoid routing decrypted POST traffic through PSF gateways with ATS tee plugin enabled until the fix is available.

When managing Distributed Cloud Firewall (DCF) rules through Terraform with Multi-Writer Policy (MWP) enabled, Terraform operations may take significantly longer compared to using the legacy V1 policy list.

In environments with large rule sets, such as 3,000+ DCF rules, the Terraform apply and refresh operations can be up to 20× slower** when compared to storing them in the default V1 policy list.

This behavior has been observed in environments with hundreds of spokes and high rule volume.

Impact:

Affected Scenario: Terraform workflows that create or manage large DCF rulesets under Multi-Writer Policy (MWP).

Workaround: Rule sets can be broken up in multiple smaller rule sets under a rule block, this helps manageability. The recommended maximum size for a ruleset is 500-750 rules. Contact Aviatrix Support for further assistance with large-scale DCF Terraform deployments.

When deploying a load balancer–enabled VPN gateway with an overlapping VPN CIDR on Controller versions 8.0, 8.1, or 8.2, the gateway creation fails.

Impact:

Affected Scenario: Load balancer–enabled VPN gateway deployments on Controller versions 8.0, 8.1, and 8.2.

Workaround:

Ensure that the VPN CIDR does not overlap with existing gateways behind the load balancer before deployment. Contact Aviatrix Support for assistance.

In Aviatrix software versions 8.1.x and 8.2.0, the VRRP state file /etc/localgateway/vrrp_state.json, may be empty on AEP and self-managed Edge-as-Spoke gateways configured in active-active HA pairs. This prevents VRRP state updates from being sent from the edge gateways to the Aviatrix Controller, and Aviatrix CoPilot will not display the updated VRRP states. This is a cosmetic issue and there will be no disruption to traffic.

Impact:

Affected Scenario: - AEP and self-managed Edge-as-Spoke gateways in active-active HA deployments with VRRP enabled upgrade from 8.0 to 8.1 or created in 8.1 and 8.2

Workaround: Please contact Aviatrix Support for assistance to help you fix the incorrect display of VRRP states in Aviatrix CoPilot.