Skip to main content

Posts

Showing posts with the label VMware

VMware on AWS - How to restore NSX DFW firewall rules to previous state

Customers who uses NSX day-in, day-out would like to have a point-in time restore functionality of DFW firewall rules. Many customer have a large footprints in VMC and make changes to DFW quite often. This feature was missing for long time and we could see its included in recent versions . Let's see how DFW configuration roll back works  NSX DFW configuration has versioning, and it is stored in the NSX Manager.  Every time when someone update DFW configuration, NSX creates one more version but keep storing the previous ones. You can rollback for previous config but reapplying it once again.  You can find the options under Networking & Security tab , > Security > Distributed Firewall . In the right side we see an Actions drop down. Choose View to get to the below screen.  Let’s go through the use case:  1. Original state- default config with no custom rules:  a. There are no saved configurations during last 30 days: In my existing test setup, with the current setting

[How to] Enable Multi-cast in VMware on AWS - NSX environment

I had a customer who were running few application VMs in their on-premises datacenter which uses multicasting as main mechanism in order to form cluster blocks. They are in process of migrating the workloads from On-premises to VMware on AWS SDDCs. The application Architect wanted to ensure that the VMC supports multicasting within AWS VMC so that they migrate the VMS ( Life & Shift) without major downtime/config changes to their applications clusters. Let's see how things works within VMC world In VMC setup the Multi casting feature is enabled by default. In SDDC networks, layer 2 multicast traffic is treated as broadcast traffic on the network segment where the traffic originates. It is not routed beyond that segment.   VMC Limitation:  Optimisation features such as IGMP snooping are not supported.  Layer 3 multicast (such as  Protocol Independent Multicast) is not supported in VMware Cloud on AWS.   In the above example case, the customer has L2 multicast, let's check i

Implement and configure AWS Backup for VMware Cloud on AWS VM workloads

In our previous post we saw the design of the AWS Backup on VMC. In this post we’re going through the implementation steps As per the design and best practice, we are going to use the ENI for the Backup traffic CREATE A VPC ENDPOINT  TO CREATE AN INTERFACE ENDPOINT FOR AN AWS SERVICE 1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc    2. In the navigation pane, choose Endpoints 3. Choose Create endpoint 4. Name the endpoint   5. For Service category, choose AWS services 6. For Service name, search “ Backup ” and select “ backup-gateway ” service from the dropdown 7. For VPC, select the VPC which we used for SDDC deployment and extension 8. To create an interface endpoint for Amazon S3, you must “uncheck” Additional settings, Enable DNS name. This is because Amazon S3 does not support private DNS for interface VPC endpoints 9. For  Subnets , select one subnet per Availability Zone which we used for SDDC VMC selection  10. For Security group , sel

AWS Backup for VMware Cloud on AWS workloads - The Design

This blog post provides the high level design for implementing the Native AWS Backup to protect the VMware Workloads hosted on VMware Cloud on AWS.  VMware Cloud on AWS VMware Cloud on AWS enables customers to deploy the SDDC and consume vSphere workloads as a managed service on AWS global infrastructure. VMC is a jointly engineered solution by VMware and AWS that provides customers with a true hybrid cloud experience. As customers continue to adopt VMware Cloud on AWS, data protection for the VMs and workloads hosted on the VMC SDDC is becoming increasingly important. Customers should also be able to comply with data regulations and manage backup costs effectively. This post will go over the design considerations and best practices for enabling Native AWS Backup for VMs hosted on VMC SDDC. We'll go over different architecture design options and use cases that address customer needs. AWS Backup for VMware We can centrally protect our VMware workloads hosted on VMC SDDC thanks to A

VMware on AWS Cloud - Moving VMware HCX from VPN to Direct Connect

One of my customers are in the journey of migrating the workloads from On-Premise Datacenter to VMware Cloud on AWS. They have a 6 node VMC SDDC brought up and they are connected via a VPN tunnel over the public Internet. They also have HCX deployed on premise with multiple stretched networks and two HCX Service Meshes. The existing service meshes was created over the HCX VPN tunnel for the workload migration. Due to the fact that the customer is now planning for the mass VM migration from On-Premise to VMC, they decided to go with Direct Connect (AWS Direct Connect)  In this blog spot, I share the steps we performed.  Architecture:  We have setup the Direct Connect between On-Prem and AWS Datacenter and the connections are made available in AWS network account. Then created the Transit Virtual interfaces and associated with the Direct connect gateway ( detailed steps here ). Then attach the Direct Connect Gateway to an SDDC group steps here.    The high-level architecture looks like: 

Onboarding experience of VMware ON AWS in Production Environment-Part2

 VMware ON AWS Deployment - Requirements.  As mentioned in the previous post , when we are set with the project objective, we need to prepare the items mentioned in the VMC deployment checklist. Some of the basic requirements are,  The AWS account details - When we deploy our SDDC on VMware Cloud on AWS, it is created within an AWS account and a VPC dedicated to your organisation and managed by VMware. We must also connect the SDDC to an AWS account belonging to us, called the customer AWS account . This connection allows our SDDC to access AWS services belonging to our org  account. SDDC Management subnets - This is the most critical part of the deployment. Choosing the right network for SDDC and connect back to ON-Premise network (check with network team to make sure you provide unique range of CIDR, ASN etc to avoid conflicts)  Connectivity to On-Premise DC and VMC - There are different ways to connect to the On-Prem DC, using IPsec VPN, AWS Direct Connect, Hybrid Cloud Extension

Onboarding experience of VMware ON AWS in Production Environment - Part1

I hope you and your loved ones are safe and healthy   During this pandemic time, I have got a chance to onboard the VMware ON AWS to another location of our business. In this blog series I will share my experience and few tips about VMware ON AWS (VMC). This is purely my view and the intention are to spread the views to the community. If you have any issues, comments, feedback kindly share via email. Let’s get straight to the topic.  Why VMC:  Before we go choose to proceed with VMC, we need to understand and convince ourselves on below items,  Where do we fit this VMC in our existing infrastructure?  How could VMC bring in a value to our business  What workloads or solutions do we plan to run in this VMC?  Do we have a DR requirement? If yes, do we have an existing setup to migrate to VMC or its going to be a new DR setup?  Like this you might have to ask few questions which you might need to address it. When we have a problem statement and the solution, we are ready to proceed.  What

Automated deployment of Virtual Container Host (VCH) using vRealize Automation (vRA)

In our previous posts , we saw the option to deploy the VCH using CLI utility, vSphere client etc. In this post, we see an option to automate the VCH deployment using vRealize Automation ( vRA) Background:  The current automated world requires the seamless and fastest deployment of its infrastructure. VMware vSphere Integrated Containers gives developers an essential tool for streamlining the process of building and running containerized applications in production.  The deployment of VCH is done through various methods as we see in our previous posts. But in this post, we are going to see how to automate the VCH deployment and the first VCH in few mouse clicks. By using the service catalog in vRealize Automation to provision Virtual Container Hosts on-demand as a ticketless offer, you can make your developers self-sufficient. The vRealize Automation 7.4 and later versions support provisioning and management of Virtual Container Hosts(VCH) for running vSphere Integrated Containe