7.2

Configuring Network and Security Component Settings
vRealize Automation supports virtualized networks based on the NSX platform. Integrated Containers for
vRealize Automation networks are also supported.
To integrate network and security with vRealize Automation, an IaaS administrator must install the NSX
plug-ins in vRealize Orchestrator and create vRealize Orchestrator and vSphere endpoints.
For information about external preparation, see Configuring vRealize Automation.
You can create network profiles that specify network settings in reservations and in the design canvas.
External network profiles define existing physical networks. NAT and routed profiles are templates that will
build NSX logical switches and appropriate routing settings for a new network path and for configuring
network interfaces to connect to network path when you provision virtual machines and configure NSX
Edge devices.
The network and security component settings that you add to the design canvas are derived from your
NSX configuration and require that you have installed the NSX plug-in and run data collection for the NSX
inventory for vSphere clusters. Network and security components are specific to NSX and are available
for use with vSphere machine components only. For information about configuring NSX, see NSX
Administration Guide.
For machine components that do not have a Network or Security tab, you can add network and security
custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the design
canvas. NSX network, security, and load balancer properties are only applicable to vSphere machines.
If you specify a network profile in a reservation and a blueprint, the blueprint value takes precedence. For
example, if you specify a network profile in the blueprint by using the
VirtualMachine.NetworkN.ProfileName custom property and in a reservation that is used by the
blueprint, the network profile specified in the blueprint takes precedence. However, if the custom property
is not used in the blueprint, and you select a network profile for a machine NIC, vRealize Automation uses
the reservation network path for the machine NIC for which the network profile is specified.
Depending on the compute resource, you can select a transport zone that identifies a vSphere endpoint.
A transport zone specifies the hosts and clusters that can be associated with logical switches created
within the zone. A transport zone can span multiple vSphere clusters. The blueprint and the reservations
used in the provisioning must have the same transport zone setting. Transport zones are defined in the
NSX environments. See NSX Administration Guide.
You can configure security settings for the virtual machines to be provisioned by specifying information in
a reservation, blueprint, or guest agent script. If the machines to be provisioned requires a guest agent,
you must add a security rule that contains that requirement to the reservation or the blueprint. For
example, if you use a default security policy that denies communication between all machines, and rely
on a separate security policy to allow communication between specific machines, the guest agent might
be unable to communicate with vRealize Automation during the customization phase. To avoid this
problem during machine provisioning, use a default security policy that allows communication during the
customization phase.
You can also add a Containers network component to a blueprint.
Configuring vRealize Automation
VMware, Inc. 365