Abiquo 6.0

Skip to end of metadata
Go to start of metadata


1. Manage networks

1.1. Display virtual datacenter networks

To display the networks available to a virtual datacenter:

Privileges: Manage virtual network elements, Access external networks tab, Access public networks tab


  1. Go to Virtual datacenters → select virtual datacenter → Network.
  • The default network is highlighted with a star symbol
  • A network with an internet gateway is highlighted with a globe symbol
  • In public cloud, to synchronize networks and IP addresses, click the round arrows synchronize button
  • In AWS, you can filter the list of private networks by Availability Zone


API Features

Virtual datacenter networks are available in the Abiquo API. For example, see VirtualDatacentersResource and PrivateNetworksResource.

Screenshot: Private networks in private cloud

Screenshot: Private networks in public cloud (AWS)

In the Networks list, to view the pool and allocation of IPs:

  • To display all the IPs in the virtual datacenter, click the All button at the top of the list
  • To display the IPs in a network, click the Network name

You can then:

  • Use the slider at the bottom of the list to move through the pages 
  • Filter the list by entering text in the Search box. The filter works with all the columns of the table including:
    • IP Address
    • MAC address
    • Network name
    • Virtual appliance using the IP
    • VM using the IP
    • Provider ID of the entity using the IP (for example, a load balancer)




1.2. Create a private network

Private networks are only available within a virtual datacenter. However, your cloud provider may configure an external gateway for your virtual datacenter.

To create a private network:

  1. Go to Virtual datacenters → select virtual datacenter Network Private
  2. Click the + add button  and complete the dialog

Create private network


Create private network Amazon

For more details see GUI Create network Private


You can configure static routes when you create or edit a network. However, you should check with your systems administrator about when your VM will receive changes to static routes.

For more details see GUI create network static routes


 Click here to show/hide IPv6 networks


Strict network


Non-strict network

For more details see GUI Create network Private IPv6




1.3. Create IP addresses in private networks

To create new IP addresses in a private network do these steps.
  1. Go to Virtual datacenters → optionally select a virtual datacenter
  2. Go to NetworksPrivate → select a private network
  3. On the Private IPs page, click the add + button and enter details

Or you can add an IP directly to a VM. To do this:

  1. Go to Virtual datacenters → Edit VM → Network
  2. Click the add + button and enter details (or drag the Auto-generated IP label into the Network pane)

    For more details see GUI Create IP addresses






1.4. Edit a private network

To edit a private network
  1. Go to Virtual datacenters → select a virtual datacenter → Network
  2. Select Private and select the network
  3. Click the pencil edit button below the Networks list
  4. If there are no VMs deployed in the network, you can change the Name, Gateway, Static routes, and make the network the new default for the virtual datacenter
    1. The gateway must be an IP address inside the range defined by the network address and the network mask
  5. Optionally, change the DNS settings. The new settings will apply to all VMs deployed after you save the network
  6. Click Save




1.5. Delete a private network

You can delete a private network if no VMs are using its IPs and it is not the default network for the virtual datacenter.

To delete a private network:

  1. Go to Virtual datacenters → select a virtual datacenter → NetworkPrivate
  2. Select the network and click the delete button below the networks list. 




1.6. Display onboarded external networks

The platform automatically onboards external networks when you onboard virtual datacenters from vCloud Director.

Privileges: Manage virtual network elements, Access external networks tab, Manage external network elements


To display onboarded external networks

  1. Go to Virtual datacentersNetwork
  2. Select a vCloud VDC
  3. Go to External




1.7. Delete an onboarded external network

If an onboarded network has been deleted in the provider, its name will display in light gray text. If a VM is using an IP from this network, then you cannot deploy the VM.

If there are no VMs using the IPs of an external network that was already deleted in the provider, to delete the network in the platform, select it and click the delete button.



1.8. Set the default network for a virtual datacenter

Each virtual datacenter requires a default network. If you deploy a VM without assigning a NIC, the platform will add one from the default network. You cannot unselect the default network, instead you must assign a new default network to replace it.

To set a network as the default, you will require privileges to access this network in the virtual infrastructure.

Privileges: Manage virtual datacenter network elements, Access public network tab, Manage public network elements, Access external network tab, Manage external network elements

To assign a network as the default for a virtual datacenter do these steps:

  1. Go to Virtual datacenters → select virtual datacenter → Network → network type, e.g. Private
  2. Create or edit a network
  3. Select the Default network checkbox 
    • This default will override the platform default network and any network set for the enterprise in the datacenter
    • The new default network will apply to all VMs deployed after you set it
    • For a public network that is the virtual datacenter default, obtain IP addresses for your VMs before you deploy



1.9. Obtain IP addresses from public networks

In public networks you can reserve or purchase public IP addresses for your VMs. Reserved IPs may be charged while they are reserved, even if they are not used in VMs. 

Privilege: Manage public IPs, Access public networks tab, Manage public network elements

To add new public IP addresses to your virtual datacenter:

  1. Click the + Add button on the Public IPs page to display the list of available public IPs
    1. To move between pages, use pagination controls such as arrows and page numbers
    2. To filter your search, enter an IP address or Network name in the Search filter box
  2. Select IP addresses to add them to your virtual datacenter 
  3. Click Add to reserve the IPs

The platform will add the IPs to your VDC

You can also reserve public IPs directly from the Edit VM dialog.





1.10. Obtain public IP addresses in public cloud

During onboarding from public cloud, the platform will onboard existing public IP addresses in providers that support them, such as AWS and Azure. You can obtain them from the provider and assign them to your virtual datacenters and VMs.

The provider may charge for public IP addresses as soon as you reserve them for your virtual datacenter. Therefore you should reserve your IP addresses just before you deploy and check they are deleted when you undeploy your VMs. Remember that your provider may also limit the number of public IP addresses that you can use per virtual datacenter.


To add public IP addresses to your virtual datacenter, so that you can later assign them to your VMs:

Privileges: Manage virtual network elements, Manage floating IPs, Access public networks tab, Manage public network elements

  1. Go to Virtual datacenters → Select a public cloud virtual datacenter → Network → Public
  2. On the Allocated public IPs page, click the + add button
  3. To add the public IP to a virtual datacenter, click the Add to VDC link near the IP address

Now when you edit a VM in the VDC and go to Network → Public, the platform will display the public IP address and you can add it to your VM.

To obtain a public IP directly for a VM, click Purchase public IPs.



1.11. Synchronize public IP addresses with the cloud provider

To onboard any public IP addresses that were already created in your cloud provider, or update changes made directly in the provider:

Privileges: Manage virtual network elements, Manage floating IPs, Access public networks tab, Manage public network elements

  1. Go to Virtual datacenters → select a public cloud virtual datacenter → Network → Public
  2. Click the double arrow synchronize public IPs button (beside the + add button)




1.12. Release a reserved public IP address

You can release a public IP if it is not assigned to a VM.

In private cloud, to release a public IP that belongs to a public network, select the IP in the IP list and click the delete button.

In public cloud, click the link to Remove from VDC and then click the delete button.




1.13. Limit Public IP bandwidths for a VDC

You can use Quality of Service (QoS) traffic shaping parameters to limit the bandwidth for each public IP in a virtual datacenter.  

This feature applies to public IPs in infrastructure and managed by NSX in vCenter and vCenter clusters.

Privileges: Manage public bandwidth limit

When you upgrade the platform or create a virtual datacenter, the public IPs bandwidth limit is disabled. To enable the limit for the public IPs of the VDC, edit the bandwidth limit. 

To edit the bandwidth limit and enable it in the platform:

  1. Select the virtual datacenter and go to Network → QoS
  2. Click the pencil edit button 
    1. To set the bandwidth limit in a specific direction, select the Enabled checkbox for that direction
    2. Set QoS values to apply to each public IP in virtual datacenter. This bandwidth will be set for each public IP in the virtual datacenter.


For more details see: 

To register changes that were made outside the platform, save existing public IP bandwidth values. In the API, to register changes, send a POST request with the existing values.



1.14. Reserve private IPs

The private IP reservation feature will prevent users from assigning reserved IPs to VMs within the platform. The platform does not display reserved IPs to allow users to select them for VMs. You can only assign reserved IPs to VMs from outside of Abiquo, for example, using a script. If you onboard a VM with a reserved IP, the platform logs a warning message.

Privilege: Manage private IP reservation

To reserve private IPs:

  1. Go to Virtual datacenters → Networks → Private
  2. Select the IPs and click the lock button
  3. Enter the reason for the reservation
  4. The platform will list the VMs in the virtual datacenter. Optionally select VMs to indicate where the IPs might be used. Note that you must check that the VMs are able to use these IPs. This selection does not assign the IPs to VMs.

The platform will display a padlock symbol and the reason beside the IP reserved addresses.



2. Manage NAT

2.1. Display NAT rules

When the Network Address Translation (NAT) integration is available in your environment, to display NAT IPs and NAT rules:
  1. Go to Virtual datacenters → select virtual datacenterNetworkNAT

To display NAT rules for a VM:

  1. Go to Virtual datacenters → select VM → go to VM control panel → select NAT

To manage or display NAT rules for a VM:

  1. Go to Virtual datacenters → edit VM → Networks → NAT

2.2. Create a NAT rule for DNAT

To enable VMs outside your VDC to connect to a VM with a private IP address, after you obtain a NAT IP, create a destination NAT rule, which is also called a DNAT rule. 

To create a DNAT rule:

  1. Go to Virtual datacenters → Virtual appliances → edit VM
  2. If your VM does not yet have an IP, go to Network → NICs and add a private IP
  3. Go to Network → DNAT
  4. Click the + add button on the top right-hand side of the tab
  5. Enter the details of the DNAT rule

    For more details see GUI Add NAT rule DNAT

  6. Click Add
  7. Save the VM

2.3. Create a NAT rule for SNAT

To send outgoing traffic through a NAT IP that is not the default one, add an additional SNAT rule with these steps:

To create an SNAT rule:

  1. Go to Virtual datacenters → Virtual appliances → edit VM
  2. If your VM does not yet have an IP, go to NetworkNICs and add a private IP
  3. Go to Network → SNAT
  4. Click the + add button on the top right-hand side of the tab
  5. Enter the addresses of the SNAT rule

    For more details see GUI Add NAT rule SNAT

  6. Click Add
  7. Save the VM

2.4. Use a NAT IP for a load balancer

To use a NAT IP address as a public IP address for a load balancer:
  1. Use the virtual datacenter's NAT IP address or obtain an additional NAT IP address. See Obtain an additional NAT IP address for a virtual datacenter
  2. Create the load balancer and select the NAT IP

The platform will automatically create a NAT rule to match the port mappings of the routing rule of the load balancer.

2.5. Obtain an additional NAT IP for your virtual datacenter

In addition to the NAT IP address assigned to the virtual datacenter, you can obtain NAT IP addresses for creating additional NAT rules.

To obtain an additional NAT IP address:

  1. Go to Virtual datacenters Network → NAT
  2. Click the + add button on the top right-hand side of the screen
  3. Select the NAT network and click Accept

The platform will reserve an IP address and allocate it to your virtual datacenter.

You can then use the NAT IP address as the public IP address for a load balancer or to provide access to a private IP address.

2.6. Limit NAT IP bandwidth for a VDC

You can use Quality of Service (QoS) traffic shaping parameters to limit the bandwidth for all the NSX NAT IPs in a virtual datacenter. 

Privileges: Manage NAT bandwidth limit

When you create a virtual datacenter, the new "natbandwidthlimit" attribute is present but you must edit the virtual datacenter to enable it in the platform and in the NSX. 

To edit the bandwidth limit and apply it in the NSX:

  1. Select the virtual datacenter and go to Network → QoS
  2. Click the pencil edit button 
    1. To enable the bandwidth limit in a specific direction, select the Enabled checkbox for that direction
    2. Set QoS values for your virtual datacenter. Be sure to allow enough bandwidth to share between all the NAT IPs in the virtual datacenter.

For more details see GUI Edit NAT bandwidth limit

To register changes that were made outside the platform, save existing NAT bandwidth values. In the API, to register changes, send a POST request with the existing values.



3. Manage firewalls

3.1. Introduction to firewalls

The platform provides a unified interface to firewalls in varied cloud environments. 

This section describes firewall policies, which are similar to security groups. The platform supports firewall policies in private cloud with network managers (NSX, NSX-T) and in public cloud.

Abiquo firewall policies represent.

  • AWS security groups
  • Azure firewall policies
  • GCP firewall rules
  • OCI network security groups

For more details, please see the public cloud features table for each provider.

In vCloud Director, the platform also supports classic firewalls, which are Edge firewalls at level of the public cloud region (orgVDC). See Manage classic firewalls

3.2. Display firewall policies

You can display and manage firewalls in the platforms at the level of the virtual datacenter or the location (public cloud region or datacenter).

To display firewalls in a virtual datacenter in a provider:

  1. Go to Virtual datacenters → select a virtual datacenter → NetworkFirewalls

To display all firewalls in Google Cloud Platform

  1. Go to myCloud → Global view → select the GCP provider → Networks → Firewalls

To display all firewalls in a location (public cloud region or datacenter):

  1. Go to Cloud virtual datacenters view → Locations
  2. Select a location
  3. Go to Network → Firewalls

    Firewalls that do not exist in the provider are grayed out, and you should delete these firewalls.


To filter firewalls, enter text in the Search box to search by the NameDescription, and Provider ID in the Firewalls list.


To display firewalls in an Azure Resource Group:

  1. Go to Cloud virtual datacenters view
  2. Go to Global → Azure → Resource Groups → select a resource group
  3. To display the details of the firewall, edit the firewall

3.3. Synchronize firewall policies

The synchronization process will onboard firewalls and it will update the platform's information about firewalls that already exist in the cloud provider. The platform synchronizes automatically when you onboard virtual resources from public cloud. Depending on the provider, the platform may support synchronization at the level of the location (public cloud region) or virtual datacenter.

To synchronize firewalls do these steps:

  1. In the myCloud view go to Virtual datacenters, or Locations, or for Google Cloud Platform select the Global view
  2. Go to Network → Firewalls
  3. Click the double-arrow synchronize button 

To synchronize a firewall in AWS before you add new firewall rules:

  1. Select the firewall and click the double-arrow synchronize button

3.4. Create a firewall policy

The platform can create firewall policies in virtual datacenters in the provider, or in the platform only, for later use in providers, depending on provider support.

Privilege: Manage firewall

To create a new firewall, do these steps:

  1. Go to Virtual datacentersNetworkFirewalls
    1. For GCP go to Global → Network → Firewalls
  2. Click the Add button
  3. Enter the firewall details
    1. In GCP, if you assign a firewall to a Virtual datacenter, you can then use it as a default firewall
    2. In VCD, if you do not select a Virtual datacenter, the platform will create the firewall in the platform only, not in the provider
  4. Click Save to create the firewall
  5. Add Firewall rules as describe in Create firewall rules.



3.5. Edit firewall rules

You can define firewall rules for inbound and outbound traffic in your firewall policy.

To add a new firewall rule:

  1. Select the virtual datacenter or location
  2. Select the firewall
  3. On the Firewall rules panel, click the pencil Edit button
  4. Select the Inbound or Outbound tab for the traffic direction you wish to control
  5. Enter the details of a rule
    1. Protocol
      • Select from Common protocols, OR
      • Select and enter a Custom protocol
    1. Port range with the Start port and End port that this rule will apply to.
      To enter one port, enter the same value twice, or optionally apply the rule to a number of ports at the same time. 
      For Azure and GCP, you can enter:
      1. a single port, such as 80
      2. a range, such as 1024-65535
      3. a list of port/range, such as 80,1024-65535
    2. Sources or Targets as a network address and netmask, or a comma separated list of these (with no spaces)
  6. Click Add. The firewall rule will be added to the Firewall rules list
  7. Enter more rules as required, then click Save

Before you edit firewall rules in AWS, synchronize the firewall to update the rules because AWS will not allow you to create a rule that already exists in the security group. Remember that it may take some time for firewall rules to propagate throughout AWS. Until the rules have propagated, the platform will not be able to detect them. See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/query-api-troubleshooting.html#eventual-consistency



3.6. Move firewall policies

Before you begin:
  1. Check if your provider allows you to move firewalls. For example, Azure ARM allows you to move firewalls to other VDCs in the same resource group

To move a firewall to another virtual datacenter

  1. Go to Virtual datacenters → Locations or Global
  2. Select the public cloud region, or Azure provider and resource group
  3. Edit the firewall policy and select the new Virtual datacenter

3.7. Troubleshooting firewalls

Unable to render {include} The included page could not be found.

3.8. Delete a firewall policy

To delete a firewall policy:

  1. Edit each VM that is using the firewall policy to remove the firewall policy
  2. Select the firewall policy
  3. Click the Delete button


4. Manage load balancers

The load balancer feature aims to simplify the creation of load balancers across all providers in the multi-cloud platform, providing a unified interface.
  • In AWS, Abiquo supports Application load balancers (see Manage application load balancers) and Classic load balancers (described on this page).
  • In Azure, Abiquo supports Basic and Standard load balancers (described on this page)
  • In vCloud Director, load balancers belong to a public cloud region, not a virtual datacenter. This means that in vCloud Director, you can attach VMs from more than one virtual datacenter to the same load balancer, and these load balancers do not work with private networks, which belong to only one virtual datacenter.
  • In Oracle Cloud Infrastructure (OCI), Abiquo supports load balancers with target groups. See Abiquo and Oracle Cloud Infrastructure load balancers
  • In Google Cloud Platform (GCP), Abiquo supports load balancers with target groups. See Abiquo and Google Cloud Platform load balancers

See Provider support for load balancers tables.

Please always refer to cloud provider documentation as the definitive guide to the load balancing features.  And remember to check your cloud provider's pricing before you begin.


4.1. Display load balancers

You can display and manage load balancers in the platform at the level of the virtual datacenter or the location (public cloud region or datacenter).

To display load balancers in virtual datacenters:

  1. Go to Cloud virtual datacenters view
  2. Select a virtual datacenter

  3. Go to Network → Load balancers.


To display load balancers in a region, including those that do not exist in the provider.

  1. Go to Cloud virtual datacenters view
  2. Click the Locations button and select a location
  3. Go to Network → Load balancers


    Load balancers that do not exist in the provider are displayed in light gray text and you should delete these load balancers.

To display load balancers in an Azure Resource Group:

  1. Go to Cloud virtual datacenters view
  2. Go to Global → Azure → Resource Groups → select a resource group
  3. To display the details of the load balancer, edit the load balancer


4.2. Create load balancers

Before you begin:
  • Synchronize your virtual datacenters (including VMs, networks, firewalls, firewall rules, and load balancers)
  • If required by your provider, create firewalls for your VMs to allow your load balancers to access the VMs
  • In Azure make sure that your VMs belong to availability sets


Privilege: Manage load balancers, Assign load balancers


To create a load balancer:

  1. Go to Virtual datacenters → select a virtual datacenter → NetworkLoad balancers 
    1. For vCloud, select All virtual datacentersNetworkLoad balancersRegion
  2. Click the + add button and complete the following dialogs according to your cloud provider's documentation

4.2.1. Load balancer general information

The following screenshots are from AWS or Azure

For more details see GUI Create load balancer General info

4.2.2. Load balancer routing rules

For more details see GUI Create load balancer Routing rules

4.2.3. Load balancer SSL certificate

For more details see GUI Add a new certificate

4.2.4. Load balancer health check

For more details see GUI Create load balancer Health check

4.2.5. Load balancer firewalls

For more details see GUI Create load balancer Firewalls

4.2.6. Assign load balancer nodes

For more details see GUI Create load balancer Nodes


4.3. Edit load balancers

The cloud provider determines which elements of a load balancer that you can modify. Due to different provider support for load balancer features, it may be possible to make modifications in the platform that will later be rejected by the cloud provider, triggering an error. Check your cloud provider documentation for supported modifications.


5. Manage VPNs

The platform enables you to create site-to-site VPNs between virtual datacenters and other virtual datacenters or other entities. 

This feature is available in datacenters using VMware with NSX-NAT or NSX-gateway.

To manage VPNs, go to Virtual datacenters → select a virtual datacenter → Network → VPN

Initial support for VPNs is per VDC, which means you need to create a separate VPN site for each connected virtual datacenter. Both sites of a VPN must have the same encryption and authentication settings, and inverse local and remote network configurations.

The following table describes VPN functionality in the providers.


AWSVMware NSXAzure
EncryptionAESAES, AES256, Triple DES, AES-GCMAES128_SHA1, AES128_SHA256, AES256_SHA1,
AES256_SHA256, _3DES_SHA1, _3DES_SHA256
Perfect forward secrecy enabledalways enabledoptionalalways disabled
DH groupDH2DH2, DH5, DH14DH2, DH14
AuthenticationPSK (mandatory)PSK (mandatory)PSK (mandatory)

To connect private cloud with public cloud, define the VPN site in private cloud first. 

  • In Azure you can create a VPN using a dummy address for the local gateway (site 1) and edit it after you create the Azure VPN site
  • Azure may automatically select a compatible encryption type
  • In AWS you must supply the IP address of site 1 and you cannot edit it, so you must create site 1 first and the VPN site in AWS will always be site 2

To create the VPN site for site1:

  1. Go to Virtual datacenters → select a virtual datacenter → Network → VPN
  2. Click the + add button and enter the VPN details

The platform will create the VPN site.

For more details see GUI Create a VPN

To create the VPN site for site2 in another VDC:

  1. Select the Virtual datacenter
  2. Add another VPN site using the same encryption and authentication settings, and the remote network configuration of the first VPN site as the local values. 

After you have created both VPN sites, on the VPNs tab, to check the connection in the network virtualization system, click the Check link in the VPN Status column, or when you edit a VPN site.

  • No labels