I have used VLC to deploy nested VCF for a long time and I am quite happy with how it works. VLC is usually deployed to a VLAN Trunk Port Group. This requires the VLANs used in the nested VCF to be configured on the physical switches in the environment. This does not scale well, and it is hard to automate. By following the steps below we are able to deploy VLC to an NSX-T Overlay Segment which allows each VFC instance to be isolated on their own layer 2 network. NSX-T Overlay Segments can be deployed automatically and they don’t require any changes to the physical network. This also allows us to use overlapping IP addressing between them. I have not yet tested to connect my Segment to a Tier-1 Gateway so that the nested VCF can connect to any external networks, but I plan to do this soon and update this post.
The following configuration needs to be done on the hosting NSX-T environment.
IP Discovery Profile
|Duplicate IP Detection||Disabled|
|ARP Binding Limit||256|
|ND Snooping Limit||3|
|ARP ND Binding Limit Timeout||10|
|Trust on First Use||Enabled|
|DHCP Snooping – IPv6||Disabled|
|VMware Tools – IPv6||Disabled|
MAC Discovery Profile
|MAC Learning Aging Time||600|
|MAC Limit Policy||Allow|
|Unknown Unicast Flooding||Enabled|
Segment Security Profile
|BPDU Filter Allow List||Not Set|
|Server Block – IPv6||Disabled|
|Non-IP Traffic Block||Disabled|
|Client Block – IPv6||Disabled|
Jump Host Configuration
To deploy VLC we need a jump host with two network adapters, one connected to your management network so that we can access it with RDP, and one connected to the nested environment so that we can connect to the nested appliances there. More details on this can be found in the VLC installation guide.
Jump Host 01
|OS||Windows Server 2019|
VLAN: 10 (Tagged in Guest OS)
|Static Routes||For example: route ADD 10.50.0.0 MASK 255.255.255.0 10.0.0.221|
|Powershell Policy||Set-ExecutionPolicy Unrestricted|
|ESXi Host Configuration||C:\VLC\conf\default_mgmt_hosthw.json|
|Licenses||Must be added to NOLIC-44-TMM-vcf-ems-public.json|
|MTU||1700 (can probably be increased to 8800 or more)|
The following changes need to be done to the default VLCGui.ps1 to make it work with NSX-T.
Changed the following to be able to select NSX-T Segments:
Changed the following to get 1500 bytes MTU on vSwitch0:
Added the following to recreate vmk0 so that it gets a unique MAC address:
Change the MAC Address of NSX-T Virtual Distributed Router
You must change the default MAC address of the NSX-T virtual distributed router in the nested VCF deployment so that it does not use the same MAC address that is used by the hosting NSX-T virtual distributed router.
An alternative is to configure the hosting NSX-T environment’s Overlay Transport Zone with the nested_nsx property set to true, but this has to be done when creating the Transport Zone.
Thanks to Ben Sier for helping me getting this to work.