7.2

When using an NSX app isolation policy, only internal traffic between the machines provisioned by the
blueprint is allowed. When you request provisioning, a security group is created for the machines to be
provisioned. An app isolation security policy is created in NSX and applied to the security group. Firewall
rules are defined in the security policy to allow only internal traffic between the components in the
deployment. For related information, see Create a vSphere Endpoint with Network and Security
Integration.
Note When provisioning with a blueprint that uses both an NSX Edge load balancer and an NSX app
isolation security policy, the dynamically provisioned load balancer is not added to the security group. This
prevents the load balancer from communicating with the machines for which it is meant to handle
connections. Because Edges are excluded from the NSX distributed firewall, they cannot be added to
security groups. To allow load balancing to function properly, use another security group or security policy
that allows the required traffic into the component VMs for load balancing.
The app isolation policy has a lower precedence compared to other security policies in NSX. For
example, if the provisioned deployment contains a Web component machine and an App component
machine and the Web component machine hosts a Web service, then the service must allow inbound
traffic on ports 80 and 443. In this case, users must create a Web security policy in NSX with firewall rules
defined to allow incoming traffic to these ports. In vRealize Automation, users must apply the Web
security policy on the Web component of the provisioned machine deployment.
If the Web component machine needs access to the App component machine using a load balancer on
ports 8080 and 8443, the Web security policy should also include firewall rules to allow outbound traffic to
these ports in addition to the existing firewall rules that allow inbound traffic to ports 80 and 443.
For information about security features that can be applied to a machine component in a blueprint, see
Using Security Components in the Design Canvas.
Adding Network and Security Properties to a Machine Component
Non-vSphere machine components do not have a Network or Security tab. You can add network and
security options to non-vSphere machine components in the blueprint design canvas by using custom
properties.
The Network & Security components are only available for use with vSphere machine components.
For machine components that do not have a Network or Security tab, you can add network and security
custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the design
canvas. NSX network, security, and load balancer properties are only applicable to vSphere machines.
You can define custom properties individually or as part of an existing property group by using the
Properties tab when configuring a machine component in the design canvas. The custom properties that
you define for a machine component pertain to machines of that type that are provisioned from the
blueprint.
For information about the available custom properties, see Custom Properties Reference.
Configuring vRealize Automation
VMware, Inc. 364