Cloud Infrastructure Network Design #
Network Design of Management Cluster for VMware Cloud Foundation #
The following picture shows the network design for all the components in the Cloud Infrastructure and how they are managed using VMware Cloud Provider Lifecyclle Manager
Reg.Mgmt and X.Reg.Mgmt
These are overlay Segments
Existing Reg. Mgmt is used for a secondary interface for VCD cells, vSAN FS, Usage meter, vRealize Operations
Manager Tenant App and VMware Cloud provider Lifecycle Manager
Cross region X.Reg.Mgmt is utilized for RabbitMQ nodes and load balancer.
VCD DMZ network has been added to separate the internet traffic. It is routed via a separate Tier-1 gateway and connected to existing Tier-0.
VCD Cells have the primary (eth0) interface connected to this network with NSX-T load balancer in its own Tier-1 gateway.
VMware Cloud Provider Lifecycle Manager Firewall Ports #
The below table provides a list of ports used by VMware Cloud Provider Lifecycle Manager for product and integration communication.
|9443||TCP||Inbound / Outbound||Management network||Port used for VMware Cloud Provider Lifecycle Manager REST API.|
|22||TCP||Inbound / Outbound||Management network||SSH connection to the VMware Cloud Provider Lifecycle Manager machine to configure and set up deployment binaries.|
|22||TCP||Outbound||Deployed products (VCD, RMQ, vROPS TA, UM)||SSH used to configure deployed products.|
|53||TCP/UDP||Inbound / Outbound||DNS Server||DNS will be used to resolve IPs and hostnames and validate corresponding records for requested deployments.
The DNS server provided in the payload will be used for validation purposes.
|123||UDP||Outbound||NTP server||Configure NTP server to ensure time is in sync.|
|443||TCP||Outbound||vCenter (Mgmt and resource)
VCD (cells and load balancer)
vROPS Tenant App
|HTTPS traffic to access and configure deployed products as well as validate infrastructure components.|
|5671 *||TCP, UDP||Outbound||RabbitMQ||AMQP port used for RabbitMQ AMQP service. This port can be customized; thus, the corresponding port must be accessible.|
|15671 *||TCP||Outbound||RabbitMQ Management Interface||Management port used for RabbitMQ Management Interface. This port can be customized; thus, the corresponding port must be accessible.|
|ICMP||Inbound / Outbound||VCD cells
vROPS Tenant App
|Ping is performed to check if deployed machines are running or existing prior to deployment.|