Aviatrix Controller and Gateway Software Release Notes

AVX-57922

Security Notice: CVE-2024-50603 has been permanently patched.

AVX-58286

An issue was fixed where gateways using Legacy Egress FQDN filtering could experience traffic interruptions when processing very large data packets (approximately 4000 bytes or larger). This could result in halting all network traffic through the affected gateway. The system would attempt to automatically restart the problematic process, but the issue could recur if the system continued sending large packets.

AVX-58757

Fixed an error condition whereby upon upgrading from 7.0 to 7.1, the Controller was not able to update gateway configuration, resulting in the affected gateway being flagged as not up-to-date.

AVX-59149

This release addresses a regression in 7.1 with TCP maximum segment size (MSS) clamping support, which is now supported on standalone gateways.

AVX-61310

In an Aviatrix multi-transit design with Transit Peering, where one of the Transit Gateways has BGP S2C enabled and learns a default route (0.0.0.0/0), an issue occurs following a controller upgrade where incorrect metrics are applied to PeerS2c routes.

AVX-52626

There was an issue when modifying the remote subnet CIDR range of an existing Site2Cloud (S2C) connection using Terraform provider version 3.1.4 with Aviatrix Controller versions 7.1.3696 and 7.0.2239. Instead of updating the remote subnet CIDR range as specified in the Terraform configuration, the change was incorrectly applied to the local subnet CIDR range.

AVX-53986

Fixed an issue where the Aviatrix Controller was using excessive memory when managing large numbers of access accounts. Customers managing large numbers of access accounts should see improved Controller stability and performance after upgrading.

AVX-54732

Fixed an issue where Aviatrix Edge Platform (AEP) Gateway upgrade status displayed incorrectly.

After a successful image upgrade, the Controller showed an empty upgrade status and the CoPilot interface displayed the status as “unknown”. This was only a display issue with no impact on Gateway functionality.

AVX-55012

After upgrading to version 7.1, certain Source Network Address Translation (SNAT) IP addresses were not properly advertised to connected networks when manual connection summaries were configured. This has been corrected. Outbound traffic using the affected SNAT IP addresses now connects properly.

This issue only affected BGP over IPSec connections between Transit Gateways and on-premises devices.

AVX-55434

Resolved an issue where attaching a virtual network with both IPv4 and IPv6 address spaces could cause invalid routes to be added to the network, losing management connectivity. Data traffic was not affected. The workaround was to avoid attaching virtual networks with IPv6 enabled.

AVX-56022

Fixed the following issue that resulted in loss of expected network connectivity between VNets: If an Aviatrix Gateway is originating the default route (such as customized spoke-advertised VPC CIDRs, having an FQDN gateway in its VPC, or a default route from on-premise), this route is then installed in the private subnet route tables of other spoke VNETs.

However, if the originating Aviatrix Gateway experiences a disruption (such as stopping and starting the gateway, or withdrawing and adding routes by downstream routers), it can cause the advertised default route to be removed from the route tables of other spoke VNETs, leaving the default route next-hop as NONE in the private route table of the VNET/VPC thereby impacting network connectivity.

AVX-56032

Fixed an issue where Security Group Orchestration was not functioning as expected in some Azure environments. If you were running multiple instances in the same Azure virtual network, Distributed Cloud Firewall (DCF) connectivity rules configured between instances might not have been applied correctly.

AVX-56466

Resolved an issue affecting Azure Transit Gateways (with FireNet, VNG, or BGP over LAN enabled) where upgrading to 7.1.4139 resulted in additional routes being added to the Gateways’ secondary network interfaces.

AVX-56779

Fixed an issue where restore from backup fails during controller image upgrades.

AVX-56921

Resolved an issue where, during Azure service outages, resource handling incorrectly deleted all Azure resources from its database. This could cause brief interruptions in expected network traffic.

AVX-45480

Distributed Cloud Firewall rules are not properly applied to non-encrypted (non-TLS), non-web (non-HTTP) traffic when processed by Gateways with High Performance Encryption (HPE) enabled.To address this issue, you can configure Distributed Cloud Firewall rules for non-TLS/non-HTTP traffic with higher priority to ensure proper handling. After updating, review and adjust security policies as needed to ensure desired traffic handling.

AVX-51456

Destination network address translation (DNAT) rules cannot be configured on Aviatrix Gateways using Terraform provider version 3.1.4. When setting up DNAT rules on standalone Gateways with policy-based tunnels configured, an error message indicates the interface for the connection cannot be found.

To work around this issue, configure DNAT rules through the Aviatrix CoPilot interface at Cloud Fabric > Gateways. See Enabling Gateway DNAT Settings.

AVX-53179

AVX-55015

An issue can occur in handling Site2Cloud Mapped NAT connections when the local CIDR is set to 0.0.0.0/0. When a user edits or deletes a connection mapped to this CIDR, the corresponding IP table rule is not properly removed. This can cause incorrect routing behavior.

AVX-56811

After restoring a Controller configuration, restarting Gateways that were offline could fail re-attestation.

To address this issue, ensure that all Gateways are up before restoring a Controller configuration.

AVX-55256

Running packet capture results in an error, preventing generation of packet captures for troubleshooting.

AVX-55290

If custom DNS/NTP entries are configured in the Cloud Service Provider DHCP options, and these DNS/NTP destinations are not reachable on the local VPC/VNet, then traffic to those destinations might be blocked.

AVX-55499

Software Rollback of a gateway upgrade from 7.1.4105 (newer operating system) to 7.1.3956 or 7.1.4101 (older operating system) causes gateway PKI service to go down. This results in lost communication between the gateway and Aviatrix Controller.

AVX-62067

Aviatrix Transit Gateways with large number of tunnels and running for a long time could encounter an issue where in the IPSec process becomes unresponsive leading to all IPsec tunnels going into a DOWN state. The cause of this is an internal counter reaching its maximum value and overflowing. To recover, the transit gateway needs to be rebooted.

While it is not possible to specify the exact number of tunnels and length of time it would take for the internal counter to overflow, the few customers who encountered this issue had greater than 800 tunnels and took three to four months to encounter this issue.

AVX-37706

(GCP) An issue that could cause gateway image upgrades to fail if Aviatrix Gateways were configured as Router Appliance spokes in the GCP Network Connectivity Center (NCC) is resolved.

AVX-37982

Clearing the bell notifications no longer results in the error, “Command to execute is too long”.

AVX-42518

An issue where adding and deleting a large number of stateful firewalls increased memory usage to more than 80% has been resolved.

AVX-48386

(OCI Gov) An issue where gateway creation in OCI Gov failed, has been resolved.

AVX-48707

AVX-48764

Product telemetry corrected for intra tunnels count. No workarounds or corrective actions needed by customer.

AVX-48903

An issue is resolved where an upgrade can fail when you upgrade an image for a non-HPE (High Performance Encryption) Transit Gateway that has a Site2Cloud GRE connection and Jumbo Frame.

AVX-48917

Resolved an issue where traffic from the Spoke CIDR was incorrectly routed to FireNet, despite exclusion of the Spoke CIDR from the Inspection Policy.

AVX-50194

(GCP) Resolved an issue with FireNet BGP over LAN on GCP by correcting the routing for the firewall_rtb table, ensuring proper mapping of routes to interfaces.

AVX-50640

In single IP HA Site2Cloud because of CSP underlay NAT issue, the single IP HA IPsec connection may not come up after the failover of a gateway. To address this, an enhancement was made in the way Aviatrix loads the IPSec configuration to the standby gateway so that the CSP underlay NAT issue is avoided.

AVX-50752

Product telemetry corrected in private mode implementations. No workarounds or corrective actions needed by customer.

AVX-50897

An issue is resolved where the Controller did not restore the peered tunnels that were deleted during the resizing process. This issue was the result of errors returned by the Cloud Service Provider (CSP) when resizing a High Performance Encryption (HPE) Gateway.

AVX-50941

(Azure) When a new Azure HPE gateway is provisioned, the Controller now creates a gateway route table with the name <vnet_name>-avx-gw-public associated with the gateway subnet. If there are subnets without any route tables associated, an optional public route table with name <vnet_name>-avx-public is also created. These route tables will be deleted when the gateway is torn down.

AVX-51027

The VPC Tracker Overlap Detection tool in Aviatrix CoPilot now works correctly with Edge devices.

AVX-51147

An issue is resolved that could cause Site2Cloud connection disruptions. External Site2Cloud connections (such as those with CloudN or standalone gateways with legacy route-based Site2Cloud connections) could have tunnel interfaces with overlapping Site2Cloud IPs.

New tunnel IPs are now validated prior to assignment to ensure they do not overlap with existing Site2Cloud connections.

AVX-51314

(Azure) Resolved an issue where Azure VNets that were created out-of-band (OOB) were not populating on the Controller when creating a Gateway. This was due to changes in the Azure API.

AVX-51407

An issue was resolved that caused disruptions in Site2Cloud tunnel configurations. Specifically, the local IP address was incorrectly changed to the standby gateway IP after upgrading the image on the standby gateway. This behavior occurred in environments using Site2Cloud configurations with single IP HA and public IP as the gateway identifier.

AVX-51703

Previously, an extra route table was created when a gateway without High Performance Encryption (HPE) was initially deployed. This route table had no function and was creating issues during the deletion of the gateway.

This issue has been resolved and the extra route table is no longer created during the deployment of a non-HPE gateway.

AVX-52360

Disabling Controller Security Group Management after a Controller image upgrade no longer causes a dependency violation error.

AVX-52640

Resolved an issue where Security Group Orchestration incorrectly counted existing user security groups. This led to the creation of new groups, exceeding the Security Group mapping limit of 5. Exceeding the limit posed a potential risk of gateway outage due to insufficient security rules for gateway communication with the Controller.

AVX-52808

The eth1 interface no longer goes down after upgrade to Controller 7.0.

AVX-53450

Corrected an issue that, during migration, sometimes resulted in receiving an email about an exception in export_tf. This did not affect the actual migration, which completed successfully.

AVX-54729

Resolved an issue where deploying Layer 7 Distributed Cloud Firewall rules to a gateway will slowly leak memory.

AVX-54874

(Azure) The message "Agent status: Not ready" might display in the Azure portal when viewing the Aviatrix Controller. This occurs because the Controller does not have the Azure VM agent running. This behavior is by design and does not affect the Controller’s functionality or performance. No action is required from users; this message can be safely ignored.

AVX-55256

Running packet capture results in an error, preventing generation of packet captures for troubleshooting. If you encounter this issue, please contact Aviatrix Support for assistance.

AVX-55290

If custom DNS/NTP entries are configured in the Cloud Service Provider DHCP options, and those DNS/NTP destinations are not reachable on the local VPC/VNet, then traffic to those destinations might be blocked. If you encounter this issue, please contact Aviatrix Support for assistance.

AVX-55499

Software rollback of a gateway upgrade from 7.1.4105 (newer operating system) to 7.1.3956 or 7.1.4101 (older operating system) causes gateway PKI service to go down. This results in lost communication between the gateway and Aviatrix Controller. If you need to rollback a gateway upgrade from 7.1.4105 to 7.1.3956 or 7.1.4101, contact Aviatrix Support for assistance.

This issue does not apply to 7.1.3958.

AVX-51314

(Azure) Resolved an issue where Azure VNets that were created out-of-band (OOB) were not populating on the Controller when creating a Gateway. This was due to changes in the Azure API.

AVX-54470

(Azure) Resolved an issue where all Security Group rules were not removed when disabling Access Security from Aviatrix Controller. Security Group rules still showed up in the Network Security Group list for the Controller in the Azure Portal (Console).

AVX-54729

Resolved an issue where deploying Layer 7 Distributed Cloud Firewall rules to a gateway will slowly leak memory.

AVX-50897

AVX-54480

(Azure) Manually aborting an Azure migration might not remove the new Controller instance. If that happens, delete the new Controller instance manually.

AVX-54886

(Azure) After migrating to the new 7.1.3958 or 7.1.4105 Controller releases, the storage disk IOPS setting is not retained from the old 7.1.3956 or 7.1.4101 Controllers.

AVX-55499

Software rollback of a gateway upgrade from 7.1.4105 (newer operating system) to 7.1.3956 or 7.1.4101 (older operating system) causes gateway PKI service to go down. This results in lost communication between the gateway and Aviatrix Controller. If you need to rollback a gateway upgrade from 7.1.4105 to 7.1.3956 or 7.1.4101, contact Aviatrix Support for assistance.

This issue does not apply to 7.1.3958.

AVX-38433

If you see error messages like “MemoryUsageLimitExceeded” or “RequestLimitExceeded” when you try to access the Controller, this could be caused by high memory usage. You can verify memory usage from Aviatrix Copilot on the Monitor > Performance tab.

To resolve this issue, please contact Aviatrix Support.

AVX-45386

AVX-53623

7.1.3958 fixes an issue where, if you were on a version of the Aviatrix Controller older than 7.0 and attempted to launch a gateway on OCI, the gateway launch would fail due to a bug in OCI.

AVX-37706

AVX-37913

AVX-47065

AVX-48386

(OCI) The new Aviatrix base image is not available on OCI Gov in the current Controller release.

AVX-50897

AVX-52048

(AWS) Auto-migration does not inherit volume values for IOPS on the new gp3 volume. If the volume IOPS settings on the old Controller were modified, those changes might not be retained after the migration. The modified settings might need to be re-created for the new gp3 volume after migration.

AVX-52360

After Controller image upgrade, disabling Controller Security Group Management might cause a dependency violation error. If this happens, delete the old Controller, and then retry disabling Security Group Management.

AVX-52587

AVX-53025

On Controller’s Settings > Maintenance page, the kernel version is missing for newly launched Edge Gateways on Aviatrix Edge Platform.

AVX-53027

On Aviatrix Edge Platform, after you have upgraded the image to the latest Aviatrix base image, you cannot roll back to the previous image.

AVX-53450

During migration, you might receive an email about an exception in export_tf. This does not affect the actual migration, which will complete successfully.

AVX-50897

AVX-52048

(AWS) Auto-migration does not inherit volume values for IOPS on the new gp3 volume. If the volume IOPS settings on the old Controller were modified, those changes might not be retained after the migration. The modified settings might need to be re-created for the new gp3 volume after migration.

AVX-52095

If your Controller is running release 7.1.3956 or earlier, you will not be able to upgrade directly to 7.2 or later releases, when they become available. You will need to upgrade to release 7.1.3958 or a later 7.1 release before proceeding to any 7.2 releases.

AVX-52360

After Controller image upgrade, disabling Controller Security Group Management might cause a dependency violation error. If this happens, delete the old Controller, and then retry disabling Security Group Management.

AVX-52587

Changes to the certificate domain fail on gateways.

To resolve this issue, configure the same certificate domain name again or repeat the configuration steps. The gateways should be properly updated the second time.

AVX-52360

After Controller image upgrade, disabling Controller Security Group Management might cause a dependency violation error. If this happens, delete the old Controller, and then retry disabling Security Group Management.

AVX-53030

When doing a dry run prior to doing a gateway software upgrade to 7.1.3956, the dry run might report errors. This could happen because of backend dependencies. Please wait 15 minutes and attempt the dry run again.

AVX-53116

If you detach an IAM role from the Controller instance in the AWS Console, but do not update the Onboarded Account on the Controller, the Controller is not aware of the change made in AWS Console and still maintains the IAM role association with the Onboarded Account. This will result in a failed dry run.

You must reattach an IAM role to the Controller in your cloud service provider (CSP) account.

AVX-53583

The Certificate Domain (required for China region) is not updated for Edge Gateways, so the Edge Gateway cannot connect to the Controller. To resolve this issue, restore the Certificate Domain to its previous value. You can reset this in Controller by going to Onboarding and scrolling to Enter Certificate Domain.

AVX-50895

Customers using an Aviatrix Controller to orchestrate AWS Transit Gateways (TGWs), can encounter a software defect wherein the Aviatrix software might raise a false positive warning about duplicated CIDRs which could impact route propagation.

This issue occurs when you have two or more AWS TGWs and have TGW peering between them. The false positive warning can be raised on unrelated VPCs. If there are duplicated CIDRs in any TGW attachments in peered TGWs, routing propagation could be impacted.

AVX-47437

The traceroute for an Edge Gateway may display an incorrect value for the Edge Gateway Interface.

AVX-48456

AVX-49015

If you change your Jumbo Frame configuration for Edge Gateways, that configuration change is not propagated to existing VLAN sub-interfaces.

If you experience this issue and need to change your Jumbo Frame configuration, make the configuration change and then delete and recreate all existing VLAN sub-interfaces.

AVX-49375

When you try to create a GCP Palo Alto firewall instance using a certain version of a Palo Alto image, the instance creation fails. The affected versions are versions of the Palo Alto Networks Next-Generation Firewall BUNDLE that contain the letter “h,” such as “8.1.25-h1.”

If you experience this issue, choose a Palo Alto Networks image version that does not contain the letter “h.” New Check Point and FortiGate Fortinet instance deployments are unaffected.

AVX-50076

The Aviatrix Controller now only displays the metrics for the last hour, in Dashboard > Controller Metrics or Gateway Metrics. For detailed Gateway metrics, please use Aviatrix CoPilot.

AVX-50897

AVX-26567

A FireNet Egress FQDN gateway was dropping traffic.

AVX-36054

AVX-36996

(Azure) After an Azure FireNet FQDN Egress gateway image upgrade, the gateway goes into the “config_fail” state. To resolve this issue, try restarting the gateway. If the gateway state does not change, please contact Aviatrix Support.

AVX-38843

AVX-39477

When you tried to do an image upgrade or a software rollback for a BGP-enabled gateway on which you applied the “remove-unnecessary-packages-from-gateway” software patch, the operation may have failed.

AVX-39662

(GCP) Upgrading a GCP Transit Gateway with BGPoLAN and Firenet features enabled might have resulted in the loss of direct connectivity to the on-site firewall appliance.

AVX-41223

At the early stage of the gateway initialization, if you configured SSM agents to patch your Ubuntu servers automatically, the gateway initialization process may have failed.

AVX-41361

If a domain name used in an Egress FQDN tag had a long DNS record, attaching that FQDN tag to a gateway could fail. The error given was “command hostname_filter failed due to exception errors invalid IPNetwork.” An email notification was sent.

AVX-41555

When a Controller was in Private Mode and you opened the Firewall page and tried to select a subnet, nothing appeared in the dropdown menu.

AVX-41680

If a Gateway Transit-Spoke attachment was deployed before version 6.2.1742 and one of the Transit Gateway tunnels went down, then the connected Spoke Gateway CIDRs would be removed from the Transit Gateway’s routing tables, causing a traffic outage.

AVX-41693

Linux auditd logs filled the disk space of some instances.

AVX-42269

(GCP) In GCP, if the gateway deployment fails due to CSP (Cloud Service Provider) errors, the rollback fails due to the configuration being in an inconsistent state.

AVX-42706

FortiGate Firewalls failed to launch due to using an incorrect template on the Controller.

AVX-42789

Increased the length of time before an attempt to Encrypt Existing Gateways times out. This improvement helps avoid an encryption failure you would receive if the encryption timed out too soon. The warning message for that encryption failure was: Encryption failed. Waiter SnapshotCompleted failed: Max attempts exceeded.

AVX-43028

On a newly registered CloudN, users could not create attachments to multiple transits from a single CloudN Gateway.

AVX-43362

Aviatrix’s Single AZ HA (Availability Zone High Availability HA) feature would restart a gateway if it found that the gateway had gone down. Due to a timing issue between the process handling the feature and detecting the gateway state, it was possible for the gateway to go into a repeated stop-and-start loop. Disabling the Single AZ HA feature would break the loop.

AVX-43663

There was a memory leak in a firewall monitoring task. The memory leak was proportional to the number of firewalls in the network.

AVX-44022

In Distributed Cloud Firewall, rules inserted by Terraform or by API call were incorrectly evaluated in order of entry instead of order of priority. This issue only affected accounts that used the preview features WebGroups or decrypted IDS.

Note that with this fix, the rules may be rearranged as they are reordered by priority. This correction may change the behavior in your account.

Action required: To determine whether your configuration is affected, please check the ordering of the rules in your Terraform definition or API call. If they are not ordered by priority, reorder them by priority and check affected traffic and expected behavior.

AVX-44023

When running Aviatrix Edge on a Dell R450 device, when you configured a Transit Gateway attachment with HPE (High Performance Encryption) mode, you could not set the tunnel count to more than two.

AVX-44255

When you tried to do a dry run for a Controller software version upgrade with more than one version in the pending list for upgrading and chose “latest” as the default version for the upgrade, the Controller incorrectly ran the dry run for the last version to upgrade to instead of the next upgrade version. For example, if you ran a dry run for 6.9 > 7.0 > 7.1, the Controller ran the dry run for 7.1 instead of 7.0.

AVX-44526

VPN NAT for gateway traffic did not work as expected due to a NAT-related misconfiguration in the iptable rules.

Action required: If you experience a VPN NAT issue after upgrading to this software version, disable and reenable your UserVPN NAT configuration.

AVX-44673

When you changed the tunnel count for an existing Spoke-Transit HPE (High-Performance Encryption) peering, some tunnels may not have come up.

AVX-44812

Deployments with a Utility license were unable to view some license details.

AVX-44974

(Azure) When Transit Gateways had Active-Standby enabled and the Active Transit Gateway was down, the attached Azure Native Spoke VNet route tables failed to switchover routes.

AVX-45598

(AWS) When you added a UserVPN Load Balancer to the UserVPN User Accelerator in the Aviatrix Controller before the Load Balancer state became active in the Cloud Service Provider, the Controller might have throw an exception: “command vpn_user_xlr failed due to exception errors 'HealthState'<p></p>. An email notification with exception reason and trace log was sent to exceptions@aviatrix.com for troubleshooting.

AVX-45782

AVX-45853

A Controller web page loading issue occurred when you tried to edit any FQDN tag other than the first one in the row table.

AVX-45873

When you used a link local address as an IPSec peer address, a Controller upgrade to release 6.8.1148 would drop traffic.

AVX-45897

On the Site2Cloud Details page in the Controller, the message “Authentication Type: null” was displayed for Site2Cloud connections even though there was a PSK authentication. Now, the page correctly displays “Authentication Type: psk” where PSK is the Authentication Type.

AVX-46098

When an Egress Filtering Gateway had a base Stateful Firewall policy of DENY, the gateway added the DROP rule from the base policy instead of letting the packets flow to the egress filter. The Egress Filtering Gateway should not have the DROP rule from the Stateful Firewall base policy. Instead, the packets should be allowed to flow to the egress filter.

AVX-46462

An HPE gateway resize could fail if the gateway had a peering with a gateway from release 6.7.1148 or earlier, as the new peering had additional fields in the structure.

AVX-46788

The Controller would not disable the Access Security feature during a Controller restore if the feature was not enabled in the backup configuration.

AVX-47027

(OCI Gov) OCI Gov gateways failed to launch.

AVX-47234

Previously, the S2C RX Balancing feature was supported only on AWS C5 and C5n gateway sizes. S2C RX Balancing now supports AWS C6in instances. Now, you can upgrade your gateway instance size to C6in and enable S2C RX Balancing.

AVX-47361

(AWS) A rare race condition caused the AWS TGW (AWS Transit Gateway) data migration in the Controller database to fail during a gateway upgrade. This issue caused a problem with route programming.

AVX-47486

(AWS) Starting with software release 7.0.1307, AWS Gateways enabled tags in the instance metadata service. As a result, the tag keys used on the instance had to match this pattern: ([0-9a-zA-Z\\-_+=,.@:]{1,255}), and could not be a reserved name ('.', ‘..', '_index').

Image upgrades and new gateway creations would fail if tag keys in the instance metadata did not manage the requirements above.

AVX-47764

(AWS) When a VPC was attached to an AWS Transit Gateway (TGW), if you deleted one of the Spoke VPC Advertised CIDRs, the routes in associated Transit Gateways were not correctly updated.

AVX-47795

An issue with reading the Controller time zone caused the Controller to send false alerts about an expired PKI agent certificate on gateways.

AVX-48007

(Azure) When a VNet is created with intra-VPC resources enabled, any Aviatrix resources created (NSG or ASG), had a tag with the key “Aviatrix-Created-Resource Value.” Now, Aviatrix-created NSGs or ASGs have tags with the key “Aviatrix-Created-Resource.”

Action required: For NSG/ASGs created before this software release, you must fix the tag manually in your Azure account.

AVX-48193

When a Transit Gateway had a Stateful Firewall policy configured that uses tags, creating or deleting BGP connections on the Transit Gateway could fail. The BGP connection change may have appeared to have completed successfully, but the updated configuration was not applied on the gateway.

AVX-48337

(AWS) The Controller was sending too many API requests to AWS to query route tables. AWS could respond with duplicate route table information.

AVX-48457

(AWS) AWS Gateways with tags that did not match new AWS requirements caused metadata service to fail to turn on.

AVX-48931

When you detached and reattached a CloudN attachment to an Aviatrix Transit Gateway that had any Stateful Firewall rules that used Stateful Firewall Tags, the BGP configuration incorrectly remained on the gateways.

AVX-49236

(OCI) After an OCI gateway image upgrade, several routing tables within several VCNs were missing the default route, 0.0.0.0/0.

AVX-45386

On a gateway with multiple mapped Site2Cloud connections with Forward Traffic to Transit Gateway enabled, after a successful gateway image upgrade, some of these connections may not work. To resolve this issue, go to Controller > Site2Cloud > Setup and disable and re-enable "Forward Traffic to Transit Gateway" for each impacted Site2Cloud connection.

AVX-47437

The traceroute for an Edge Gateway may display an incorrect value for the Edge Gateway Interface.

AVX-48456

AVX-49015

If you change your Jumbo Frame configuration for Edge Gateways, that configuration change is not propagated to existing VLAN sub-interfaces.

If you experience this issue and need to change your Jumbo Frame configuration, make the configuration change and then delete and recreate all existing VLAN sub-interfaces.

AVX-49375

When you try to create a GCP Palo Alto firewall instance using a certain version of a Palo Alto image, the instance creation fails. The affected versions are versions of the Palo Alto Networks Next-Generation Firewall BUNDLE that contain the letter “h,” such as “8.1.25-h1.”

If you experience this issue, choose a Palo Alto Networks image version that does not contain the letter “h.” New Check Point and FortiGate Fortinet instance deployments are unaffected.

AVX-50076

The Aviatrix Controller now only displays the metrics for the last hour, in Dashboard > Controller Metrics or Gateway Metrics. For detailed Gateway metrics, please use Aviatrix CoPilot.

AVX-50897

AVX-39662

(GCP) Upgrading a GCP Transit Gateway with BGPoLAN and Firenet features enabled might have resulted in the loss of direct connectivity to firewall appliance management.

AVX-43013

A previous method for adding new metrics to interface RRD files caused unnecessary delay and decreased performance. Resolved this issue so that the new metrics are available without the extra expense of time and performance. You must upgrade to software version 7.0.2004 or 7.1.2131 or later to access the new metrics.

AVX-43547

On a newly registered CloudN, users could not create attachments to multiple transits from a single CloudN Gateway.

AVX-43545

When you updated the credentials of your cloud access accounts, the Aviatrix Controller could no longer get the latest status of the resources (for example, instances or VPCs) in your Cloud Service Providers: AWS, Azure, or GCP.

AVX-43549

Removing the Egress FQDN tag from a gateway could result in the uninstalling of the hostname filtering service (avx-hostname-filter). Adding the tag back didn’t reinstall the service and the feature did not work.

AVX-43550

A Stateful Firewall rule allowing reverse-path traffic flows was temporarily removed during a software upgrade.

AVX-43863

(GCP) A tag issue prevented the Global VPC feature for Spoke Gateways from being enabled or disabled properly.

AVX-44022

AVX-44298

AVX-45566

AVX-45569

Linux auditd logs filled the disk space of some instances.

AVX-45571

(Azure) After an Azure FireNet-enabled gateway image upgrade, the gateway went into the “config_fail” state.

AVX-45630

(GCP and AWS) There was a connectivity issue between workloads behind Aviatrix Gateways within GCP and workloads in GCP VPCs and AWS gateways. GCP has a default MTU of 1460, while AWS has a default MTU of 1500.

AVX-48199

(GCP) Controllers that manage GCP resources may run into errors when a new Controller instance is started (via Controller High Availability or Controller Migration) or when a new GCP account is onboarded.

AVX-44987

After multiple Controller migrations and upgrades, the Spire Nodes page (Controller > Troubleshoot > Diagnostics > mTLS > Spire Nodes) may have duplicate gateway entries. To re-attest a gateway with duplicate entries, select the gateway and click Re-Attest.

AVX-45156

AVX-45682

A rare issue with a gateway software upgrade may cause the BGP neighbor status to go down. To resolve this issue, restart the gateway.

AVX-45684

AVX-45685

AVX-43137

If your Aviatrix Controller image was from 2022 or newer, a dependency caused an upgrade failure to 7.0.1724 or 7.1.1187.

AVX-1470

During Panorama vendor integration, a configuration using the same template or template stack on both primary and HA (High Availability) gateways was blocked, as there would have been a routing issue.

AVX-21689

(GCP) When two VPN gateways without ELBs (External Load Balancers) were deployed in two different regions in GCP, after adding VPN user to the first VPN GW, you could not add a VPN user to the second gateway.

AVX-25209

The Aviatrix rsyslog may have unexpectedly stopped forwarding logging packets to remote server(s).

AVX-26234

With inter-region HPE (High-Performance Encryption) transit peering between gateways, application traffic across the regions was failing. Packets were not getting clamped to TCP MSS 1370 for inter-region vs intra-region traffic.

AVX-27704

When a gateway had too many routes, the CoPilot Cloud Routes page did not display anything.

AVX-30518

After enabling CoPilot Security Group management, an error occurred: you could not enable copilot security group management. Rest API enable_copilot_sg POST failed, and then Controller was unable to initialize Aviatrix Gateways.

AVX-32351

During Packet Capture, if you clicked Download multiple times, you received an error message: “Failed to open file.” Now, you can download successfully even if you click Download multiple times.

AVX-32730

You could not modify a UserVPN LDAP configuration and upload CA certificate when more than one VPN Gateway was deployed behind a load-balancer.

AVX-32904

If the Edge node could not access the Aviatrix release server because of a firewall setting or because the Management was over a private network, enabling the FIPS caused the Edge gateway to fail. The gateway could not be recovered.

AVX-32921

Some VPN user traffic to certain destinations was dropped on the VPN Gateway. This issue could occur when the VPN Gateway was rebooted and old VPN profile rules were not cleaned up from the system iptables.

AVX-33510

(GCP) All GCP gateways reached 100% CPU Utilization at the same time.

AVX-33814

When a Controller account had too many Site2Cloud connections, Multicloud Transit Segmentation pages failed to load.

AVX-33917

If you had set a custom NetFlow certificate domain when in Private Mode, NetFlow and Syslog data could not be sent to Aviatrix CoPilot.

AVX-34163

When your Controller was deployed in Private Mode, enabling NetFlow on a gateway failed. The iptables rules associated with NetFlow would not be installed, and the gateway configuration failed.

AVX-34401

After the Controller was updated to the 6.7.1376 software version with the AVX-25632 bug fix, you could not attach a CloudN as a Gateway (CaaG) to an Azure Transit Gateway.

AVX-34487

A gateway upgrade may have failed if the gateway could not reach the Internet and install the Linux sysstat package.

AVX-34540

When you configured NAT and NetFlow on a gateway and rebooted it, the NAT rules were accidentally removed.

AVX-34823

(AWS and Azure) In AWS accounts in the Controller that were onboarded using a key and secret instead of IAM Roles, an error occurred when you tried to bring up an Azure gateway.

AVX-34845

Removed a file from managed CloudN or the CaaG device during an upgrade to improve security.

AVX-34872

On a newly-deployed Controller or gateways, if multiple syslog profiles were configured, data was only forwarded on the most recently saved profile.

AVX-35096

(Azure) An API error may have caused the Controller to become unresponsive.

AVX-35549

(Azure, US East region) A default route advertised from on-prem was not written to the VNet route table.

AVX-35646

Previously, the gateway name reported in logs generated by the HTTP/HTTPS FQDN enforcer was “NA.” Now, the gateway name is correctly reported for newly created gateways.

AVX-35728

If an incorrect passphrase was entered when attempting to enable SSH access to your Controller, a bug was causing all the keys for on-prem managed CloudN or CaaG devices to be removed.

AVX-35844

(AWS) When you had a Transit Gateway attached to an AWS TGW and many Site2Cloud connections, the TGW list and plan page loaded slowly.

AVX-35958

The primary and HA gateway shared the same remote IP configuration.

AVX-36147

Configuring customized SNAT policies on a Spoke Gateway via Terraform failed.

AVX-36249

In Private Mode, when the Controller’s proxy was set up, gateway diagnostics and an upgrade dry run would incorrectly show a status failure.

AVX-36387

(AWS) You received a gateway error message, “Missing account or VPC,” when you tried to bring up a gateway.

AVX-36546

FlightPath may have incorrectly shown Spoke and Transit Gateway routes as inactive if the Controller and Gateways were using the following software versions: 7.0.1373, 7.0.1383, 6.9.308, or 6.8.1483.

AVX-36794

If a Spoke Gateway has multiple Custom Mapped or Mapped Site2Cloud connections, Forward Traffic to Transit configuration enabled, and the same virtual destination CIDRs are configured in other Site2Cloud connections, a failover in one connection will cause TCP sessions belonging to the other connections to drop.

AVX-36893

A Controller restore may have failed if the Controller had some dangled files.

AVX-36913

(GCP) GCP gateways may have experienced CPU spikes every 10 minutes.

AVX-36971

A gateway instance could shut down as you used the Monitor Gateway Subnet feature.

AVX-37020

(Azure) Upgrading certain older Azure gateways was unsuccessful because they did not have the “gw_subnet_cidr” attribute.

AVX-37066

Under certain conditions, when you tried to download Egress FQDN logs or stats, the download failed and you received an error message: "…​ 'utf-8' codec can’t decode byte …​"

VX-37120

Editing the Stateful Firewall policy for a gateway could fail when a large amount of rules were added to the policy.

AVX-37394

(Azure) An Azure FireNet route table would fill up and not allow any more gateways after you attached more than 400 non-HPE Spoke Gateways.

AVX-37801

(Azure) Deleting an Azure Spoke Gateway incorrectly deleted user-created RFC1918 routes in the VNet route table.

AVX-38158

(Alibaba Cloud) With CoPilot Security Group management enabled, when you brought up gateways in Alibaba Cloud, they would be missing Security Group rules on CoPilot. This issue meant there would be no visibility of NetFlow and syslog data from the gateways.

AVX-38161

If a Spoke Gateway has multiple Custom Mapped or Mapped Site2Cloud connections, Forward Traffic to Transit configuration enabled, and the same virtual destination CIDRs are configured in other Site2Cloud connections, a failover in one connection will cause TCP sessions belonging to the other connections to drop.

AVX-38409

A gateway credential could be doubly encrypted.

AVX-38469

Unnecessary or irrelevant threat rules for gateways were not successfully deleted.

AVX-38471

If the quagga bgp Debian packages were not installed properly, the Aviatrix Controller would try to reinstall the package instead of failing the gateway configuration.

AVX-38682

(GCP) When you selected the CheckPoint BYOL image as the third-party firewall option, the CheckPoint PAYG image came up instead.

AVX-38954

A Controller bug could lead to gateway crashes and traffic disruption.

AVX-38965

When a gateway was deployed in Private Mode with NetFlow enabled, and you disabled NetFlow and rebooted it, NetFlow could not be reenabled.

AVX-39037

If you added policy rules to Distributed Firewalling, additional and unnecessary code could always run, even if the rules were deleted.

AVX-39040

Gateways reconnecting to the Controller could cause a resource leak on the gateway.

AVX-39050

This fix applies to gateways deployed in Private Mode with NetFlow enabled and NAT rules configured. When you rebooted this type of gateway, NAT rules were sometimes cleared from the IP tables. This clearing could affect data traffic.

AVX-39358

When you updated the CIDR range for a VPN gateway with NAT enabled, the gateway may have stopped forwarding traffic.

Issue

Description

AVX-21547

Spokes using the Global VPC Routing for GCP feature cannot be connected to FireNet transit gateways.

AVX-25000

(AWS) A Private Mode gateway may not have Internet access, in which case it cannot directly upload a gateway tracelog to the S3 bucket. Instead, when you need to upload a gateway tracelog to an S3 bucket, upload the gateway tracelog to the Controller. Then, your Controller uploads the gateway tracelog to the S3 bucket.

AVX-30776

AVX-34997

If you deploy your Aviatrix Controller using proxy configuration and Private mode, the SMTP port does not open. In this situation, because Aviatrix accounts do not have an SMTP relay, your Controller will email Aviatrix Support about the error using port 443 via API.

AVX-35077

(Azure) If the Azure Spoke Gateways were down and a Transit Gateway propagated to an Azure Spoke Gateway with the default route, the Spoke VNet could not program default routes in the route table.

AVX-35613

When the Controller’s timezone was set to any other time zone than UTC (Coordinated Universal Time), a software upgrade became stuck at 99% progress.

AVX-36138

AVX-36492

When single-IP HA (High Availability) is enabled on Aviatrix Gateways and the HA gateway goes up, a bug may cause the security group to not be added to the gateway. To resolve this issue, manually add the security group to the HA gateway.

AVX-37895

AVX-43180

If your Controller is using an outdated image, a software upgrade may fail. If your Controller software upgrade fails, please contact the Aviatrix Support team for assistance.