vCloud Director – Key Differences in Edge Gateway Services (1 of 2)
Okay, continuing my comparison to the vCloud Director (vCD) Edge Services UI capabilities.
IPsec/L2 VPN Services – Advantage: Advanced Gateway
- Very modular interface similar to NSX that allows me to apply the necessary configurations to bring up a IPsec or L2 VPN tunnel. Remember, this is how we configure an L2 VPN tunnel for vCloud Director Extender!
- Well, I can set up an IPsec VPN. Nice feature, but no L2 VPN capability.
SSL VPN-Plus Services – Advantage: Advanced Gateway
- Comprehensive capability of establishing SSL VPN+ capability inside of the vCD HTML5 UI. From your general settings to creating the installation package, it’s covered.
- I got nothing, Jim. Not available in the Flex UI for the Standard Gateway.
Miscellaneous Services – Advantage: Advanced Gateway
- Very basic capability from enabling HA for the edge to configuring IP settings (external, IP Pools, etc).
- I see a section for Syslog Server settings, but no way of changing it. This can be done through the API however. Also, no way of changing the admin account password through this interface (that I’m aware of).
- As the name states, quite a bit more of available here.
- Edge Settings has the ability to enable/disable SSH, change the username/password, and set a login banner along with editing a single syslog server.
- We also have Statistics available from a Connections, IPsec VPN, and L2VPN perspective.
- Ability to upload/modify certificates from the UI.
- Last of all, Grouping Objects – ability to establish groups based on IP Sets, MAC Sets, Services, and Service Groups.
- As expected, very comprehensive and gives you a similar look and feel to NSX.
This should not come to any surprise, but the Advanced Gateway Services provide many more features in a very streamlined interface. For our NSX consumers, it’s very similar to what they see in the vSphere Flash Client today, but cleaner in my opinion.
There’s absolutely nothing wrong with the Standard Edge Services by the way. It’s an NSX Edge under the covers and what we went through here is what the UI presents from the Flex interface.
So why use the Standard Edge in comparison to the Advanced? First off, anything before vCD version 8.20 does not have the Advanced Edge available as it was released then. So if you’re on an older version, upgrade!
Second, there may be a consideration where the provider controls the managed services and provides basic network services. This could be good enough for the operating model and allows the provider to have complete control over the tenant/org environment.
Last of all, if you’re providing self-serviceability and advanced network services, you should be using the Advanced Gateway! I didn’t even discuss the granular Roles Based Access Control (RBAC) where I can present/unpresent specific configurations. For example, we can allow the tenant to manage their VPN tunnels while Routing is not available and controlled by the Provider.
Stay tuned for more updates on vCD, we got a lot of things cookin’. 🙂
Two-part vCD series since it was longer than I expected!
I had a question come in from a Cloud Provider on what are the actual key differences between a standard Edge Gateway Service and an Advanced Edge inside of the vCloud Director (vCD) User Interface (UI). While I could explain a few things on my own, I decided to do a little bit of legwork to confirm my suspicions. While some of you may already know the following, I thought this was an interesting exercise and wanted to share my results.
Before I get to that, I’m sure everyone is aware vCloud Director started off with vCloud Network and Security (VCNS) and this was the network backing before NSX. With recent versions of vCloud Director, everything is backed by NSX.
With that said, the Advanced Gateway experience is what VMware will eventually migrate to. Therefore, get used to the nice HTML5 intuitive and speedy UI! 🙂
In my vCD 9.x instance, I have two edges deployed:
- SiteB-T1-ESG is my advanced edge. I can verify this by right-clicking on the edge and seeing that I do not have an option to Convert to Advanced Gateway
- Moreover, you can see I am running version 9.x of vCD – I can convert it to a Distributed Logical Router!
- However, with my SiteB-T1-ESG-2, I can see it’s not an Advanced Gateway as I’m able to convert it
Let’s get to the comparisons now. Again, this is going to be in the context of the UI – not going to talk about the API right now. Going to state the advantage based on service in the title.
Firewall Services – Advantage: Advanced Gateway
- I can create granular firewall rules using grouping objects associated with the HTML5 interface.
- This provides a very similar experience to NSX within vCenter. To be honest, anyone that has used NSX should be able to figure this out very quickly.
- From the standard interface, I can only create rules from a IP/CIDR and key words such as “any, internal, external.”
- Pretty limited to say the least.
DHCP Services – Advantage: Advanced Gateway
- From the DHCP subtab, I am able to establish pools, bindings, and relay configurations. Moreover, configuring IP Sets and DHCP Relay Agents.
- We have the ability to add a DHCP pool that’s applied on an internal network that’s connected to this ESG. Pretty basic capabilities, but works.
NAT Services – Advantage: Tie
- Ability to establish Destination or Source NAT’s. I see the same options between both Advanced and the Standard gateway, so it’s hard to call an advantage either way.
- As stated with the Advanced Gateway, I have the ability to establish a DNAT or SNAT. Seems like the same options to me.
Routing Services – Advantage: Advanced Gateway
- This seems like a night and day difference in routing options. I’m able to get an NSX-like experience from an HTML5 interface (that’s been around for over 1 year or so!)
- Ability to set ECMP, Routing ID’s, utilize OSPF, BGP, and Route Redistribution with prefixes to boot.
- If you’re used to NSX and applying routing configurations to an Edge, this is a very similar experience.
- Yeah, how do static routes sound to you? That’s all I can apply here from the UI.
Load Balancer – Slight Advantage: Advanced Gateway
- The Advanced Gateway is very similar to what we see in NSX – just in an HTML5 format.
- We get to see our Global Configuration, Application Profiles, Monitoring, Rules, Pools and Virtual Servers.
- I also see we have additional algorithms available from an LB perspective. I wouldn’t say it’s a stark difference between Advanced and Standard, but more comprehensive than the Standard Gateway.
- Standard Gateway has very similar options as the Advanced UI, just in a different UI format.
- As stated above, we don’t have UDP available as a type and fewer algos for the Pool configuration. With that said, it’s very comparable, but giving a slight advantage to Advanced for some of the other options available.
More to come on Part 2 here.
I’ve been rebuilding my vCloud Director (vCD) lab and running through a few connectivity scenarios. Moreover, I wanted to write and share my findings on orchestrating an on-prem NSX environment connecting to a vCD/Provider environment using vCloud Director Extender (VXLAN to VXLAN). In vCD Extender, this is also known as a DC Extension.
To back up, let’s talk about how NSX provides flexible architecture as it relates to Provider scalability and connectivity. My esteemed colleagues did some great papers from our vCloud Architecture Toolkit (vCAT):
Before I get started, I also think this is a good guide for planning out VXLAN <–> VXLAN VPN connectivity.
Let’s look at my lab design from a network / logical perspective –
As you can see above, I have my Acme-Cloud organization available on the left with a single VM in the 172.16.20.x/24 network that’s running on NSX/VXLAN.
On the right, we have “Acme DC” that’s also using NSX and has a logical switch named “Acme-Tier” with the same network subnet.
The orange Extender Deployed L2VPN Client is what’s deployed by vCD Extender on tunnel creation. We’re going to walk through how Extender creates this L2VPN tunnel within an on-prem NSX environment.
- This is very similar to my warm migration setup, so I’m going to try not to duplicate material.
- I have my Acme-Cloud-Tier Org VDC Network that was converted to a Subinterface inside of vCD:
- We can see in the Edge Services, my L2VPN Server has been set up with a default site configuration. However, vCD Extender creates its own site configuration –
- Extender generates a unique ID for the username and password. This is done when the DC Extension is executed by the tenant. I also established the egress optimization gateway address for local traffic.
Tenant – vCD Extender Setup
- Before we can create a Data Center Extension, we need two required fields for NSX deployments.
- First, we need to give the required information to successfully deploy a standalone Edge that will be running our L2VPN client service. This would include the uplink network along with an IP address, gateway, and VMware-specific host/storage information.
- Second, we need to provide the required NSX Manager information. I’m sure this is to make the API calls required to deploy the Edge device(s) to the specified vCenter.
- Once the DC Extension has been created, we would see a new Edge device under Networking & Security
Tenant – DC Extension (L2VPN) Execution
- So what happens when we attempt to create a new DC Extension (or L2VPN Connection)? A few things:
- Creation of our trunk port for our specified subinterface
- Deployment of the new Edge device that will act as the L2VPN Client
- Reconfiguration of the trunk port (uses mcxt-tpg-l2vpn-vxlan-** prefix)
- Allowing NSX to do its magic along with L2VPN
- We can see within my task console what happened –
- Voila, we have a connected L2VPN tunnel. As you can see, the blue “E” stipulates that we have a local egress IP set. I did this since I wanted to route traffic to its local interface for traffic optimization.
- So, what happens in the background? Well, let’s take a look at the Edge device. We can see the trunk interface was created while the subinterface is configured to point to my logical switch “Acme-Tier.”
- Last of all, the L2VPN configuration was completed and established as the Client. We can now see the tunnel is alive too.
- From the main vCD Extender page, we can also see traffic utilization over the tunnel. Pretty nice graph!
Just a quick ping test, yep! WebVM can access WebVM2.
In summary, NSX to NSX DC Extensions within vCD Extender works pretty similar to Provider/VXLAN to On-Prem/VLAN. The key difference is the on-prem vCD Extender has the embedded Standalone Edge to deploy to vCenter.
Enjoy those cloud migrations!
I am happy to state that I passed my VCAP-NV and will be achieving VCIX6-NV.
This was an exhausting test – and sometimes frustrating. I even had a PSOD on one of my hosts that I had to resolve (pretty sure that was not part of the lab test)!
I have many people to thank but there have been some great guides out there. I posted a blog article on links I collected for preparing for my VCAP-NV.
I’ll be the first to admit this was my second attempt at my VCAP-NV: the first attempt one just got to me. Not to make any excuses, but my background isn’t networking/routing, so many of these topics were green to me.
I dusted myself off and said I’ll knock the second attempt out of the park. As you can see, VMware does document the blueprint objectives you missed on the test.
So what did I do? Before I start that, here’s a summary of my experience:
- This test will frustrate you. Yes, it is meant to. Accept it and embrace it.
- It is a nested vPOD/Lab environment. ProTip – for East Coasters, schedule your test first thing in the morning before the West starts working – much more responsive!
- It will attempt to confuse you. Take a deep breath and look at the overall question – what are you trying to accomplish?
- Also, sometimes the simplest answer is all you need. Don’t overcomplicate things (I have a tendency to do this).
- Do not spend too much time on a specific problem. If it’s not working as expected, make a note of it and move on.
- This was my problem with the first attempt. I spent too much time on a specific set of questions and ran out of time.
- Stay true to the Blueprint. If you practice and study using its guidelines, you will be okay.
First off, I wrote the entire Blueprint on my whiteboard with the main tasks. Excuse my handwriting, but you get the gist of what I was trying to accomplish here. I notated how many times I did a specific item.
After I didn’t make it the first attempt, I circled the sections I missed in black (even though half of them were because I just ran out of time). These were areas I focused on for the second attempt.
- Lab, lab, and lab. This is a test you cannot dump your way through. I don’t see how it would be possible to pass this without hands-on experience, especially with routing protocols and how NSX interacts with them.
- Labs of Focus
- The VMware Hands-On Labs (HOL) is FREE! You would be crazy for not using these and getting some insight/guidance on how things work. I primarily used the 1803 and 1825 labs on VMware HOL – link here.
- VMware Education – NSX Install, Configure, Manage – Lab Connect.
- I thought this was a great, self-paced, approach to a vPOD environment with 22 guided labs. There is a cost to using this, but I believe there may discounts for Partners.
- VMware Education – Install, Configure Manage – Lab Connect Link
- Josh Andrews’ VCIX6-NV Practice Exam
- I thought this was a very nice addition from SOSTech / Josh Andrews.
- Josh provided 9 sample “test” questions using the 1703 (or 1803 which is the new version) lab.
- Definitely test yourself and document where you may struggle.
- Link to the SOSTech VCIX6 Practice Exam
- Existing Blog Guides
- I thought Clinton’s VCAP6-NV was the most comprehensive guide out there. I used this as a rule of thumb and mimicked many of the things he documented in his blog series. DEFINITELY spend some time here.
- Other Guides I went through:
- Chestin Hay / v4Real – Link
- Lostdomain.org – Study Guide ( a little dated, but still pertinent info)
- thecloudexpert / Chris Lewis’ guide – Link
- There are probably others I’m missing, but definitely leverage what’s out in the community – thank you to those of you that have published and spent a significant amount of time documenting!
- Practice and get involved. Read all of the publications out there on VMware’s site. Build out designs for customers. This will take time but provides further exposure and compounding of the topics.
- Break stuff. You need to see how NSX works when you start “pulling cables” if you will. I spent countless hours just doing this. There are several troubleshooting topics so you’ll need to understand what happens when things go awry.
What’s next? I will continue to focus on VMware NSX, but may attempt one of the VCAP-DCV’s. I hope this post will benefit others – cheers!