When you implement NSX-T Federation, all existing NSX-T Manager nodes become NSX-T Local Manager nodes. You must perform certain configurations before you can enable NSX-T Federation in Region A.
Procedure
Create an IP Pool for Remote Tunnel Endpoints in NSX-T Data Center for the Management Domain in Region B You must create an IP pool in your NSX-T Data Center for the remote tunnel end points.
Configure Automatic Backups of the NSX-T Global Manager Cluster Configurations for the Management Domain in Region B Configure your NSX-T Global Manager cluster to store daily configuration backups to a Secure File Transfer Protocol (SFTP) server. The NSX-T configuration backup contains the NSX-T Global Manager nodes backup, cluster backup, and inventory backup.
Obtain the Certificate Thumbprint of the NSX-T Manager Cluster Virtual IP for the Management Domain in Region B You must obtain the certificate thumbprint for the virtual IP of the NSX-T Manager cluster to use it later.
Delete the Existing Cross-Region Segment from the NSX-T Manager for the Management Domain in Region B Delete the xreg-m01-seg02
cross-region segment to avoid conflicts in the NSX-T Data Center environment when you enable NSX-T Federation in Region B. The same segment is also configured in Region A and you later stretch that segment to Region B.
Enable NSX-T Federation for the Management Domain in Region B To enable NSX-T Federation you add your existing NSX-T Manager as a location to the NSX-T Global Manager. You use the certificate thumbprint obtained earlier for that procedure. The NSX-T Manager becomes an NSX-T Local Manager. You later import your segments, Tier-0 gateways, and Tier-1 gateways from the NSX-T Local Manager to the NSX-T Global Manager.
Delete the Existing Tier-0 Gateway for the Management Domain in Region B You must delete the existing Tier-0 gateway in Region B. You first disconnect the Tier-1 gateway from the Tier-0 gateway and delete the Tier-0 gateway from the NSX-T Global Manager.
Configure the Tier-0 Gateway to Provide Networking for the Management Domain in Region B You reconfigure the Tier-0 gateway in Region A to stretch the network between Region A and Region B. You configure interface, BGP, and route distribution for Region B.
Configure an Any IP Prefix in the Tier-0 Gateway for the Management Domain You configure the Any
IP prefix on the Tier-0 Gateway to allow access to any network to perform route advertisement. Route maps use IP prefixes to prepend a path to one or more autonomous systems (AS-path prepend) for BGP neighbors and to configure local-reference on learned default-route for BGP neighbors.
Create a Route Map for No Export Traffic in the Tier-0 Gateway for the Management Domain Configure route maps in the Tier-0 Gateway to define which allowed routes can be redistributed in the management domain.
Configure Route Filters and Route Redistribution for BGP for the Management Domain After you configured the Tier-0 gateway with interfaces and BGP route filters on the BGP neighbors, you must configure route redistribution.
Configure the Tier-1 Gateway for the Management Domain in Region B You connect the lax-m01-ec01-t1-gw01
Tier-1 gateway for the region-specific workloads in Region B to the Tier-O gateway in Region A.
Add Region B as a Location in the Cross-Region Tier-1 Gateway for the Management Domain in Region A You add Region B as a location in secondary mode on the cross-region Tier-1 gateway in Region A to fulfill the cross-region workloads design.
Prevent Password Lockout on the NSX-T Local Manager Nodes for the Management Domain in Region B After an NSX-T Local Manager is imported to an NSX-T Global Manager, if you reset the admin password of the NSX-T Local Manager, the admin account gets locked out. As a result the connectivity between the NSX-T Global Manager cluster and the NSX-T Local Manager cluster fails with general system error. The NSX-T Global Manager nodes for both regions must be added to an allowlist of trusted nodes for the NSX-T Local Manager cluster to avoid lockdown.