Organization Network

An organization network provides network services to one particular organization, whereas an external network is created at the provider level and supplies connectivity to multiple organizations. There are three options when creating organization networks: internal, NAT-connected, and direct-connected. An organization administrator cannot create an organization network due to the configuration of external IPs; only a system administrator can configure this.

Internal

An organization can be set up so that it does not have a connection to the Internet or a connection to any other external network, just an internal connection. An internal-only network could be set up for groups of test virtual machines; a virtual machine can be configured with multiple network interfaces so that it has a connection to the internal network as well as one of the other two types. With an internal organization network, vApps can connect, but there is no traffic outside the organization.

Network Address Translation (NAT)-Connected

Network Address Translation (NAT)-connected, sometimes called a “routed network,” can be connected to the external network through a vShield Edge device. The vShield Edge device provides port-forwarding services, NAT, DNS forwarding, and DHCP services to the network; the vShield Edge device gets provisioned automatically
by vCloud Director as needed. A NAT connection allows for virtual machines to communicate with each other while only having one IP seen from the Internet. Another use of NAT is to fence, which includes two sets of IP addresses: external and internal. Fencing allows for several vApps to utilize the same internal IP addresses and extremely useful for test environments.

Direct Communication

The last option for an organization network is a direct connection. The organization would use an external net- work to connect to external systems, including the Internet. Using this method, a user can connect directly to a virtual machine using remote desktop or even SSH. If a vApp configured for a direct connection then the vApp’s IP addresses must be statically assigned or a DHCP server must be connected to the external providing the vApp with those IP addresses.

For further reading, check out my vCloud Director 5.1 Networking Concepts white paper!

A VMware vCloud is made up of one or more vCloud Director servers that are integrated with underlying vSphere components. The vCloud is a new abstraction layer above vCenter Server consuming the resources that vCenter manages; this allows a user to self-provision virtual environments utilizing memory, compute, storage, and networking resources. Cloud computing has become a vague, arbitrary phrase, but there are six characteris- tics that define exactly what a cloud should consist of

• self-service
• elasticity
• pay as you go
• multi-tenancy
• resource pooling
• ubiquitous access

A private cloud is an infrastructure whose resources are only used internally. A public cloud is an infrastructure made available to external customers for a price. A hybrid cloud combines two or more clouds with some kind of standardized technology, like VMware vCloud Connector, while each cloud maintains its own unique identity.

The foundation of the vCloud centers on the networking configuration. Networking occurs over three different layers: external, organization, and vApp; it is imperative to properly configure and manage these networks so that the vCloud can be consumed. Think of vCloud networking as an onion that will be peeled back to reveal each layer, starting with the organization’s networks that are created by an administrator with the system administrator role in vCloud Director. A system administrator is the highest role within the vCloud.

For further reading, check out my vCloud Director 5.1 Networking Concepts white paper!

The first object that is created within vCloud Director is the External Network. An External Network provides the connection from the cloud to the outside world, allowing inter-Cloud connections and is port group based. Even though this connection is called the external connection, an Internet connection is not actually required; this can be set up to provide a connection to several different internal entities, like ESXi hosts, without an actual route to the Internet. Since this connection is port group-based, then the port group needs to exist prior to attempting to establish the connection. The port group can be defined on a standard vSwitch, a distributed vSwitch, or on a Nexus 1000V. Organization virtual datacenters can use the external networks to provide Internet connectivity to the organizations and the virtual machines that reside within a vApp, given that the vApp network is configured for that. By creating an external network, vCloud Director is effectively configured to send all external traffic using the port group(s) selected. Should there be multiple external networks created then be sure to separate them by using VLANs. Only someone with the system administrator role within the vCloud can create and manage external networks.

For further reading, check out my vCloud Director 5.1 Networking Concepts white paper!