Aviatrix

No entries match these filters. Clear filters

1. announced seen Oct 28, 2026 · issue 123

   Aviatrix launches Clearance: per-workload outbound and lateral containment with monitor-mode shadow rules and one-action enforcement/backout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ▶ ⤢
   • Adds Aviatrix Clearance™ to the Aviatrix Containment Platform, introducing Outbound Containment (limiting each workload to outbound destinations it is explicitly cleared for, named by domain rather than network address) and Lateral Containment (restricting workload-to-workload reachability by identity across clouds and Kubernetes/serverless paths not governed by hub-based inspection), enforcing per-workload outbound and lateral communication policy by workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. and protocol across clouds, down to individual containers, serverless functions, databases, and AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Aviatrix Active Defense™, an autonomous agent layer that models the estate from live traffic, drafts per-application policies with no tagging project or inventory import, proves each policy in monitor mode on real traffic, and keeps policies current as the estate changes.
   • Adds Shadow Rule Set monitor mode, which evaluates a new policy alongside the live policy on real traffic and shows exactly which connections would be blocked before any enforcement change is made.
   • Delivers single-setting enforcement and single-action backout for every containment policy.
   • Offers a free read-only Containment Assessment (at aviatrix.ai/containment-assessment) that installs nothing and can reserve AWS Marketplace enrollment; makes Clearance free for all enterprises — covering Outbound Containment, Lateral Containment, and Intrusion Prevention with no workload cap — from November 1, 2026 through May 1, 2027 via AWS Marketplace; provides a General Availability tier with a Containment Assessment plus 15 workloads in monitor or enforce mode with no time limit, priced per workload and delivered on Aviatrix Cloud (same controls also available on Aviatrix Enterprise); and makes Aviatrix Active Defense available today in free early access for design partners.

   5 details in Everything

2. announced seen Oct 28, 2026 · issue 018

   Aviatrix launches Clearance: per-workload outbound and lateral containment with monitor-mode shadow rules and one-action enforcement/backout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ▶ ⤢
   • Adds Aviatrix Clearance™ to the Aviatrix Containment Platform, introducing Outbound Containment (limiting each workload to outbound destinations it is explicitly cleared for, named by domain rather than network address) and Lateral Containment (restricting workload-to-workload reachability by identity across clouds and Kubernetes/serverless paths not governed by hub-based inspection), enforcing per-workload outbound and lateral communication policy by workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. and protocol across clouds, down to individual containers, serverless functions, databases, and AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Aviatrix Active Defense™, an autonomous agent layer that models the estate from live traffic, drafts per-application policies with no tagging project or inventory import, proves each policy in monitor mode on real traffic, and keeps policies current as the estate changes.
   • Adds Shadow Rule Set monitor mode, which evaluates a new policy alongside the live policy on real traffic and shows exactly which connections would be blocked before any enforcement change is made.
   • Delivers single-setting enforcement and single-action backout for every containment policy.
   • Offers a free read-only Containment Assessment (at aviatrix.ai/containment-assessment) that installs nothing and can reserve AWS Marketplace enrollment; makes Clearance free for all enterprises — covering Outbound Containment, Lateral Containment, and Intrusion Prevention with no workload cap — from November 1, 2026 through May 1, 2027 via AWS Marketplace; provides a General Availability tier with a Containment Assessment plus 15 workloads in monitor or enforce mode with no time limit, priced per workload and delivered on Aviatrix Cloud (same controls also available on Aviatrix Enterprise); and makes Aviatrix Active Defense available today in free early access for design partners.

   5 details in Everything

3. announced seen Sep 22, 2026 · issue 082

   Aviatrix launches Harvest and Decrypt Protection: post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. encryption plus Communication Governance in one software policy, free for first five policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds post-quantum key exchangepost-quantum key exchangeA cryptographic handshake algorithm designed to resist attacks from quantum computers, using math problems like lattices that quantum algorithms cannot efficiently solve, letting tools stay secure against future quantum-capable adversaries. using the ML-KEM standard on the control plane across Aviatrix-encrypted paths, making intercepted traffic unreadable to future quantum computers without a hardware refresh or network redesign.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Communication Governance on the same gateways that handle encryption, enforcing explicit workload-to-workload reachability policy at the granularity of workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. and protocol on every available path.
   • Provides crypto agility as a configuration setting — the post-quantum algorithm can be swapped with a configuration push rather than a hardware refresh cycle.
   • Adds a self-service Containment Assessment tool that tests five properties of the cloud estate and returns a provisional Blast Radius and harvest exposure read in approximately five minutes.
   • Adds a Containment Assessment level 2 — a read-only, agentless engagement against live runtime flows that quantifies exposure as Reachable Value at Risk in dollars, before any policy is written.

   +2 more show less

   • Extends the quantum-safequantum-safeCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. roadmap with crypto visibility: a network-path cryptographic inventory mapping which applications communicate in cleartext, what they depend on, and where they communicate.
   • Harvest and Decrypt Protection is available at no cost for the first five policies and five nodes for existing customers, with no license and no time limit; new customers receive a 30-day free trial.

   7 details in Everything

4. docs update Sep 18, 2026 · issue 078

   Aviatrix VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Client 3.0.2 adds native Apple Silicon support and extends Ubuntu coverage to 26.04⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Packages the macOS installer as a Universal binary, running natively on both Intel and Apple Silicon (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) Macs without Rosetta 2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Ubuntu 26.04 alongside Ubuntu 22.04 and 24.04.
   • Packages the macOS installer as a Universal binary, running natively on both Intel and Apple Silicon (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) Macs without Rosetta 2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. build of VPN Client 3.0.2 requires the VPN gateway's UserVPN CA to use an RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key of at least 2048 bits; gateways on Controller versions earlier than 8.2, or Controller 8.2 whose UserVPN CA has not been rotated, may use a 1024-bit key (generated on Aviatrix 7.1 or earlier) that the FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. module will reject, preventing the client from verifying the gateway server certificate.
   • !Ubuntu 20.04 support is deprecated in VPN Client 3.0.2.
5. docs update Sep 18, 2026 · issue 078

   Aviatrix adds Security > Egress > Overview tab with Egress Security Score and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. protection status (requires Controller 8.0 + DCF).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Check your organisation's overall egress posture and identify unprotected VPC/VNets at a glance after upgrading to Controller 8.0 with DCF enabled.
   📍In the Aviatrix Controller, go to Security › Egress › Overview. Review the Egress Security Score card and the Protected VPC/VNets chart to see which VPCs/VNets are Unprotected, Monitored, Partially Protected, or Protected. Click Manage VPC/VNets to open the Egress VPC/VNets tab and begin remediating gaps.
   • Adds the Security > Egress > Overview tab (requires Controller 8.0 and DCF enabled) showing an Egress Security Score card for VPC/VNets and a breakdown of Unprotected, Monitored, Partially Protected, Protected, No Egress, and Unknown states.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Egress Security Score Explained dialog (accessed via Learn More on the Overview tab) that details how the score is calculated and the score values assigned per VPC/VNet protection status.
   • Adds Manage VPC/VNets shortcut on the Egress Security Score card that navigates directly to the Egress VPC/VNets tab for protection management.

   3 details in Everything

6. 10.1.0 Sep 17, 2026 · issue 078

   Aviatrix 10.1.0 adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., end-to-end VRFVRFA Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. multi-tenancy, DCF East-West L7 inspection, Premium IPS feeds, and Flexible Gateway Deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable DCF intra-cluster policy enforcement on an EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. cluster so that Distributed Cloud Firewall controls all east-west pod traffic via existing CNI NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. support.
   📍In CoPilot, go to Security › Distributed Cloud Firewall › Settings › Intra-Cluster, select the target EKS cluster, and enable enforcement.
   Activate the Premium ET Pro IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule feed so that matched traffic is handled according to your active IPS Profile severity thresholds, without replacing any custom Suricata rules you have uploaded.
   📍In CoPilot, go to Security › Distributed Cloud Firewall › IPS › Rule Feeds; the ET Pro feed is listed as the default entry — confirm it is enabled, then verify or adjust severity thresholds in your active IPS Profile.
   Resize a single gateway instance without touching HA peers or changing the group default size, useful when one instance needs more capacity after a traffic spike.
   📍In CoPilot, go to Cloud Fabric › Gateways › (transit or spoke) › gateway group › Instances tab, select the individual instance, and choose a new size.
   • Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPS feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds DCF intra-cluster enforcement for EKS, enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.
   • Adds VRF for multi-tenancy (end-to-end propagation) across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.
   • Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.
   • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated IPsec data plane as a separate FIPS-validated gateway build; existing gateways must be replaced (not toggled) to enter FIPS mode.

   +16 more show less

   • Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.
   • Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.
   • Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.
   • Promotes Kubernetes Discovery and SmartGroups to general availability, enabling DCF rules to enforce policy across both Kubernetes Pods/Services and VM workloads.
   • Promotes DCF CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. Exclusion List to general availability.
   • Adds Universal Installer for the Aviatrix OpenVPN Client.
   • Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab without affecting HA or the group default size; surfaces Multiple Sizes label when a group has diverged.
   • Adds Azure v6 instance support for gateways on Controller 10.1.0 and later.
   • Adds AZ Affinity Across Transit, enabled per peering (disabled by default) on AWS same-region HPE peerings.
   • Adds opt-in AWS inter-region jumbo frame support for transit peering (AWS only, excluding partitions such as AWS GovCloud that do not support jumbo frames).
   • Adds GCP Global VPC Regional Spoke Egress (Phase 2), letting operators choose which regions egress locally vs. through FireNet, with both modes coexisting in the same Global VPC; CoPilot Egress page now shows Global VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. in a nested tree displaying each region's egress mode.
   • Adds SNAT and HPE support on Azure spokes with subnet groups for both HPE and non-HPE deployments, configurable via the existing Controller API/CLI or Terraform.
   • Adds AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. onboarding with Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., with Controller auto-detecting the Entra ID setting on the AKS cluster.
   • Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKS, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.
   • Adds Make Before Break Gateway Replacement (Preview), preserving the gateway's external IP through cut-over so partners and firewalls need no reconfiguration, with automatic eligibility checking per gateway.
   • Adds Smart Gateways Phase 3 (Preview) covering transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways, controlled by three tiered feature flags (fabric-wide kill switch, per-group underlay flag, per-group route-resolver flag) all off by default.
   • Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPS feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds DCF intra-cluster enforcement for EKS, enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.
   • Adds VRF for multi-tenancy (end-to-end propagation) across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.
   • Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.
   • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated IPsec data plane as a separate FIPS-validated gateway build; existing gateways must be replaced (not toggled) to enter FIPS mode.

   +13 more show less

   • Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.
   • Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.
   • Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.
   • Promotes Kubernetes Discovery and SmartGroups to general availability, enabling DCF rules to enforce policy across both Kubernetes Pods/Services and VM workloads.
   • Promotes DCF CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. Exclusion List to general availability.
   • Adds Universal Installer for the Aviatrix OpenVPN Client.
   • Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab without affecting HA or the group default size; surfaces Multiple Sizes label when a group has diverged.
   • Adds Azure v6 instance support for gateways on Controller 10.1.0 and later.
   • Adds AZ Affinity Across Transit, enabled per peering (disabled by default) on AWS same-region HPE peerings.
   • Adds opt-in AWS inter-region jumbo frame support for transit peering (AWS only, excluding partitions such as AWS GovCloud that do not support jumbo frames).
   • Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKS, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.
   • Adds Make Before Break Gateway Replacement (Preview), preserving the gateway's external IP through cut-over so partners and firewalls need no reconfiguration, with automatic eligibility checking per gateway.
   • Adds Smart Gateways Phase 3 (Preview) covering transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways, controlled by three tiered feature flags (fabric-wide kill switch, per-group underlay flag, per-group route-resolver flag) all off by default.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Private Mode is fully removed; deployments still on Private Mode cannot upgrade in place and must be rebuilt as Flexible Gateway deployments.
   • !Controller UI features formerly managed in the Controller UI are now managed exclusively from CoPilot; onboarding flows for new and existing deployments now route through CoPilot.
7. 10.1.0 Sep 17, 2026 · issue 012

   Aviatrix 10.1.0 adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., end-to-end VRFVRFA Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. multi-tenancy, DCF East-West L7 inspection, Premium IPS feeds, and Flexible Gateway Deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable DCF intra-cluster policy enforcement on an EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. cluster so that Distributed Cloud Firewall controls all east-west pod traffic via existing CNI NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. support.
   📍In CoPilot, go to Security › Distributed Cloud Firewall › Settings › Intra-Cluster, select the target EKS cluster, and enable enforcement.
   Activate the Premium ET Pro IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule feed so that matched traffic is handled according to your active IPS Profile severity thresholds, without replacing any custom Suricata rules you have uploaded.
   📍In CoPilot, go to Security › Distributed Cloud Firewall › IPS › Rule Feeds; the ET Pro feed is listed as the default entry — confirm it is enabled, then verify or adjust severity thresholds in your active IPS Profile.
   Resize a single gateway instance without touching HA peers or changing the group default size, useful when one instance needs more capacity after a traffic spike.
   📍In CoPilot, go to Cloud Fabric › Gateways › (transit or spoke) › gateway group › Instances tab, select the individual instance, and choose a new size.
   • Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPS feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds DCF intra-cluster enforcement for EKS, enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.
   • Adds VRF for multi-tenancy (end-to-end propagation) across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.
   • Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.
   • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated IPsec data plane as a separate FIPS-validated gateway build; existing gateways must be replaced (not toggled) to enter FIPS mode.

   +16 more show less

   • Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.
   • Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.
   • Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.
   • Promotes Kubernetes Discovery and SmartGroups to general availability, enabling DCF rules to enforce policy across both Kubernetes Pods/Services and VM workloads.
   • Promotes DCF CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. Exclusion List to general availability.
   • Adds Universal Installer for the Aviatrix OpenVPN Client.
   • Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab without affecting HA or the group default size; surfaces Multiple Sizes label when a group has diverged.
   • Adds Azure v6 instance support for gateways on Controller 10.1.0 and later.
   • Adds AZ Affinity Across Transit, enabled per peering (disabled by default) on AWS same-region HPE peerings.
   • Adds opt-in AWS inter-region jumbo frame support for transit peering (AWS only, excluding partitions such as AWS GovCloud that do not support jumbo frames).
   • Adds GCP Global VPC Regional Spoke Egress (Phase 2), letting operators choose which regions egress locally vs. through FireNet, with both modes coexisting in the same Global VPC; CoPilot Egress page now shows Global VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. in a nested tree displaying each region's egress mode.
   • Adds SNAT and HPE support on Azure spokes with subnet groups for both HPE and non-HPE deployments, configurable via the existing Controller API/CLI or Terraform.
   • Adds AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. onboarding with Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., with Controller auto-detecting the Entra ID setting on the AKS cluster.
   • Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKS, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.
   • Adds Make Before Break Gateway Replacement (Preview), preserving the gateway's external IP through cut-over so partners and firewalls need no reconfiguration, with automatic eligibility checking per gateway.
   • Adds Smart Gateways Phase 3 (Preview) covering transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways, controlled by three tiered feature flags (fabric-wide kill switch, per-group underlay flag, per-group route-resolver flag) all off by default.
   • Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPS feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds DCF intra-cluster enforcement for EKS, enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.
   • Adds VRF for multi-tenancy (end-to-end propagation) across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.
   • Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.
   • Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated IPsec data plane as a separate FIPS-validated gateway build; existing gateways must be replaced (not toggled) to enter FIPS mode.

   +13 more show less

   • Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.
   • Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.
   • Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.
   • Promotes Kubernetes Discovery and SmartGroups to general availability, enabling DCF rules to enforce policy across both Kubernetes Pods/Services and VM workloads.
   • Promotes DCF CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. Exclusion List to general availability.
   • Adds Universal Installer for the Aviatrix OpenVPN Client.
   • Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab without affecting HA or the group default size; surfaces Multiple Sizes label when a group has diverged.
   • Adds Azure v6 instance support for gateways on Controller 10.1.0 and later.
   • Adds AZ Affinity Across Transit, enabled per peering (disabled by default) on AWS same-region HPE peerings.
   • Adds opt-in AWS inter-region jumbo frame support for transit peering (AWS only, excluding partitions such as AWS GovCloud that do not support jumbo frames).
   • Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKS, and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.
   • Adds Make Before Break Gateway Replacement (Preview), preserving the gateway's external IP through cut-over so partners and firewalls need no reconfiguration, with automatic eligibility checking per gateway.
   • Adds Smart Gateways Phase 3 (Preview) covering transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways, controlled by three tiered feature flags (fabric-wide kill switch, per-group underlay flag, per-group route-resolver flag) all off by default.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Private Mode is fully removed; deployments still on Private Mode cannot upgrade in place and must be rebuilt as Flexible Gateway deployments.
   • !Controller UI features formerly managed in the Controller UI are now managed exclusively from CoPilot; onboarding flows for new and existing deployments now route through CoPilot.
8. Aviatrix CoPilot — 4.37.0 Release Notes Sep 10, 2026 · release notes

   Aviatrix CoPilot 4.37 adds Manage Route Tables, Distributed Cloud Firewall Value Dashboard, Gateway Start/Stop, and CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. generation.

   • Adds a Manage Route Tables settings card for redesigned VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. routing with private route table cards for Azure and AWS transit gateways
   • Adds a new FireNet Details page consolidating FireNet status across horizontally scaled transit gateways
   • Adds support for Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. horizontal scaling beyond two gateway instances
   • Adds Recommended Security Controls on the Security Control page with ten curated controls starting in Monitor mode
   • Adds the ability to edit an entire IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Rule Feed at once within the enhanced IPS Rule Feed experience

   +9 more show less

   • Consolidates Kubernetes cluster onboarding into a single flow with a new Route Cluster Connectivity through Spoke Gateway toggle for private clusters
   • Promotes Enforcement on Clouds and Distributed Cloud Firewall on Kubernetes to general availability
   • Adds Deprecation Notice page in the CoPilot UI for upcoming feature deprecations
   • Removes CostIQ, ThreatIQ, Geoblocking, and Cluster Deployment features from the CoPilot UI
   • Adds Gateway Start and Stop capabilities via action menus for gateway groups and individual instances, including bulk operations
   • Adds ability to select a spoke gateway per region for Local Egress on GCP Global VPC
   • Adds support for additional outbound CIDRs for transit and spoke peering and migration of multiple-IP SNAT configurations
   • Adds Table Views for the Power and Auto-Sizing Cycles table and System Messages tab
   • Adds CSR generation directly from the CoPilot UI to install certificates

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The CostIQ, ThreatIQ, Geoblocking, and Cluster Deployment features have been removed from the CoPilot UI.
9. docs update Aug 14, 2026 · issue 045

   Aviatrix VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Client 3.0.2 adds native Apple Silicon support and extends Ubuntu compatibility to 26.04

   • Adds Universal binary macOS installer that runs natively on both Intel and Apple Silicon (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) Macs, eliminating the Rosetta 2 requirement.
   • Extends Ubuntu support to Ubuntu 22.04, 24.04, and 26.04 in VPN Client 3.0.2.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. build of VPN Client 3.0.2 requires the VPN gateway's UserVPN CA to use an RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. key of at least 2048 bits; gateways on Controller versions earlier than 8.2, or Controller 8.2 whose UserVPN CA has not been rotated since upgrade, may have a 1024-bit RSA CA (generated by Controllers originally initialized on Aviatrix 7.1 or earlier) and must rotate the CA via the CA Certificate Rotation of UserVPN workflow before upgrading the client.
   • !Ubuntu 20.04 is deprecated and no longer supported in VPN Client 3.0.2.
10. docs update Aug 14, 2026 · issue 045

    Aviatrix adds Egress Security Score dashboard tab showing VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. protection scoring and breakdown (requires Controller 8.0 + DCF)

    ⤢ ⤢ ⤢
    • Adds Security > Egress > Overview tab (requires Controller 8.0 and DCF feature enabled) showing an Egress Security Score card, a score-calculation explainer dialog, and a Protected VPC/VNets breakdown chart.
    • Adds Manage VPC/VNets shortcut on the Egress Security Score card linking directly to the Egress VPC/VNets tab for inline remediation.

    2 details in Everything

11. docs update Aug 14, 2026 · issue 045

    Aviatrix 10.0 docs add AI agent workload containment, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration, CNSF, and Kubernetes Firewall coverage

    • Introduces the Aviatrix Cloud Native Security Fabric (CNSF), a new architectural framework for cloud-native security.
    • Adds AI Agent Workload Containment via the Distributed Cloud Firewall (DCF) to close network security gaps for AI agent workloads.
    • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server Security through a containment architecture addressing egress security for Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
    • Adds an Aviatrix MCP Server for Enterprise Fabrics, enabling MCP-compatible AI agents to connect to Aviatrix enterprise fabric operations.
    • Adds an Aviatrix MCP for Docs integration, enabling MCP-compatible AI agents to connect to Aviatrix documentation.

    +14 more show less

    • Publishes validated prompts and example outputs for Suggested Use Cases for the Aviatrix Enterprise MCP Server.
    • Adds Kubernetes Firewall support within DCF (mix of Preview and GA features) for container workload micro-segmentation.
    • Documents DNS Hostname SmartGroups, enabling filtering of non-HTTP/TLS traffic by hostname within DCF policies.
    • Documents ActiveMesh 4.0 as the latest version of the Aviatrix encrypted transit network architecture.
    • Documents IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support overview for cloud transit connectivity.
    • Documents Edge Spoke Gateway Horizontal Scaling for high-throughput edge deployments.
    • Documents VLAN segmentation extension to the cloud via the Aviatrix Hybrid Cloud Edge solution.
    • Documents Bidirectional Forwarding Detection (BFD) for BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. on Aviatrix transit gateways.
    • Documents BGP Communities support in Aviatrix.
    • Documents Local Internet Breakout at the network edge for the Hybrid Cloud Edge solution.
    • Documents customized SNAT and DNAT support on Edge gateways.
    • Documents Transit Peering over public networks with Edge Spoke Gateway for multicloud environments.
    • Documents Transitive Routing support on Edge Spoke Gateways.
    • Documents Security Group Orchestration for DCF, enabling AWS security group management from SmartGroup and DCF policy configuration.

    19 details in Everything

12. 10.0.1 Aug 13, 2026 · release notes

    Controller 10.0.1 adds data-at-rest encryption with AES-256 and updates the base OS image for all gateways.

    • Container data on the Controller and gateway is encrypted at rest with AES-256.
    • Controller and gateway images have been rebuilt on the latest actively maintained base OS.

    2 details in Everything

13. Aviatrix CoPilot — 4.36.0 Release Notes Aug 13, 2026 · release notes

    Aviatrix CoPilot 4.36 adds T-Shirt gateway sizing, Serverless permission visibility, and updated bell notifications.

    • Adds T-Shirt sizing to the instance size lists in gateway management to simplify workload-based selection
    • Surfaces missing permissions for Serverless functions directly in the UI’s Serverless view
    • Updates Controller bell notifications to improve clarity and consistency with CoPilot event states

    3 details in Everything

14. Aviatrix VPN Client — Aviatrix VPN Client 3.0.2 Aug 4, 2026 · release notes

    Aviatrix VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Client 3.0.2 adds macOS Universal binary support and explicit Ubuntu 26.04 compatibility

    • macOS installer is now a Universal binary that runs natively on both Intel and Apple Silicon (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) Macs, removing the need for Rosetta 2.
    • VPN Client now explicitly supports Ubuntu 26.04 alongside existing support for Ubuntu 22.04 and 24.04.

    2 details in Everything

15. Aviatrix CoPilot — 4.35.0 Release Notes Jul 14, 2026 · release notes

    Aviatrix CoPilot 4.35.0 adds SmartGroup Kubernetes workload/pod selection, per-instance gateway start/stop, and TLS CA creation time column.

    • Adds Workloads or Pods type selection when creating a SmartGroup for Kubernetes resources
    • Adds Creation Time column to the Decryption CA table in Security > Distributed Cloud Firewall > TLS Profiles
    • Adds per-instance start and stop controls for gateway instances on the Cloud Fabric > Gateways page
    • Adds filtered row count display in the Enforcement Dialog alongside the total row count

    4 details in Everything

16. Aviatrix CoPilot — 4.34.0 Release Notes Jun 25, 2026 · release notes

    Aviatrix CoPilot 4.34.0 adds Transit Egress config exposure, Access Control card, and Site2Cloud SDN metric.

    • Exposes full Transit Egress configuration options (subnet selection and gateway-level settings) in CoPilot UI, previously Controller-only.
    • Adds CoPilot Access Control card with strategy selector for greenfield vs legacy deployments and CAM terminology removal.
    • Shows tooltip listing all gateways included in a maintenance window entry on the Upcoming and Runs tabs.
    • Displays SDN metric in the Site2Cloud connection detail view for additional routing context.

    4 details in Everything

17. 9.0.10 Jun 22, 2026 · release notes

    Aviatrix Controller 9.0.10 makes the database migration timeout user-configurable during upgrades.

18. Aviatrix CoPilot — 4.33.0 Release Notes Jun 1, 2026 · release notes

    Aviatrix CoPilot 4.33.0 adds upgrade workflows in Administration > Maintenance, DCF logging visibility for serverless workloads, gateway Security Rules tabs, and SNAT/DNAT ru

    • Adds Administration > Maintenance pages to consolidate Controller and gateway upgrade workflows, including upgrade groups, readiness checks, and backup/restore.
    • Adds serverless workload details (VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules., Region, Cloud Account, Type) to Source and Destination Workload columns in DCF logging via an info icon tooltip.
    • Adds a new accordion UI for DCF audit changes providing structured diff views for policy modifications.
    • Adds a Security Rules tab on the Gateways page and Transit Egress page to display DCF rules enforced on each gateway, plus an Enforcement on Gateway setting card.
    • Adds priority and move controls to reorder SNAT and DNAT rules, enabling user-controlled priority assignment for both Customized SNAT and DNAT rules.

    +1 more show less

    • Moves TLS inspection and WebGroup URL filtering from Preview to General Availability; TLS Profiles now support configurable enforcement levels for SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. Verification (strict or permissive).

    6 details in Everything

19. 9.0.0 May 12, 2026 · release notes

    Aviatrix Controller 9.0 adds DCF IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection., East-West TGW inspection, K8S discovery, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Phase 2, ActiveMesh 4.0 Phase 2, S2C on scaled transit, and Edge image upgrades.

    • aviatrix_spoke_gateway and related resources gain private_route_table_config to explicitly select Azure route tables for DCF egress SNAT
    • Adds DCF IPS (Intrusion Prevention System) with Suricata inline detection/prevention and TLS decryption modes (IPS Only, TLS Decrypt Only, IPS + TLS Decrypt)
    • Adds DCF East-West inspection for AWS TGW environments by inserting spoke gateways into the traffic path without re-architecture
    • Kubernetes workload discovery is now enabled by default for SmartGroup policy enforcement
    • ActiveMesh 4.0 Phase 2 enables dynamic HPE toggle at gateway group level with mixed HPE/non-HPE support during transition

    +13 more show less

    • First-hop VRFVRFA Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. support allows overlapping CIDRs from multiple S2C connections via kernel VRF namespace isolation on Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic.
    • Proxy ID configuration for route-based Site2Cloud tunnels enables specific local/remote traffic selectors instead of default 0.0.0.0/0
    • S2C is now supported on horizontally scaled (Smart Gateway) transit groups with 3 or more gateways
    • Dell R470 hardware platform is added for AEP Edge with 25G NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. support
    • Image upgrade for self-managed and Equinix Edge Gateways is supported without deleting the gateway from the Controller
    • FireNet supports per-firewall Panorama template and template stack for heterogeneous configurations within the same FireNet gateway
    • Azure FireNet firewall management interfaces are scoped to Aviatrix Controller IP, replacing open 0.0.0.0/0 rules
    • Default route propagation from Transit FireNet to Edge Spoke gateways is enabled
    • Centralized Security Hub VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. for AWS is available via API only, auto-provisioning VPC infrastructure including GWLB and endpoint services
    • DCF enforcement is extended to Edge gateways (Spoke and Transit) with L4/L7 filtering and TLS decryption capabilities
    • BGPoLAN is now available in Azure China (21Vianet)
    • DCF Policy Audit provides structured diffs and change attribution for DCF entities, exportable via API
    • DCF extends SmartGroups and policies to serverless resources including AWS Lambda, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping./Fargate, Azure Functions, Container Apps, GCP Cloud Functions, and Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GCP Regional VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. now use the Spoke Gateway for local egress by default for all workloads instead of requiring avx-snat-noip tagging
    • !Azure VNET local egress no longer auto-detects route tables; administrators must explicitly select them via private_route_table_config, causing plan drift in existing Terraform configs
20. Aviatrix CoPilot — 4.32.0 Release Notes Apr 29, 2026 · release notes

    Aviatrix CoPilot 4.32.0 adds Transparent Inspection for AWS TGW, Power Cycle types, Manual Gateway power controls, vCPU metrics API, vCPU alerting, Proxy ID support, explicit

    • Adds Transparent Inspection configuration for inter-VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. traffic in AWS Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. (TGW) networks
    • Adds Power cycle type to Auto Cycles, allowing scheduled power up/down with per-cycle start and end times
    • Adds Power Up and Power Down actions on the Gateways page for manual gateway lifecycle management
    • Exposes per-gateway vCPU utilization metrics through the Metrics API for external monitoring integration
    • Enables alerting configuration based on per-gateway vCPU utilization thresholds

    +4 more show less

    • Adds Proxy ID configuration support for routed external connections to enable third-party VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. interoperability
    • Enhances DCF UI with improved management controls for URL-based WebGroups, Encryption Certificates, TLS Profiles, and Custom CA imports
    • Adds explicit Azure route table selection for Single IP SNAT on spoke gateways, replacing implicit detection with direct assignment via Edit VPC/VNet Route Tables control
    • Supports selective egress NAT for Bump-in-the-Wire (BITW) deployments in AWS, automatically determining internet-bound traffic for NAT while preserving east-west flows

    9 details in Everything

21. Aviatrix CoPilot — 4.31.0 Release Notes Mar 24, 2026 · release notes

    Aviatrix CoPilot 4.31.0 adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. overlap detection and DCF ruleset managed-by indicators

    • Adds VPC overlapping CIDR tracker to identify IP address conflicts across multicloud networks.
    • Adds AWS Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. (TGW) peering attachments view on the Gateway Details page.
    • Adds Managed By column to Distributed Cloud Firewall (DCF) Rulesets page to show Terraform or CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. origin.
    • Enables selection of multiple templates and template stacks per firewall in FireNet Vendor Integration.

    4 details in Everything

22. Aviatrix CoPilot — 4.29.0 Release Notes Feb 3, 2026 · release notes

    Aviatrix CoPilot 4.29.0 adds Auto Right-Sizing for all gateways, maintenance windows, multiple TLS profiles per DCF rule, and enhanced VM/K8s context in Monitor

    • Auto Right-Sizing is now available for all gateways, allowing proactive resizing without waiting for recommendations.
    • Any gateway can now be added to a maintenance window to schedule upgrades and minimize impact.
    • Non-CoPilot rulesets are now locked from modification to protect externally managed configurations.
    • The Distributed Cloud Firewall (DCF) Monitor UI now displays enriched workload context for VMs (Name, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules., Region, Cloud Account) and Kubernetes workloads (Cluster Name, Node Name, Pod Name, Namespace/Service).
    • DCF rules now support associating multiple TLS profiles to a single rule.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Rulesets that are not created by CoPilot can no longer be modified.
23. Aviatrix CoPilot — 4.28.0 Release Notes Dec 22, 2025 · release notes

    Aviatrix CoPilot 4.28 adds Intrusion Log subtab in DCF Monitor and TLS controls for remote logging.

    • Adds an Intrusion Log subtab under Security > Distributed Cloud Firewall > Monitor for IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. Phase 2 (Preview) visibility
    • Adds dedicated TLS toggle and certificate upload/validation controls for remote rsyslog profiles in the UI
    • Reorganizes Cloud Assets menu into Cloud Workloads and Cloud Networks categories with Kubernetes Clusters and Serverless support

    3 details in Everything

24. 8.2.0 Dec 22, 2025 · release notes

    Aviatrix Controller 8.2.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. DCF support, FlightPath 2.0, TLS profiles, hierarchical policies, and more.

    • Adds FlightPath 2.0 for deep, topology-aware troubleshooting with CAI metrics and hop-by-hop path visualization
    • Extends Distributed Cloud Firewall (DCF) to Oracle Cloud Infrastructure (OCI), allowing rule enforcement on OCI gateways
    • Adds TLS Profile Extensions for DCF, enabling per-rule TLS profiles and multiple custom CA bundles for origin certificate validation
    • Introduces Hierarchical (MultiWriter) Policy via Terraform for distributed policy management and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.
    • Enhances logging with configurable session-level logging options in Session Profiles, including duration, bytes transferred, and stage attributes

    +12 more show less

    • Adds Controller CA Rotation capability for zero-downtime rotation of the Controller's internal CA certificate
    • Updates Terraform provider to support IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. constructs, Smart Gateway settings, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. profiles, advanced SNAT/DNAT options, hierarchical policy attachments, and logging/TLS profile objects
    • Enables DCF policy enforcement and SmartGroup discovery for Kubernetes private clusters
    • Changes default IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. ciphers to NIST-recommended AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. and deprioritizes weak ciphers
    • Adds BGPoLAN Gateway Resizing, allowing dynamic downsizing of AWS BGPoLAN gateways without service disruption
    • Enables Preview: IPv6 Capability Phase 1 for dual-stack networking across Controller, CoPilot, AWS, and Azure
    • Enables Preview: Active Mesh 4.0 Phase 1 with primary gateway lifecycle control, dynamic HPE toggle, and Make-Before-Break upgrade pipeline
    • Enables Preview: Smart Gateways Phase 1 with BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-LU underlay and Controller offload capabilities
    • Enables Preview: Suricata-based IPS with customizable rulesets, external threat feeds, and Terraform/API automation
    • Enables Preview: Policy Audit Enhancement with structured diffs, change attribution, and API export
    • Enables Preview: DCF Serverless Rule Support for AWS Lambda discovery and Smart Group-based policy application
    • Enables Preview: Bump-in-the-Wire mode for AWS TGW + Cloud WAN for inter-VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. traffic inspection without TLS decryption

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Gateway audit status indicators have been fully removed from the UI and API
    • !The historical default deny bootstrap rule has been relocated into the user-manageable ruleset; legacy allow/deny bootstrap rules may be safely removed after confirming equivalent policy coverage
    • !Legacy FQDN Filtering is deprecated; users must migrate to Distributed Cloud Firewall (DCF) FQDN/URL Filtering via WebGroups
    • !The legacy Stateful Firewall is deprecated; users must migrate to Distributed Cloud Firewall (DCF) Stateful Rules via SmartGroups
    • !ThreatIQ is deprecated; users must migrate to Distributed Cloud Firewall (DCF) ThreatGroups with integrated threat intelligence
    • !Geo Blocking is deprecated; users must migrate to Distributed Cloud Firewall (DCF) GeoGroups with country-level filtering
25. Aviatrix CoPilot — 4.24.0 Release Notes Aug 13, 2025 · release notes

    Aviatrix CoPilot 4.24.0 adds upgrade group ordering, Kubernetes SmartGroup labels, and detailed VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. routes.

    • Adds an Order column to the Administration > Upgrade > Upgrade Groups page to control multi-group upgrade sequences
    • Enables creating Kubernetes SmartGroups using Kubernetes Node attributes for label-based selection
    • Adds a Show Detailed Routes action in Diagnostics > Cloud Routes > VPC/VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Routes to view non-summarized route lists
    • Allows skipping gateway upgrades that are already at the target version via the Prepare for Upgrade card in Administration > Upgrade > Upgrade Plan
    • Adds Account (default) and Billing ID columns to Cloud Resources > Cloud Assets pages for VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules./VNets & Subnets and Virtual Machines

    5 details in Everything

26. Aviatrix CoPilot — 4.23.0 Release Notes Jul 24, 2025 · release notes

    Aviatrix CoPilot 4.23.0 adds saved views for Native Peering and Cloud Assets, plus new TGW columns and WebGroup navigation

    • Adds the ability to save custom views and filters in *Networking > Connectivity > Native Peering* to manage large-scale peering deployments.
    • Adds a *Manage View* page to *Cloud Resources > Cloud Assets* that supports saving custom views, persisting column filter settings, and pinning the first column during horizontal scrolling.
    • Adds TGW ID, Account, and Cloud columns to the *Networking > Connectivity > AWS TGW* page for deeper context on Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. connections.
    • Enables navigation from WebGroups in *Security > Distributed Cloud Firewall > Policies* rules to their details pages, and allows links in *Groups > WebGroups* to return to the *Policies* page.

    4 details in Everything

27. Aviatrix CoPilot — 4.22.0 Release Notes Jun 23, 2025 · release notes

    Aviatrix CoPilot 4.22.0 adds Megaport MVE GA support, egress protection workflow, and alert notification bulk actions

    • Megaport Virtual Edge (MVE) is now a General Availability feature for Edge Transit Gateways when used with Controller release 8.0.
    • Adds the ability to perform bulk actions on alert notifications in the CoPilot UI.
    • Adds an Actions list and a Views list to the Alert Notifications interface.
    • Updates the Details pane for alerts in the Notification feature.
    • Distributed Cloud Firewall (DCF) is now enabled by default in CoPilot without an additional license or cost.

    +5 more show less

    • Network Insights API is now enabled by default in CoPilot without an additional license or cost.
    • The Add-On Features list has been removed from Settings > Configuration > License due to the licensing change for DCF and Network Insights API.
    • Network Insights API, Cost IQ, and Billing Insights (legacy) can be turned on or off from Settings > Configuration > General.
    • Distributed Cloud Firewall can be turned on or off from Distributed Cloud Firewall > Settings.
    • The Egress Protection Workflow automatically creates SmartGroups and WebGroups for VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules./VNets and trusted domains when protection is enabled.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Add-On Features list has been removed from Settings > Configuration > License.
28. Aviatrix CoPilot — 4.21.0 Release Notes May 27, 2025 · release notes

    Aviatrix CoPilot 4.21 adds Egress Security Score preview and self-service K8s resource discovery

    • Adds Egress Security Score under *Security > Egress > Overview* to visually display VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. egress protection status (Unprotected, Monitored, Partially Protected, Fully Protected)
    • Updates Auto Right-Sizing to consider Azure local temporary disks for gateway size recommendations
    • Enables self-service activation of Discovery of Kubernetes Resources via *Settings > Configuration > License > Add-on Features* and *Groups > Settings > Discovery of Kubernetes Resources*

    3 details in Everything

29. Aviatrix CoPilot — 4.20.0 Release Notes May 1, 2025 · release notes

    Aviatrix CoPilot 4.20.0 adds maintenance windows for auto right-sizing, custom AEP management CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., and overall health visualization.

    • Adds a Resize button in Cloud Fabric > Scaling > Auto Right-Sizing to schedule gateway resizing during a custom maintenance window with configurable start time, recurrence (daily, weekly, monthly), and duration.
    • Enables specification of a custom Management Interface CIDR when adding or editing an Edge device on the Aviatrix Edge Platform (AEP).
    • Adds an Overall Health section under Settings > Resources > System Health with color-coded bar charts and status labels (Up, Degraded, Down) for Controller and CoPilot.
    • Allows selecting multiple threat types and severity levels when creating or editing an ExternalGroup with Threat Feeds as the resource type.

    4 details in Everything

30. Aviatrix CoPilot — 4.19.0 Release Notes Apr 1, 2025 · release notes

    Aviatrix CoPilot 4.19.0 adds Controller IP Access UI, SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. toggle for DCF rules, and Equinix/Megaport gateway updates

    • Adds ability to add CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. blocks directly via Settings > Configuration > General > Security > Controller IP Access in the CoPilot UI
    • Adds SNI verification toggle when creating or editing Distributed Cloud Firewall (DCF) rules
    • Enables adding additional WAN interfaces to existing Equinix Edge Transit Spoke gateways
    • Allows disabling ActiveMesh for transit peering with Megaport Edge gateways
    • Renames Remote Gateway to Remote Device in External Connections (S2C)

    +1 more show less

    • Adds ability to update or dismiss alerts directly from the Alert details view

    6 details in Everything

31. Aviatrix CoPilot — 4.18.0 Release Notes Mar 7, 2025 · release notes

    Aviatrix CoPilot 4.18.0 adds UI Usage Analytics opt-in and Controller service restart from System Health.

    • Adds a UI Usage Analytics option in Settings > Configuration to collect user interaction data with an explicit opt-in mechanism
    • Enables restarting individual Controller services directly from the System Health page via the Monitor field

    2 details in Everything

32. Aviatrix CoPilot — 4.17.0 Release Notes Feb 12, 2025 · release notes

    Aviatrix CoPilot 4.17.0 adds IP whitelist management, DCF Kubernetes support, ExternalGroups, health views, and conntrack alerts

    • Adds Settings > Configuration > General > Security section for managing the CoPilot IP Access List to whitelist allowed IP addresses.
    • Enables Aviatrix Distributed Cloud Firewall (DCF) support for Kubernetes clusters via automated networking, security, and Kubernetes-based SmartGroups in DCF rules.
    • Introduces the ExternalGroups feature for creating named groups for access controls and security policies across multiple resource types via DCF, including Azure SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., GitHub, threat feeds, and country restrictions.
    • Provides a comprehensive Controller & CoPilot Health view with graphs for System, Application, and Network health, service health reporting, and metric alert configuration.
    • Adds Conntrack Allowance Available and Conntrack Usage Rate as new metrics supported by the Alert System for monitoring connection tracking resource utilization.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Controller and CoPilot Metrics have been moved from the Performance page and are now found in Settings > Resources > System Health.
33. Aviatrix CoPilot — 4.16.0 Release Notes Dec 19, 2024 · release notes

    Aviatrix CoPilot 4.16.0 adds Hostname SmartGroup support, custom DNS resolution for non-HTTP/S, and auto right-sizing controls.

    • Adds Hostname resource type to SmartGroups so you can create SmartGroups based on hostnames instead of IP addresses.
    • Adds the DNS Server for Hostname Resolution card under Groups > Settings to select a custom DNS server or the Gateway's default for resolving SmartGroup hostnames in non-HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic.
    • Adds enable/disable toggle for the Auto Right-Sizing feature via Cloud Fabric > Scaling > Auto Right-Sizing > Auto Right-Sizing Settings dialog.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Security > Egress > Monitor is renamed to FQDN Monitor (Legacy).
34. Aviatrix CoPilot — 4.15.0 Release Notes Nov 14, 2024 · release notes

    Aviatrix CoPilot 4.15 adds Microsoft SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. external connections, Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. spoke peering, and GCP Global VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. for FireNet egress.

    • Adds Microsoft SSE Solution to the External Connections To dropdown under Networking > Connectivity > External Connections (S2C)
    • Supports Azure ARM Spoke attachment through Native Peering on CoPilot
    • Enables configuring GCP Global VPC on Gateways > Settings for FireNet Egress
    • Adds Enable Local Egress on VPC/VNets button on Security > Egress > Egress VPC/VNets
    • Allows accepting auto-resizing recommendations in Cloud Fabric > Scaling to immediately implement gateway right-sizing

    +1 more show less

    • Automatically selects the single available cloud account in the Upgrade Controller Wizard when only one is accessible

    6 details in Everything

35. Aviatrix CoPilot — 4.14.0 Release Notes Oct 8, 2024 · release notes

    Aviatrix CoPilot 4.14.0 renames Cloud Fabric > Edge to Hybrid Cloud with a new URL path

    • Renames the Cloud Fabric > Edge page to Cloud Fabric > Hybrid Cloud and changes its URL from /cloud-fabric/edge/... to /cloud-fabric/hybrid-cloud/...

    1 detail in Everything

36. Aviatrix CoPilot — 4.13.0 Release Notes Sep 4, 2024 · release notes

    Aviatrix CoPilot 4.13.0 adds SmartGroup cloning, gateway details pages, and persistent DCF auto-refresh

    • Adds Clone SmartGroup option under Groups > SmartGroups vertical ellipses menu to duplicate a group configuration
    • Adds Details view (with General Information, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes., Subnet Information, and Certs Info tabs) for Transit, Spoke, and Specialty Gateways on Cloud Fabric > Gateways

    2 details in Everything

37. Aviatrix CoPilot — 4.12.0 Release Notes Aug 8, 2024 · release notes

    Aviatrix CoPilot 4.12.0 adds Manage Gateway Attachments window and saved views for External Connections

    • Adds a Manage Gateway Attachments option on Cloud Fabric > Gateways to add or delete transit and spoke gateway attachments
    • Allows saving filtered views of the External Connections (S2C) table on Networking > Connectivity

    2 details in Everything

38. Aviatrix CoPilot — 4.11.1 Release Notes Jul 17, 2024 · release notes

    Aviatrix CoPilot 4.11.1 adds a View vCPU Breakdown dialog for gateway core usage analysis.

39. Aviatrix CoPilot — 4.11.0 Release Notes Jun 27, 2024 · release notes

    Aviatrix CoPilot 4.11.0 adds Gateway Instance Sizing report and Aviatrix Secure Edge on Megaport support.

    • Adds Gateway Instance Sizing Recommendations report under Administration > Reports, outputting in JSON format.
    • Adds UX for deploying Aviatrix Secure Edge on Megaport Virtual Edge.

    2 details in Everything

40. Aviatrix CoPilot — 4.10.0 Release Notes May 31, 2024 · release notes

    Aviatrix CoPilot 4.10.0 adds controller image upgrades via UI and unmanaged VM visibility in topology.

    • Adds the ability to perform a Controller image upgrade directly from the CoPilot UI
    • Shows Unmanaged VMs in the Topology view for Controller versions earlier than 7.1

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing Alerts configured on renamed Network Interface and Connection Status interfaces will not work until updated with new names; e.g., AWS eth1 is now eth-tgw0, eth2 is eth-fn0, and Azure/GCP/OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. eth1 is now eth-fn0.
41. Aviatrix CoPilot — 4.9.0 Release Notes Apr 30, 2024 · release notes

    Aviatrix CoPilot 4.9.0 adds direct gateway navigation from topology, packet count metrics, and updated edge resource properties.

    • Adds View Gateway button in Topology side panel to open Cloud Fabric > Gateways details
    • Adds Packet Count option in Monitor > FlowIQ > Overview View By dropdown with Total Packet Count card
    • Adds Instance ID, Site ID, and Managed fields to Edge resources Properties panel in Topology
    • Renames Insane Mode field to High Performance in Edge resources Properties panel

    4 details in Everything

42. Aviatrix CoPilot — 4.8.0 Release Notes Apr 8, 2024 · release notes

    Aviatrix CoPilot 4.8.0 adds the GA Network Insights API and Controller Diagnostics tool in the UI.

    • The Aviatrix Network Insights API is now GA, supporting Prometheus and JSON formats for network metric data retrieval.
    • A new Diagnostics Tool on the *Diagnostics > Diagnostic Tools* page runs comprehensive controller reports including routes, NTP, DNS, SSH, IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., and other services.
    • The Gateway Diagnostics page now offers an option to run Controller diagnostics alongside existing Gateway diagnostics.

    3 details in Everything

43. Aviatrix CoPilot — 4.7.0 Release Notes Mar 11, 2024 · release notes

    Aviatrix CoPilot 4.7.0 adds multi-account IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access./Audit actions, UserVPN diagnostics, billing report views, and job status toasts.

    • Adds UserVPN Diagnostics option to the More action menu in the UserVPN gateway list for Cloud Fabric > UserVPN
    • Enables bulk IAM policy updates and account audits on multiple cloud accounts via Actions menu on Cloud Resources > Cloud Account page
    • Introduces Summary, Usage Breakdown, and Billing Breakdown views in the Cloud Fabric > Aviatrix Billing > Report tab
    • Displays job result status (success or failure) directly in toast pop-up messages during background jobs with a link to Monitor > Notifications > Tasks

    4 details in Everything

44. Aviatrix CoPilot — 4.6.0 Release Notes Jan 26, 2024 · release notes

    Aviatrix CoPilot 4.6.0 introduces Gateway Group Upgrade and fixes CSV export bugs

    • Adds the Gateway Group Upgrade feature at CoPilot > Administration > Upgrade to group gateways (by region, cloud, or type) and configure priority-based upgrade sequences.

    1 detail in Everything

45. Aviatrix VPN Client — Aviatrix VPN Client 2.17.7 Jan 10, 2024 · release notes

    Aviatrix VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Client 2.17.7 adds Ubuntu 20/22 support and includes updated Windows TAP driver.

    • Adds native support for Ubuntu 20.04 and 22.04 operating systems
    • Bundles Windows TAP driver v9.24.7 with the client installer

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for Ubuntu 18.04 has been deprecated and is no longer available in this release
46. Aviatrix CoPilot — 4.5.0 Release Notes Dec 22, 2023 · release notes

    Aviatrix CoPilot 4.5.0 adds Geo-blocking preview, spoke-to-spoke attachment management, and view persistence.

    • Adds Geoblocking feature under ThreatIQ in Preview mode
    • Adds Spoke-to-Spoke gateway attachment management
    • Adds Spoke-to-Egress Transit FireNet gateway attachment management
    • Enables creating, editing, and deleting views on the *Aviatrix CoPilot > Security > Distributed Cloud Firewall → Monitor* tab
    • Enables saving and preserving views on the *Aviatrix CoPilot > Monitor > Performance* page

    +1 more show less

    • Adds ability to view both managed and unmanaged VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. in the Topology Network View

    6 details in Everything

47. Aviatrix CoPilot — 4.3.0 Release Notes Oct 24, 2023 · release notes

    Aviatrix CoPilot 4.3.0 adds alerts for gateway DOWN/KEEPALIVE_FAIL states and a Geo View in the Topology map.

    • Adds ability to configure alerts based on the number of gateways in the DOWN or KEEPALIVE_FAIL state
    • Adds a Geo View selection to the Topology > Overview page showing all cloud network constructs on a geographic map
    • Adds a Performance tab to the CoPilot > Cloud Fabric > Gateways > Transit/Spoke Gateways page for telemetry statistics
    • Adds ability to configure a subnet group for Spoke Gateways when configuring FireNet Gateway policies for Microsoft Azure
    • Redesigns the CoPilot > Dashboard with separate sections for network health and resources, adding cards for Gateway Health, Connection Health, Detected Intrusions, CoPilot Health, Controller Health, Threats view, Threats list, and Alerts list

    5 details in Everything

48. Aviatrix CoPilot — 4.2.0 Release Notes Sep 22, 2023 · release notes

    Aviatrix CoPilot 4.2.0 adds UserVPN support and new percentage-based alert metrics.

    • Adds UserVPN feature to configure VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. gateways, profiles, users, and authentication against AWS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., Azure AD, and Centrify.
    • Adds percentage-based metric conditions for alerts: per_bandwidth_egress_limit_exceeded, per_bandwidth_ingress_limit_exceeded, per_conntrack_limit_exceeded, per_linklocal_limit_exceeded, per_pkt_drop, per_pkt_fail, per_pps_limit_exceeded, per_rx_drop, per_rx_errs, per_tx_drop, and per_tx_errs.
    • Adds support for Dell R450 hardware in Aviatrix Secure Edge platform.
    • Moves the option to enable Old Topology Experiences to CoPilot > Settings > Configuration page, adding the Old Topology Experiences toggle.

    4 details in Everything

49. Aviatrix CoPilot — 4.1.0 Release Notes Aug 24, 2023 · release notes

    Aviatrix CoPilot 4.1.0 adds AWS TGW orchestration, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. central view, and FlowIQ quick filters

    • Adds the ability to create an AWS Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. (TGW) and orchestrate attachments via *CoPilot > Networking > Connectivity > AWS TGW*
    • Introduces a central VPC/VNet inventory page at *CoPilot > Cloud Resources > Cloud Assets > VPC/VNets & Subnets* with Aviatrix managed status
    • Adds automatic quick filter generation for host IP addresses and port numbers in the FlowIQ Filter dialog

    3 details in Everything

50. Aviatrix CoPilot — 4.0.0 Release Notes Jul 21, 2023 · release notes

    Aviatrix CoPilot 4.0 adds VM visibility, Secure Egress wizard, native VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. peering, and in-product Controller management.

    • Adds the CoPilot > Cloud Resources > Cloud Assets > Virtual Machines page to view all cloud VMs and create SmartGroups (max 20 VMs per group).
    • Adds a Getting-Started Workflow Wizard for Secure Egress traffic rules with preview support for WebGroups, TLS Decryption, and IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. options.
    • Adds in-product capability to perform native peering for CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. via the CoPilot > Networking > Connectivity > Native Peering page (requires Controller build > 7.1.1577).
    • Enables uploading and updating Aviatrix Controller certificates from the Controller Certificate card in CoPilot > Settings > Configuration.
    • Adds Install Patches card in CoPilot > Settings > Maintenance > Upgrade to apply software patches to Aviatrix Controller.

    +3 more show less

    • Allows enabling Controller Security Group Management via the Controller Security Group Management card in CoPilot > Settings > Configuration > Security.
    • Allows enabling CoPilot Security Group Management via the CoPilot Security Group Management card in CoPilot > Settings > Configuration > Security.
    • Adds configuration options for Controller IP Access, DNS Server, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., Tunnel, FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-2, Session Timeout, and Logging Services through dedicated UI cards.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The top-level AirSpace menu option is renamed Cloud Fabric.
    • !The top-level Troubleshooting menu option is renamed Diagnostics.
    • !The Distributed Firewalling page is renamed Distributed Cloud Firewall.
    • !The Distributed Firewalling > Policy Monitor page is renamed Distributed Cloud Firewall > Monitor.
    • !The Asset Visibility page is renamed Cloud Assets.
    • !The Connectivity page has moved to CoPilot > Networking.
    • !The Anomaly Detection page has moved to CoPilot > Security.
    • !FlowIQ Overview, Trends, and Geo pages now show only the most recent 120 days of data; historical data earlier than this must be accessed via the Flows and Records tabs.
51. Aviatrix CoPilot — 3.14.0 Release Notes Jun 28, 2023 · release notes

    Aviatrix CoPilot 3.14.0 adds controller patching, native VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. peering, backup/restore, image migration, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure./configurable alert recipients, and metric_info to webhooks

    • Adds metric_info field to CoPilot webhook payloads for triggered alerts.
    • Adds CoPilot > AirSpace > Connectivity > Native Peering page for CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. VPC peering.
    • Adds Install Patches card in CoPilot > Settings > Maintenance > Upgrade for applying software patches.
    • Adds Back Up Controller and Restore Controller cards in CoPilot > Settings > Maintenance > Back Up & Restore.
    • Adds Upgrade Controller Image card in CoPilot > Settings > Maintenance > Upgrade for image migration.

    +2 more show less

    • Adds configurable alert email recipients (e.g., Security Events, Critical Alerts) in CoPilot > Monitor > Notifications > Settings.
    • Adds SMTP Service card in CoPilot > Monitor > Notifications > Settings to configure SMTP server for alerts.

    7 details in Everything

52. Aviatrix CoPilot images — Image table — 3.0.0 (x86) (Increased from v2) / OCI Jun 15, 2023 · release notes

    Aviatrix CoPilot OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image v3.0.0 applies CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. hardening and updates base software to 3.12.1

    • OCI image version 3.0.0 now includes CIS hardening
    • Base software version updated to 3.12.1

    2 details in Everything

53. Aviatrix CoPilot — 3.13.0 Release Notes Jun 14, 2023 · release notes

    Aviatrix CoPilot 3.13 adds VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. creation in UI, Global Memory Swap Surge alerts, and enhanced diagnostic tools.

    • Adds CoPilot > Monitor > Cloud Networks page for creating and deleting VPC/VNets directly from the UI
    • Adds Global Memory Swap Surge alert to monitor gateway virtual machines when swap memory (mem_swapped) is more than 0B and total memory exceeds 1GB
    • Adds ability to run ping, restart services (CloudXD, PERFMON, rsyslog), and view command/event logs via CoPilot > Troubleshoot > Diagnostic Tools

    3 details in Everything

54. Aviatrix CoPilot — 3.12.0 Release Notes May 31, 2023 · release notes

    Aviatrix CoPilot 3.12.0 adds vertical scaling for SNAT-enabled gateways, custom webhook auth headers, and per-user UI time zone configuration

    • Supports setting a custom authorization header in CoPilot webhook requests to integrate with downstream third-party alerting systems
    • Allows users to configure a display time zone for the UI via the user profile menu

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Monitor > Traffic & Latencies > Latency Monitor view with Classic Experience enabled is removed and superseded by the CoPilot > Monitor > Traffic & Latencies > Latencies page.
    • !The Monitor > FlowIQ view with Classic Experience enabled is removed and superseded by the CoPilot > Monitor > FlowIQ > Overview page.
55. Aviatrix CoPilot — 3.11.0 Release Notes May 22, 2023 · release notes

    Aviatrix CoPilot 3.11.0 introduces new diagnostic capabilities and improved help content.

    • Adds Gateway, Connectivity and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. Diagnostic tools to CoPilot Troubleshoot > Diagnostic Tools menu
    • Adds in-app help content for SmartGroups feature accessible via question mark icon

    2 details in Everything

56. Aviatrix CoPilot images — CoPilot Image: Version 3.10.0 — AWS China (x86) / Aviatrix CoPilot images — Image table — 3.0.0 (x86) (Increased from v2) / AWS China May 12, 2023 · release notes

    Aviatrix CoPilot v3.10.0 for AWS China x86 applies CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. hardening and bumps appliance version to 3.0.0.

    • Applies CIS hardening in the AWS China x86 image
    • Increases appliance version from 2 to 3.0.0

    2 details in Everything

57. Aviatrix CoPilot — 3.10.0 Release Notes May 11, 2023 · release notes

    Aviatrix CoPilot 3.10.0 adds Edge HA creation, Distributed Firewalling with WebGroups, GCP Global VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. routing, and L4 firewall support on Secure Edge.

    • Adds CoPilot > AirSpace > Edge page to create edge high availability (HA) gateways
    • Adds WebGroups support for defining Domains and URLs in Distributed Firewalling (DFW) rules within CoPilot > Security > Distributed Firewalling
    • Adds GCP Global VPC Routing (Global Spoke) configuration option in CoPilot > AirSpace > Gateways > Settings page
    • Adds L4 firewall capabilities on Aviatrix Secure Edge to define policies using CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., IP addresses, ports, and protocols
    • Adds event.threatIqInfo field to ThreatIQ webhook alerts containing affected gateway name in addition to threat IP

    5 details in Everything

58. Aviatrix CoPilot — 3.9.0 Release Notes Apr 25, 2023 · release notes

    Aviatrix CoPilot 3.9.0 adds FireNet configuration UI, CSV gateway exports, and backup time-range selection.

    • Adds CoPilot > Security > FireNet page to configure FireNet settings
    • Enables CSV export for gateway summary details via the CoPilot > AirSpace > Gateways > Overview page
    • Adds time range selection for CoPilot data backups in CoPilot > Settings > CoPilot Management

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The memory_free metric is removed from alert configuration options; alerts now use memory_available.
    • !Custom timezones are deprecated and will be removed; Controller must be set to UTC timezone for CoPilot 3.9+ compatibility.
59. Aviatrix CoPilot — 3.8.0 Release Notes Apr 5, 2023 · release notes

    Aviatrix CoPilot 3.8.0 adds gateway upgrades via UI, SAP-services discovery, Packet Drop Rate metrics, and Metric API authentication.

    • Adds the Metric API authentication feature to retrieve network metric data across your Aviatrix data plane
    • Enables selection of Packets Drop Rate and Packets Drop Rate(%) options for Performance Metric Settings, Gateway Alert Configuration, and Manual Scaling Policy Settings
    • Adds SAP-Services Discovery Enablement as a configurable feature (disabled by default)
    • Adds gateway upgrade capability on the CoPilot > Gateways > Gateway Management page

    4 details in Everything

60. Aviatrix CoPilot — 3.7.1 Release Notes Mar 19, 2023 · release notes

    Aviatrix CoPilot 3.7.1 adds Global Control Plane/Network Health alerts, multi-metric webhook fields, and user visibility controls.

    • Adds Global Control Plane Health alert to monitor Controller and CoPilot VM resources (CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., memory, disk).
    • Adds Global Network Health alert to monitor Gateway instances for packet drop rates or down status.
    • Introduces CoPilot > Administration > User Access page for setting navigation menu permissions and creating Controller user groups.
    • Adds new webhook payload fields: alert.defId, alert.metrics, alert.version (always v2), alert.query, and event.condition.
    • Separates alert notification channel configuration to the CoPilot > Monitor > Notifications > Recipients page with webhook preview.

    +1 more show less

    • Enables setting egress-traffic rule conditions for selected VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNets on the CoPilot > Security > Egress page.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pre-existing alert configurations monitoring Controller host AND other hosts for health/network metrics had the Controller host removed; if Controller was the only monitored host, the configuration was removed.
61. Aviatrix CoPilot — 3.6.0 Release Notes Feb 22, 2023 · release notes

    Aviatrix CoPilot 3.6.0 adds gateway pages, multi-condition alerts, and date picker for data migration

    • Adds a new page in *CoPilot > Gateways* for launching specialty (regular) and edge gateways
    • Adds a new page for establishing Site2Cloud (S2C) and external connections
    • Enables specifying multiple conditions when defining alert configurations
    • Adds a date picker to the data migration process to select the start time for migrating data indices

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !In Gateways > Scaling configuration and Distributed Firewalling configuration pages, the field *Wait Time* is renamed to *Evaluation Period*
62. Aviatrix VPN Client — Aviatrix VPN Client 2.16.42 Feb 2, 2023 · release notes

    Aviatrix VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Client 2.16.42 adds Ubuntu 22.04 support and fixes connection termination issues.

    • VPN client now supports Ubuntu 22.04

    1 detail in Everything

63. Aviatrix CoPilot — 3.5.2 Release Notes Jan 19, 2023 · release notes

    Aviatrix CoPilot 3.5.2 adds Scheduled Auto Scaling, Private Mode proxy support, and a new Cloud Accounts page with audit settings.

    • Adds Scheduled Scaling policy creation for gateway HA instances (scale out/in) based on time periods.
    • Enables configuration of HTTP or HTTPS proxy settings in CoPilot > Settings > Configuration for Private Mode deployments.
    • Introduces the Cloud Accounts page (CoPilot > Cloud Resources > Cloud Accounts) with Audit Settings for regular background health audits and email notifications.
    • Adds Amount for Time Period field to Shared Services in CostIQ (CoPilot > Billing & Cost > CostIQ > Shared Services tab).
    • Allows disabling/enabling SAP Discovery via CoPilot > Settings > Configuration > General tab.

    5 details in Everything

64. Aviatrix Controller/Gateway images — AWS China Gateway Images — AWS China Gateway Image hvm-cloudx-aws-china-121622 Jan 9, 2023 · release notes

    AWS China Gateway Image hvm-cloudx-aws-china-121622 adds Strongswan default and Python3 env

    • Uses Strongswan by default for AWS China Gateway Images
    • Provides a ready-to-use Python3 environment in the gateway image

    2 details in Everything

65. Aviatrix CoPilot — 3.4.1 Release Notes Dec 12, 2022 · release notes

    Aviatrix CoPilot 3.4.1 adds Gateway Overview page, Intelligent Cloud Analytics for AppIQ, and Topology Builder preview.

    • Adds Gateway Overview Page to AirSpace > Gateways for visualizing instance utilization and packet drop rates
    • Adds Intelligent Cloud Analytics view in Monitor > AppIQ with custom dashboard creation for application-to-application networking troubleshooting
    • Updates Traffic & Latencies pages with a new view that allows selecting specific gateways for on-demand latency monitoring

    3 details in Everything

66. Aviatrix Controller/Gateway images — AWS Controller Images — AWS Gateway, hvm-cloudx-aws-103122 / Aviatrix Controller/Gateway images — AWS China Controller Images — AWS China Controller Image ami-04a602b81140d2c96 / Aviatrix Controller/Gateway images — AWS China Controller Images — AWS China Gateway, hvm-cloudx-aws-china-110522 / Aviatrix Controller/Gateway images — GCP Controller Images — GCP Controller Image avx-controller-gcp-2022-10-31 / Aviatrix Controller/Gateway images — GCP Controller Images — GCP Gateway, gw-base-10312022 Dec 8, 2022 · release notes

    Aviatrix images now support dynamic disk resizing on the Controller and harden to 80% of CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Server L1 benchmark.

    • Supported dynamic disk image resizing on the Controller
    • Hardened to 80% of CIS Server L1 benchmark

    2 details in Everything

67. Aviatrix Controller/Gateway images — AWS Controller Images — AWS Controller Image 103122 Nov 21, 2022 · release notes

    AWS Controller Image 103122 adds dynamic disk image resizing support and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Server L1 benchmark hardening.

    • Hardened to 80% of CIS Server L1 benchmark.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the logstash integration.
68. Aviatrix CoPilot — 3.3.1 Release Notes Nov 21, 2022 · release notes

    Aviatrix CoPilot 3.3.1 adds SmartGroups page, Gateways area for multi-gateway deployment, and intra-VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. distributed firewalling preview.

    • Adds SmartGroups page for creating reusable policy enforcement constructs
    • Adds new Gateways functional area with list view and Scaling tab to deploy Transit, Spoke, and Edge Gateways
    • Enables manual vertical scaling (VM size) and horizontal scaling (instance count) of Aviatrix Spoke Gateways
    • Adds preview of Intra VPC/VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Distributed Firewalling (Security Group Orchestration)
    • Enhances High Availability Gateway Instances to support multiple HA gateway instances for Spoke Gateway

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Top-level menu Networking is renamed AirSpace.
    • !Top-level menu Secured Networking is renamed Programmable Intent.
    • !Page Micro-Segmentation is renamed Distributed Firewalling.
    • !Term App Domain is deprecated and renamed SmartGroup.
    • !Term ThreatGuard is deprecated.
69. Aviatrix CoPilot — 3.1.3 Release Notes Oct 21, 2022 · release notes

    Aviatrix CoPilot 3.1.3 adds AppIQ reports for SAP instances and improves FlowIQ performance.

    • Supports running AppIQ reports for SAP instances via *CoPilot Home > Troubleshoot > AppIQ*.
    • Includes performance improvements to FlowIQ.

    2 details in Everything

70. Aviatrix CoPilot — 3.0.5 Release Notes Oct 13, 2022 · release notes

    Aviatrix CoPilot 3.0.5 now displays storage units in IEC binary-prefix notation (MiB, GiB, etc.).

    • Adds IEC binary-prefix notation for data units in the UI, replacing MB/GB/TB/PB with MiB/GiB/TiB/PiB.

    1 detail in Everything

71. Aviatrix CoPilot — 3.0.2 Release Notes Oct 7, 2022 · release notes

    Aviatrix CoPilot 3.0.2 adds CostIQ shared services billing, Aviatrix Billing page, Disk Utilization UI, and unified licensing.

    • Adds CostIQ Shared Services visibility into shared services used by cost centers for billback purposes under CoPilot Home > Billing & Cost > CostIQ
    • Adds Aviatrix Billing Page for viewing costs of Aviatrix Controller and gateways by CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks., region, group of Cloud Accounts, or individual Cloud Account at CoPilot Home > Billing & Cost > Aviatrix Billing
    • Adds Disk Utilization UI in Settings showing days/weeks until data disk reaches free space threshold and setting data retention policies at CoPilot Home > Settings > Disk Utilization
    • Unifies CoPilot licensing with Controller so a separate license is no longer required, displaying Controller license details at CoPilot Home > Settings > Licensing

    4 details in Everything

72. Aviatrix CoPilot — 2.5.3 Release Notes Sep 16, 2022 · release notes

    Aviatrix CoPilot 2.5.3 introduces a new report section for SAP service discovery and performance improvements to AppIQ.

73. Aviatrix CoPilot — 2.5.0 Release Notes Aug 24, 2022 · release notes

    Aviatrix CoPilot 2.5.0 adds remote SSH support tunnel control and gateway diagnostics from Cloud Routes.

    • Adds Remote Support toggle under Settings > Services to allow Aviatrix Support to SSH into your instance via a user-controlled tunnel
    • Adds Gateway Diagnostics button on the Cloud Routes page for direct gateway troubleshooting

    2 details in Everything

74. Aviatrix CoPilot — 2.4.2 Release Notes Aug 12, 2022 · release notes

    Aviatrix CoPilot 2.4.2 adds TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. export for reports and a new Alerts data grid UI.

    • Adds the ability to download Inventory and FlightCheck reports as TSV (Tab Separated Value).
    • Introduces an Alerts UI rendered as a data grid that supports searching, filtering, and exporting alert instances.

    2 details in Everything

75. Aviatrix CoPilot — 2.3.0 Release Notes Jul 28, 2022 · release notes

    Aviatrix CoPilot 2.3.0 adds disk, memory, and underlay connection alert conditions, gateway tunnel limit notifications, and CostIQ cost visibility.

    • Adds three new notification trigger conditions: Percent Disk Free, Percent Memory Free, and Underlay Connection Status.
    • Adds a new system message notification for when the allowed number of gateway tunnels is reached.
    • Introduces CostIQ private preview feature for cross-cloud cost visibility reported as percentages of spoke gateway traffic.

    3 details in Everything

76. Aviatrix CoPilot — 2.1.0 Release Notes Jul 6, 2022 · release notes

    Aviatrix CoPilot 2.1.0 adds anomaly charts, FlightCheck reports, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. syslog support

    • Adds 24-hour anomaly charts showing metric deviation from fingerprinted behavior
    • Adds FlightCheck report generation for CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. account integrity, backups, gateways, syslog, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., and connections status
    • Enables TCP transport (port 5000) for CoPilot egress FQDN & audit data syslog

    3 details in Everything

77. Aviatrix CoPilot — 2.0.4 Release Notes Jun 17, 2022 · release notes

    Aviatrix CoPilot 2.0.4 adds data migration between instances and micro-segmentation policy enforcement with logging and priority.

    • Adds Data Migration capability to migrate CoPilot data between source and destination instances within the same cloud.
    • Adds Micro-segmentation policy monitor for viewing rules hit by network traffic.
    • Adds system messages notification in CoPilot action bar for micro-segmentation configuration updates.

    3 details in Everything

78. Aviatrix CoPilot — 1.11.3 Release Notes May 23, 2022 · release notes

    Aviatrix CoPilot 1.11.3 adds Geoblocking capability to block IP traffic by country.

    • Adds Geoblocking feature to select and block IP traffic for specific countries via tag-based security policies on gateways.

    1 detail in Everything

79. Aviatrix CoPilot — CoPilot Release 1.9.0, 1.9.1 Apr 27, 2022 · release notes

    Aviatrix CoPilot 1.9 adds topology render limits and network segmentation configuration via UI.

    • Adds Limit Topology Render option under Settings > Advanced Settings > Topology Environment Settings to control large-scale topology loading
    • Enables network segmentation (reachability) for inter-VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. connectivity directly in the CoPilot UI under Security > Network Segmentation

    2 details in Everything

80. Aviatrix CoPilot — 1.7.0 Release Notes Feb 23, 2022 · release notes

    Aviatrix CoPilot 1.7.0 adds gateway resource utilization reports, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. tag filtering in Topology, and saved topology filters.

    • Adds ability to create and export PDF reports summarizing telemetry data (approx. 80 performance metrics) for Aviatrix gateways, aggregated by gateway or metric, with optional per-interface granularity for network metrics
    • Enables search and filtering for native cloud service provider VPC/VNET/VCN tags in the Topology view via the CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. Tags category in the Toggle Filter key list
    • Adds capability to create and save custom topology filters from the main topology page

    3 details in Everything

81. Aviatrix CoPilot — 1.6.1 Release Notes Jan 26, 2022 · release notes

    Aviatrix CoPilot 1.6.1 adds instance tag filtering in Topology and auto-refresh for Resources page

    • Adds the ability to search and filter by instance tags directly from the Topology view (requires Controller release 6.6+)
    • Adds auto-refresh capability to the Resources page within Settings

    2 details in Everything

82. Aviatrix CoPilot — 1.6.0 Release Notes Jan 25, 2022 · release notes

    Aviatrix CoPilot 1.6.0 adds topology packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., FlowIQ gateway filters, and custom ThreatIQ IP lists

    • Adds packet capture capability directly from the Topology map node properties pane, allowing users to filter by host, port, protocol, and other fields before downloading a pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file for Wireshark
    • Adds src_gateway_name, dest_gateway_name, and gw_gateway fields to FlowIQ queries to allow filtering information by specific gateway names
    • Adds support for maintaining custom ThreatIQ IP lists with configurable severity, classification, color, and notes, accessible via ThreatIQ > Custom Threat List in CoPilot

    3 details in Everything

83. Aviatrix CoPilot images — CoPilot Image: Version 1.5.1 / Aviatrix CoPilot images — Image table — Version 1.5.1 / AWS Jan 14, 2022 · release notes

    Aviatrix CoPilot v1.5.1 adds expandable disk volume support and automatic memory sizing for ETL/datastore components.

    • Adds support for allocating data disks (volumes) to Aviatrix CoPilot deployments for expandable storage, with automatic detection and formatting during instance creation
    • Adds automatic memory sizing for the ETL and datastore based on physical instance memory at boot

    2 details in Everything

84. Aviatrix CoPilot — 1.5.1 Release Notes / Aviatrix CoPilot — 1.5.0 Release Notes Jan 12, 2022 · release notes

    Aviatrix CoPilot 1.5.1 adds crosshair performance charts, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./VNET/VCN diagnostics from Topology, and configurable disk/memory features.

    • Performance Charts now have synchronized cross hairs for correlation across all visible charts
    • Topology DIAG button submits VPC/VNET/VCN diagnostics directly to Aviatrix Support
    • Notifications>Configure input box allows typing threshold values instead of using a slider
    • New data disk (volume) support enables attaching expandable storage during CoPilot marketplace deployment
    • Auto-scaling memory support automatically sizes ETL and datastore based on instance physical memory at boot

    5 details in Everything