Is Direct Connect (DX) encrypted by default?
No. DX is not encrypted. The encryption solution needs to be built on top of it. If you are looking for near line rate encryption for DX and/or ER (Express Route), Aviatrix has a hardware appliance called CloudN that one should consider.
Does the 3rd party firewall and Aviatrix controller have to be in AWS, or do the firewall services work on Azure as well?
Nothing has to be in AWS. If you are a customer who has no footprint in AWS, you can only be in Azure, which means that your Controller, GWs, FWs will all be in Azure, too.
I want to have routing from multiple regions to my on-prem via AWS-TGW, would I need multiple route peering?
Yes, you would terminate a VPN per TGW to on-prem. If using a Direct Connect, you could leverage the DX Gateway.
If the VPN tunnel is built with an AWS-TGW, do we also need to programs routes in VPCs?
You will need to go into the VPC route tables and manually configure routes for DC to use Transit (TGW), which will have the VPN tunnel to get back to the DC.
