|
| 1 | +--- |
| 2 | +title: Enable VMware Cloud director service with Azure VMware Solution (Public Preview) |
| 3 | +description: This article explains how to use Azure VMware Solution to enable enterprise customers to use Azure VMware Solution for private clouds underlying resources for virtual datacenters. |
| 4 | +ms.topic: how-to |
| 5 | +ms.date: 08/09/2022 |
| 6 | +--- |
| 7 | + |
| 8 | +# Enable VMware Cloud Director service with Azure VMware Solution (Preview) |
| 9 | + |
| 10 | +[VMware Cloud Director Service (CDs)](https://docs.vmware.com/en/VMware-Cloud-Director-service/services/getting-started-with-vmware-cloud-director-service/GUID-149EF3CD-700A-4B9F-B58B-8EA5776A7A92.html) with Azure VMware Solution enables enterprise customers to use APIs or the Cloud Director services portal to self-service provision and manage virtual datacenters through multi-tenancy with reduced time and complexity. |
| 11 | + |
| 12 | +In this article, you'll learn how to enable VMware Cloud Director service (CDs) with Azure VMware Solution for enterprise customers to use Azure VMware Solution resources and Azure VMware Solution private clouds with underlying resources for virtual datacenters. |
| 13 | + |
| 14 | +>[!IMPORTANT] |
| 15 | +> Cloud Director service (CDs) is now available to use with Azure VMware Solution under the Enterprise Agreement (EA) model only. It's not suitable for MSP / Hoster to resell Azure VMware Solution capacity to customers at this point. For more information, see [Azure Service terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftAzure/EAEAS#GeneralServiceTerms). |
| 16 | +
|
| 17 | +## Reference architecture |
| 18 | +The following diagram shows typical architecture for Cloud Director Services with Azure VMware Solution and how they're connected. Communications to Azure VMware Solution endpoints from Cloud Director service are supported by an SSL reverse proxy. |
| 19 | + |
| 20 | +:::image type="content" source="media/vmware-cds/reference-architecture-diagram.png" alt-text="Diagram showing typical architecture and how CDS is connected with Azure VMware Solution." border="false" lightbox="media/vmware-cds/reference-architecture-diagram-expanded.png"::: |
| 21 | + |
| 22 | +VMware Cloud Director supports multi-tenancy by using organizations. A single organization can have multiple organization virtual data centers (VDC). Each Organization’s VDC can have their own dedicated Tier-1 router (Edge Gateway) which is further connected with the provider’s managed shared Tier-0 router. |
| 23 | + |
| 24 | +## Connect tenants and their organization virtual datacenters to Azure vNet based resources |
| 25 | + |
| 26 | +To provide access to vNET based Azure resources, each tenant can have their own dedicated Azure vNET with Azure VPN gateway. A site-to-site VPN between customer organization VDC and Azure vNET is established. To achieve this connectivity, the provider will provide public IP to the organization VDC. Organization VDC’s administrator can configure IPSEC VPN connectivity from Cloud Director Service portal. |
| 27 | + |
| 28 | +:::image type="content" source="media/vmware-cds/site-to-site-vpn-diagram.png" alt-text="Diagram showing site to site VPN connection and how CDS is connected with Azure VMware Solution." border="false" lightbox="media/vmware-cds/site-to-site-vpn-diagram-expanded.png"::: |
| 29 | + |
| 30 | +As shown in the diagram above, organization 01 has two organization Virtual datacenters (VDCs): VDC1 and VDC2. The virtual datacenter of each organization has its own Azure vNETs connected with their respective organization VDC Edge gateway through IPSEC VPN. |
| 31 | +Providers provide public IP addresses to the organization VDC Edge gateway for IPSEC VPN configuration. An ORG VDC Edge gateway firewall blocks all traffic by default, specific allow rules needs to be added on organization Edge gateway firewall. |
| 32 | + |
| 33 | +Organization VDCs can be part of a single organization and still provide isolation between them. For example, VM1 hosted in organization VDC1 cannot ping Azure VM JSVM2 for tenant2. |
| 34 | + |
| 35 | +### Prerequisites |
| 36 | +- Organization VDC is configured with an Edge gateway and has Public IPs assigned to it to establish IPSEC VPN by provider. |
| 37 | +- Tenants have created a routed Organization VDC network in tenant’s Virtual datacenter. |
| 38 | +- Test VM1 and VM2 are created in the Organization VDC1 and VDC2 respectively. Both VMs are connected to the routed orgVDC network in their respective VDCs. |
| 39 | +- Have a dedicated [Azure vNET](tutorial-configure-networking.md#create-a-vnet-manually) configured for each tenant. For this example, we created Tenant1-vNet and Tenant2-vNet for tenant1 and tenant2 respectively. |
| 40 | +- Create an [Azure Virtual network gateway](tutorial-configure-networking.md#create-a-virtual-network-gateway) for vNETs created earlier. |
| 41 | +- Deploy Azure VMs JSVM1 and JSVM2 for tenant1 and tenant2 for test purposes. |
| 42 | + |
| 43 | +> [!Note] |
| 44 | +> CDS supports a policy-based VPN. Azure VPN gateway configures route-based VPN by default and to configure policy-based VPN policy-based selector needs to be enabled. |
| 45 | +
|
| 46 | +### Configure Azure vNet |
| 47 | +Create the following components in tenant’s dedicated Azure vNet to establish IPSEC tunnel connection with the tenant’s ORG VDC edge gateway. |
| 48 | +- Azure Virtual network gateway |
| 49 | +- Local network gateway. |
| 50 | +- Add IPSEC connection on VPN gateway. |
| 51 | +- Edit connection configuration to enable policy-based VPN. git status |
| 52 | + |
| 53 | +### Create Azure virtual network gateway |
| 54 | +To create an Azure virtual network gateway, see the [create-a-virtual-network-gateway tutorial](tutorial-configure-networking.md#create-a-virtual-network-gateway). |
| 55 | + |
| 56 | +### Create local network gateway |
| 57 | +1. Log in to the Azure portal and select **Local network gateway** from marketplace and then select **Create**. |
| 58 | +1. Local Network Gateway represents remote end site details. Therefore provide tenant1 OrgVDC public IP address and orgVDC Network details to create local end point for tenant1. |
| 59 | +1. Under **Instance details**, select **Endpoint** as IP address |
| 60 | +1. Add IP address (add Public IP address from tenant’s OrgVDC Edge gateway). |
| 61 | +1. Under **Address space** add **Tenants Org VDC Network**. |
| 62 | +1. Repeat steps 1-5 to create a local network gateway for tenant 2. |
| 63 | + |
| 64 | +### Create IPSEC connection on VPN gateway |
| 65 | +1. Select tenant1 VPN Gateway (created earlier) and then select **Connection** (in left pane) to add new IPSEC connection with tenant1 orgVDC Edge gateway. |
| 66 | +1. Enter the following details. |
| 67 | + |
| 68 | + | **Name** | **Connection** | |
| 69 | + |:---------- | :--------------| |
| 70 | + | Connection Type | Site to Site | |
| 71 | + | VPN Gateway | Tenant’s VPN Gateway | |
| 72 | + | Local Network Gateway | Tenant’s Local Gateway | |
| 73 | + | PSK | Shared Key (provide a password) | |
| 74 | + | IKE Protocol | IKEV2 (ORG-VDC is using IKEv2) | |
| 75 | + |
| 76 | +1. Select **Ok** to deploy local network gateway. |
| 77 | + |
| 78 | +### Configure IPsec Connection |
| 79 | +Cloud Director Service supports a policy-based VPN. Azure VPN gateway configures route-based VPN by default and to configure policy-based VPN policy-based selector needs to be enabled. |
| 80 | + |
| 81 | +1. Select the connection you created earlier and then select **configuration** to view the default settings. |
| 82 | +1. **IPSEC/IKE Policy** |
| 83 | +1. **Enable policy base traffic selector** |
| 84 | +1. Modify all other parameters to match what you have in OrgVDC. |
| 85 | + >[!Note] |
| 86 | + > Both source and destination of the tunnel should have identical settings for IKE,SA, DPD etc. |
| 87 | +1. Select **Save**. |
| 88 | + |
| 89 | +### Configure VPN on organization VDC Edge router |
| 90 | +1. Log in to Organization CDS tenant portal and select tenant’s edge gateway. |
| 91 | +1. Select **IPSEC VPN** option under **Services** and then select **New**. |
| 92 | +1. Under general setting, provide **Name** and select desired security profile. Ensure that security profile settings (IKE, Tunnel, and DPD configuration) are same on both sides of the IPsec tunnel. |
| 93 | +1. Modify Azure VPN gateway to match the Security profile, if necessary. You can also do security profile customization from CDS tenant portal. |
| 94 | + |
| 95 | + >[!Note] |
| 96 | + > VPN tunnel won't establish if these settings were mismatched. |
| 97 | +1. Under **Peer Authentication Mode**, provide the same pre-shared key that is used at the Azure VPN gateway. |
| 98 | +1. Under **Endpoint configuration**, add the Organization’s public IP and network details in local endpoint and Azure VNet details in remote endpoint configuration. |
| 99 | +1. Under **Ready to complete**, review applied configuration. |
| 100 | +1. Select **Finish** to apply configuration. |
| 101 | + |
| 102 | +### Apply firewall configuration |
| 103 | +Organization VDC Edge router firewall denies traffic by default. You'll need to apply specific rules to enable connectivity. Use the following steps to apply firewall rules. |
| 104 | + |
| 105 | +1. Add IP set in CDS portal |
| 106 | + 1. Log in to Edge router then select **IP SETS** under the **Security** tab in left plane. |
| 107 | + 1. Select **New** to create IP sets. |
| 108 | + 1. Enter **Name** and **IP address** of test VM deployed in orgVDC. |
| 109 | + 1. Create another IP set for Azure vNET for this tenant. |
| 110 | +2. Apply firewall rules on ORG VDC Edge router. |
| 111 | + 1. Under **Edge gateway**, select **Edge gateway** and then select **firewall** under **services**. |
| 112 | + 1. Select **Edit rules**. |
| 113 | + 1. Select **NEW ON TOP** and enter rule name. |
| 114 | + 1. Add **source** and **destination** details. Use created IPSET in source and destination. |
| 115 | + 1. Under **Action**, select **Allow**. |
| 116 | + 1. Select **Save** to apply configuration. |
| 117 | +3. Verify tunnel status |
| 118 | + 1. Under **Edge gateway** select **Service**, then select **IPSEC VPN**, |
| 119 | + 1. Select **View statistics**. |
| 120 | + Status of tunnel should show **UP**. |
| 121 | +4. Verify IPsec connection |
| 122 | + 1. Log in to Azure VM deployed in tenants vNET and ping tenant’s test VM IP address in tenant’s OrgVDC. |
| 123 | + For example, ping VM1 from JSVM1. Similarly, you should be able to ping VM2 from JSVM2. |
| 124 | +You can verify isolation between tenants Azure vNETs. Tenant1’s VM1 won't be able to ping Tenant2’s Azure VM JSVM2 in tenant2 Azure vNETs. |
| 125 | + |
| 126 | +## Connect Tenant workload to public Internet |
| 127 | + |
| 128 | +- Tenants can use public IP to do SNAT configuration to enable Internet access for VM hosted in organization VDC. To achieve this connectivity, the provider can provide public IP to the organization VDC. |
| 129 | +- Each organization VDC can be created with dedicated T1 router (created by provider) with reserved Public & Private IP for NAT configuration. Tenants can use public IP SNAT configuration to enable Internet access for VM hosted in organization VDC. |
| 130 | +- OrgVDC administrator can create a routed OrgVDC network connected to their OrgVDC Edge gateway. To provide Internet access. |
| 131 | +- OrgVDC administrator can configure SNAT to provide a specific VM or use network CIDR to provide public connectivity. |
| 132 | +- OrgVDC Edge has default DENY ALL firewall rule. Organization administrators will need to open appropriate ports to allow access through the firewall by adding a new firewall rule. Virtual machines configured on such OrgVDC network used in SNAT configuration should be able to access the Internet. |
| 133 | + |
| 134 | +### Prerequisites |
| 135 | +1. Public IP is assigned to the organization VDC Edge router. |
| 136 | + To verify, log in to the organization's VDC. Under **Networking**> **Edges**, select **Edge Gateway**, then select **IP allocations** under **IP management**. You should see a range of assigned IP address there. |
| 137 | +2. Create a routed Organization VDC network. (Connect OrgvDC network to the edge gateway with public IP address assigned) |
| 138 | + |
| 139 | +### Apply SNAT configuration |
| 140 | +1. Log in to Organization VDC. Navigate to your Edge gateway and then select **NAT** under **Services**. |
| 141 | +2. Select **New** to add new SNAT rule. |
| 142 | +3. Provide **Name** and select **Interface type** as SNAT. |
| 143 | +4. Under **External IP**, enter public IP address from public IP pool assigned to your orgVDC Edge router. |
| 144 | +5. Under **Internal IP**, enter IP address for your test VM. |
| 145 | + This IP address is one of the orgVDC network IP assigned to the VM. |
| 146 | +6. **State** should be enabled. |
| 147 | +7. Under **Priority**, select a higher number. |
| 148 | + For example, 4096. |
| 149 | +8. Select **Save** to save the configuration. |
| 150 | + |
| 151 | +### Apply firewall rule |
| 152 | +1. Log in to Organization VDC and navigate to **Edge Gateway**, then select **IP set** under security. |
| 153 | +2. Create an IPset. Provide IP address of your VM (you can use CIDR also). Select **Save**. |
| 154 | +3. Under **services**, select **Firewall**, then select **Edit rules**. |
| 155 | +4. Select **New ON TOP** and create a firewall rule to allow desired port and destination. |
| 156 | +1. Select the **IPset** your created earlier as source. Under **Action**, select **Allow**. |
| 157 | +1. Select **Keep** to save the configuration. |
| 158 | +1. Log in to your test VM and ping your destination address to verify outbound connectivity. |
| 159 | + |
| 160 | +## Migrate workloads to Cloud Director Service on Azure VMware Solution |
| 161 | + |
| 162 | +VMware Cloud Director Availability can be used to migrate VMware Cloud Director workload into Cloud Director service on Azure VMware Solution. Enterprise customers can drive self-serve one-way warm migration from the on-premises Cloud Director Availability vSphere plugin, or they can run the Cloud Director Availability plugin from the provider-managed Cloud Director instance and move workloads into Azure VMware Solution. |
| 163 | + |
| 164 | +For more information about VMware Cloud Director Availability, see [VMware Cloud Director Availability | Disaster Recovery & Migration](https://www.vmware.com/products/cloud-director-availability.html) |
| 165 | + |
| 166 | +## FAQs |
| 167 | +**Question**: What are the supported Azure regions for the VMware Cloud Director service? |
| 168 | + |
| 169 | +**Answer**: This offering is supported in all Azure regions where Azure VMware Solution is available except for Brazil South and South Africa. Ensure that the region you wish to connect to Cloud Director service is within a 150-milliseconds round trip time for latency with Cloud Director service. |
| 170 | + |
| 171 | +## Next steps |
| 172 | +[VMware Cloud Director Service Documentation](https://docs.vmware.com/en/VMware-Cloud-Director-service/index.html) |
0 commit comments