7.3

Networking and Security Rules and Considerations for Nesting Blueprints
n
Networking and security components in outer blueprints can be associated with machines that are
defined in nested blueprints.
n
NSX network, security, and load balancer components and their settings are not supported in nested
blueprints.
n
When app isolation is applied in the outer blueprint, it overrides app isolation settings specified in
nested blueprints.
n
Transport zone settings that are defined in the outer blueprint override transport zone settings that are
specified in nested blueprints.
n
When working in an outer blueprint, you can configure load balancer settings relative to network
component settings and machine component settings that are configured in an inner or nested
blueprint.
n
For a nested blueprint that contains an on-demand NAT network component, the IP ranges specified
in that on-demand NAT network component are not editable in the outer blueprint.
n
The outer blueprint cannot contain an inner blueprint that contains on-demand network settings or on-
demand load balancer settings. Using an inner blueprint that contains an NSX on-demand network
component or NSX load balancer component is not supported.
n
For a nested blueprint that contains NSX network or security components, you cannot change the
network profile or security policy information specified in the nested blueprint. You can, however,
reuse those settings for other vSphere machine components that you add to the outer blueprint.
n
To ensure that NSX network and security components in nested blueprints are uniquely named in a
composite blueprint, vRealize Automation prefixes the nested blueprint ID to network and security
component names that are not already unique. For example, if you add a blueprint with the ID name
xbp_1 to an outer blueprint and both blueprints contain an on-demand security group component
named OD_Security_Group_1, the component in the nested blueprint is renamed
xbp_1_OD_Security_Group_1 in the blueprint design canvas. Network and security component
names in the outer blueprint are not prefixed.
n
Component settings can change depending on which blueprint the component resides on. For
example, if you include security groups, security tags, or on-demand networks at both the inner and
outer blueprint levels, the settings in the outer blueprint override those in the inner blueprint. Network
and security components are supported only at the outer blueprint level except for existing networks
that work at the inner blueprint level. To avoid issues, add all your security groups, security tags, and
on-demand networks only to the outer blueprint.
Configuring vRealize Automation
VMware, Inc. 507