Cloud Infrastructure Network Design

Cloud Infrastructure Network Design #

Network Design of Management Cluster for VMware Cloud Foundation #

The following picture shows the network design for all the components in the Cloud Infrastructure and how they are managed using VMware Cloud Provider Lifecyclle Manager

Logical design

Reg.Mgmt and X.Reg.Mgmt

  • These are overlay Segments

  • Existing Reg. Mgmt is used for a secondary interface for VCD cells, vSAN FS, Usage meter, vRealize Operations

    Manager Tenant App and VMware Cloud provider Lifecycle Manager

  • Cross region X.Reg.Mgmt is utilized for RabbitMQ nodes and load balancer.

VCD DMZ

  • VCD DMZ network has been added to separate the internet traffic. It is routed via a separate Tier-1 gateway and connected to existing Tier-0.

  • VCD Cells have the primary (eth0) interface connected to this network with NSX-T load balancer in its own Tier-1 gateway.


VMware Cloud Provider Lifecycle Manager Firewall Ports #

The below table provides a list of ports used by VMware Cloud Provider Lifecycle Manager for product and integration communication.

Port Protocol Direction Target Description
9443 TCP Inbound / Outbound Management network Port used for VMware Cloud Provider Lifecycle Manager REST API.
22 TCP Inbound / Outbound Management network SSH connection to the VMware Cloud Provider Lifecycle Manager machine to configure and set up deployment binaries.
22 TCP Outbound Deployed products (VCD, RMQ, vROPS TA, UM) SSH used to configure deployed products.
53 TCP/UDP Inbound / Outbound DNS Server DNS will be used to resolve IPs and hostnames and validate corresponding records for requested deployments.

The DNS server provided in the payload will be used for validation purposes.
123 UDP Outbound NTP server Configure NTP server to ensure time is in sync.
443 TCP Outbound vCenter (Mgmt and resource)
NSX Manager
VCD (cells and load balancer)
vROPS
vROPS Tenant App
Usage Meter
HTTPS traffic to access and configure deployed products as well as validate infrastructure components.
5671 * TCP, UDP Outbound RabbitMQ AMQP port used for RabbitMQ AMQP service. This port can be customized; thus, the corresponding port must be accessible.
15671 * TCP Outbound RabbitMQ Management Interface Management port used for RabbitMQ Management Interface. This port can be customized; thus, the corresponding port must be accessible.
ICMP Inbound / Outbound VCD cells
VCD cells
vROPS Tenant App
Usage Meter
RabbitMQ
Ping is performed to check if deployed machines are running or existing prior to deployment.