7.1

To integrate network and security with vRealize Automation, an IaaS administrator must install the NSX
plug-ins in vRealize Orchestrator and create vRealize Orchestrator and vSphere endpoints.
For information about external preparation, see Conguring vRealize Automation.
You can create network proles that specify network seings in reservations and in the blueprint canvas.
External network proles dene existing physical networks. NAT and routed proles are templates that will
build NSX logical switches and appropriate routing seings for a new network path and for conguring
network interfaces to connect to network path when you provision virtual machines and congure NSX
Edge devices.
The network and security component seings that you add to the blueprint design canvas are derived from
your NSX conguration and require that you have installed the NSX plug-in and run data collection for the
NSX inventory for vSphere clusters. Network and security components are specic to NSX and are available
for use with vSphere machine components only. For information about conguring NSX, see NSX
Administration Guide.
For machine components that do not have a Network or Security tab, you can add network and security
custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the blueprint canvas.
NSX load balancer properties are only applicable to vSphere machines.
If you specify a network prole in a reservation and a blueprint, the blueprint value takes precedence. For
example, if you specify a network prole in the blueprint by using the
VirtualMAchine.NetworkN.ProfileName custom property and in a reservation that is used by the blueprint,
the network prole specied in the blueprint takes precedence. However, if the custom property is not used
in the blueprint, and you select a network prole for a machine NIC, vRealize Automation uses the
reservation network path for the machine NIC for which the network prole is specied.
Depending on the compute resource, you can select a transport zone that identies a vSphere endpoint. A
transport zone species the hosts and clusters that can be associated with logical switches created within the
zone. A transport zone can span multiple vSphere clusters. The blueprint and the reservations used in the
provisioning must have the same transport zone seing. Transport zones are dened in the NSX
environments. See NSX Administration Guide.
Using Security Components in the Blueprint Canvas
You can add NSX security components to the canvas to make their congured seings available to one or
more vSphere machine components in the blueprint.
Security groups, tags, and policies are congured outside of vRealize Automation in the NSX application.
The network and security component seings that you add to the blueprint design canvas are derived from
your NSX conguration and require that you have installed the NSX plug-in and run data collection for the
NSX inventory for vSphere clusters. Network and security components are specic to NSX and are available
for use with vSphere machine components only. For information about conguring NSX, see NSX
Administration Guide.
You can add security controls to blueprints by conguring security groups, tags, and policies for the
vSphere compute resource in NSX. After you run data collection, the security congurations are available
for selection in vRealize Automation.
Security Group
A security group is a collection of assets or grouping objects from the vSphere inventory that is mapped to a
set of security policies, for example distributed rewall rules and third party security service integrations
such as anti-virus and intrusion detection. The grouping feature enables you to create custom containers to
which you can assign resources, such as virtual machines and network adapters, for distributed rewall
protection. After a group is dened, you can add the group as source or destination to a rewall rule for
protection.
You can add security groups to a blueprint, in addition to the security groups specied in the reservation.
Configuring vRealize Automation
282 VMware, Inc.