Aviatrix VPN Client

The Aviatrix VPN Client is available on Windows, macOS, and Ubuntu, and supports SAML-based authentication (including Okta, Duo, and other SAML identity providers) alongside FIPS 140-3 compliant encryption.

Universal binary for macOS. The macOS installer is now a Universal binary that runs natively on both Intel and Apple Silicon (ARM64) Macs. Rosetta 2 is no longer required. This change ensures the client continues to work on macOS releases that remove Rosetta 2 support.

Version 3.0.2 also delivers security hardening, along with UI, logging, and packaging refinements across Windows, macOS, and Ubuntu.

If you plan to run the FIPS build of Aviatrix VPN Client 3.0.2, verify that your VPN gateway’s UserVPN CA uses an RSA key of at least 2048 bits before you upgrade the client. The FIPS 140-3 validated cryptographic module does not accept RSA keys shorter than 2048 bits, so a client running the FIPS build cannot verify a gateway server certificate that chains to a 1024-bit CA.

This applies to VPN gateways on Controller versions earlier than 8.2, and to VPN gateways on Controller 8.2 whose UserVPN CA has not been rotated since the Controller was upgraded. Controllers originally initialized on Aviatrix version 7.1 or earlier generated the UserVPN CA with a 1024-bit RSA key; the CA is preserved across upgrades to avoid disrupting active UserVPN users, so a Controller upgrade alone does not change the key size.

To bring the UserVPN CA up to a FIPS 140-3 compliant key size, rotate it to at least RSA 2048-bit before upgrading the VPN Client. Follow the CA Certificate Rotation of UserVPN procedure, which describes both a simple rotation and a staged rotation for deployments with active UserVPN users.

AVX-78411 - (macOS) Transient DNS changes may cause the VPN client’s watchdog process to restart the entire VPN tunnel instead of repairing DNS in place.

AVX-36015 - (Windows) The latest version of Windows TAP driver 9.24.7 is now included with VPN Client 2.17.7.

AVX-46236 - You may see an error while installing the TAP device driver during the installation of the VPN Client 2.17.7 on Windows Server 2012. The Windows Server 2012 may complain that it cannot verify the signature of the TAP Windows driver v9.24.7. To resolve this issue, install an older version of the Windows TAP driver (v9.24.2) manually from this index.

When you set your minimum version client to 2.16.42 under OpenVPN > Advanced > Global Config > Minimum Aviatrix VPN Client Version, Mac and Ubuntu users received an error: “the required minimum VPN client is 2.16.42.” Note that this issue did not affect Windows users.