Tag Archives: HCX

Policy Routing with HCX Mobility Optimized Networking (MON)

**First and foremost, thank you Michael Kolos for the assist on this blog!!!**

If there is anything I’ve learned over the past four years with VMware Cloud on AWS (also applies to other hyperscalers) it’s that spinning up the SDDC is easy. It’s connecting on-premise and other cloud providers together that’s the hard part. In order to simplify these connections, VMware engineered a little bit of magic with VMware HCX™. In summary, VMware HCX™ is an application mobility platform designed for simplifying application migration, workload rebalancing and business continuity across datacenters and clouds. As a part of an HCX deployment, a few appliances are deployed. HCX Manager, WAN Interconnect (IX)m, WAN Optimization (WAN-OPT), Network Extension (L2C), and a Proxy Host. More details can be found here. For this post, I am going to focus on enabling MON via the HCX Network Extension and why you need to understand policy routing. I’ve run into this a few times with customers. Hopefully, this helps!!

So what is Mobility Optimized Networking?
Mobility Optimized Networking improves routed connectivity patterns for multi-segment applications and virtual machines with inter-VLAN dependencies as those virtual machines are migrated into the cloud. Without MON, HCX Network Extension expands the on-premises broadcast domain to the cloud SDDC while the first hop routing function remains at the source. The network “tromboning” effect is observed when virtual machines connected to different extended segments communicate. More information can be found here.

""

Scenario: Customer has a Layer 2 network stretched via HCX L2C. In order for the customer to allow their teams to deploy and manage workloads on VMC on a secondary domain, they want to add a Windows Domain Controller as an Identity Source to the VMC SDDC vCenter. This DC is deployed on the same VLAN where the network is stretched. Firewall rules have been validated similar to my previous blog which details the rules needed for the domain controller to communicate with the vCenter. When trying to add the following error appears. F So what gives?!!!!!

Here’s my list of assumptions:

  • A source VM, on an HCX L2E network with MON enabled, and the VM set to use the local (MON) gateway – not the source(on-prem) L3 gateway.
  • Default policy routes (RFC1918) in place.
  • VM trying to reach the vCenter of the local SDDC (i.e. the one where the MON gateway is, not the source L3 gateway)

In this scenario, MON will only optimize the path for other VMs on the MON enabled networks whose gateway is also the MON network, or for routed segments in the same SDDC (connected to the same T1 Router aka Compute Gateway). The SDDC’s management CIDR (which vCenter is a part of) is not connected to the same T1 Route as the vCenter is connected to the Management Gateway. As a result, there is not a matching T1 route. Without this route, the traffic decision then moves to the policy routes. Since the vCenter is using private IP, which is in the default Policy routes for MON, the traffic will be sent back over the L2E to the source L3 gateway. Depending on the routing configuration, this path may or may not work.

To resolve this, we need to modify the default policy routes. Depending on what the desired path is (e.g. what destinations are reachable on the on-prem side), we can update them to match that. The easiest way to do this is to add a DENY route with the SDDC’s management CIDR to the Policy Routes.

In my lab, the SDDC uses 10.62.0.0/16 as the management CIDR, this is how you can add the Policy Route. Go to HCX Manager via the HCX Center Plug-in or HCX Manager URL and select Network Extension > Advanced > Policy Routes.

Enter in the SDDC Management CIDR as a deny rule.

Once this change is made, the Domain Controller is able to communicate with vCenter and is able to be added as an identity source.

Dive in!!!!! Learning all about VMware Cloud on AWS and HCX

Lately, I’ve been asked by peers and customers alike “How can I learn more about VMware Cloud on AWS?!” Many of us are finding ourselves in front of screens much more than normal these days so what better way to fill in some time gaps than by learning more about VMware Cloud on AWS and HCX?! While search engines are helpful, I hope my “definitive list” helps!!! If you need more, feel free to reach out!!! Happy Learning!!!

VMware Cloud on AWS

YouTube

VMware Cloud on AWS Customer Success YouTube Channel

VMware Cloud YouTube Channel

VMware Cloud on AWS Blogs

Nico Vibert – https://nicovibert.com/

Gilles Chekroun – http://www.gilles.cloud/

Ryan Kelly – http://www.vmtocloud.com/

William Lam – https://www.virtuallyghetto.com/

Tom Twyman – https://occasional-it.com/

Dustin Spinhirne – https://dspinhirne.github.io/vmcbook/

VMware Cloud Blog – https://cloud.vmware.com/community/blog/

Community Sites

VMware Cloud on AWS Blog Community – https://cloud.vmware.com/community/vmware-cloud-on-aws/

VMTN Forum –https://communities.vmware.com/community/vmtn/vmc-on-aws/overview

VMware Cloud on AWS VMUG- https://community.vmug.com/communities/community-home169?CommunityKey=df5b4c52-4f7b-48dc-b5ad-ea0be799e128

Documentation

VMware Cloud on AWS Sizer and Workload Profiles – https://vmc.vmware.com/sizer/workload-profiles

VMware Cloud on AWS Documentation – https://docs.vmware.com/en/VMware-Cloud-on-AWS/index.html

Configuration Maximums – https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-operations/GUID-10A0804B-04F4-4B8A-9EBA-85169F533223.html

Getting Started – https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/vmc-on-aws-getting-started.pdf

Operations Guide – https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/vmc-aws-operations.pdf

Feature Walkthrough – https://featurewalkthrough.vmware.com/t/vmware-cloud-on-aws/

Hands on Labs

HOL-2052-01-ISM – VMware Horizon on VMware Cloud on AWS – https://labs.hol.vmware.com/HOL/catalogs/lab/6542

HOL-2087-01-HBD – VMware Cloud on AWS – Getting Started – https://labs.hol.vmware.com/HOL/catalogs/lab/6593

HOL-2087-91-HBD – VMware Cloud on AWS – Lightning Lab- https://labs.hol.vmware.com/HOL/catalogs/lab/6053

Hybrid Cloud Extension (HCX)

Blogs

Gabe Rosas – https://hcx.design/ THIS IS A ONE STOP SHOP FOR HCX!!!!!

Emad Younis – https://emadyounis.com/

Communities

https://cloud.vmware.com/community/vmware-hcx/

Documentation

HCX Overview – https://docs.vmware.com/en/VMware-HCX/services/user-guide/GUID-A7E39202-11FA-476A-A795-AB70BA821BD3.html

Hands on Labs

HOL-2081-01-HBD – VMware HCX – Getting Started with Cross-Cloud Mobility- https://labs.hol.vmware.com/HOL/catalogs/lab/6352

AWS re:Invent 2018 – Day 4

Last full day at re:Invent for me but it ended on a really good note. The morning was spent attending Werner Volgels’ Keynote that covered new database services, serverless, and more! I highly recommend watching.

The next session I attended put me on my heels. My background is in systems administration and operations. I am not a developer but my main goal in attending re:Invent was to stretch myself and learn more about what Andy Jassy refers to as “builders”. I believe that Artificial Intelligence (AI) and Machine Learning (ML) are going to be major disruptors in all industries so I jumped at the chance to learn more about them. I attended a session on the newly announced AWS Deep Racer. This was a 2.5 hour workshop where I learned about Reinforcement Learning (RL). This is the main type of machine learning behind Deep Racer. The standby line to get into the session was at least 100 people so I’m lucky I pre-registered for this one. This session was attended by developers, robotic specialists, ML scientists, and those who simply wanted to learn more about AI. The surprise of the session was that each of us was given a Deep Racer for attending!!! The irony was that we had to pick up the car and then take it to the FedEx store to have it shipped to our homes if we didn’t want to carry it on the plane. I’m pretty sure AWS could have leveraged someone who’s really good at shipping things to my door….but who cares….I got one!!!!

My last session for the conference ended on a high note. ENT215-R1 – Top Strategic Priorities You Can Tackle with VMware Cloud on AWS. With yesterday’s announcement of AWS Outposts, this was a highly attended session. Well-known VMware technologists such as William Lam, Kyle Ruddy, Emad Younis, and Alan Renouf were all in attendance. AWS VP Sandy Carter and VMware VP Mark Lohmeyer along with Emad covered more uses cases for VMWonAWS and introduced AWS Outposts. This is a must watch if you are interested in Hybrid Cloud.

After sending my Deep Racer off for home delivery, it was time for some R&R at the hotel before re:Play. Re:Play is the party held on the last night of the conference. The only time I have seen so many people in tight spaces have been at major sporting events or amusement parks. PEOPLE EVERYWHERE!! Even the line for the men’s restroom was insane! The laser show and dodgeball were entertaining. It was great to see all the excitement after a long week of sessions. After about an hour of bumping into people, I decided to call it a night. Day 4 = 20,545 steps (10.18 miles)

 

AWS re:Invent 2018 – Day 3

Day 3 I attended a breakfast to celebrate the great things that VMware and CloudHealth are doing with our partners and customers. I’m excited about the multi-cloud functions the service has and how it will help customers get their arms around better managing their public cloud instances from security to costs. Here’s a link to VMware CEO Pat Gelsinger and CloudHealth CEO Tom Axbey discussing the acquisition and strategy going forward. During breakfast, we watched the live steam of Andy Jassy’s keynote. The next 2.5 hours of announcements were announced at an insane pace as I struggled to keep track. Once Andy started telling the story of Hybrid Cloud, I knew something cool was coming. Low and behold, Pat Gelsinger (VMware CEO) joins him on stage to announce AWS Outposts!!! There are so many exciting things about this announcement. In a nutshell, we are letting users choose between on-premises servers and storage, which can be ordered in quarter, half, and full rack units. AWS Outposts can be upgraded with the latest hardware and next-generation instances to run all native AWS and VMware applications. A second version, VMware Cloud on AWS Outposts, will let customers use the VMware control plane and APIs to run the hybrid environment. Andy Jassy Keynote at AWS at The Venetian, Las Vegas, NV on Wednesday, Nov. 28, 2018.After the keynote, I headed back to the Expo Hall to see what kind of attention the AWS Outposts message was getting and it was fairly packed! There’s a lot of interest around this technology. Very exciting! I spend a few hours there talking to several other VMware attendees at our booth and on the floor. It was awesome to see all the customer meetings. VMware and AWS are going to continue to innovate together, that much is clear.

My last session of the day was ENT313-S Running Production Workloads in VMware Cloud on AWS. VCSA and Hybrid Cloud Extension (HCX) all-pro Emad Younis and VMWonAWS Director Alex Jauch presented. Alex and Emad focused on the deep partnership between VMware and AWS that makes this service possible. If you want to know more about use cases, how the service is built, and how to quickly migrate workloads between on-prem and VMWonAWS, look no further than this session.

Day 3 = 14,509 steps (7.18 miles)