NSX-T与Horizon 7设计指南：构筑安全的云桌面架构

需积分: 0 113 浏览量更新于2024-06-21 收藏 4.95MB PDF 举报

本指南是VMware NSXT End User Computing (NSX-T) 设计指南的第1.0版本，专注于NSX-T与Horizon 7.9 Data Center环境的集成设计。NSX-T是VMware的下一代软件定义网络和安全平台，而Horizon则是其统一接入管理和虚拟桌面基础设施(VDI)解决方案。该文档旨在为IT专业人士提供详细的指导，帮助他们理解如何在NSX-T环境中优化和部署Horizon服务，确保高效、安全的用户体验。 **1. 目标受众** 本指南主要针对负责设计、实施和管理NSX-T与Horizon集成的网络和安全架构的系统管理员、网络工程师和安全专家。它适合那些希望利用NSX-T的强大功能来提升企业网络性能、微分段安全以及优化VDI环境的团队。 **2. 引言** - **Horizon 7参考架构**：指南首先概述了Horizon 7的架构，强调其组件和部署模型，以便读者理解基础环境。 - **NSX-T设计指南**：接着介绍了NSX-T的核心原则和设计思想，确保读者对其在整体架构中的角色有清晰的认识。 **3. NSX-T与Horizon架构及组件** - **NSX-T组件定义**：这部分详细解释了NSX-T的架构，包括控制器、分布式防火墙、逻辑网关等，以及它们如何协同工作以支持Horizon。 - **Horizon核心组件定义**：讲解了Horizon的Pod和Block结构，以及它们在NSX-T网络中的定位。 **4. NSX-T与Horizon用例** - 通过实际场景，展示了NSX-T如何应用于不同类型的VDI场景，如远程办公、混合云环境等，以满足多样化的需求。 **5. NSX-T对Horizon的功能支持** - **虚拟网络**：NSX-T提供了灵活的虚拟网络解决方案，包括逻辑视图的设计，确保桌面流量的安全和性能。 - **安全**： - **微分段**：Context Micro-segmentation被用来加强虚拟桌面之间的隔离和安全性。 - **分布式防火墙**：包括策略定义、连接策略和执行机制，确保细粒度的安全控制。 - **身份防火墙**：基于用户和组的身份进行访问控制。 - **安全消费**：指南说明如何有效地利用NSX-T的安全功能来满足企业安全策略。 - **边缘服务**：NSX-T Gateway Routing和负载均衡技术在提供高速、可靠的服务时发挥关键作用。 **6. NSX-T边缘和合作伙伴服务** 这部分深入探讨了NSX-T如何与其他服务和外部合作伙伴集成，以实现无缝的网络和安全扩展。 NSXT-EUC-DESIGN-GUIDE-v1.0提供了全面的指导，让IT团队能够根据VMware NSX-T和Horizon 7.9的特性，设计出适应现代企业需求的高效、安全的网络架构。无论是网络配置、安全策略还是服务优化，这份指南都是不可或缺的参考资料。

NSX-T End User Computing Design Guide

NSX-T provides contextual security solutions for micro-segmentation of Horizon VDI workloads by providing granular Layer 2 through

Layer 7 firewalling capabilities between workload VMs and also providing user-based context for VDI and Remote Desktop Session

Host (RDSH) workloads.

• Edge and Partner Services

NSX-T provides software solutions for Equal Cost Multipath (ECMP), NAT, SSL-Offloading, DHCP Relay, Gateway Firewalling and

Routing, and Load Balancing for the Horizon infrastructure and the workloads Horizon manages and deploys. NSX-T also provides the

Guest and Network Introspection platform for 3

party partners to inject their services such as IDS/IPS, agent-less Anti-

Virus/Malware, and Next-generation Firewalling capabilities.

• Network Virtualization

NSX-T provides core networking services in software (e.g., switching and routing) that can be automatically provisioned to create

various topologies. This allows for elastic spin up of new desktop pools or expansion of pools in an existing infrastructure. Network

virtualization is also a key tenant of micro-segmentation, enabling the rapid provisioning of isolated network segments.

5. NSX-T Features for Horizon

NSX-T provides network virtualization capabilities using industry standard GENEVE encapsulated overlay networks. This section

examines design considerations for a logical topology deployment of Horizon on an overlay network. It covers deploying both the

Horizon infrastructure components and Horizon desktop pools connected to overlays created by NSX. Network virtualization requires a

basic understanding of how switching and routing are done with NSX-T. Below are the components associated with NSX-T network

virtualization and how they can be used together in a Horizon design.

• NSX-T Logical Routing

NSX-T provides capabilities to interconnect both physical and virtual workloads in different logical Layer 2 networks. NSX-T does this

using software to create these logical constructs and embeds them into the hypervisor layers, abstracted from the physical

hardware. Since these network elements are logical entities, multiple logical routers can be created in an automated and agile

fashion. NSX-T routing is instantiated for East/West traffic flows in a distributed manner within each hypervisor. NSX-T routing is

instantiated for North/South traffic flows in a centralized manager within the NSX-T Edge Node.

• NSX-T Two-Tier Routing

In addition to providing optimized distributed and centralized routing functions, NSX-T supports a multi-tiered routing model with

logical separation between provider router function and tenant routing function. The concept of multi-tenancy is built into the

routing model. The top-tier logical router is referred to as tier-0 while the bottom-tier logical router is tier-1. This structure gives both

provider and tenant administrators complete control over their services and policies. The provider administrator controls and

configures tier-0 routing and services, while the tenant administrators control and configure tier-1. Configuring two tier routing is not

mandatory and NSX-T Segments can be attached to the Tier-0 Gateway just like they can with a Tier-1 Gateway.

• NSX-T Segment

The NSX Segment is virtual Layer 2 broadcast domain. Segments are created and attached to a Transport Zone. The span of a

Segment is defined by the Transport Zone. An NSX-T Segment can either be a type Overlay or VLAN and inherits the type from the

Transport Zone of which it’s attached. It can be associated with a network subnet and its default gateway is typically the tier-0 or

tier-1 logical NSX-T router. A VLAN Segment represents a software extension of a physical layer 2 broadcast domain into the

virtualized environment. The subnet ID of the underlying physical network is associated with the VLAN Segment, and the default

gateway is typically the physical router that already provides the gateway in the underlay network.

NSX-T End User Computing Design Guide

NSX-T provides several security benefits to enhance an existing or new Horizon deployment for the Horizon infrastructure machines,

RDSH Farms and VDI desktops pools. In a virtual desktop infrastructure, it is difficult to provide security at a granular level be it, user-

based, application-based, or function-based. NSX helps secure desktop pools and allow communications as necessary based on the

context of the communication, to applications that should be allowed, and denies the rest. NSX-T is able to provide this level of

security by using a concept called Context-aware micro-segmentation.

Context-aware micro-segmentation provides three foundational security capabilities: Isolation, Segmentation, and Advanced Services.

• Network Isolation

Isolation is the foundation of most network security, whether for compliance, containment, or separation of distinct operational

environments. Manually configured and maintained routing, ACLs, and firewall rules on physical devices have traditionally been used to

establish and enforce isolation and multi-tenancy. These properties are now inherent to network virtualization. Virtual networks (e.g.,

leveraging GENEVE technology) are isolated from other virtual networks as well as from the underlying physical infrastructure by

default, delivering the security principle of least privilege. Virtual networks are created in isolation and remain isolated unless

specifically connected. No physical subnets, VLANs, ACLs, or firewall rules are required to enable this isolation.

Figure 8 - Micro-segmentation Isolation Concept

Any isolated virtual network can be made up of workloads distributed anywhere in the data center. Workloads in the same virtual

network can reside on the same or separate hypervisors. Additionally, workloads in several multiple isolated virtual networks can

reside on the same hypervisor. Isolation between virtual networks allows for overlapping IP addresses. This makes it possible to have

isolated development, test, and production virtual networks - each with different application versions but with the same IP addresses -

all operating at the same time and on the same underlying physical infrastructure. Virtual networks are also isolated from the

underlying physical network. Since traffic between hypervisors is encapsulated, physical network devices operate in a distinct address

space from the workloads connected to the virtual networks. A virtual network could support IPv6 application workloads on top of an

剩余63页未读，继续阅读

routetable

粉丝: 0
资源: 6

NSX-T与Horizon 7设计指南：构筑安全的云桌面架构

Python库 | library_nsxt-1.0.8.post12-py3-none-any.whl

基于Matlab面板版的卡尔曼小球运动跟踪[Matlab面板版].zip

Day01(1).py

面试-PHP高频面试题整理-面试题合集.zip

(最新整理)中国企业OFDI微观数据2005-2022年

毕业设计论文SpringBoot+Vue茶叶销售系统.docx

用于计算贴片天线的基本参数matlab代码.rar

毕业设计论文SpringBoot+Vue二手书籍交易系统.docx

毕业设计论文SpringBoot+Vue电子印章管理系统.docx

HTML5响应式黑白博客文章类模_网站整站打包下载.zip

最新资源