7.0

The app isolation policy has a lower precedence compared to other security policies in NSX. For
example, if the provisioned deployment contains a Web component machine and an App component
machine and the Web component machine hosts a Web service, then the service must allow inbound
traffic on ports 80 and 443. In this case, users must create a Web security policy in NSX with firewall rules
defined to allow incoming traffic to these ports. In vRealize Automation, users must apply the Web
security policy on the Web component of the provisioned machine deployment.
If the Web component machine needs access to the App component machine using a load balancer on
ports 8080 and 8443, the Web security policy should also include firewall rules to allow outbound traffic to
these ports in addition to the existing firewall rules that allow inbound traffic to ports 80 and 443.
For information about security features that can be applied to a machine component in a blueprint, see
Using Security Components in the Blueprint Canvas.
Configuring Network and Security Component Settings
vRealize Automation supports virtualized networks based on the vCloud Networking and Security and
NSX platforms.
Network and security virtualization allows virtual machines to communicate with each other over physical
and virtual networks securely and efficiently.
To integrate network and security with vRealize Automation, an IaaS administrator must install the
vCloud Networking and Security or NSX plug-ins in vRealize Orchestrator and create
vRealize Orchestrator and vSphere endpoints.
For information about external preparation, see Configuring vRealize Automation.
You can create network profiles that specify network settings in reservations and in the blueprint canvas.
External network profiles define existing physical networks. NAT and routed profiles are templates that will
build NSX logical switches and appropriate routing settings for a new network path and for configuring
network interfaces to connect to network path when you provision virtual machines and configure NSX
Edge devices.
The network and security component settings that you add to the blueprint design canvas are derived
from your NSX configuration and require that you have installed the NSX plug-in and run data collection
for the NSX inventory for vSphere clusters. Network and security components are specific to NSX and are
available for use with vSphere machine components only. For information about configuring NSX, see
NSX Administration Guide.
For machine components that do not have a Network or Security tab, you can add network and security
custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the blueprint
canvas. However, NSX load balancer properties are only applicable to vSphere machines.
If a network profile is specified in the blueprint (by using the VirtualMAchine.NetworkN.ProfileName
custom property) and by a reservation that is used by the blueprint, the network profile specified in the
blueprint takes precedence. However, if the custom property is not used in the blueprint, and you select a
network profile for a machine NIC, vRealize Automation uses a reservation network path for the machine
NIC for which the network profile is specified.
Configuring vRealize Automation
VMware, Inc. 303