Create the Service Definition and a Corresponding Virtual Endpoint

You must use NSX Manager APIs to create a service definition and virtual endpoint for the service appliance in your public cloud.

Prerequisites

Pick out a /32 reserved IP address to serve as the Virtual Endpoint for the service appliance in your public cloud, for example, 100.100.100.100/32. This is referred to as the Virtual Service IP (VSIP).

Note: If you deployed your service appliance in a High Availability pair, do not create another service definition but use the same VSIP when advertising it to the PCG during BGP configuration.

Procedure

1. To create a Service Definition for the service appliance, run the following API call using NSX Manager credentials for authorization:

   POST https://{{NSX Manager-IP}}/policy/api/v1/enforcement-points/default/service-definitions

   Example request:

   {
        "resource_type":"ServiceDefinition",
        "description":"NS-Service",
        "display_name":"Service_Appliance1",
        "attachment_point":[
           "TIER0_LR"
        ],
        "transports":[
           "L3_ROUTED"
        ],
        "functionalities":[
           "NG_FW", "BYOD"
        ],
        "on_failure_policy":"ALLOW",
        "implementations":[
           "NORTH_SOUTH"
        ],
        "vendor_id" : "Vendor1"
   }

   Example response:

   {
       "resource_type": "ServiceDefinition",
       "description": "NS-Service",
       "id": "33890153-6eea-4c9d-8e34-7b6532b9d65c",
       "display_name": "Service_Appliance1",
       "attachment_point": [
           "TIER0_LR"
       ],
       "transports": [
           "L3_ROUTED"
       ],
       "functionalities": [
           "NG_FW", "BYOD"
       ],
       "vendor_id": "Vendor1",
       "on_failure_policy": "ALLOW",
       "implementations": [
           "NORTH_SOUTH"
       ],
       "_create_time": 1540424262137,
       "_last_modified_user": "nsx_policy",
       "_system_owned": false,
       "_protection": "REQUIRE_OVERRIDE",
       "_last_modified_time": 1540424262137,
       "_create_user": "nsx_policy",
       "_revision": 0
   }

2. To create a Virtual Endpoint for the service appliance, run the following API call using NSX Manager credentials for authorization:

   PATCH https://{{NSX Manager-IP}}policy/api/v1/infra/tier-0s/<tier-0 router ID>/locale-services/cloud/endpoints/virtual-endpoints/Service_Appliance1_Endpoint

   Example request:

   {
     "resource_type": "VirtualEndpoint",
     "display_name": "Service_Appliance1_Endpoint",
     "target_ips": [
       {
         "ip_addresses": [
           "100.100.100.100"
         ],
         "prefix_length": 32
       }
     ],
     "service_names": [
       "Service_Appliance1"
     ]
   }

   Example response:

   200 OK

   Note: The display_name in step 1 must match the service_names in step 2.

What to do next

Set up an IPSec VPN Session