Planning Your Egress Control Deployment
Any vendor specific comments to be noted?
Any GCP instance (excluding Controller-created gateways) that needs to participate in egress control (FQDN, SNAT and FW Egress) has to be tagged as "avx-snat-noip". The GCE network tag "avx-snat-noip" can be associated during GCP instance creation or by editing an existing instance.
What happens if I enable FQDN and there are route tables that have an existing default route?
When enabling egress filtering on a VPC/VNet, each subnet’s route table is reviewed. If there is an existing default route (0.0.0.0/0) in the route table, the following logic is used:
Target | Aviatrix action |
---|---|
igw-* |
Ignore this route table |
anything other than igw-* |
Update the Target to point to the AVX GW ENI and remember the current value of Target. (see note below) |
If the Gateway is detached from the VPC/VNet (via the egress configuration page), the route table will be updated with the original values. |
Can FQDN gateway be deployed in central place?
Yes. The Aviatrix FQDN gateway can be deployed centrally in the TGW environment as shown in the diagram below.
![fqdn_in_firenet](_images/security-egress-firenet.png)
One use case is if you need to limit the public IP addresses to a third-party public service. Follow the Firewall Network workflow to deploy.