Page Comparison

Requirements

• Abiquo supports only one vCenter when working with NSX.
• You will need a vCenter user with NSX administrator rights to use it from Abiquo.
• Ensure the vCenter is managing all hosts so NSX can use vCenter to manage them.
  If there are unregistered hosts, the plugin will not work. Abiquo does not validate this.
• Tested with NSX version 6.1.x and version 6.2.x. Version 6.3.x may work but has not been tested.
• To use the firewall and load balancer functionality, NSX Advanced edition or higher is required.
• Each NSX blueprint requires a separate Abiquo license.

Limitations

• Chef is not supported because the NSX DHCP does not support the required vendor-encapsulated-options.
• Load balancers are only available through the NSX Gateway blueprint.

• Abiquo does not currently support firewalls applied to load balancers.

Recommendations

• We recommend using a cluster not managed by Abiquo to deploy the Edge appliances. This cluster is defined in the Remote Services appliance properties in each DC.

Configure the integration

To configure the integration, Abiquo will supply a tool to get the NSX configuration properties values from the vCenter. This tool can also be used to check that the Abiquo properties are properly configured.

Then, follow the specific steps for the chosen blueprint as described in the guides below:

• NSX Gateway configuration guide
• NSX with ECMP configuration guide
• NSX NAT configuration guide

In a nutshell, you will need to perform the steps below:

1. Set the NSX global properties and the enterprise defaults in the Remote Services properties.
2. Set the NSX enterprise properties in Abiquo as necessary.
3. In Abiquo, create the NSX devices for the configured plugin type. The endpoint will usually be something like  https://ADDRESS/api , where ADDRESS is the NSX appliance IP address. See Manage Devices

Integration details

Synchronization

It is not necessary to synchronize the NSX integration elements. Abiquo synchronization in NSX only applies to configurations that conform to Abiquo specifications with 1 x routing rule, identifier in comment field, and so on.

Firewalls

Firewall in NSX with Abiquo works like this:

• If there is no firewall on a VM, all traffic is allowed by default. Otherwise, all traffic is denied by default.
• Abiquo creates global firewall rules and applies them to logical switches, and then specifies individual VM
  • Global firewall rules are identified by the names of the firewall and the VDC.
  • Firewalls apply to the logical switch, not to NICs (The NSX API does not expose methods to access the ESXi API to obtain vNIC details)
  • Traffic through all logical switches is filtered by the firewall
• Rules are always evaluated in order
  • Rules apply globally to all VMs connected to the same logical switch, even to those that don't have the firewall assigned.
    Abiquo configures the source and destination IPs so as to guarantee the rules will only apply to the right VM
• Abiquo creates a global firewall rule section with the VM name
• Abiquo creates rules as IN or OUT with origin or destination IP as appropriate
• Abiquo creates rules for each IP

See Manage Firewalls for further details.

Load Balancers

Load balancers in NSX with Abiquo work like this:

1. Abiquo does not support firewalls assigned to load balancers. By default, Abiquo will explicitly permit traffic to virtual servers.
2. Load balancers can have private and public IP addresses. These IPs will be taken from the range reserved by properties.
3. A virtual LB will be created for each routing rule and each load balancer address.
4. The platform only allows one routing rule to limit problems identifying load balancers in synchronization.
   You can use multiple load balancers for incoming traffic to multiple ports

See Manage Load Balancers for further details.

External and public networks

With the NSX integrations, External and Public networks are logical switches defined in the NSX manager.

To enable users to work with external and public networks in the Abiquo NSX integration, follow the steps below:

1. Create external and public networks in the NSX manager

2. Create the same networks in Abiquo. On the Create network dialog:

   1. Select the NSX device pointing to the corresponding NSX manager as Device.

   2. Use the Segment ID for the network logical switch as Tag.

DHCP

VMs must have port udp/68 open for DHCP to work. By default, Abiquo will create a default inbound rule for it when creating a firewall.

The platform configures the same gateway for all the vNICs (in Edge / DHCP / static bindings).

For private networks, Abiquo will manage DHCP through the provisioned NSX appliances during VDC creation:

• In the Gateway blueprint, the NSX edge acts as the DHCP server for the virtual machines, and has a DHCP static binding for each VM IP address.
• In the ECMP blueprint, the DHCP server is at the same level as the DLR.

For External/Public networks, Abiquo will search for an Edge appliance on the network logical switch with DHCP enabled. Otherwise, it will fallback to the DHCP configured in the DC Remote Services. In this case, Abiquo will not validate whether the DHCP requests/replies are properly forwarded from the DHCP server to the logical switch.Abiquo supports Standard SKU load balancers and Basic SKU load balancers.