Security

Hi all: Currently we are creating the smart group in our environment. I would like to know about how smart group distributed to the gateway. If we create a rule with smart group with specific vpc via copilot, what will be in the gateway. will it create all gateways or only on create on specific gateway by copilot ?

 In the manufacturing industry, where the protection of intellectual property, sensitive data, and operational integrity are paramount, the implementation of a Zero Trust security model is crucial. Aviatrix's cloud network solutions are uniquely positioned to support manufacturers in adopting this rigorous security framework, ensuring robust protection against evolving cyber threats.Secure Network Access and Segmentation In manufacturing, the network often spans across various operational and administrative zones, each with its distinct security needs. Aviatrix facilitates fine-grained network segmentation, which is a cornerstone of the Zero Trust model. This capability allows manufacturers to control access precisely, ensuring that users and devices only connect to network segments essential for their specific tasks. By segmenting the network, Aviatrix helps prevent lateral movement of threats across production and IT environments, significantly enh

Hello Team,We have one query regarding Aviatrix Secure edge.Regarding Security group flows on Mgmt interface we have created the ACL in egress directional only as per Aviatrix guideline.so further we  need to know, if any inbound flows need to allow on Mgmt interface and what are those or any reference link? Shailendra

The Aviatrix Certified Engineer (ACE) Multicloud Network Security Specialty Training is starting point for your cloud security education.  This specialty training starts by discussing how to secure the access connected from an on-premises edge location (Data Center, Colocation, SD-WAN, Branch, etc.) to the public cloud. Then, it dives into how to secure the network deployed inside the cloud. The nature of the cloud is boundary-less, flexible, constantly changing, and capable of scaling as needed. Network security needs to adapt accordingly. Security is not just another add-on feature or service; it should be distributed and integrated into the network to provide a genuine zero-trust and agile environment.The ACE Network Security Specialty training covers various design patterns, including Distributed and Centralized firewalling models with Palo Alto, Check Point, Fortinet, Cisco,

Aviatrix cloud backbone security.Can we discuss Aviatrix's global backbone network?How does Aviatrix ensure the security of different cloud providers, including AWS AZUR GCP, for different customers around the world?What security providers do they use?

As a former Head of Network Engineering at a global financial, I have witnessed the transformative power of cloud networks. The ability to scale resources dynamically, enhance collaboration, and increase operational efficiency has made cloud networks a cornerstone of modern business infrastructure.  We’re now moving into another exciting era of cloud networking whereby the security and cost control of cloud networks is paramount - given the sensitive data and critical applications moving to cloud, and the need to lower cloud cost and spend more strategically. Balancing these factors is key to maximize the benefits of the cloud while minimizing risks and maintaining financial sustainability. 

Does Aviatrix have integration capability with WAFs (e.g. Impervia & Akamai) & Endpoint Security Solutions (e.g. Crowdstrike & Symantec) If yes, can a single set of instances in a Firenet serve VMs across multiple clouds If no, are they on the roadmap & is there a set timeline?

Hi everyone, I have an Aviatrix Controller deployed and would like to secure browser access with an SSL certificate. Let's Encrypt seems like an easy and cost effective method, however in order to use it I need SSH access to the Controller, which is disabled. If there's anyone that has successfully implemented this I'd love to hear the details! Thanks,   Mark

In video lectures it is mentioned that Azure native firewall do not have support for DPI, IDS or IPS but on azure website they it says it has IDS and IPS support. please refer the link below.   What should be our answer if the question comes on support of IDS and IPS feature of Azure native firewall? https://azure.microsoft.com/en-in/services/azure-firewall/

What is the difference between the firewall network and the Transit FireNet? The Firewall Network is when we insert the firewall in the AWS TGW. Transit FireNet is when we insert a firewall in the Aviatrix Transit VPC/VNet, which works in all clouds.  Who programs the TGW to send traffic to the appropriate FW? Aviatrix Controller will orchestrate VPC and TGW routes to send traffic to Aviatrix Gateways in the Firewall Network VPC. From there, Aviatrix Gateways will load balance traffic between available FWs.  Can you have more than one HA pair of FireNet systems sitting with the Transit Gateway for further bandwidth? Absolutely, Aviatrix supports up to 10 Firewall instances per AZ (20 per Transit FireNet VPC) in AWS, for example.  Do the Transit Gateways and FireNet systems have the ability to handle Malicious IP filtering and IDS/IPS? Yes, this is handled by the Aviatrix Gateways (Transit, Spoke, a

Is application-based filtering possible?     Aviatrix Egress FQDN can filter the traffic based on Layer 7 (L7) FQDN, IP, or even with wildcard FQDN. One can also use NGFW with Aviatrix FireNet solution to provide deeper level filtering if needed. Are there any 3rd party plug-ins for the FQDN filters?  ie. DNS filtering based on domain classification? No, but you can import your filters. Does the controller identify URLs on the basis of families? How do we redirect the DNS request to Aviatrix FQDN Engine? The Aviatrix Gateway replaces the native NAT GW and not only provides NAT but also advanced filtering capabilities using the L7 FQDN. Aviatrix Controller automatically programs all necessary VPC/VNET routes to redirect traffic towards the Egress GW for Internet bound traffic. Will the DNS get resolved with the packet dropped based on the data plane’s traffic? Yes. The DNS will be res

In HPE environments, as you are bundling IPsec tunnels to achieve greater overall throughput, are you still limited to 1.25 Gbps per session/flow? Or do you perform some form of per packet load-sharing across the available tunnels? 1- We are building multiple IPSec tunnels.  2- We do have tech. beyond just building simple tunnels. So no, we are not limited to just 1.25 Gbps per session/flow.  Can we get 70Gbps with a single gateway? This is cumulative throughput and depends on the size of the gateway and whether you enable HPE or not. How do you accomplish high performance encryption on the Direct Connect/peering links? It is done using our technology called HPE (High Performance Encryption, AKA, Insane Mode Encryption).  For HPE, is it bundling multiple VPN's or a single VPN with 10Gbps throughput?     Check out this document for more information: 

The problem: The number of inbound or outbound rules per security group in amazon is 60. Reference. From the inbound perspective, this is not a big issue because if your instances are serving customers on the internet, then your security group is wide open; on the other hand, if you want to allow access only from a few internal IPs, then the 60 IP limit is sufficient. However, outbound or egress traffic is a different discussion. Let's say you have a production instance that needs updates from updates.ubuntu.com (