The appendix aggregates design decisions that determine the deployment configuration to support Cross Cloud Mobility for VMware Cloud Foundation validated solution. You can use this design decisions list for reference related to the end state of the environment and potentially to track your level of adherence to the design and any justification for deviations.

Deployment Specification

Table 1. Design Decisions on the Deployment of an HCX Connector

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-CFG-001

Deploy the HCX Connector appliance in the default management vSphere cluster.

Required to establish secure communication between the VMware Cloud Foundation instance and VMware HCX.

The HCX Connector must be able to connect to the internet through a firewall.

CCM-CDP-CFG-002

Protect the HCX Connector appliance by using vSphere High Availability.

Supports the availability objective without requiring manual intervention during an ESXi host failure.

None.

CCM-CDP-CFG-003

Place the HCX Connector appliance in a designated virtual machine folder.

Provides organization of the appliances in the management domain vSphere inventory.

You must create the virtual machine folder before or during deployment.
Table 2. Design Decisions on the Deployment of an HCX Connector in Multiple Availability Zones

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-CFG-004

When using two availability zones, add the HCX Connector appliance to the VM group of the first availability zone.

Ensures that the HCX Connector appliance runs in the primary availability zone hosts group.

After the implementation of the second availability zone for the management domain, you must update the VM group for the primary availability zone virtual machines to include the HCX Connector appliance.

Network Design

Table 3. Design Decisions on the Network Segments for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-NET-001

Place the HCX Connector appliance on the management VLAN.

  • Places the HCX Connector on the same network as the VMware Cloud Foundation components that the appliance must communicate with.

  • Provides a consistent deployment model for VMware Cloud Services.

None.
Table 4. Design Decisions on the IP Addressing for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-NET-002

Allocate statically assigned IP addresses from the management VLAN to the HCX Connector appliance.

Using statically assigned IP addresses ensures stability of the deployment and simplifies maintenance and tracking.

Requires precise IP address management.
Table 5. Design Decisions on Name Resolution for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-NET-003

Configure forward and reverse DNS records for the HCX Connector appliance IP address.

Ensures the appliance is accessible by using a fully qualified domain name instead of using IP addresses only.

  • You must provide a DNS record for the appliance IP address.

  • Firewalls between the appliance and the DNS servers must allow DNS traffic.

CCM-CDP-NET-004

Configure DNS servers on the HCX Connector appliance.

Ensures the appliance has accurate name resolution.

  • DNS infrastructure services must be highly-available in the environment.

  • Firewalls between the appliance and the DNS servers must allow DNS traffic.

  • You must provide two or more DNS servers unless a DNS geographic load balancing is active.
Table 6. Design Decisions on Time Synchronization for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-NET-005

Configure NTP servers for the HCX Connector appliance.

  • Ensures that the appliance has accurate time synchronization.

  • Assists in the prevention of time mismatch between the appliance and dependencies.

  • NTP infrastructure services must be highly-available in the environment.

  • Firewalls between the appliance and the NTP servers must allow NTP traffic.

  • You must provide two or more NTP servers unless an NTP geographic load balancing is active.

VMware Cloud on AWS Design

Table 7. Design Decisions on VMware Cloud on AWS for VMware HCX

Decision ID

Design Decision

Design Justification

Design Implication

CCM-AWS-CFG-001

Deploy a VMware Cloud on AWS mobility SDDC with a minimum of two nodes.

Ensures that the pre-provisioned mobility SDDC remains available. A single node expires after 60 days.

A pre-provisioned mobility SDDC consumes infrastructure that incurs a regular charge.

CCM-AWS-CFG-002

Configure the management gateway to allow access to VMware Cloud on AWS mobility SDDC vCenter Server over the internet.

Ensures users can access the vCenter Server UI of the mobility SDDC over the internet.

You must manually manage access to the vCenter Server by using an NSX group.

VMware HCX Design

Table 8. Design Decisions on HCX Integration

Decision ID

Design Decision

Design Justification

Design Implication

CCM-HCX-CFG-001

Register the HCX Connector with the VI workload domain vCenter Server.

Registering the HCX Connector with vCenter Server installs the plug-ins to integrate HCX with vCenter Server.

None.

CCM-HCX-CFG-002

Register the HCX Connector with the VI workload domain NSX Manager.

Registering the HCX Connector with NSX Manager is required to enable the networking configuration.

None.

CCM-HCX-CFG-003

Register the HCX Connector with the Single Sign-On Domain of the VI workload domain vCenter Server.

By registering the HCX Connector with Single Sign-On, you can create dedicated VMware HCX roles within vCenter Server.

None.
Table 9. Design Decisions on Site Paring for VMware HCX

Decision ID

Design Decision

Design Justification

Design Implication

CCM-HCX-CFG-004

Pair the HCX Connector with the HCX Cloud service.

Required to establish unidirectional communication between the VMware Cloud Foundation instance and the HCX Cloud service to create a Service Mesh.

  • The HCX Connector must be able to connect to the internet through a firewall.

  • You can also establish connectivity through a proxy server which you would need to configure outside of this solution.
Table 10. Design Decisions on Service Mesh for VMware HCX

Decision ID

Design Decision

Design Justification

Design Implication

CCM-HCX-CFG-005

Create a management network profile using the management network distributed switch port group and assign Management and HCX Uplink traffic types.

Provides management network configuration details used when deploying VMware HCX service appliances.

None.

CCM-HCX-CFG-006

Assign the management network profile a pool of 5 IP address from the VI workload domain management VLAN.

Provides a pool of IP addresses that can dynamically be assigned to the VMware HCX service appliances.

Requires the allocation of a static pool of IP addresses from the VI workload domain management VLAN.

CCM-HCX-CFG-007

Create a vMotion network profile using the vMotion network distributed switch port group and assign vMotion traffic type.

Provides vMotion network configuration details used when deploying VMware HCX service appliances.

None.

CCM-HCX-CFG-008

Assign the vMotion network profile a pool of 5 IP address from the VI workload domain vMotion VLAN.

Provides a pool of IP addresses that can dynamically be assigned to the VMware HCX service appliances.

Requires the allocation of a static pool of IP addresses from the VI workload domain vMotion VLAN.

CCM-HCX-CFG-009

Create a compute profile and activate all available VMware HCX services.

Provides the compute, storage, and network settings that VMware HCX uses to deploy the interconnect-dedicated appliances when a Service Mesh is added.

Services that can be activated are dependent on the VMware HCX license applied during the activation of the HCX Connector.

CCM-HCX-CFG-010

Assign the VI workload domain cluster as a resource to the compute profile.

Provides compute capacity for the interconnect-dedicated appliances when a Service Mesh is added.

None.

CCM-HCX-CFG-011

Assign a vSphere resource pool as a container to the compute profile.

Provides a container to group the interconnect-dedicated appliances and the ability to configure resource priorities.

 You must manually create a resource pool before configuring the compute profile.

CCM-HCX-CFG-012

Assign a virtual machine folder as a container to the compute profile.

Provides organization of the appliances in the management domain vSphere inventory.

You must manually create a virtual machine folder before configuring the compute profile.

CCM-HCX-CFG-013

Assign the management and vMotion network profiles to the compute profile.

Provides network settings for the interconnect-dedicated appliances when a Service Mesh is added.

None.

CCM-HCX-CFG-014

Create a Service Mesh between the VMware Cloud Foundation instance and VMware Cloud on AWS SDDC.

Provides an interconnect between on-premises and the VMware Cloud on AWS environments to enable extending VMware Cloud Foundation networks to facilitate workload mobility without the need to re-IP application virtual machines.

None.

Life Cycle Management Design

Table 11. Design Decisions on Life Cycle Management of the HCX Connector appliance

Decision ID

Design Decision

Design Justification

Design Implication

CCM-CDP-LCM-001

Manually upgrade the HCX Connector appliance using the built-in tools.

An upgrade package must be downloaded and applied to the HCX appliance to perform an upgrade.

None.

CCM-CDP-LCM-002

Use the VMware Cloud Services automatic over-the-air service to perform the upgrades to the HCX Connector appliance.

The VMware HCX service pushes upgrades automatically.

None.

Information Security and Access Control Design

Table 12. Design Decisions on Identity Management for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-IAM-SEC-001

Limit the use of local accounts for interactive or API access, and solution integration.

Local accounts are not specific to user identity and do not offer complete auditing from an endpoint back to the user identity.

You must define and manage service accounts, security groups, group membership, and security controls in Active Directory.

CCM-IAM-SEC-002

Limit the scope and privileges for accounts used for interactive or API access, and solution integration.

The principle of least privilege is a critical aspect of access management and must be part of a comprehensive defense-in-depth security strategy.

You must define and manage custom roles and security controls to limit the scope and privileges used for interactive access or solution integration.

CCM-IAM-SEC-003

Assign VMware Cloud on AWS service roles to designated users.

To provide access to the VMware Cloud on AWS service, you assign users to service roles.

You must maintain the service roles required for users of your organization.

CCM-IAM-SEC-004

Assign VMware HCX service roles to designated users.

To provide access to the VMware HCX service, you assign users to service roles.

You must maintain the service roles required for users of your organization.
Table 13. Design Decisions on Service Accounts for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-IAM-SEC-005

Define a custom vCenter Server role for VMware HCX with minimum privileges required to support the registration of a vCenter Server.

VMware HCX integrates with each VI workload domain vCenter Server instance using a minimum set of privileges required to support registration and management.

  • You must maintain the privileges required by the custom vSphere role.

  • If additional VI workload domain vCenter Server instances are not in the same vCenter Single Sign-On domain, you must apply the custom role to each vCenter Single Sign-On domain.

CCM-IAM-SEC-006

Assign the custom vCenter Server role to an Active Directory user account as a service account for each VI workload domain vCenter Server instance for application-to-application communication between VMware HCX and vCenter Server.

  • Provides integration and data collection of objects managed by the vCenter Server for a given VI workload domain.

  • Limiting the use of a service account reduces the risk in the case of either a security or a password-related event.

  • Using a named Active Directory account provides for auditability unlike generic administrative accounts.

You must maintain the life cycle, availability, and security controls for the account in Active Directory.

CCM-IAM-SEC-007

Assign the default Enterprise Admin role in NSX Manager to a service account for each VI workload domain NSX Manager instance for application-to-application communication between VMware HCX and NSX.

VMware HCX integrates with each VI workload domain NSX Manager instance using a minimum set of privileges required to support registration and management.

None.
Table 14. Design Decisions on Password Policies for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-IAM-SEC-008

Configure the local user password expiration policy for each HCX Connector appliance.

  • You configure the local user password expiration policy for each HCX Connector appliance to align with the requirements of your organization which might be based on industry compliance standards.

  • The local user password expiration policy is applicable to the root and admin accounts for the HCX Connector appliance.

You must manage the local user password expiration settings on each HCX Connector appliance by using the appliance console.

CCM-IAM-SEC-009

Configure the local user password complexity policy for each HCX Connector appliance.

  • You configure the local user password complexity policy for each HCX Connector appliance to align with the requirements of your organization which might be based on industry compliance standards.

  • The local user password complexity policy is applicable only to the local HCX Connector appliance users.

You must manage the local user password complexity settings on each HCX Connector appliance by using the appliance console.

CCM-IAM-SEC-010

Configure the local user account lockout policy for each HCX Connector appliance.

  • You configure the local user account lockout policy for each HCX Connector appliance to align with the requirements of your organization which might be based on industry compliance standards.

  • The local user account lockout policy is applicable only to the local HCX Connector appliance users.

You must manage the local user account lockout settings on each HCX Connector appliance by using the appliance console.
Table 15. Design Decisions on Password Management for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-IAM-SEC-011

For each vCenter Server, change the VMware HCX service account password on a recurring or event-initiated schedule.

To maintain a secure platform, you must rotate the VMware HCX service account passwords on a regular basis

Performing password rotation for a service account is a manual process. You update the associated credentials in the HCX Connector appliance.

CCM-IAM-SEC-012

For each NSX Manager, change the VMware HCX service account password on a recurring or event-initiated schedule.

To maintain a secure platform, you must rotate the VMware HCX service account passwords on a regular basis.

Performing password rotation for a service account is a manual process. You update the associated credentials in the HCX Connector appliance.

CCM-IAM-SEC-013

Change the HCX Connector appliance root and admin passwords on a recurring or event-initiated schedule.

The password for the HCX Connector appliance root and admin accounts never expires based on the default password expiration policy.

  • You must manage the password change for the root and the admin accounts.

  • You must manage the password change on each HCX Connector appliance by using the virtual appliance console.
Table 16. Design Decisions on Certificate Management for Cross Cloud Mobility

Decision ID

Design Decision

Design Justification

Design Implication

CCM-IAM-SEC-014

Replace the default self-signed certificate with a CA-signed certificate during the deployment of the HCX Connector appliance.

Ensures that all communication to the user interface of the HCX Connector appliance is encrypted.

  • Replacing the default certificates with a trusted CA-signed certificate increases the deployment preparation time as certificates requests are generated and delivered.

  • You must manage the life cycle of the certificate replacement.

  • The SSL certificate key size must be 2048 or 4096 bits.

CCM-IAM-SEC-015

Use an SHA-2 or higher algorithm when signing certificates.

The SHA-1 algorithm is considered less secure and is deprecated.

Not all certificate authorities support SHA-2.

CCM-IAM-SEC-016

Rotate the CA-signed certificate of the HCX Connector appliance on a recurring or event-initiated schedule.

Ensures that all communication to the user interface of the HCX Connector appliance and between the components continues to be encrypted with a non-expired or non-compromised certificate.

  • Replacing the default certificates with a trusted CA-signed certificates might require preparation time as certificates requests are generated and delivered.

  • You must continue to manage the life cycle of the certificate replacement.

  • The SSL certificate key size must be 2048 or 4096 bits.

Solution Interoperability

Table 17. Design Decisions on Monitoring and Alerting Using Intelligent Operations Management for VMware Cloud Foundation

Decision ID

Design Decision

Design Justification

Design Implication
CCM-MON-IOM-001

Add a Ping adapter for the HCX Connector appliance.

Provides metrics on the availability of the HCX Connector appliance.

You must add the adapter instances manually.

CCM-MON-IOM-002

Configure the Ping adapter for the HCX Connector appliance to use the local-instance collector group.

Offloads data collection for local management components from the analytics cluster.

None.
Table 18. Design Decisions on Data Protection for VMware HCX

Decision ID

Design Decision

Design Justification

Design Implication

CCM-BCK-HCX-001

Configure an FTP server using the SFTP protocol as a target for the HCX Connector.

Provides an external target for storing backup sets.

An external FTP server supporting SFTP must be available in the environment.

CCM-BCK-HCX-002

Configure a backup schedule for the HCX Connector.

Ensures regular backups, which facilitate recovery, are performed.

None.