Operating VMware Shared

Switching between storage properties

Some disk settings cannot be changed while the VM is powered on. For example, you can increase the disk size while the VM is powered on, but you cannot decrease the disk size unless the VM is powered off. A message displays if you must power off the VM before you modify a disk setting. For more information, see Power off a virtual machine.

For more information about changing a storage policy, see Change the general properties of a virtual machine.

If you must power off the VM before you change a storage policy, power the VM back on after the VM is moved to the new storage policy. For more information, see Power on a virtual machine.

Create the Organization virtual data center network firewall rule to allow access to the external network

From the virtual data center for that edge gateway, create the network firewall rule. For more information, see Add an NSX data center for vSphere Edge Gateway firewall rule.

Review the following notes for creating the Organization virtual data center network firewall rule to allow access to the external network.

• For Source, you can use an IP address, a range of addresses, or an object.
• In the Browse objects of Type menu, select Org Vdc Networks. Select the Organization virtual data center network that you created as the Source cell. Click the right arrow to move the Organization virtual data center network into the Filter column.
• Keep all remaining default selections.
• For Action, select Accept.
• To define a source IP address or range, click the IP in the Source cell and set the IP address, or range to allow everything on that subnet. For example, 192.168.100.2 or 192.168.100.0/24. Destination and services are set to Any when you choose the defaults.

Source NAT definitions to the external network

A source NAT rule is necessary to allow traffic from the Organization virtual data center network outbound to the internet. From the virtual data center for that edge gateway, create NAT44 Rules. For more information, see Add a SNAT or a DNAT rule.

Review the following notes for source NAT definitions.

Under the NAT44 Rules, click SNAT Rule and create the configuration by using the following selections.

• For Applied On, select the Organization virtual data center external network.
• For Original Source IP/Range, enter your Organization virtual data center Gateway CIDR.
• For Translated Source IP/Range, click SELECT. Then, for Select IP Address Network, select the external network and choose one of the external network addresses that were assigned to your virtual data center.
• Optionally, enter a destination port.
• Optionally, enter a description. A description can be useful to identify the SNAT rule later.
• Set to Enabled.
• Optionally, enable logging. Logs are not preserved. If you want to have historical data, you must set up a syslog server.

Create the Organization virtual data center network firewall rule to allow access to the IBM Cloud Services Network

From the virtual data center for that edge gateway, create the network firewall rule. For more information, see Add an NSX data center for vSphere Edge Gateway firewall rule.

Review the following notes for creating the Organization virtual data center network firewall rule to allow access to the IBM Cloud Services Network.

• For Source you can use an IP address, a range of addresses, or an object.
• In the Browse objects of Type menu, select Org Vdc Networks. Select the Organization virtual data center network that you created as the Source cell. Click the right arrow to move the Organization virtual data center network into the Filter column.
• The destination can be an IP address, a range of addresses, or an object. In the Destination column, click the + in the upper right of the cell when you hover your mouse in the field. In the Browse objects of Type menu, select Gateway Interfaces. Select the service network available to your virtual data center. Click the right arrow to move the service network into the right side filter column.
• For Action, select Accept.
• To define a destination IP address or range, click the IP in the destination cell and set the IP address or range to allow everything on that subnet. For example, 192.168.100.2 or 192.168.100.0/24.

Source NAT definitions to the IBM Service Network (Private)

A source NAT rule is necessary to allow traffic from the Organization virtual data center network into the IBM Cloud Service Network. This rule is used to enable VM access to IBM Cloud Services such as update servers, DNS servers, NTP servers, or to get to the IBM Cloud Object Storage.

From the virtual data center for that edge gateway, create the source NAT definitions to the IBM Service Network (Private). For more information, see Add a SNAT or a DNAT rule.

Under the NAT44 Rules, click SNAT Rule and create the configuration by using the following selection.

• For Applied On, select the service network.
• For Original Source IP/Range, enter your Organization virtual data center Gateway CIDR.
• For Translated Source IP/Range, click SELECT. In the Select IP Address Network menu, select the service network and choose one of the service network addresses that were assigned to your virtual data center.
• Optionally, enter the destination IP addresses.
• Optionally, enter the destination port.
• Optionally, enter the description. A description can be useful to identify the SNAT rule later.
• Set to Enabled.
• Optionally, enable logging. Logs are not preserved. If you want to have historical data, you must set up a syslog server.

If the DHCP services are enabled on the edge, you can test for internet connectivity by logging in to one of the VMs that are attached to the network for which the firewall and DNAT rules are defined.

The steps differ depending on the VM operating system and network configuration:

• For a Windows VM, renew the DHCP lease. Open a command line and issue the ipconfig /renew command.
• For a Linux VM, type systemctl restart NetworkManager.service. Depending on the type and version of Linux, this command might vary. From the command line, ping 8.8.8.8 or 9.9.9.9. If everything is configured correctly, you receive a reply. If the name resolution is required and no DNS server was defined yet, you can configure either 9.9.9.9 or 8.8.8.8 on the VM, edit the DHCP pool and define it there.

Destination NAT definition and port forwarding

A destination NAT allows an outside host, in this case on the internet, to connect to an inside host on the Organization virtual data center network. The destination NAT maps one IP address or port to another IP address or port. The following instructions are an example of configuring DNAT and port forwarding to allow a Windows remote desktop connection to a Windows VM in the Organization virtual data center. Port forwarding is optional.

From the virtual data center for that edge gateway, create the destination NAT definition. For more information, see Add a SNAT or a DNAT rule.

Under the NAT44 Rules, click DNAT Rule and create the configuration by using the following selection.

• For Applied On, select the <datacenter>-w<idx>-tenant-external interface, for example, dal13-w02-tenant-external.
• For Original Source IP/Range, select one of the IP addresses from the Suballocated Public IP address range. Click SELECT, and select an IP from the IP Address menu. This value is the tenant-external IP address referenced in future steps. Click KEEP.
• Optionally, select port forwarding. Click the Protocol menu arrow and select TCP.
• Select a port that is not previously used with the original IP address or range. The Original Port in this example is 8000. Ports that are lower than 1024 are reserved.
• If ICMP is selected in the Protocol menu, select the ICMP Type.
• For Translated IP/Range, type the IP address of the VM on the private Organization virtual data center that you want to connect.
• For Translated Port, select the port on the previous VM that the servicer is listening on. In the Windows RDP example, port 3389 is the default remote desktop port.
• Optionally, provide a description.

From the virtual data center for that edge gateway, add a firewall rule to enable port forwarding. For more information, see Add an NSX data center for vSphere Edge Gateway firewall rule.

Review the following notes for destination NAT definition and port forwarding.

• For Source, optionally define the source if you want to restrict access to the internal Organization virtual data center VM to a specific IP or IP range.
• For Destination, set the value to the tenant-external IP address used for Original IP/Range in the DNAT rule.
• For Service, set the Protocol to TCP and the Destination Port to the tenant-external IP address used in the DNAT rule. In the example, port 8000 is used.

To test the configuration, use the remote desktop client and connect to the tenant-external IP address:port number as the destination in the Computer field.

Adding the NAT rule for VMware Solutions Shared

Add a NAT rule for translating internal network addresses into the service network IP address space.

1. Log in to the VMware Cloud Director tenant portal.
2. Click the virtual data center Edges tab and open the single preconfigured edge.
3. In the External Networks section, click the IP Settings link. Find the name of the service network and the IP address that is assigned for the service network interface from the table displayed. The format for the service network name is <datacenter>-w<idx>-service<idx>, for example, dal13-w02-service02.
4. Click SERVICES to open the Edge Gateway configuration page. Click the NAT tab and click + SNAT RULE to add a SNAT rule.
5. Select the service network next to the Applied on field and add the IP addresses or range from one of the virtual data center Organization networks to the Original Source IP/Range field.
6. In the Translated Source IP/Range field, click Select. From the Network menu, select the service network. From the IP Address menu, select the service IP address that you want to use.
7. Optionally define the Description field.
8. Verify that Enabled is selected and click KEEP.
9. Click Save Changes.

Adding the NAT rule for VCF as a Service

Add a NAT rule for translating internal network addresses into the service network IP address space.

1. Log in to the VMware Cloud Director tenant portal.
2. From the main page under Virtual Data Center, click the virtual data center where you want to add the NAT rule.
3. In the left pane under Networking, click Edges and open the single preconfigured edge.
4. Under the Services section, click the NAT tab and click NEW to add an SNAT rule.
5. Complete the following configuration in the Add NAT Rule window:
   1. Enter a name for the NAT rule.
   2. Select SNAT in the Interface Type field.
   3. In the External IP field, click the information icon to view the available IP addresses and enter the external IP address that you want to use.
   4. In the Internal IP field, enter the internal IP address, including the CIDR to be translated. Typically, a subnet from the RFC1918 private range is best, but not required. For example, 192.168.10.0/24.
6. Verify the Advanced Settings fields and click Save.

Adding the firewall rule for VMware Solutions Shared

Add a firewall rule to allow the traffic from the internal network to the service network.

1. Click the Firewall tab and click + to add a firewall rule.
2. Add the IP addresses or range from your internal network to the Source field.
3. Add 52.117.132.1/24 in the Destination field.
4. Specify Any for the Service field and Accept for the Action field.
5. Click Save changes.

After the previous configuration is completed, you can use the supported IBM Cloud services on the VMs in your virtual data center.

If your vApp or VM is deployed from the IBM templates that are provided in the public catalog, the services are already configured on the VM. To enable the connection, you must complete the previous steps in Adding the NAT rule and Adding the firewall rule.

Adding the firewall rule for VCF as a Service

Add a firewall rule to allow the traffic from the internal network to the service network. Before you add the firewall rule, you must define the IP set.

1. Define the IP set.
   1. Log in to the VMware Cloud Director tenant portal.
   2. From the main page under All Edge Gateways, click the virtual data center where you want to add the firewall rule.
   3. In the left pane under IP Management, click IP Allocations. Make note of the external allocated IPs.
   4. In the left pane under Security, click IP Sets. Then, click NEW.
   5. In the Edit IP Set window, enter the name of the IP set and add the IP address to use. Then, click Save.
2. Add the firewall rule.
   1. Under the Services section, click the Firewall tab and click EDIT RULES. Then, click NEW ON TOP to add a firewall rule.
   2. Add the IP addresses or range from your internal network to the Source field.
   3. Add the IP set in the Destination field.
   4. Select Allow in the Action field.
   5. Click Save.

After the previous configuration is completed, you can use the supported IBM Cloud services on the VMs in your virtual data center.

If your vApp or VM is deployed from the IBM templates that are provided in the public catalog, the services are already configured on the VM. To enable the connection, you must complete the previous steps in Adding the NAT rule and Adding the firewall rule.