vRealize Automation supports virtualized networks based on the NSX platform. Integrated Containers for vRealize Automation networks are also supported.
To integrate NSX network and security with vRealize Automation, an IaaS administrator must configure vSphere and NSX endpoints. vRealize Automation supports NSX for vSphere and NSX-T.
For information about external preparation, see Checklist for Preparing NSX Network and Security Configuration.
You can create network profiles that specify network settings in reservations and in the blueprint. External network profiles define existing physical networks. On-demand NAT and routed network profiles can build NSX logical switches and appropriate routing settings for a new network path.
The network and security component settings that you add to the blueprint are derived from your NSX for vSphere and NSX-T configuration and require that you have run data collection for the NSX inventory for vSphere clusters. Network and security components are specific to NSX and are available for use with vSphere machine components only. For information about configuring NSX, see the Administration Guide in NSX for vSphere product documentation or NSX-T product documentation, depending on which application you are using.
For vSphere machine components with associated NSX, use network, security, and load balancing setting in the user interface. For machine components that do not have a Network or Security tab, you can add network and security custom properties, such as VirtualMachine.Network0.Name, to their Properties tab in the design canvas. NSX network, security, and load balancer properties are only applicable to vSphere machines.
If you specify a network profile in a reservation and a blueprint, the blueprint value takes precedence. For example, if you specify a network profile in the blueprint by using the VirtualMachine.NetworkN.ProfileName custom property and in a reservation that is used by the blueprint, the network profile specified in the blueprint takes precedence. However, if the custom property is not used in the blueprint, and you select a network profile for a machine NIC, vRealize Automation uses the reservation network path for the machine NIC for which the network profile is specified.
Depending on the compute resource, you can select a transport zone that identifies a vSphere endpoint. A transport zone specifies the hosts and clusters that can be associated with logical switches created within the zone. A transport zone can span multiple vSphere clusters. The blueprint and the reservations used in the provisioning must have the same transport zone setting. Transport zones are defined in the NSX environments.
You can configure security settings by specifying information in a reservation, blueprint, or guest agent script. If the machines to be provisioned require a guest agent, you must add a security rule that contains that requirement to the reservation or the blueprint. For example, if you use a default security policy that denies communication between all machines, and rely on a separate security policy to allow communication between specific machines, the guest agent might be unable to communicate with vRealize Automation during the customization phase. To avoid this problem during machine provisioning, use a default security policy that allows communication during the customization phase.
You can also add a Containers network component to a blueprint.