7.0

Applying an NSX Routed Gateway Reservation Policy to a Blueprint
You can specify a reservation policy to manage the network communications for machines provisioned by
the blueprint. When requesting machine provisioning, the reservation policy is used to group the
reservations that can be considered for the deployment. The routed gateway reservation policy is also
referred to as an Edge reservation policy.
Networking information is contained in each reservation. When the machines are provisioned, a routed
gateway is allocated as the network router to manage network communications for the provisioned
machines in the deployment. You can add or edit blueprint-level properties by using the blueprint
properties page.
vRealize Automation provisions a routed gateway, for example an edge services gateway, for NAT
networks and for load balancers. For routed networks, vRealize Automation uses existing distributed
routers.
The reservation used to provision the routed gateway determines the external network used for NAT and
routed network profiles, as well as the load balancer virtual IP addresses.
When you use the blueprint to provision a machine deployment, vRealize Automation attempts to use
only the reservations associated with the specified reservation policy to provision the routed gateway.
Applying an NSX App Isolation Security Policy to a Blueprint
An NSX app isolation policy acts as a firewall to block all inbound and outbound traffic to and from the
provisioned machines in the deployment. When you specify a defined NSX app isolation policy, the
machines provisioned by the blueprint can communicate with each other but cannot connect outside the
firewall.
You can apply app isolation at the blueprint level by using the New Blueprint or Blueprint Properties
dialog.
When using an NSX app isolation policy, only internal traffic between the machines provisioned by the
blueprint is allowed. When you request machine provisioning, a security group is created for the
machines to be provisioned. An app isolation security policy is created in NSX and applied to the security
group. Firewall rules are defined in the security policy to allow only internal traffic. For related information,
see Create a vSphere Endpoint with Network and Security Integration.
Note When provisioning with a blueprint that uses both an NSX Edge load balancer and an NSX app
isolation security policy, the dynamically provisioned load balancer is not added to the security group. This
prevents the load balancer from communicating with the machines for which it is meant to handle
connections. Because Edges are excluded from the NSX distributed firewall, they cannot be added to
security groups. To allow load balancing to function properly, use another security group or security policy
that allows the required traffic into the component VMs for load balancing.
Configuring vRealize Automation
VMware, Inc. 302