Edge Firewall Rules:

Tenant can use the edge gateway Firewall tab to add firewall rules for that edge gateway. You can add multiple NSX Edge interfaces and multiple IP address groups as the source and destination for these firewall rules.

The Firewall rules will already have a few entries pre-built in as part of preconfigured services, which you should not need to change in most cases:

To overcome with this issue, Cloud Director offers NSX proxy API , which will help provider/tenant to automate rules. Here is process of creating firewall rule using API:

• Find NSX Edge ID using API
• Get Edge FW Configuration
• Post Firewall rules

Find NSX Edge ID:

To find the NSX Edge ID , you need to fire “Get” to this API “https://<vCD>/network/edges&#8221;, here is “Get” to my API’s headers information , body will be empty.

Here is API Content:

This call will return All the edges and their related information, note on which edge you want to apply firewall rule and its ID.

Get Edge FW Configuration:

Though this step is not required but if you still want to see what all firewall rules has been configured etc..run “get” against “Edge Id”  -“https://<vCD>/network/edges/8417a9fc-c1df-4c03-befd-c79f60d5d0ab/firewall/config&#8221;

Post Firewall Rule:

Header Information:

To add firewall rule, we need to do “Post” against URL “https://<vCD>/network/edges/8417a9fc-c1df-4c03-befd-c79f60d5d0ab/firewall/config/rules&#8221; with following parameters:

• 417a9fc-c1df-4c03-befd-c79f60d5d0ab – this is Edge ID which we got from Step-1
• Content-Type – Application/xml
• Authorization – Bearer Token

Body Content:

Here is body content which is self explanatory. few important items are as below:

• Entire body must be within <firewallRules></firewallRules>
• Within<firewallRules></firewallRules> you can write various rule within <firewallRule></firewallRule> section.
• <service></service>  – In this section you will define “protocol” & “port”.

<firewallRules>
<firewallRule>
<name>New Rule</name>
<ruleType>user</ruleType>
<enabled>true</enabled>
<loggingEnabled>false</loggingEnabled>
<action>accept</action>
<destination>
<exclude>false</exclude>
<vnicGroupId>external</vnicGroupId>
<vnicGroupId>internal</vnicGroupId>
</destination>
<application>
<service>
<protocol>tcp</protocol>
<port>554</port>
<sourcePort>any</sourcePort>
</service>
<service>
<protocol>udp</protocol>
<port>554</port>
<sourcePort>any</sourcePort>
</service>
<service>
<protocol>tcp</protocol>
<port>556</port>
<sourcePort>any</sourcePort>
</service>
<service>
<protocol>udp</protocol>
<port>556</port>
<sourcePort>any</sourcePort>
</service>
</application>
</firewallRule>
</firewallRules>

Screenshot of my API Call body which should be in “application/xml” format.

if you need to write multiple rules in to single API call, then you can create multiple sections of <firewallRule></firewallRule> with single section of <firewallRules></firewallRules>

Result:

Once Header and body is ready, do a post and you should get a valid response of “201 Created”

vCD GUI reflects what you put in to the body of the API call.

I hope this will help Cloud providers/tenants to automate rules which needs to be automated or there are rules which providers need to create by default when onboarding a tenant.

In continuation to my last post, In this post we are going to onboard a tenant using vCloud Director Terraform provider , there are five things that we are going to do:

• Create a new Organisation for the Tenant
• Create a new Organisation Administrator for this Tenant
• Create a new Organisation VDC for the Tenant
• Deploy a new Edge gateway for the Tenant
• Create a new routed Network for the Tenant

Code for New Organisation:

So in this section , we are going to create a new organisation names “T3” which is enabled to use, This section creates a new vCloud Organisation by specifying the name, full name, and description.

#Create a new org names "T3"
resource "vcd_org" "org-name" {
  name             = "T3"
  full_name        = "My organization"
  description      = "The pride of my work"
  is_enabled       = "true"
  delete_recursive = "true"
  delete_force     = "true"
}

Code for Creating Organisation Administrator:

Once as a provider you created Org, this org need an admin, below code will create local org admin. In this code everything is self explanatory but few important parameters explained here:

• Resource Type -> “vcd_org_user”
• org & name -> these are variable, referred in variable file.
• role -> role assigned to this user
• password -> initial password assigned
• depends_on -> Explicit dependencies that this resource has. These dependencies will be created before this resource

#Create a new Organization Admin
resource "vcd_org_user" "org-admin" {
org = var.org_name #variable referred in variable file 
name = var.org_admin #variable referred in variable file
description = "a new org admin"
role = "Organization Administrator"
password = "change-me"
enabled = true
email_address = "avnish@t3company.org"
depends_on = [vcd_org.org-name]
}

Code for Creating new Organisation VDC:

So till now we created Org and Org admin , next is to create a organisation virtual data center , so that tenant can provision VMs, Containers and Applications. few important configuration parameters to consider:

• name -> T3-vdc
• Org -> T3
• Allocation Pool -> Pay as you go (represented as “AllocationVApp”).
• network_pool_name -> Network pool name as defined during provider config.
• provider_vdc_name -> Name of Provider VDC name.
• Compute & Storage -> Define compute and storage allocation.
• VM_quota -> Maximum no. of vms can be provisioned in to this VDC
• network_quota -> Maximum no of networks can be created.

# Create Org VDC for above org
resource "vcd_org_vdc" "vdc-name" {
  name        = var.vdc_name
  description = "The pride of my work"
  org         = var.org_name #variable referred in variable file
  allocation_model = "AllocationVApp"
  network_pool_name = "PVDC-A-VXLAN-NP"
  provider_vdc_name = "PVDC-A"
  compute_capacity {
    cpu {
      limit = 0
    }
    memory {
      limit = 0
    }
  }
  storage_profile {
    name     = "*"
    limit    = 10240
    default  = true    
  }
  metadata = {
    role    = "For Customer T3"
    env     = "staging"
    version = "v1"
  }  
  vm_quota                 = 10 #Max no. of VMs 
  network_quota            =  100
  enabled                  = true
  enable_thin_provisioning = true
  enable_fast_provisioning = true
  delete_force             = true
  delete_recursive         = true
depends_on = [vcd_org.org-name]
}

Code for Creating Edge Gateway for Tenant

This next section creates a new vCloud Organisation Edge Gateway by specifying the name, full name, and description. Provider configures an edge gateway to provide connectivity to one or more external networks.

• Configuration -> compact
• Advanced -> this will be an advance edge
• distributed_routing -> distributed routing is enabled
• external_network ->  uplink information towards DC exit.
• You will notice there is a ‘depends_on’ setting. This means that this resource depends on the resource specified before executing.

resource "vcd_edgegateway" "egw" {
  org = var.org_name #variable referred in variable file
  vdc = var.vdc_name #variable referred in variable file
  name                    = var.edge_name
  description             = "T3 new edge gateway"
  configuration           = "compact"
  advanced                = true
  distributed_routing     = true
  external_network {
    name = "SiteA-ExtNet"
    subnet {
      ip_address            = "192.168.100.20"
      gateway               = "192.168.100.1"
      netmask               = "255.255.255.0"
      use_for_default_route = true
    }
  }
depends_on = [vcd_org_vdc.vdc-name]
}

Code for Creating Organisation Routed Network

An organization VDC network with a routed connection provides controlled access to machines and networks outside of the organization VDC. System administrators (Providers) and organization administrators can configure network address translation (NAT) and firewall settings on the network’s Edge Gateway to make specific virtual machines in the VDC accessible from an external network. Things to consider:

• resource -> must be of type “vcd_network_routed”
• Define other networking information

resource "vcd_network_routed" "net" {
org = var.org_name #variable referred in variable file
vdc = var.vdc_name #variable referred in variable file
name = "T3-Routed-net"
edge_gateway = var.edge_name 
gateway = "10.10.0.1"
dhcp_pool {
start_address = "10.10.0.2"
end_address = "10.10.0.100"
}
static_ip_pool {
start_address = "10.10.0.152"
end_address = "10.10.0.254"
}
depends_on = [vcd_edgegateway.egw]
}

Putting it all together:

So i have put all this code in to a single file and also created a variable file, which will allow providers to on-board a new Tenant less then “5 minute” , provider admin just need to update few parameters in to the variable file like:

• org_name -> Tenant organisation name
• vcd_name -> Tenant Org VDC Name
• edge_name -> Tenant N/S router name
• org_admin -> Org Admin name

Once you input the parameters, run terraform plan and Apply the plan, this enitre process should not take more than 5 minutes to complate.

• Terraform Plan -out f1.tfplan
  • 
• Terraform apply “f1.tfplan”
  • 

Result:

As described above all five tasks related to a Tenant on-boarding got successfully completed and if you notice highlighted boxes , everything is over in less than 2 minutes, isn’t it awesome ?

Here i am attaching variable and code file , which you can use it in your environment by just changing variable file contents like , org_name , vdc_name etc..which i explained above. pls try these files in to a non-prod environment and make your self comfortable before doing it in production.Here is the Code file to download – Terraform.zip. Please share feedback , suggestion any in the comment section…

The new refreshed Terraform vCloud Director provider enables administrators and DevOps engineers to define vCloud Director “infrastructure as code” inside Terraform configuration files. This makes it an efficient automation and integration tool and this project is fully open-source and available on GitHub and also HashiCorp is hosting it in the “terraform-providers” namespace together with all the other official Terraform providers.

If you’d like to contribute with a feature request, report an issue or propose a code improvement please visit the project’s site below. There you can also see current activity and what’s in the works.

• https://github.com/terraform-providers/terraform-provider-vcd

Terraform Installation & Configuration:

Terraform installation is very simple, it is just a single file. if you are running Linux OS system it is “terraform” and if it is windows based systems then it is terraform.exe.You can download the latest version of Terraform from the HashiCorp website using this direct link: https://www.terraform.io/downloads.html

I am using Windows in my Lab so for my Windows based system, I simply downloaded the Terraform Windows x64 file and put into a folder called “c:\tf” then added this folder into my PATHS variable so that I could run terraform.exe from anywhere. This can be done by going to System Properties –> Advanced –> Environment Variable

now go to “System variables” and add :terraform.exe” folder location.

• Select Path and Click on “Edit”
• at the end of the line put symbol “;” and add “terraform.exe” directory path.

Download Terraform vCloud Director Plugin and VS Code:

Download the latest vCloud director terraform plugin from here  and put in to a directory and we will use this during terraform initialization.

Now a days i start using Microsoft Visual Studio Code to write my automation scripts. It has inbuilt terraform plugin to highlight/validate code which makes it way more simple, then working with different text editors and multiple windows. It’s a free download, check it out or you are free to use any other text editor of your choice.

Create Terraform files:

1. Create a new folder
2. Create two terraform files (terraform.tfvars & main.tf) as below and put the below content in to the files
3. Save both the files in to the folder which we created in to step1
4. terraform.tfvars:–
   • This is where we give value to the variables. For example vcd_url = “https://vcd-01a.corp.local/api”, this means that anytime var.vcd_url is referenced in the “main.tf file” it will reference back to . Most variables below are self-explanatory.

   • # vCloud Director Connection Variables
     vcd_user = "administrator"
     vcd_pass = "VMware1!"
     vcd_url = "https://vcd-01a.corp.local/api"
     vcd_max_retry_timeout = "60"
     vcd_allow_unverified_ssl = "true"

   • 
5. main.tf – This will have actual actionable code which will perform action on to vCloud Director.We do this by using a provider and multiple resources. The provider we are using in this demonstration is “vcd”. The resources are then responsible for different parts of vCloud Director. In this example “vcd_org” is going to create, modify or delete an Org. we are created new VCD Organisation.

   • variable "vcd_user" {
     description = "vCloud user"
     }
     variable "vcd_pass" {
     description = "vCloud pass"
     }
     variable "vcd_allow_unverified_ssl" {
     default = true
     }
     variable "vcd_url" {}
     variable "vcd_max_retry_timeout" {
     default = 60
     }
     
     # Connect VMware vCloud Director Provider
     provider "vcd" {
     user = var.vcd_user
     password = var.vcd_pass
     org = "System"
     url = var.vcd_url
     max_retry_timeout = var.vcd_max_retry_timeout
     allow_unverified_ssl = var.vcd_allow_unverified_ssl
     }
     
     #Create a new org names "T3"
     resource "vcd_org" "org-name" {
     name = "T3"
     full_name = "My organization"
     description = "The pride of my work"
     is_enabled = "true"
     delete_recursive = "true"
     delete_force = "true"
     }

   • 

Initialize terraform plugin:

The terraform “init” command is used to initialize a working directory containing Terraform configuration files. This is the first command that you should be run after writing a new Terraform configuration or cloning an existing one from version control. It is safe to run this command multiple times.this command will never delete your existing configuration or state.

During init, Terraform searches the configuration for both direct and indirect references to providers and attempts to load the required plugins. For providers distributed by HashiCorp, init will automatically download and install plugins if necessary.

Since on my windows init didn’t downloaded plugin for some reason , so i have downloaded vCD plugin in above steps and during initialization i am pointing towards my directory and it says terraform will use vCloud Director Plug-in version 2.6.

Terraform Plan:

The terraform “plan” command is a convenient way to check whether the execution plan for a set of changes matches your expectations without making any changes to real resources or to the state.

“Terraform plan” command will check above created files and check what changes it needs to do on the environment and will give you summary of tasks.

Terraform Apply

The “terraform apply” command is used to apply the changes required to reach the desired state of the configuration, or the pre-determined set of actions generated by a terraform plan execution plan.

Org Created Successfully:

above step created an organisation in to my vCloud Director environment and it took only few minutes.

lots of development is happening on terraform  provider for vCloud Director which will help VMware Cloud provider to automate repeated tasks. i will continue to add few more blog articles on this topic, stay tuned….