Azure MANA NIC Rollout: Could It Impact Your Aviatrix Gateways?

If you run Aviatrix on Azure, there is a slow-moving infrastructure change happening underneath your gateways right now that is worth paying attention to. Microsoft started rolling out a new generation of network hardware on May 26, 2026, called MANA (Microsoft Azure Network Adapter). For most Azure workloads, the change is invisible. For network virtual appliances (NVAs) like Aviatrix gateways, it is not, and Aviatrix has issued a field notice (, using the command lspci:

$ lspci

7870:00:00.0 Ethernet controller: Microsoft Corporation Device 00ba

If you see Microsoft Corporation Device 00ba, then your VM is using MANA.

If you see anything else, for example Ethernet controller: Mellanox Technologies, you are on legacy hardware.

Of course with Aviatrix, this is not easy to check, since users can't directly SSH to their Gateways, but as an Aviatrix customer, I can say their Support is super-helpful and they can check it fairly quickly.

The Short-Term Mitigation: The LegacyVMNVA Tag

Microsoft is providing an opt-out mechanism specifically for NVA workloads: a tag called LegacyVMNVA. When this tag is set to true on a VM, Azure's placement logic keeps the VM on legacy Mellanox-backed hardware instead of moving it to MANA-backed hosts.

Aviatrix's recommendation is to apply this tag via Azure Policy rather than directly on each VM. The reason is important: Aviatrix gateway lifecycle operations (redeploy, upgrade, HA replacement) often recreate the underlying VM, and a tag set manually does not survive that recreation. A policy-enforced tag does, because the policy reapplies it on the new VM.

How to Apply the Mitigation

1. Assign the Azure Policy at Management Group or Subscription scope.

The policy definition ID is:

e87a87f5-e6dd-4919-be21-abb0a4ea4630

Set the Tag Value parameter to true. Scope the assignment to the management group or subscription that contains your Aviatrix gateway VMs.

2. Activate the tag on existing VMs.

The policy applies the tag to newly created VMs automatically, but existing gateway VMs need a one-time push to pick it up. Aviatrix recommends doing this in a maintenance window using either:

• 
  az vm reapply (preferred, no downtime if you have HA pairs and reapply one at a time)


• A stop-deallocate-start sequence (similar no downtime if you have HA)

Either method triggers Azure to register the tag and update placement behavior for that VM.

3. Do not apply the tag manually.

The field notice is explicit on this: do not set the LegacyVMNVA tag directly via the Azure portal, CLI, or PowerShell as a standalone action. Doing so will work until the next gateway lifecycle operation rebuilds the VM, at which point the tag is gone and the new VM is free to land on MANA hardware. Always use Azure Policy so the tag is re-applied automatically on every VM in scope.

The Long-Term Fix: MANA-Compatible Releases

The tag is a workaround, not a final fix. Aviatrix is shipping MANA-compatible releases over Summer 2026:

The other hard deadline is May 31, 2027. On that date, Microsoft disables the LegacyVMNVA tag entirely. Any Aviatrix gateway still running a non-MANA-compatible release at that point will be subject to MANA placement and the associated performance degradation. Aviatrix is explicit about not waiting until the last days before the deadline to upgrade.

A Practical Timeline

If you are running Aviatrix on Azure today, the rough plan for the next 12 months could look like this:

1. 
   This week: Subscribe to Azure Service Health Tracking ID 5RWW-K4G. Check whether your gateways are in any of the four currently-live regions.


2. 
   Before August 1, 2026: Apply the LegacyVMNVA Azure Policy at the appropriate scope and activate the tag on all existing gateway VMs.


3. 
   Summer / Autumn 2026: Plan the upgrade to the MANA-compatible release for your gateway version stream. Test on a non-production environment first if you can.


4. 
   Well before May 31, 2027: Complete the fleet-wide upgrade using the CoPilot Upgrade Groups feature. Decommission the legacy tag once your fleet is fully on MANA-compatible code.

The reason to start now, even if your regions are not yet live, is that once a region is migrated to MANA-backed infrastructure, future gateway lifecycle operations may place VMs on the new hardware unless the mitigation is applied.

Wrapping Up

If you have only ever thought of Accelerated Networking as a checkbox in the VM creation flow, this rollout is a reminder that the hardware under the abstraction does change, and it can change in ways that matter to specialized workloads. For most VMs, MANA is transparent. For NVAs binding to a specific NIC driver, it is not.

The good news is that the mitigation is straightforward, the long-term fix is on the roadmap, and Aviatrix has given customers a year of runway before the legacy escape hatch closes. The bad news is that "intermittent performance degradation" is the kind of symptom that gets misdiagnosed in production for weeks before anyone connects it to an Azure hardware change. The best decision is to apply the policy now, while the rollout is still small.

Source:

Azure MANA support for NVAs