Versions Compared

Old Version 1

changes.mady.by.user Tahir Kulelija

Saved on

compared with

New Version Current

changes.mady.by.user Tahir Kulelija

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Assumptions
  • You purchased a Basic Internet Gateway or Advanced NSX Edge (Firewall)
  • You have already created a VM
  • You have create private subnet
  • Example Subnet containing the VM: 192.168.2.0/24
  • Example VM IP Address: 192.168.2.100
  • Example Edge Gateway Address: 119.252.74.161

Overview

In this article we will configure a VDC to allow internet access for a VM on a private subnet.

  • In order to configure internet access for the subnet (inclusive of the VM) we will be assigning 2 x NAT rules and 1 Firewall rule to the Uplink port.
  • The NAT rules will provide address and port translation between the internal subnet and the edge gateway.
  • The firewall rule will allow all bidirectional traffic originated by the internal subnet.
  • The firewall rule we are implementing is overly generous and may not be appropriate for your needs.
  • A more specific rule may better meet your particular requirements, for example you may wish to restrict the source IP to a particular host and the destination ports to 80 and 443 TCP to allow only web traffic.
  • In general, you should open only the minimal set of required ports and addresses.

...

Configuration

All configuration items will be applied against the uplink network. You must identify both the external IP address of the edge gateway and the internal subnet for which you wish to provide access. The internal VDC subnet you will have assigned previously to one of your VNICS.

1. Identify Edge gateway IP address

The gateway address can be found by navigating to the Network Configuration tab for your VDC in MyAccount, selecting the ?uplink? network and viewing the config page as below (Customers who have an Advanced NSX Edge will have tabs that the picture below):

Image Added

2. NAT Rules

Add a SNAT rule to the uplink network, click on the NAT page and click the ?Add NAT Rule? button. You will be configuring the following rules:

Source NAT

  • Rule Type: Source NAT
  • Original IP: 192.168.2.0/24
  • Translated IP: 119.252.74.161

Image Added

Destination NAT

  • Rule Type: Destination NAT
  • Protocol: Any
  • Original IP: 119.252.74.161
  • Translated IP: 192.168.2.0/24

Image Added

3. Firewall Rules

Add a Firewall Rule to the uplink network, click on the Firewall page and click the ?Add Firewall Rule? button. The firewall rule we are implementing is overly generous and may not be appropriate for your needs. A more specific rule may better meet your particular requirements, for example you may wish to restrict the source IP to a particular host and the destination ports to 80 and 443 TCP to allow only web traffic. In general, you should open only the minimal set of required ports and addresses. You will be configuring the following rule:

Rule

  • Policy: Allow
  • Description: All
  • Source IP: 192.168.2.0/24
  • Destination IP: Any
  • Protocols: Any

Image Added

Your NAT and firewall rules to allow internet access to your internal VDC subnet 192.168.2.0/24 via edge gateway 119.252.74.161 are now complete.