Skills and Abilities
Man….let me tell ya….I’m so happy to say that the “Road to VCAP6-NV” is complete! I passed my exam at VMworld 2018! Back in Oct 2017, I began my “Road to VCAP6-NV” series with the intent of giving myself a reference point to take my notes as I studied for the exam and also something that could be useful to the community. Well that work paid off!
Skills and Abilities
Universal logical switches can only be created from the primary NSX manager and when connected to a universal transport zone.
To create a universal logical switch, navigate to Networking & Security > Logical Switches. Click the green “+”. Enter a name for the logical switch. Click Change next to Transport Zone.
In a Cross-vCenter NSX deployment, the NSX Manager can have one of four different roles:
The primary role can only be given to one NSX Manager. The primary manager has the controllers installed and all universal objects are created on the primary NSX Manager. The secondary NSX Manager becomes secondary when it added to the primary manager. All universal objects are read only on the secondary NSX Manager. The secondary NSX Manager cannot have it’s own controllers. Each NSX Manager can have its own local objects that are only seen by that NSX environment. The Standalone role is the default role of a newly installed NSX Manager. It is not a part of a cross-vCenter setup. The Transit role comes into play when a once primary or secondary is made standalone again but there are still universal objects that exist. In the transit role, universal objects can only be deleted, not created. Once all universal objects are deleted, the NSX Manager can become a standalone or secondary NSX Manager.
To assign the primary role to a NSX Manager, navigate to Networking & Security > Installation and Upgrade > Management. Select the the NSX Manager and click the Actions wheel and select Assign Primary Role.
Skills and Abilities
• Implement identity service support for Active Directory, NIS, and LDAP with Single Sign-On (SSO)
• Manage User rights:
You can register a Windows domain with NSX Manager and vCenter. The NSX Manager will get the user and group info from Active Directory and that can be used to create identity based security groups and firewall rules and for activity monitoring. To register a Windows domain with NSX Manager, navigate to Networking & Security > System > Users and Domains. I’ve already configured this but in a new instance, click the green “+”.
Skills and Abilities
• Configure logging for NSX components according to a deployment plan
• Monitor health of networking services
• Monitor health and status of infrastructure components:
• Enable data collection for single/multiple virtual machines
To configure logging for our ESXi host, navigate to the host and click Configure > Advanced System Settings. You can click Edit and search for syslog. Edit the settings for Syslog.global.logHost and enter in your syslog server’s FQDN or IP and port number.
Skills and Abilities
Having backups of your NSX environment is highly recommended in case you ever need to restore your config back to a working state in the event of a failure. A NSX backup will contain all of the NSX configuration, including controllers, logical switches, logical routers, firewall rules and other things that were configured within NSX. It is also good to have the vCenter database and distributed switch configs backed up so that you have a complete recovery point.
To begin setting up the backup, log in to the NSX Manager.
Skills and Abilities
Security Groups are a way to define objects that you want to group together to protect. They can be statically defined or defined dynamically. Security Groups can be defined using some of the following objects:
Grouping objects together can make the application of firewall rules that much easier and cut down on the amount of rules that need to be generated in NSX
To create a security group, navigate to Networking & Security > Service Composer > Security Groups. Click the “New Security Group” icon.
Identity based firewall allows you to make distributed firewall rules based off Active Directory users and groups. A few things need to be in place for this to work. You must have a cluster that is prepared for NSX. You must setup AD synchronization so that NSX can see the users and groups and you must have Guest Introspection and/or AD Event Log Scraper in place. Guest Introspection must be deployed on the clusters where IDFW VMs are running. When network events are created, a guest agent installed on the VM (VMware Tools full installation) forward the information through guest introspection on to the NSX manager. With Active Directory event log scraper, you must point the NSX manager to a AD domain controller. The NSX manager then pulls the events from the AD security event log and filter through the firewall rules accordingly. IDFW monitors where AD users log in, maps the login to a IP address, and that is used by the DFW to apply rules. Read Full Article
Let's v4Real 