7.4

The app isolation policy has a lower precedence compared to other security policies in NSX. For
example, if the provisioned deployment contains a web component machine and an app component
machine and the web component machine hosts a web service, then the service must allow inbound
traffic on ports 80 and 443. In this case, users must create a web security policy in NSX with firewall rules
defined to allow incoming traffic to these ports. In vRealize Automation, users must apply the web security
policy on the web component of the provisioned machine deployment.
Note If a blueprint contains one or more load balancers and app isolation is enabled for the blueprint,
the load balancer VIPs are added to the app isolation security group as an IPSet. If a blueprints contains
an on-demand security group that is associated to a machine tier that is also associated to a load
balancer, the on-demand security group includes the machine tier and the IPSet with the load balancer
VIP.
If the web component machine needs access to the app component machine using a load balancer on
ports 8080 and 8443, the web security policy should also include firewall rules to allow outbound traffic to
these ports in addition to the existing firewall rules that allow inbound traffic to ports 80 and 443.
For information about security features that can be applied to a machine component in a blueprint, see
Using Security Components in the Design Canvas.
Configuring Network and Security Component Settings
vRealize Automation supports virtualized networks based on the NSX platform. Integrated Containers for
vRealize Automation networks are also supported.
To integrate network and security with vRealize Automation, an IaaS administrator must configure
vSphere and NSX endpoints.
For information about external preparation, see Configuring vRealize Automation.
You can create network profiles that specify network settings in reservations and in the design canvas.
External network profiles define existing physical networks. NAT and routed profiles are templates that will
build NSX logical switches and appropriate routing settings for a new network path and for configuring
network interfaces to connect to network path when you provision virtual machines and configure NSX
Edge devices.
The network and security component settings that you add to the design canvas are derived from your
NSX configuration and require that you have run data collection for the NSX inventory for vSphere
clusters. Network and security components are specific to NSX and are available for use with vSphere
machine components only. For information about configuring NSX, see NSX Administration Guide.
For machine components that do not have a Network or Security tab, you can add network and security
custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the design
canvas. NSX network, security, and load balancer properties are only applicable to vSphere machines.
Configuring vRealize Automation
VMware, Inc. 385