The virtual machines in a vApp can connect to vApp networks (isolated or routed) and to organization virtual data center networks. You can add networks of different types to a vApp to address multiple networking scenarios.
Virtual machines in a vApp can connect to the networks that are available in the vApp. If you want to connect a virtual machine to a different network, you must first add it to the vApp.
A vApp can include vApp networks and organization VDC networks. A vApp network can be isolated or routed. An isolated vApp network is contained within the vApp.
When you create a vApp network, you can route it to an organization VDC network to provide connectivity to virtual machines outside of the vApp. For routed vApp networks, you can configure network services, such as a firewall and static routing.
The networks that you add to the vApp use the network pool that is associated with the organization VDC in which you created the vApp.
Starting with version 10.3, VMware Cloud Director supports vApp network services both for data centers that are backed by NSX-T Data Center and by NSX Data Center for vSphere.
You can connect a vApp directly to an organization VDC network. If you have multiple vApps that contain identical virtual machines connected to the same organization VDC network that is backed by NSX Data Center for vSphere, and you want to start the vApps at the same time, you can fence the vApp. Fencing the vApp allows you to power on the virtual machines without a conflict, by isolating their MAC and IP addresses.
When you open the Networks tab of a vApp, if you see a notification that vApp fencing is not supported, this means that your organization VDC is backed by NSX-T Data Center. To avoid conflict between identical VMs in vApps connected to an NSX-T Data Center organization VDC network, it is best to use a routed vApp network and to set NAT rules.
You can deploy a vApp in a VDC that is backed by NSX-T Data Center from a template that was created in an organization backed by NSX Data Center for vSphere, and vice versa.
Because fencing a vApp is not supported for vApp networks backed by NSX-T Data Center, to avoid conflict when you connect a vApp that you deployed from an NSX Data Center for vSphere template to an NSX-T Data Center organization VDC network, you must route the vApp network and set NAT rules.
