7.1

vRealize Automation provisions a routed gateway, for example an edge services gateway (ESG), for NAT
networks and for load balancers. For routed networks, vRealize Automation uses existing distributed
routers.
A NAT network prole and load balancer enable vRealize Automation to deploy an NSX edge services
gateway. A routed network prole uses an NSX logical distributed router (DLR). The DLR must be created
in NSX before it can be consumed by vRealize Automation. vRealize Automation cannot create DLRs. After
data collection, vRealize Automation can use the DLR for virtual machine provisioning.
The reservation used to provision the edge or routed gateway determines the external network used for
NAT and routed network proles, as well as the load balancer virtual IP addresses.
When you use the blueprint to provision a machine deployment, vRealize Automation aempts to use only
the reservations associated with the specied reservation policy to provision the edge or routed gateway.
Applying an NSX App Isolation Security Policy to a Blueprint
An NSX app isolation policy acts as a rewall to block all inbound and outbound trac to and from the
provisioned machines in the deployment. When you specify a dened NSX app isolation policy, the
machines provisioned by the blueprint can communicate with each other but cannot connect outside the
rewall.
You can apply app isolation at the blueprint level by using the New Blueprint or Blueprint Properties dialog.
When using an NSX app isolation policy, only internal trac between the machines provisioned by the
blueprint is allowed. When you request provisioning, a security group is created for the machines to be
provisioned. An app isolation security policy is created in NSX and applied to the security group. Firewall
rules are dened in the security policy to allow only internal trac between the components in the
deployment. For related information, see “Create a vSphere Endpoint with Network and Security
Integration,” on page 161.
N When provisioning with a blueprint that uses both an NSX Edge load balancer and an NSX app
isolation security policy, the dynamically provisioned load balancer is not added to the security group. This
prevents the load balancer from communicating with the machines for which it is meant to handle
connections. Because Edges are excluded from the NSX distributed rewall, they cannot be added to
security groups. To allow load balancing to function properly, use another security group or security policy
that allows the required trac into the component VMs for load balancing.
The app isolation policy has a lower precedence compared to other security policies in NSX. For example, if
the provisioned deployment contains a Web component machine and an App component machine and the
Web component machine hosts a Web service, then the service must allow inbound trac on ports 80 and
443. In this case, users must create a Web security policy in NSX with rewall rules dened to allow
incoming trac to these ports. In vRealize Automation, users must apply the Web security policy on the
Web component of the provisioned machine deployment.
If the Web component machine needs access to the App component machine using a load balancer on ports
8080 and 8443, the Web security policy should also include rewall rules to allow outbound trac to these
ports in addition to the existing rewall rules that allow inbound trac to ports 80 and 443.
For information about security features that can be applied to a machine component in a blueprint, see
“Using Security Components in the Blueprint Canvas,” on page 282.
Configuring Network and Security Component Settings
vRealize Automation supports virtualized networks based on the vCloud Networking and Security and
NSX platforms.
Network and security virtualization allows virtual machines to communicate with each other over physical
and virtual networks securely and eciently.
Chapter 4 Providing On-Demand Services to Users
VMware, Inc. 281