Adding a VMware Cloud on AWS SDDC to an Egress VPC (Part 2)
Gilles Chekroun
Lab Setup
Similarly to the setup in Part 1, I will now connect an SDDC with VPN to the TGW like this:
Generic considerations
- Since we want the SDDC internet access via the Egress VPC for Security reasons, we will need a global 0.0.0.0/0 route on the VPN.
- That's now basically cutting the SDDC IGW access. Because of that, we will need to take care of 2 things:
- How to access vCenter if we don't have internet on the SDDC?
- How do we resolve DNS ?
Point 1
For vCenter access I decided to use the SDDC attached VPC via the ENI and deploy a Windows JumpHost there. The attached VPC has its own Internet Gateway.
The vCenter resolution will now need to be changed to "Private IP" as described below:
Point 2
The DNS default for CGW and MGW is set to 8.8.8.8 and 8.8.4.4. This needs to be fixed because we don't have access to public DNS anymore.
Our only way out of the SDDC is VPN to TGW and ENI to the attached VPC and here, we have the capability to use the embedded VPC DNS at the reserved IP address CIDR+2.
The IP address of the VPC DNS server is the reserved IP address at the base of the VPC IPv4 network range plus two
Make sure the attached VPC has DNS Resolution enabled.
Set the SDDC System DNS to the Attached VPC CIDR + 2Create a new TGW attachment as VPN.
TGW new Route Table
Having this global static route, it will be advertised to the SDDC via BGP on our VPN tunnels. Let's check that.
Egress VPC public route tables
Egress VPC attachment route table
- SSH to the JumpHost
- SSH to the Ubuntu VM (192.168.1.5)
- Ping any external address like amazon.com
- Traceroute the same address and verify the we go via one of the NAT Gateways
Hello Gilles,
ReplyDeleteThank you for the great post. I'm in the process of designing SDDC. Am I able to route internet traffic via vTGW to my existing VPC and IGW? instead of using VPN to AWS TGW.
Good question and today it’s not possible but this feature will be available soon. We need to be able to program a static 0.0.0.0/0 route pointing to the egress VPC to do that. Soon ....
Delete