0

Getting Started with vCloud Director 9.0 API –…

Getting Started with vCloud Director 9.0 API – Part 1

Getting Started with vCloud Director 9.0 API –…

Recently, VMware released vCloud Director 9.0 for Service Providers. I refer you to this vCloud Director 9.0 What’s New White Paper, this explains all the goodness packed into this latest release. As the title suggests – in this post I’m going to cover the vCloud Director 9.0 for Service Providers vCloud API. There are a…


VMware Social Media Advocacy

0

Installing NSX Manager GUEST INTROSPECTION NSX Data Security

Guest introspection is a service that is deployed from NSX Manager to offload security functions. Guest Introspection installs a new vib and a service virtual machine on each host in the cluster. Guest Introspection is required for NSX Data Security, Activity Monitoring, and several third-party security solutions.

System Requirements for NSX

To install Guest Introspection First need to login into the vSphere web client and browse to Networking & Security.
on the left hand side click on Installation. Click the green plus symbol to add a new service deployment.

After this select Guest introspection

 

Select Storage and Network

Create IP Pool for the VM which NSX install for AV purpose.

 

 

Now select the IP Pool and click next

After that it will appear here in last tab

If you closely monitor vCenter task then it will start installing VM

In NSX manager you can see status.

Now your Guest Introspection is ready.

 

You can check this in vCenter under Newly created resource pool > ESX Agent.
This resource pool is auto created by NSX manager for these VM’s only.

 

If this VM giving you error or warning like Failed then just click on Resolve and it will delete the VM and create new VM.

0

VPN Configuration to VMware Cloud on AWS using…

VPN Configuration to VMware Cloud on AWS using pfSense

VPN Configuration to VMware Cloud on AWS using…

Provisioning a new SDDC on VMware Cloud on AWS (VMC) is not an operation that I perform on a regular basis. Usually, one of the first tasks after a new SDDC deployment is setting up a VPN connection between your on-premises datacenter and your VMC environment. Given this is not a frequent activity, I always forget the […]


VMware Social Media Advocacy

0

Configuring IPsec VPN within VMware NSX Edge

This article shows you how to create an IPsec VPN between a NSX Edge Gateway with a vCloud Director/NSX Manager and a remote Client site.

First you need basic details from client so that you can configure IPSec VPN from your end.Like you need Phase 1 and Phase 2 Details. (This document related to NSX Edge 6.3.2)

 

Image Credit VMware

Note: NSX Edge supports Main Mode for Phase 1 and Quick Mode for Phase 2.

Phase 1 Parameters

Phase 1 sets up mutual authentication of the peers, negotiates cryptographic parameters, and creates session keys. The Phase 1 parameters used by NSX Edge are:

  • Main mode
  • TripleDES / AES [Configurable]
  • SHA-1
  • MODP group 2 (1024 bits)
  • pre-shared secret [Configurable]
  • SA lifetime of 28800 seconds (eight hours) with no kbytes rekeying
  • ISAKMP aggressive mode disabled

In 6.3.2 you Can see basic details or you can say this is mixed mode like Phase 1 and Phase 2 they don’t have different tabs or options.

 

Here are details which you have to fill while configuring IPSec VPN for client.

Note: If you are doing this from HTML5 Console then in “Peer Subnets” You have to provide IP range from Increasing to Decreasing order like (192.168.11.0/24 and after that 192.168.10.0/24).

 

I was trying to update this tab from vCloud Director Web and i was not able to do so i changed this from vCenter > NSX manager > Edge settings.

Client side settings must match with your Edge settings.

If your Client have old router (Cisco) then you have to ask them to do settings with supported parameter and these parameters are:

1. SHA1
2. Diffie-Hellman Group – DH5 or DH2 (Old router can only support this IOS 12.4)
3. Encryption Algorithm – AES256

NSX Edge to Cisco

  • proposal: encrypt 3des-cbc, sha, psk, group5(group2)

After setup you can export Settings from Edge and share it with Client Network Team so that they can run it in their router and do the same setup which you have done in your Edge gateway.

Go to vCenter > NSX Manager > NSX Edges > Search your Edge and double click > Manage (R.H.S) > VPN Tab > IPSec VPN and from here you can download script for Cisco router.

 

You can copy and send it to client IT team.

Note: It will copy Shared key also so before sending to Client IT team remove that.

After this check the Tunnel status.

Go to vCenter > NSX Manager > NSX Edges > Search your Edge and double click > Manage (R.H.S) > VPN Tab > IPSec VPN

 

I was getting below Error so need to check your DH2 or DH14 settings.

  • If the Cisco device does not accept any of the parameters the NSX Edge sent in step one, the Cisco device sends the message with flag NO_PROPOSAL_CHOSEN and terminates the negotiation.
0

Upgrade VMware vCloud Director for Service Providers v8.20 to v9.0.0

Now before starting this activity need to take backup for few VMs like. You can check my last blog regarding same.

Here is the link https://www.dtechinspiration.com/upgrade-vmware-vcloud-director-for-service-providers-v8-1-0-to-v8-20/

Now starting activity

 

Steps to upgrade

We are running only one vCD cell server. Here is the process:

  1. Restrict access to vCD and display a maintenance message for the duration of the upgrade.