Skip to content

Commit 603d11f

Browse files
jjaygbayjjaygbay
committed
update HCX over pulic ip
1 parent 97a5914 commit 603d11f

File tree

1 file changed

+78
-70
lines changed

1 file changed

+78
-70
lines changed

‎articles/azure-vmware/enable-hcx-access-over-internet.md

Lines changed: 78 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -6,50 +6,42 @@ ms.date: 7/19/2022
66
---
77
# Enable HCX access over the internet
88

9-
109
In this article, you'll learn how to perform HCX migration over a Public IP address using Azure VMware Solution.
1110
>[!IMPORTANT]
1211
>Before configuring a Public IP on your Azure VMware Solution private cloud, please consult your Network Administrator to understand the implications and the impact to your environment.
1312
14-
You'll also learn how to pair HCX sites and create service mesh from on-premises to an Azure VMware Solution private cloud using a Public IP. The service mesh allows you to migrate a workload from an on-premises datacenter to an Azure VMware Solution private cloud over the public internet. This solution is useful when the customer is not using ExpressRoute or VPN connectivity with the Azure cloud.
15-
13+
You'll also learn how to pair HCX sites and create service mesh from on-premises to an Azure VMware Solution private cloud using Public IP. The service mesh allows you to migrate a workload from an on-premises datacenter to an Azure VMware Solution private cloud over the public internet. This solution is useful when the customer is not using ExpressRoute or VPN connectivity with the Azure cloud.
1614

17-
> [!IMPORTANT]
18-
> The on-premises HCX appliance should be reachable from the internet to establish HCX communication from on-premises to the Azure VMware Solution private cloud.
15+
> [!IMPORTANT]
16+
> The on-premises HCX appliance should be reachable from the internet to establish HCX communication from on-premises to the Azure VMware Solution private cloud.
1917
2018
## Configure Public IP block
2119

22-
To perform HCX Migration over the public internet, you'll need a minimum of six Public IP addresses. Five of these Public IP addresses will be used for the Public IP segment, and one will be used for configuring Network Address Translation (NAT). You can obtain the Public IP block by reserving a /29 from the Azure VMware Solution portal. Configure a Public IP block through portal by using the Public IP feature of the Azure VMware Solution private cloud.
20+
For HCX manager to be available over the public IP address, you'll need one public IP address for DNAT rule.
2321

24-
1. Sign in to Azure VMware Solution portal.
25-
1. Under **Workload Networking**, select **Public IP (preview)**.
26-
1. Select **+Public IP**.
27-
1. Enter the **Public IP name** and select the address space from the **Address space** drop-down list according to the number of IPs required, then select **Configure**.
28-
>[!Note]
29-
> It will take 15-20 minutes to configure the Public IP block on private cloud.
22+
Note that to perform HCX Migration over the public internet, you'll need other IP addresses. You can have a /29 subnet to create minimum configuration when defining HCX network profile (Usable IPs in subnet will be assigned to IX, NE appliances). You can choose a bigger subnet based on the requirements. Note that you'll create an NSX-T segment using this public subnet. This segment can be used for creating HCX network profile.
3023

31-
After the Public IP is configured successfully, you should see it appear under the Public IP section. The provisioning state shows **Succeeded**. This Public IP block is configured as NSX-T segment on the Tier-1 router.
24+
Note that once you assign a subnet to NSX-T segment, you can't use an IP from that subnet to create a DNAT rule. Both subnets should be different.
3225

33-
For more information about how to enable a public IP to the NSX Edge for Azure VMware Solution, see [Enable Public IP to the NSX Edge for Azure VMware Solution](./enable-public-ip-nsx-edge.md).
26+
Configure a Public IP block through portal by using the Public IP feature of the Azure VMware Solution private cloud.
3427

35-
## Create Public IP segment on NSX-T
36-
Before you create a Public IP segment, get your credentials for NSX-T Manager from Azure VMware Solution portal.
28+
1. Sign in to Azure VMware Solution portal.
29+
1. Under **Workload Networking**, select **Internet connectivity**
30+
1. Select **+Public IP**.
31+
1. Enter the **Public IP name** and select the address space from the **Address space** drop-down list according to the number of IPs required, then select **Configure**.
32+
>[!Note]
33+
> It will take 15-20 minutes to configure the Public IP block on private cloud.
3734
38-
1. Sign in to NSX-T Manager using credentials provided by the Azure VMware Solution portal.
39-
1. Under the **Manage** section, select **Identity**.
40-
1. Copy the NSX-T Manager admin user password.
35+
After the Public IP is configured successfully, you should see it appear under the **Public IP** section. The provisioning state shows **Succeeded**. This Public IP block is configured as NSX-T segment on the Tier-1 router.
4136

42-
1. Browse the NSX-T Manger and paste the admin password in the password field, and select **Login**.
43-
1. Under the **Networking** section select **Connectivity** and **Segments**, then select **ADD SEGMENT**.
44-
1. Provide Segment name, select Tier-1 router as connected gateway, and provide the reserved Public IP under subnets. The Public IP block for this Public IP segment shouldn't include the first and last Public IPs from the overall Public IP block. For example, if you reserved 20.95.1.16/29, you would input 20.95.1.16/30.
45-
1. Select **Save**.  
37+
For more information about how to enable a public IP to the NSX Edge for Azure VMware Solution, see [Enable Public IP to the NSX Edge for Azure VMware Solution](./enable-public-ip-nsx-edge.md).
4638

47-
## Assign public IP to HCX manager
48-
HCX manager of destination Azure VMware Solution SDDC should be reachable from the internet to do site pairing with source site. HCX Manager can be exposed by way of DNAT rule and a static null route. Because HCX Manager is in the provider space, not within the NSX-T environment, the null route is necessary to allow HCX Manager to route back to the client by way of the DNAT rule.
4939

50-
### Add static null route to the T1 router
40+
## Use public IP address for Cloud HCX Manager public access
41+
Cloud HCX manager can be available over a Public IP address by using a DNAT rule. However, since Cloud HCX manager is in the provider space, the null route is necessary to allow HCX Manager to route back to the client by way of the DNAT rule. It forces the NAT traffic through NSX-T T-0 router.
5142

52-
The static null route is used to allow HCX private IP to route through the NSX T1 for public endpoints.
43+
### Add static null route to the Tier1 router
44+
The static null route is used to allow HCX private IP to route through the NSX T1 for public endpoints. This can be default Tier-1 router created in your private cloud or you can create a new tier-1 router.
5345

5446
1. Sign in to NSX-T manager, and select **Networking**.
5547
1. Under the **Connectivity** section, select **Tier-1 Gateways**.
@@ -61,82 +53,98 @@ The static null route is used to allow HCX private IP to route through the NSX T
6153
1. Under **Name**, enter the name of the route.
6254
1. Under **network**, enter a non-overlapping /32 IP address under Network.
6355
>[!NOTE]
64-
> This address should not overlap with any other IP addresses on the network.
56+
> This address should not overlap with any other IP addresses on the private cloud network and the customer network.
6557
1. Under **Next hops**, select **Set**.
6658
1. Select **NULL** as IP Address.
67-
Leave defaults for Admin distance and scope.
68-
1. Select **ADD**, then select **APPLY**.
59+
Leave defaults for Admin distance and scope.
60+
1. Select **ADD**, then select **APPLY**.
6961
1. Select **SAVE**, then select **CLOSE**.
7062
1. Select **CLOSE EDITING**.
7163

7264
### Add NAT rule to T1 gateway
7365

74-
>[!Note]
75-
>The NAT rules should use a different Public IP address than your Public IP segment.
7666
1. Sign in to NSX-T Manager, and select **Networking**.
7767
1. Select **NAT**.
78-
1. Select the T1 Gateway.
68+
1. Select the T1 Gateway. Use same Tier-1 router to create NAT rule that you used to create null route in previous steps.
7969
1. Select **ADD NAT RULE**.
80-
1. Add one SNAT rule for HCX Manager.
70+
1. Add one SNAT rule and one DNAT rule for HCX Manager.
8171
1. The DNAT Rule Destination is the Public IP for HCX Manager. The Translated IP is the HCX Manager IP in the cloud.
82-
1. The SNAT Rule Source is the HCX Manager IP in the cloud. The Translated IP is the non-overlapping /32 IP from the Static Route.
83-
1. Make sure to set the Firewall option on DNAT rule to **Match External Address**.
84-
1. Create T1 Gateway Firewall rules to allow only expected traffic to the Public IP for HCX Manager and drop everything else.
85-
1. Create a Gateway Firewall rule on the T1 that allows your On-Premise as the **Source IP** and the Azure VMware Solution reserved Public as the **Destination IP**. This rule should be the highest priority.
86-
1. Create a Gateway Firewall rule on the T1 that denies all other traffic where the **Source IP** is and “Any” and **Destination IP** is the Azure VMware Solution reserved Public IP.
72+
1. The SNAT Rule Destination is the HCX Manager IP in the cloud. The Translated IP is the non-overlapping /32 IP from the Static Route.
73+
1. Make sure to set the Firewall option on DNAT rule to **Match External Address**.
74+
1. Create T1 Gateway Firewall rules to allow only expected traffic to the Public IP for HCX Manager and drop everything else.
75+
1. Create a Gateway Firewall rule on the T1 that allows your on-premises as the **Source IP** and the Azure VMware Solution reserved Public as the **Destination IP**. This rule should be the highest priority.
76+
1. Create a Gateway Firewall rule on the T1 that denies all other traffic where the **Source IP** is and “Any” and **Destination IP** is the Azure VMware Solution reserved Public IP.
77+
78+
For more information, see [HCX ports](https://ports.esp.vmware.com/home/VMware-HCX)
8779

88-
>[!NOTE]
80+
> [!NOTE]
8981
> HCX manager can now be accessed over the internet using public IP.
9082
91-
### Create network profile for HCX at destination site
92-
1. Sign in to Destination HCX Manager.
93-
1. Select **Interconnect** and then select the **Network Profiles** tab.
94-
1. Select **Create Network Profile**.
95-
1. Select **NSX Networks** as network type under **Network**.
96-
1. Select the **Public-IP-Segment** created on NSX-T.
97-
1. Enter **Name**.
98-
1. Under IP pools, enter the **IP Ranges** for HCX uplink, **Prefix Length**, and **Gateway** of public IP segment.
99-
1. Scroll down and select the **HCX Uplink** checkbox under **HCX Traffic Type** as this profile will be used for HCX uplink.
100-
1. To create the Network Profile, select **Create**.
83+
# Pair sites using HCX Cloud manager's public IP address
10184

102-
### Pair site
103-
Site pairing is required to create service mesh between source and destination sites.
85+
Site pairing is required before you create service mesh between source and destination sites.
10486

10587
1. Sign in to the **Source** site HCX Manager.
106-
1. Select **Site Pairing** and select **ADD SITE PAIRING**.
107-
1. Enter the remote HCX URL and sign in credentials, then select **Connect**.
88+
1. Select **Site Pairing** and select **ADD SITE PAIRING**.
89+
1. Enter the **Cloud HCX Manager Public URL** as remote site and sign in credentials, then select **Connect**.
10890

10991
After pairing is done, it will appear under site pairing.
11092

111-
### Create service mesh
112-
Service Mesh will deploy HCX WAN Optimizer, HCX Network Extension and HCX-IX appliances.
93+
# Migration using Public segment as HCX Uplink
94+
95+
## Create Public IP segment on NSX-T
96+
Before you create a Public IP segment, get your credentials for NSX-T Manager from Azure VMware Solution portal.
97+
98+
1. Sign in to NSX-T Manager using credentials provided by the Azure VMware Solution portal.
99+
1. Under the **Manage** section, select **Identity**.
100+
1. Copy the NSX-T Manager admin user password.
101+
102+
1. Browse the NSX-T Manger and paste the admin password in the password field, and select **Login**.
103+
1. Under the **Networking** section select **Connectivity** and **Segments**, then select **ADD SEGMENT**.
104+
1. Provide Segment name, select Tier-1 router as connected gateway, and provide the reserved Public IP under subnets.
105+
1. Select **Save**.  
106+
107+
## Create network profile for HCX at destination site
108+
1. Sign in to Destination HCX Manager (cloud manager in this case).
109+
1. Select **Interconnect** and then select the **Network Profiles** tab.
110+
1. Select **Create Network Profile**.
111+
1. Select **NSX Networks** as network type under **Network**.
112+
1. Select the **Public-IP-Segment** created on NSX-T.
113+
1. Enter **Name**.
114+
1. Under IP pools, enter the **IP Ranges** for HCX uplink, **Prefix Length**, and **Gateway** of public IP segment.
115+
1. Scroll down and select the **HCX Uplink** checkbox under **HCX Traffic Type** as this profile will be used for HCX uplink.
116+
1. To create the Network Profile, select **Create**.
117+
118+
## Create service mesh
119+
Service Mesh will deploy HCX WAN Optimizer, HCX Network Extension and HCX-IX appliances.
113120
1. Sign in to **Source** site HCX Manager.
114121
1. Select **Interconnect** and then select the **Service Mesh** tab.
115-
1. Select **CREATE SERVICE MESH**.
116-
1. Select the **destination** site to create service mesh with and select **Continue**.
122+
1. Select **CREATE SERVICE MESH**.
123+
1. Select the **destination** site to create service mesh with and select **Continue**.
117124
1. Select the compute profiles for both sites and select **Continue**.
118-
1. Select the HCX services to be activated and select **Continue**.
125+
1. Select the HCX services to be activated and select **Continue**.
119126
>[!Note]
120127
>Premium services require an additional HCX Enterprise license.
121128
1. Select the Network Profile of source site.
122129
1. Select the Network Profile of Destination that you created in the Network Profile section.
123130
1. Select **Continue**.
124-
1. Review the Transport Zone information, and then select **Continue**.
131+
1. Review the Transport Zone information, and then select **Continue**.
125132
1. Review the Topological view, and select **Continue**.
126-
1. Enter the Service Mesh name and select **FINISH**.
127-
128-
### Extend network
129-
The HCX Network Extension service provides layer 2 connectivity between sites. The extension service also allows you to keep the same IP and MAC addresses during virtual machine migrations.
130-
1. Sign in to **source** HCX Manager.
131-
1. Under the **Network Extension** section, select the site for which you want to extend the network, and then select **EXTEND NETWORKS**.
132-
1. Select the network that you want to extend to destination site, and select **Next**.
133+
1. Enter the Service Mesh name and select **FINISH**.
134+
1. Add these public IP addresses in firewall to allow required ports only.
135+
136+
## Extend network
137+
The HCX Network Extension service provides layer 2 connectivity between sites. The extension service also allows you to keep the same IP and MAC addresses during virtual machine migrations.
138+
1. Sign in to **source** HCX Manager.
139+
1. Under the **Network Extension** section, select the site for which you want to extend the network, and then select **EXTEND NETWORKS**.
140+
1. Select the network that you want to extend to destination site, and select **Next**.
133141
1. Enter the subnet details of network that you're extending.
134142
1. Select the destination first hop route (T1), and select **Submit**.
135-
1. Sign in to the **destination** NSX, you'll see Network 10.14.27.1/24 has been extended.
143+
1. Sign in to the **destination** NSX, you'll see Network 10.14.27.1/24 has been extended.
136144

137-
After the network is extended to destination site, VMs can be migrated over Layer 2 Extension.
145+
After the network is extended to destination site, VMs can be migrated over Layer 2 Extension.
138146

139-
## Next steps
147+
## Next steps
140148
[Enable Public IP to the NSX Edge for Azure VMware Solution](./enable-public-ip-nsx-edge.md)
141149

142150
For detailed information on HCX network underlay minimum requirements, see [Network Underlay Minimum Requirements](https://docs.vmware.com/en/VMware-HCX/4.3/hcx-user-guide/GUID-8128EB85-4E3F-4E0C-A32C-4F9B15DACC6D.html).

0 commit comments

Comments
 (0)