You give a tag a name and a list of one or more network addresses. The network address can be a subnet or a host IP address. In the Aviatrix Controller, navigate to Security > Stateful Firewall > Tag Management > +Add New.

A tag is a global resource to the Aviatrix Controller and can be applied to any gateway.