VMware Cloud on AWS Networking and Security - VMware …

1 VMware Cloud on AWS. Networking and Security 13 January 2022. SDDC Version VMware Cloud on AWS. VMware Cloud on AWS Networking and Security You can find the most up-to-date technical documentation on the VMware website at: VMware , Inc. 3401 Hillview Ave. Palo Alto, CA 94304.. Copyright 2017-2022 VMware , Inc. All rights reserved. Copyright and trademark information. VMware , Inc. 2. Contents About VMware Cloud on AWS Networking and Security 5. 1 NSX-T Networking Concepts 6. Features Supported with NSX-T 11. 2 configuring VMware Cloud on AWS Networking and Security Using NSX-T 13.

2 Assign NSX Service Roles to Organization Members 14. Open NSX Manager 15. Configure AWS Direct Connect Between Your SDDC and On-Premises Data Center 18. Set Up an AWS Direct Connect Connection 18. Configure Direct Connect to a Private Virtual Interface for SDDC Management and Compute Network Traffic 19. Configure Direct Connect to a Public Virtual Interface for access to AWS Services 23. Specify the Direct Connect MTU 24. Configure a VPN Connection Between Your SDDC and On-Premises Data Center 25. Create a Route-Based VPN 25. Create a Policy-Based VPN 30. Configure a Layer 2 VPN and Extended Network Segment 34.

3 View VPN Tunnel Status and Statistics 38. IPsec VPN Settings Reference 38. Configure Management Gateway Networking and Security 40. Set vCenter Server FQDN Resolution Address 41. Set HCX FQDN Resolution Address 41. Add or Modify Management Gateway Firewall rules 42. Configure Compute Gateway Networking and Security 47. Create or Modify a Network Segment 47. Add or Modify Compute Gateway Firewall rules 54. Add or Modify Distributed Firewall rules 57. Configure DNS Services 62. View Routes Learned and Advertised over VMware Transit Connect 64. View Statistics and Manage Settings for Uplinks 64.

4 Configure a Multi-Edge SDDC With Traffic Groups 65. Working With Inventory Groups 69. Add a Management Group 69. Add or Modify a Compute Group 70. Add a Custom Service 72. View Virtual Machine Inventory 72. About Context Profiles 73. VMware , Inc. 3. VMware Cloud on AWS Networking and Security Managing Workload Connections 73. Attach a VM to or Detach a Workload VM from a Compute Network Segment 74. Request or Release a Public IP Address 74. Create or Modify NAT rules 75. Creating Firewall rules to Manage Traffic Between the Compute and Management Networks 77.

5 3 Configure Monitoring and Troubleshooting Features 79. Configure IPFIX 79. Configure Port Mirroring 80. View Connected VPC Information and Troubleshoot Problems With the Connected VPC 82. 4 About NSX Advanced Firewall Features 85. VMware , Inc. 4. About VMware Cloud on AWS Networking and Security The VMware Cloud on AWS Networking and Security guide provides information about configuring NSX-T Networking and Security for VMware Cloud on AWS. Intended Audience This information is intended for anyone who wants to use VMware Cloud on AWS to create an SDDC that has the Networking and Security infrastructure necessary to migrate workloads off premises and run them securely in the Cloud .

6 It was written for readers who have used vSphere in an on-premises environment and are familiar with the fundamentals of IP Networking using NSX-T. or another Networking solution. In-depth knowledge of vSphere or Amazon Web Services is not required. For a detailed discussion of how VMware Cloud on AWS uses NSX-T Networking , see the VMware Press eBook VMware Cloud on AWS: NSX Networking and Security . VMware , Inc. 5. NSX-T Networking Concepts 1. VMware Cloud on AWS uses NSX-T to create and manage SDDC networks. NSX-T provides an agile software-defined infrastructure to build Cloud -native application environments The VMware Cloud on AWS Networking and Security explains how to use the VMC Console Networking & Security tab to manage your SDDC networks.

7 Beginning with SDDC version , you also can use the NSX Manager Web UI to manage these networks. NSX Manager supports a superset of the features found on the Networking & Security tab. See NSX Manager in the NSX-T. Data Center Administration Guide for information about how to use NSX Manager. The NSX. Manager in your VMware Cloud on AWS SDDC is accessible at a public IP address reachable by any browser that can connect to the Internet. You can also access it from your internal network over a VPN or AWS Direct Connect. See Open NSX Manager for details. User interface layout and navigation in the NSX Manager Web UI is similar to what's presented in the VMC Console Networking & Security tab, and you can use either tool to complete most of the procedures in this document.

8 When a procedure requires you to use NSX Manager, we note that in the prerequisites to the procedure. SDDC Network Topology When you create an SDDC, it includes a Management Network. Single-host trial SDDCs also include a small Compute Network. You specify the Management Network CIDR block when you create the SDDC. It cannot be changed after the SDDC has been created. See Deploy an SDDC. from the VMC Console for details. The Management Network has two subnets: Appliance Subnet This subnet is used by the vCenter, NSX, and HCX appliances in the SDDC. When you add appliance-based services such as SRM to the SDDC, they also connect to this subnet.

9 Infrastructure Subnet This subnet is used by the ESXi hosts in the SDDC. The Compute Network includes an arbitrary number of logical segments for your workload VMs. See VMware Configuration Maximums for current limits on logical segments. In a Single Host SDDC starter configuration, we create a compute network with a single routed segment. In SDDC. configurations that have more hosts, you'll have to create compute network segments to meet your needs. See VMware Configuration Maximums for applicable limits. VMware , Inc. 6. VMware Cloud on AWS Networking and Security An SDDC network has two notional tiers: n Tier 0 handles north-south traffic (traffic leaving or entering the SDDC, or between the Management and Compute gateways).

10 N Tier 1 handles east-west traffic (traffic between routed network segments within the SDDC). Figure 1-1. SDDC Network Topology BGP AWS. Direct Linked Customer VPC. Connect (DX) Main SDDC Subnet Customer Route Premises Table BGP. xENI. Internet IGW. VGW. VPN Tunnel Interface Direct Connect BGP. Interface NSX NSX Controller Internet VPC. Tier 0. Manager Interface Interface MGW CGW. (Tier 1) (Tier 1). vCenter DFW. Edge0/1 Routed Compute Distributed Network Segment Router Default Appliance Gateway Routed Compute Infrastructure Subnet Subnet Network Segment DFW DFW.