vRealize Automation supports virtualized networks based on the NSX platform. Integrated Containers for vRealize Automation networks are also supported.

To integrate network and security with vRealize Automation, an IaaS administrator must configure vSphere and NSX endpoints.

For information about external preparation, see Checklist for Preparing NSX Network and Security Configuration.

You can create network profiles that specify network settings in reservations and in the design canvas. External network profiles define existing physical networks. NAT and routed profiles are templates that will build NSX logical switches and appropriate routing settings for a new network path and for configuring network interfaces to connect to network path when you provision virtual machines and configure NSX Edge devices.

The network and security component settings that you add to the design canvas are derived from your NSX configuration and require that you have run data collection for the NSX inventory for vSphere clusters. Network and security components are specific to NSX and are available for use with vSphere machine components only. For information about configuring NSX, see NSX Administration Guide.

For machine components that do not have a Network or Security tab, you can add network and security custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the design canvas. NSX network, security, and load balancer properties are only applicable to vSphere machines.

If you specify a network profile in a reservation and a blueprint, the blueprint value takes precedence. For example, if you specify a network profile in the blueprint by using the VirtualMachine.NetworkN.ProfileName custom property and in a reservation that is used by the blueprint, the network profile specified in the blueprint takes precedence. However, if the custom property is not used in the blueprint, and you select a network profile for a machine NIC, vRealize Automation uses the reservation network path for the machine NIC for which the network profile is specified.

Depending on the compute resource, you can select a transport zone that identifies a vSphere endpoint. A transport zone specifies the hosts and clusters that can be associated with logical switches created within the zone. A transport zone can span multiple vSphere clusters. The blueprint and the reservations used in the provisioning must have the same transport zone setting. Transport zones are defined in the NSX environments. See NSX Administration Guide.

You can configure security settings for the virtual machines to be provisioned by specifying information in a reservation, blueprint, or guest agent script. If the machines to be provisioned requires a guest agent, you must add a security rule that contains that requirement to the reservation or the blueprint. For example, if you use a default security policy that denies communication between all machines, and rely on a separate security policy to allow communication between specific machines, the guest agent might be unable to communicate with vRealize Automation during the customization phase. To avoid this problem during machine provisioning, use a default security policy that allows communication during the customization phase.

You can also add a Containers network component to a blueprint.