Create a Custom Network Isolation Level

You can create your own custom network isolation level to gain more control over the network environment on the recovery SDDC.

When you start a ransomware recovery plan, VMware Live Cyber Recovery creates a predefined set of default firewall rules for your recovery SDDC called network isolation levels.

Each network isolation level (Isolated, Quarantined, External Outbound, and more) exists as a networking and security compute SDDC group on VMware Cloud on AWS. The name of the SDDC group roughly corresponds to the name of corresponding network isolation level in the VMware Live Cyber Recovery UI.

You can create your own custom network isolation level in the VMC Console console by creating your own networking and security compute SDDC group on the recovery SDDC, set the group membership criteria, and then configure networking and security for the group. You can create or apply existing firewall rules and other network configuration to the group, which then serves as a network isolation level in VMware Live Cyber Recovery.

Do not edit the VMware Live Cyber Recovery created firewall rules/SDDC groups because they are deleted when plan gets committed. Custom groups and rules are not deleted by VMware Live Cyber Recovery. Custom isolation levels are also visible to multiple plans.

To create your own custom network isolation level, perform these two tasks:

• Create a networking and security compute SDDC group on the recovery SDDC. Do not use the SDDC groups that VMware Live Cyber Recovery creates for the pre-defined network isolation levels, as they are deleted when a recovery plan is deactivated.
• Create firewall rules and apply to the SDDC group.

Warning: Using custom network isolation levels is fully supported, but be aware that if you move a VM from a pre-defined network isolation level to a custom isolation level, it removes all network isolation controls provided by VMware Live Cyber Recovery. Ensure that you have appropriately configured your custom isolation levels to match your recovery SDDC network isolation requirements.