Category: vRNI

How to Integrate vRNI with VMC

In this blog post, we’ll see how to integrate VMC (VMware Cloud on AWS) instance to vRNI as a data source.

Supported Versions:

  • vRNI 4.0
  • VMC Datacenter with build version above M5P2 

Process:

  • Step1: Open all required firewall rules
  • Step2: Create required permissions / CSP refresh token
  • Step3: Add VMC vCenter : Login to vRNI –> Settings –> Accounts and Data sources –> Add Source –> Under Public Clouds –> Select “VMware Cloud on AWS(vCenter)
  • Step4: Provide IP Address of the VMC vCenter & Cloud admin credentials –> Click on Validate
  • Step5: After successful validation –> Provide Nickname(For identification) and Click Submit
  • Step6: Add VMC NSX manager: Login to vRNI –> Settings –> Accounts and Data sources –> Add Source –> Under Public Clouds –> Select “VMware Cloud on AWS(NSX Manager)
  • Step7: Select VMC vCenter and Collector: Enter IP address of the NSX manager and put CSP Refresh token– > Click Submit
  • Step8: Allow few hours (usually 24 hours) to collect data from VMC vCenter and NSX manager

References – Documentation Links:

  • Adding VMC vCenter as a Data Source: https://docs.vmware.com/en/VMware-vRealize-Network-Insight/4.0/com.vmware.vrni.using.doc/GUID-5644520F-3D7B-40EA-8CFD-B1D8F98C0C0B.html

How to Get vCenter IP and credentials for vRNI

Login to VMC : https://vmc.vmware.com

Welcorne to 
VMware Cloud Services

Select VMware Cloud on AWS

Select your desired SDDC (Incase you have more than 1)

AWS 
Software-Defined Data Centers (SDDC) 
83 GHz 
512 GB 
Storage 
10 TB 
SXT 
83 GHz 
Mem 
512

Click on Settings to get IP address & Credentials:

PRD-NSXT-M5P2-
  • Adding VMC NSX Manager as a Data Source: https://docs.vmware.com/en/VMware-vRealize-Network-Insight/4.0/com.vmware.vrni.using.doc/GUID-324354BB-6292-4F6E-A65C-8275097D0A7A.html

Deployment considerations:

vRealize Network Insight supports the following deployment models for VMC: 

  • Collector deployed in VMC: 
    1. In this deployment model, the collector is deployed as a workload in Compute Gateway in VMC. The platform is deployed in the SDDC on-premises version. 
    2. The firewall rules of Management Gateway allow communication to VMC vCenter and VMC NSX Manager over HTTPS. 
    3. The collector communicates to the platform using the existing communication mechanisms over VPN or Direct Connect. 
  • Collector and Platform deployed in the SDDC on-premises version 
    1. In this deployment model, the collector and the platform are deployed in the SDDC on-premises version. 
    2. The firewall rules of Management Gateway allow communication to vCenter and policy using HTTPS over VPN. 
    3. The VPN connectivity between SDDC (on-premises or SaaS version) and VMC allows data to be fetched by the collector. 

The prerequisites for the above deployment models are: 

  • There should be connectivity between the platform or collector (on-premises) and VMC SDDC. It could either be over VPN or DX if the vRealize Network Insight installation is in the private SDDC. In case of the SaaS version, the standard connectivity mechanism between the platform and the collector is sufficient. 
  • There should be a Management Gateway firewall rule to allow the vRealize Network Insight collector to invoke vCenter and NSX Manager APIs over HTTPS (443). 
  • There should be a Compute Gateway rule within the gateway firewall to allow the collector to communicate with the on-premises Platform or the SaaS platform. 

Note:

  • For a single node SDDC in VMC, you should set the CPU resource reservation for the proxy VM to 1251 MHz. Currently, the proxy OVA delivered as a part of the release has the resource reservation set to 2048 MHz. After importing this OVA in the SDDC vCenter, you have to modify the settings of the proxy VM to use the maximum allowed CPU reservation of 1251 MHz.



Introduction to vRealize Network Insight

VMware vRealize Network Insight is a Security planning, Network visualization & debugging tool especially designed for SDDC & NSX.

I would recommend all NSX users to deploy & try vRNI for better visibility and security planning.

Top Use-cases:

  • Micro-segmentation Planning: Identify network segments and flows between them, get firewall rules recommendations
  • 360 Visibility & Troubleshooting: Unify troubleshooting across the virtual and physical infrastructure
  • Manage & Scale NSX: Scale across multiple NSX Managers with powerful visualizations for topology and health

Key Features:

  • Google like Natural language search
  • East-West traffic analytics (Server to Sever Internal Traffic)
  • Visualize VXLAN to VLAN logical path mappings

Short Overview Video:

 

Resources & Links:

In the next article, we will see how we can use vRNI for micro segmentation planning and security.

 

 

vRealize Network Insight useful Search Queries

Flow Related Queries

Show VMs per L2 segment (can restrict with where vlan = xyz). Replace vlan with vxlan if using logical switches.

vm by vlan where vlan = “xyz”

Show a list of VMs with their gateway, network, VLAN etc:

L2 Network , vlan, ip address, default gateway of vms

Search a MAC address or IP address. Just type the address into the search bar.

00:50:56:a6:31:cc

Show me all network traffic going to the internet

flows where Flow Type = 'Src is VM' and Flow Type = 'Dst is Internet' by bytes

Show me all network traffic out to the internet but total bytes:

sum(bytes) of flows where Flow Type = 'Src is VM' and Flow Type = 'Dst is Internet'

Show me all network traffic going to physical

flows where Flow Type = 'VM-Physical' by bytes

Show me the same thing, but totals:

sum(total bytes) of flow where Flow Type = 'VM-Physical'

Say you have two data centres (separate vCenter per site). Show me traffic totals between them (i.e. DCI link utilisation)

sum(bytes) of flows where (Dst Manager = 'abc' AND src manager = 'cba') OR (Dst Manager = 'cba' AND src manager = 'abc')

Total amount of VTEP traffic:

sum(bytes) of flows where Flow Type = 'Src is VTEP' or flow type = 'Dst is VTEP'

VTEP traffic grouped by VMkernel IP (Can’t see this in the vRNI demo labs – has to be in a real life lab):

sum(bytes) of flows where Flow Type = 'Src is VTEP' or flow type = 'Dst is VTEP' group by src ip

Show internet traffic totals for every src IP

sum(bytes) of flows where Flow Type = Internet' group by src ip

Series of 3 days where each point is an aggregate of 2 hours (7200 seconds) of metrics. The aggregate function being applied is supplied in the query – max, sum etc.

series(max(byte rate), 7200) of flows where flow type = 'Src is Physical' and flow type = 'Dst is Internet' in last 3 days

Find switch-ports or router-interface having packet drops

show Max Packet Drops, total packet drop ratio, network Rate of Switch Ports by Total Packet Drop Ratio

Network rate of all hosts (ordered by the highest)

network rate of host order by Max Network Rate

Show total flows grouped by ports

sum(bytes) of flow group by port

Look at Internet flows grouped by port with traffic totals:

sum(bytes) of flows where Traffic Type = 'INTERNET_TRAFFIC' group by port

Information about VMs

Show which network segments have the highest VM count:

vm group by l2 network

Which datastores have highest VM count:

vm group by datastore

ESX Host Information

Show me a list vSphere versions installed in the environment and a total of hosts:

host group by version

Show me a list of vSphere builds and how many hosts they have:

host group by OS

Show me hosts with how many VMs they contain:

vm group by host

Firewall rules

Show rules which have an any source (can combine with specific port if you like)

vm where incoming rules.Source Any

Show VMs with an affected rule of xyz

vm where Firewall Rule = 'Prod MidTier to Prod DB - DBService'

Show firewall rules where any port is allowed

firewall rule where action = allow and service any = true

Not operator:

!=

Not like

Aggregations:

max(byte rate) of flows

sum(total bytes)

sum(bytes)

avg(CPU Usage Rate), avg(memory utilization) of VMs

Troubleshooting

Show which VNIs my controllers are responsible for:

controller of Vxlan group by controller

Which controller is responsible for my Prod-Midtier segment?

Primary Controller of Vxlan 'Prod-Midtier'

Where is my Prod-Midtier-1 VM and what info do I want to know about it (i.e. MAC, IP, host it’s on)?

mac address, ip, vxlan, host of vm 'Prod-Midtier-1'

Show routes for Provider edge 3:

routes where vrf = 'Provider Edge 3'

Show routes of DMZ DLR:

routes where VRF = 'LDR-DMZ'