Scalable, Secure Service Edge for AI Factories

Software-defined routing, tenant-aware NAT, elastic IPs, and stateful L3/L4 security — built to scale horizontally at the AI Factory edge.

Skip the browsing. Ask AI.

Hello! How may I help you today?

Secure Connectivity and Tenant Network Services at the AI Factory Edge

Aviz Service Gateway securely connects AI Factory tenants to the internet, clouds, shared services, and other data centers. Orchestrated by Aviz ONES, it combines BGP/EVPN routing, VRF/VXLAN termination, NAT, elastic IPs, and stateful L3/L4 policy in a software-defined service edge.

Multi-Tenant Networking and Security beyond the individual AI Factory

Tenant traffic travels from GPU hosts through leaf and border networks to Aviz Service Gateway, where tenant-aware routing, NAT, and stateful L3/L4 policies connect it to external services. Aviz ONES orchestrates the gateway through APIs and automation.

Three isolated tenant VPCs connect through two horizontally scalable Aviz Service Gateway instances to the internet, cloud and other data centers, orchestrated by Aviz ONES

Control: Aviz ONES → gateway APIs/webhooks/Terraform. Data path: tenant traffic → gateway → external destination.

Scale tenant services

Horizontally add software gateway capacity instead of relying only on physical firewall appliance limits or switch ASIC VRF scale.

Preserve isolation

Separate VRFs, NAT pools, and session state keep tenants distinct even when private address ranges overlap.

Automate operations

Coordinate tenant connectivity and gateway services through ONES, APIs, and Terraform.

Secure Connectivity, Stateful Inspection and Hybrid Access

NAT & Elastic IP Services

Enable outbound Internet access and inbound application connectivity through tenant-aware NAT and elastic IPs.

Stateful Traffic Inspection

Track active connections and automatically permit legitimate return traffic while blocking unsolicited connections.

Shared services & storage

VPC peering and hub-and-spoke connectivity with intentional tenant boundaries.

Hybrid & multi-DC

Tenant-aware routing and security across AI Factory sites and clouds.

Tenant scale

Gateway VRFs and horizontal scaling support large multi-tenant infrastructure.

Policy Enforcement

Apply tenant-specific L3/L4 allow/deny rules based on IP addresses, protocols, and ports.

Flexible Deployment at the AI Factory Edge

Deploy Aviz Service Gateway on bare-metal x86 servers with supported NICs, or in supported virtualized and cloud environments. Supports Ubuntu and RHEL, with flexible placement at the AI Factory edge, including ISP-facing, services-only, and multi-data-center deployments. Scale vertically by adding CPU and memory resources to support more tenants and network services, or horizontally by deploying additional gateway instances as demand grows.

Tier	NAT / FW sessions	CPU / RAM	NIC / throughput
Basic	100K / 100K	12 cores / 48 GB	2×25G / 50 Gbps
Advanced	250K / 250K	16 cores / 64 GB	100G / 100 Gbps
Performance	500K / 500K	32 cores / 128 GB	2×100G / 200 Gbps

Reference sizing from Aviz product brief; throughput and scale depend on configuration and workload.

Scale by gateway performance tier

Service Gateway is offered in Basic, Advanced and Performance tiers, with 1-, 3- and 5-year subscriptions. Aviz FDEs support design and deployment, backed by 24×7 TAC. Contact Aviz for current commercial terms.

Questions from architecture reviews

Can I use Service Gateway to simplify the north-south network in my AI Factory?

Yes. With tenant segmentation moved completely to both Service Gateway and host-based networking on the DPU, the north-south network can be configured as a standard IP-routed fabric. That broadens the available switch and NOS options and improves tenant scalability.

Where is the Service Gateway deployed?

Customers typically deploy a pair of Service Gateways either as service nodes connected to the border leaves (one-arm deployment) or inline between the border leaves and external firewalls or edge routers.

How does the gateway keep tenants with overlapping IP ranges isolated?

Each tenant has its own VRF, forwarding context, and NAT pool. Session state carries tenant identity, so overlapping private addresses do not mix.

How does inbound access work for an elastic IP?

Published elastic IP mappings permit the intended host or protocol/port. Unsolicited inbound traffic without a session or published service is dropped.

What happens when a tenant or its internet access is deleted?

Tenant pools, elastic IP mappings, and route advertisements are withdrawn; the documented policy also terminates active sessions for the removed service.

Can one gateway serve multiple tenants?

Yes. The gateway maintains separate tenant VRFs, routing, NAT, and firewall policy while sharing the gateway appliance.

Does Service Gateway replace Aviz ONES?

No. ONES orchestrates tenant/network workflows; Service Gateway is the forwarding and security service edge.

How does the gateway connect to an ISP?

Supported uplink modes include routed interfaces, SVIs, and EVPN L2VNI, depending on the border/ISP placement.

Can it connect multiple data centers and clouds?

The architecture includes a multi-DC hub pattern for tenant-aware routing, VPC peering, and controlled external connectivity.

Is Service Gateway inline with tenant traffic?

Yes. Unlike the ONES orchestration controller, Service Gateway processes applicable tenant traffic in its VPP-DPDK data plane for routing, NAT, and stateful policy enforcement.

Make secure tenant connectivity part of your AI Factory workflow.

See Aviz Service Gateway and ONES working together.

Schedule Demo