About External Connection Settings

Type refers to the VPN tunneling and routing protocol. You can select from:

The Local Gateway on which you want to create an external connection to a remote device.

(Static Route connections only) The Local Gateway CIDR(s) to route traffic to the cloud destination.

(Static Route connections only) The remote network CIDR(s) to route traffic to the remote network destination.

The underlying infrastructure of your network.

Jumbo Frame improves the performance throughput between the Local Gateway and the remote device.

You must first enable Jumbo Frame on the Local Gateway before creating an external connection. Enabling Jumbo Frame on the Local Gateway enables it on the WAN and LAN interfaces of the gateway.

Aviatrix supports the following default encryption algorithms to authenticate the communication between the Aviatrix gateway and the remote device. This feature is not applicable for BGP over GRE, BGP over LAN connections.

You can also choose to customize or modify the default values.

The Internet Key Exchange (IKE) protocol is used for authentication and encryption of packets between the Aviatrix gateway and the remote device. Aviatrix gateways support IKE version 1(IKEv1) and IKE version 2(IKEv2) to establish secure connections to remote sites.

(Static Routing over IPsec connections only) You can authenticate the connection using Pre-Shared Key (PSK) or certificate-based authentication.

(Optional) Pre-Shared Key(PSK) is a string of random characters that is used to authenticate the BGP tunnel connection between the Aviatrix gateway and the remote device. You must ensure that this key is the PSK that is configured for your remote device. If you do not specify one, it is auto-generated. You can view the auto-generated PSK value when you download the external connection’s configuration (see Download the External Connection Configuration).

For ActiveMesh connections, if you want the tunnels that are created to have different PSK values, you will need to enter the PSKs separated by a comma.

You can use certificate-based authentication only if a remote CA certificate has been uploaded or imported.

When creating your external connection, you enter the Subject Alternative Name(SAN) of the certificate for Remote Identifier SAN. If the remote endpoint is highly available(HA) devices, add a second connection row and enter the SAN of the remote HA gateway in the Remote Identifier SAN field.

The SAN (Subject Alternative Name) is a way to indicate that multiple domains can be secured by the same certificate.

(Static Routing over IPsec only) Aviatrix only supports IP_ADDRESS and KEY_ID as the IKE identity type for the remote identifier in the pre-shared key authentication. The IP_ADDRESS must be a valid IPv4 IP address. The KEY_ID is a remote device ID during the key authentication.

By default, Aviatrix configures the public IPv4 address of the peer device as the Remote Identifier for pre-shared key authentication. You can adjust this setting to the private IPv4 address of the peer device.

A Remote Identifier is used to identify the remote end of the tunnel and establish the IPsec connection. You can enter a DNS, IP address, or email address.

The BGP AS number the Local Gateway will use to exchange routes with the remote device.

ActiveMesh enables full mesh peering for failover redundancy. When ActiveMesh is disabled, point-to-point tunnels are created instead of full mesh.

When you have a pair of primary and highly available (HA) Local Gateways and HA remote devices:

When you have one Local Gateway with HA remote devices or HA Local Gateways with one remote device,

By default, ActiveMesh is On for Transit and Spoke Gateway BGP over IPsec and BGP over GRE connections.

You can turn On ActiveMesh for these connections:

Bidirectional Forwarding Detection (BFD) is a network protocol that enables detection of a link or node failure between the Local Gateway and its BGP peer.

An approval process for gateway-learned CIDRs. This approval process improves security for your network.

When Manual CIDR Approval is On, if an unapproved CIDR address attempts to access the connection, an email notification is sent to the administrator to approve or block access before the CIDRs are propagated to the Spoke VPC/VNet route tables.

Manual CIDR Approval is Off and disabled by default unless the Local Gateway you select has Learned CIDR Approval turned On; the Connection option selected, and the BGP connection selected. Then it is On by default (not editable).

The BGP communities to advertise to the BGP peer.

External BGP connectivity requires that the remote peer is directly connected (single-hop) to the Local Gateway.

When the remote peer is not directly connected (separated by multiple hops), you must enable BGP Multihop for the Local Gateway to establish a BGP session with a remote peer.