r/vmware • u/GabesVirtualWorld • 3d ago

Question Design - placement of Operations Manager

Currently for VCF 9.1 my design for the management domain, separates the base components from Operations Manager. So, NSX, vCenter, SDDC and VCF Management Services are in VLAN A and I had planned to put Operations Manager in VLAN B and Automation in VLAN C. Everything between the VLANs is blocked by firewalls initially.

The idea is that Operations Manager will have a lot of connections to other systems for monitoring, 20+ vCenters including remote vCenters and therefore it (in my opinion) would be easier to control all the flows instead of setting everything in VLAN A and mixing it with the real heart of VCF.

Since future vCloud tenants are going to Automation eventually, I think that Automation at least should have its dedicated VLAN.

Yet, the further I get in this design, the more I'm wondering if I'm just creating security by obscurity separating Operations Manager from the "base" components. Love to have your ideas on it.

1 Upvotes

60% Upvoted

5 comments sorted by

2

u/spenceee85 3d ago

Did you mean Vlan?

If this is a greenfield design you should be targetting nsx segments to host things. If security is a concern, implementing nsx firewalls to protect the components.

1

u/GabesVirtualWorld 3d ago

u/spenceee85 Yes VLANs, our management domain currently can't go to higher MTU size, so no VXLAN, just plain NSX with VLANs.

1

u/spenceee85 3d ago

You cant make a new vlan for the overlay to run on at 1700? The benefit you will get from setting up an overlay network will be infinitely more useful than any pain to establish a vlan with a higher mtu. Dont confuse the overlay network's mtu requirement with your bgp /bfd routing

1

u/GabesVirtualWorld 3d ago

u/spenceee85 well, partly we also don't want to. This is a small out of band cluster where nothing except the management domain will be running. Network team wants to keep visibility up to into the VMs and we're doing everything on Cisco VXLAN and I don't want to bridge that just to have two segments on NSX for a few VMs.

All workload domains are on completely different network / storage / hardware and there I do have the options.

1

u/spenceee85 3d ago

So vxlan does have a substantial integration into nsx.

As it relates to vcf appliances (ops, networks, automation) particular if you have 20 workloads (vcenters) to manage and monitor, having nsx available is still a very good choice and will provide a lot of flexibility and security.

You should be using it on the workloads and having it available to your management domain will help. I will let someone with more cisco experience talk to the evpn integration beyond saying nsx is more powerful and useful than it may first look, particularly if you have a strong cisco stack.