- Abiquo supports NSX version 6.1.x and version 6.2.x and version 6.3.x
- To use the firewall and load balancer functionality, NSX Advanced edition or higher is required.
- Abiquo supports only one vCenter when working with NSX.
- You will need a vCenter user with NSX administrator rights to use it from Abiquo.
- Ensure the vCenter is managing all hosts so NSX can use vCenter to manage them.
If there are unregistered hosts, the plugin will not work. Abiquo does not validate this.
- Each NSX blueprint requires a separate Abiquo license.
- We recommend using a cluster not managed by Abiquo to deploy the Edge appliances. This cluster is defined in the Remote Services appliance properties in each DC.
Configure the integration
To configure the integration, Abiquo will supply a tool to get the NSX configuration properties values from the vCenter. This tool can also be used to check that the Abiquo properties are properly configured.
Then, follow the specific steps for the chosen blueprint as described in the guides below:
In a nutshell, you will need to perform the steps below:
- Set the NSX global properties and the enterprise defaults in the Remote Services properties.
- Set the NSX enterprise properties in Abiquo as necessary.
- In Abiquo, create the NSX devices for the configured plugin type. The endpoint will usually be something like https://ADDRESS/api , where ADDRESS is the NSX appliance IP address. See Manage Devices
Do not make changes to Abiquo NSX assets directly because Abiquo may not recognise the changed configuration and the integration won't work as expected.
It is not necessary to synchronize the NSX integration elements. Abiquo synchronization in NSX only applies to configurations that conform to Abiquo specifications with 1 x routing rule, identifier in comment field, and so on.
Firewall in NSX with Abiquo works like this:
- If there is no firewall on a VM, all traffic is allowed by default. Otherwise, all traffic is denied by default.
- Abiquo creates global firewall rules and applies them to logical switches, and then specifies individual VM
- Global firewall rules are identified by the names of the firewall and the VDC.
- Firewalls apply to the logical switch, not to NICs (The NSX API does not expose methods to access the ESXi API to obtain vNIC details)
- Traffic through all logical switches is filtered by the firewall
- Rules are always evaluated in order
- Rules apply globally to all VMs connected to the same logical switch, even to those that don't have the firewall assigned.
Abiquo configures the source and destination IPs so as to guarantee the rules will only apply to the right VM
- Abiquo creates a global firewall rule section with the VM name
- Abiquo creates rules as IN or OUT with origin or destination IP as appropriate
- Abiquo creates rules for each IP
See Manage Firewalls for further details.
Load balancers in NSX with Abiquo work like this:
- Abiquo does not support firewalls assigned to load balancers. By default, Abiquo will explicitly permit traffic to virtual servers.
- Load balancers can have private and public IP addresses. These IPs will be taken from the range reserved by properties.
- A virtual LB will be created for each routing rule and each load balancer address.
- The platform only allows one routing rule to limit problems identifying load balancers in synchronization.
You can use multiple load balancers for incoming traffic to multiple ports
See Manage Load Balancers for further details.
External and public networks
With the NSX integrations, External and Public networks are logical switches defined in the NSX manager.
To enable users to work with external and public networks in the Abiquo NSX integration, follow the steps below:
- Create external and public networks in the NSX manager
Create the same networks in Abiquo. On the Create network dialog:
Select the NSX device pointing to the corresponding NSX manager as Device.
Use the Segment ID for the network logical switch as Tag.
VMs must have port udp/68 open for DHCP to work. By default, Abiquo will create a default inbound rule for it when creating a firewall.
For the NAT plugin, the platform configures the same gateway for all vNICs of a VM (through the Edge / DHCP / static bindings). For the ECMP plugin, the platform only configures the default gateway in DHCP for the first vNIC
For private networks, Abiquo will manage DHCP through the provisioned NSX appliances during VDC creation:
- In the Gateway blueprint, the NSX edge acts as the DHCP server for the VMs, and has a DHCP static binding for each VM IP address.
- In the ECMP blueprint, the DHCP server is at the same level as the DLR
For External/Public networks, Abiquo will search for an Edge appliance on the network logical switch with DHCP enabled. Otherwise, it will fallback to the DHCP configured in the DC Remote Services. In this case, Abiquo will not validate whether the DHCP requests/replies are properly forwarded from the DHCP server to the logical switch.
Custom private network gateway
When working with NSX (using NAT or ECMP configurations), the platform creates an Edge for each virtual datacenter to provide gateway, DHCP, load balancing, and so on.
To use your own network security software deployed on a VM and direct all virtual datacenter traffic through this VM, create your own custom gateway in a private network.
- Create your VM to use as a gateway
- Configure the VM to add NICs in the private network, and a public network or similar
- Deploy the VM
- Edit the private network and set the address of your gateway VM as the network gateway
The platform will update the existing leases in the NSX Edge DHCP to use the new gateway IP, and all new leases will use it too.
Limitation: The platform updates the Private Network IP on the NIC of the Edge to the new gateway IP