The Aviatrix Distributed Cloud Firewall (Distributed Firewall Networking) is designed specifically for this scenario. It allows security policies to be defined once and enforced at the Aviatrix gateway level across multiple clouds, enabling scalable and efficient east-west traffic inspection without the complexity and latency of backhauling all traffic to a single inspection point.

Aviatrix gateways operate in a ‘Controller-less’ mode after initial provisioning and configuration. The Controller manages the lifecycle and configuration of gateways, but the data plane forwarding is handled independently by the gateways themselves. Therefore, a Controller outage does not affect existing encrypted tunnels or traffic flow, fulfilling the requirement.

While the tunnel is up (Layer 1), successful routing (Layer 3) is required for connectivity. The encrypted tunnel uses BGP to dynamically exchange routes between the cloud VPCs/VNets. If the BGP session is down or not advertising the correct networks, the gateways will not know how to route traffic to the remote cloud. Checking this fundamental routing protocol is a critical first step before examining lower-level cloud constructs.

A Site-to-Cloud VPN (also known as a User VPN or Client VPN) establishes an IPsec tunnel directly from an on-premises device (like the customer’s firewall) to an Aviatrix gateway in the cloud. This allows the company to use their existing on-premises firewall as the termination point, enabling them to apply their inspection policies to all traffic before it enters the cloud environment.

Smart Groups in CoPilot allow you to dynamically group resources (like gateways, instances, or tunnels) based on tags or other attributes. You can then apply performance monitoring policies to these groups, such as setting latency, jitter, or packet loss thresholds. When a threshold is breached, CoPilot can trigger alerts, enabling proactive performance management.

ActiveMesh for a Spoke Gateway deploys two gateway instances in the same availability zone, forming an active-active cluster. This provides high availability and load balancing for traffic egressing from that VNet. If one instance fails, the other seamlessly takes over, minimizing downtime and performance impact without the complexity of a multi-zone deployment.

The correct method is a two-step process: 1) ‘Connected Transit’ must be enabled on the Transit Gateway to allow it to propagate routes between attached spokes. 2) Each Spoke Gateway must have the setting ‘Enable Learning of Default Route from Hub’ activated. This causes the Spoke Gateway to learn a default route (0.0.0.0/0) from the Transit Gateway and install it in its VPC’s route table, effectively sending all internet-bound traffic to the security VPC hub.

An Aviatrix App Domain is a logical grouping of one or more cloud network constructs (VPCs, VNets, VPNs, etc.) that represent a specific application or business unit. This abstraction simplifies operations by allowing network and security policies (like firewall rules, monitoring, and routing) to be applied to the entire group at once, rather than configuring each resource individually.

In GCP, selecting a zone for the Transit Gateway determines where the primary instance is launched. Crucially, when you enable ‘ActiveMesh’ (HA) during creation, Aviatrix automatically provisions a second gateway instance in a different zone within the same GCP region. This provides true active-active, cross-zone high availability without requiring manual deployment of the secondary instance.

The Aviatrix Distributed Cloud Firewall (Distributed Firewall Networking) is designed specifically for this scenario. It allows security policies to be defined once and enforced at the Aviatrix gateway level across multiple clouds, enabling scalable and efficient east-west traffic inspection without the complexity and latency of backhauling all traffic to a single inspection point.0