About External Device Connection Settings

Create an External Device Connection that uses BGP; a Static Route-Based or Static Policy-Based (Mapped or Unmapped) connection; or an AWS VGW/Azure VNG connection.

For the Static options, you should select Unmapped (any Static option not marked as Mapped) unless the Local Subnet and the Remote Subnet overlap. Then you must select a Mapped connection.

The Transit Gateway on which to apply the external connection.

The CIDR(s) of the Local Gateway selected in this external connection (the name changes to Real Local Subnet CIDR(s) if a Mapped connection is selected).

Select the gateway type of the external connection.

You should select 'Generic' for most connections (used for most third-party routers and firewalls). Select 'Aviatrix' if you are terminating on an Avatrix on-premise gateway.

Any other Remote Gateways listed here are only valid with Controller version 6.7 or lower.

The CIDR(s) of the remote gateway selected in this external connection (the name changes to Real Remote Subnet CIDR(s) if a mapped connection is selected).

Virtual local network CIDRs that are mapped to the real local subnet.

Virtual remote network CIDR(s) that are mapped to the real remote subnet.

PSK-based or Cert-based. If the latter is selected, you upload or import a remote CA certificate and enter the SAN of the certificate in the Remote Identifier field. If HA is enabled for the selected gateway you also enter the SAN of the HA gateway in the Remote Identifier field.

Used in authentication. It is a string you enter when you configure your connection. If you do not specify one, it is auto-generated.

The BGP AS number the Transit GW will use to exchange routes with external device.

When BGP is selected, the BGP AS number the external device will use to exchange routes Aviatrix Transit GW.

Select this option if your underlying infrastructure is a private network, such as AWS Direct Connect and Azure ExpressRoute. See the "How does it work" section for more details. When this option is selected, BGP and IPsec run over private IP addresses.

Select the option to connect to the remote site using IKEv2 protocol.

Aviatrix-supported encryption algorithms. If this is turned on, you can configure the following algorithms:

Enable this setting to set up High Availability (HA) instances for each new connection that can go up if the primary instance goes down. When active, each standby instance will use the same IP address as the remote connection.

An approval process for gateway-learned CIDRs. When this is On, an email notification is sent to the administrator to approve the learned CIDRs before they are propagated to the Spoke VPC/VNet route table.

IP address of the remote device.

The instance on the local gateway …​

Optional parameter. This field is for the tunnel inside IP address of the Transit Gateway. Leave it blank.

Optional parameter. This field is for the tunnel inside IP address of the external device. Leave it blank.

Select the Aviatrix Gatway to link to the Azure VNG.

The AWS region where VGW is created.

The name of the AWS account that the VGW is created with.

VGW that is created in the VGW region in the AWS VGW account.

Select the VNG Name (only displays if an Aviatrix Gateway is selected).

Allow gateways to support Active-Active mode where both tunnels are up and packets are routed to both gateways via respective VPC/VNet route tables.

To enable this, slide the toggle switch to turn it On.

Typically you enable the Forward Traffic to Transit Gateway option when you have a connection that has overlapping CIDRs. This forwarding ensures that traffic is sent between on-prem routers and local Spoke and Transit gateways.

In most cases you will enable this so that your on-premise traffic is forwarded.

Jumbo Frame improves Aviatrix Gateway throughput performance.

Dead Peer Detection (DPD) is a standard mechanism (RFC 3706) between IPsec tunnels to send periodic messages to ensure the remote site is up.

By default DPD detection is enabled.

By default, Aviatrix configures gateway’s public IP as the Local Identifier. You can adjust these settings to your gateway’s private IP.

Aviatrix only supports IP_ADDRESS and KEY_ID as the IKE identity type for the remote identifier in the pre-shared key authentication. The IP_ADDRESS must be a valid IPv4 IP address. The KEY_ID is a remote device ID during the key authentication.

By default, Aviatrix configures the public IPv4 address of the peer device as the Remote Identifier for pre-shared key authentication. You can adjust this setting to the private IPv4 address of the peer device.

Clear Session allows you to reset all the active sessions on a selected Site2Cloud connection. Click Clear to clear these connections.