Aviatrix CoPilot FAQs

Currently, CoPilot supports only simple-deployment to simple-deployment migration and migrations within the same region. Migrations to a fault-tolerant (clustered) deployment or to a different region is not supported.

If you had custom security group settings and were not using the Security Group Management feature on the old CoPilot, you will need to manually copy your old CoPilot’s security group rules to the new CoPilot. This is a known issue.

If you try to deploy CoPilot from Controller and you receive this error, your IAM role may need to be updated with new policies.

If your Account Audit check details show a status of "Pass*" with an asterisk, this means your IAM role needs to be updated. You can go to the Audit page and update the IAM policy in Controller > Access Accounts > Update Policy.

After you upgrade Controller and switch licenses, you may need to do the following:

Safari web browsers are not supported for using CoPilot as unexpected results can occur. Creating a cost center using Safari results in the error "Invalid regular expression: invalid group specifier name".

CoPilot updates the billing data shown in the CoPilot > Billing & Cost > Aviatrix Billing page every day. Typically, the update occurs 27 minutes after 0:00 UTC. If billing data is unavailable for some reason, CoPilot will reattempt the next update every 6 hours.

If you launch CoPilot from the Controller user interface, you must manually add the CoPilot public IP address to the Controller’s security group. Otherwise, the SAML Provider option will not be visible to CoPilot users on the CoPilot login page.

See also Set Up SAML Login for CoPilot.

Verify that Controller’s access for CoPilot has been configured. After CoPilot’s VM is launched and assigned a static public IP address, the Controller’s SG on 443 must be open to CoPilot’s public IP. If you launched CoPilot from the Controller user interface, the SG configuration is done as part of the auto-deploy process. If you launched CoPilot from the CSP marketplace, you will need to add the rule to the Controller SG.

The configuration of the virtual machine(s) that you provision for your CoPilot deployment depends on the scale and the kind of networking infrastructure you have planned according to your business requirements. Work with your Aviatrix Sales representative to determine your sizing requirements. For very large infrastructures, it is recommended to deploy a clustered CoPilot.

For minimum instance/VM sizing for CoPilot, see CoPilot Requirements.

No. If your Controller license expires, you will be unable to log in to CoPilot but your data will remain intact.

CoPilot authenticates against the Aviatrix Controller list of local users.

If you are logged in to copilot go to Copilot UI → Settings and click on the 'Reset controller IP' button. It will prompt you to enter the new Controller IP address and service account credentials.

If you are logged out of Copilot, please open a support ticket at Aviatrix Support Portal for a solution.

Yes. To pause a user-defined alert, click the bell icon in the alerts list.

For information about how Aviatrix CoPilot provides alerting and monitoring in your multicloud networks that are managed by Aviatrix Controller, see Monitoring.

CoPilot regularly polls Aviatrix Controller for alerts associated with events that occur in your network. The events could be detected changes in the resource utilization (telemetry) data for managed resources (gateway hosts). The events could also be conditions associated with enhanced security services like network behavior analytics (detected anomalies in your network traffic fingerprint) and Distributed Clod Firewall via ThreatIQ (detected threat IPs).

For information about metric conditions on which to base alerts, see Metric Types for Triggering Alerts.

Yes. You can customize the webhooks Aviatrix CoPilot generates for sending to external systems (such as Slack and PagerDuty). See Setting Up Webhook Channels for Sending Alert Notifications.

Yes. You can pass a custom authorization header that may be used for integrating with downstream third-party alerting systems. When set, the contents are included in the header of the webhook request as:

Authorization: <value typed in Authorization Header field>

See Setting Up Webhook Channels for Sending Alert Notifications.

No. ThreatIQ firewall rules are not added to non-Aviatrix constructs. ThreatIQ firewall rules are added to Aviatrix gateways. ThreatIQ firewall rules block traffic to and from the host (Aviatrix gateway) by adding stateful firewalls to the host that reported the threat-IP associated traffic. See Working with ThreatIQ.

The ThreatIQ drop policies are in addition to the existing firewall policies applied to the same gateways. See Blocking Known Threat IP Traffic using ThreatIQ.

To use the disk (volume) feature for expandable storage, you must deploy an instance of Aviatrix CoPilot that is based on the Aviatrix CoPilot image version 1.5.1 (that released on 01/14/2022). Instances based on the 1.5.1 image show “Appliance Version 2” in the version information (older images display “Appliance Version 1”). To use the expandable storage feature, you must launch a new CoPilot instance from the marketplace based on CoPilot image version 1.5.1. For more information about expandable storage, see CoPilot Disk (Volume) Management.

You can choose the disk type (volume type) you want. Most disk/volume types are supported (such as AWS gp2).

Your Aviatrix support/cloud service team can help you determine an initial size that is suitable for your business needs. The size of storage for CoPilot data depends on several factors. For example, an infrastructure that has 100 gateways with 1 G of traffic per day will require a different size than an infrastructure with 10 gateways with 10 TB of traffic per day.

You can start with the initial size and monitor your system for a set time period to see how much CoPilot data is stored/indexed in your environment (Settings > Index Management) to help determine whether to allocate new storage to meet your needs. You can always add additional data disks (volumes) as needed. See Add a Disk (Volume) for CoPilot Storage after Deployment.

Yes, you can encrypt disks (volumes) that you allocate to your CoPilot deployment. You enable the encryption via your cloud service provider. Refer to your cloud service provider for information about enabling disk (volume) encryption.

It may take about 5 minutes for flow data to appear in the CoPilot UI.

The flows are sent from the Aviatrix gateways directly to CoPilot’s instance.

CoPilot does not set up a private overlay between the gateways and itself. If a private communication path between the gateways and CoPilot is available, then you can use CoPilot’s private IP when you input the collector IP in the controller. For example, if you have an Aviatrix transit gateway, and you put CoPilot in one of the spokes, then you can use CoPilot’s private IP as the destination.

Flow records are generated by Aviatrix Gateways. The agent on the Gateways observes and keeps track of the flows and as soon as a particular flow ends, or if the flow expiry interval is reached, the flow record is sent to CoPilot.

If you get the error Failed to fetch Topology data, CoPilot was unable to access the data it needs for topology. If the issue persists, Contact Aviatrix Support.

CoPilot uses REST APIs and HTTPS to communicate with its Controller.

CoPilot uses REST APIs and HTTPS to communicate with its Controller.