VMWare Hub Deployment Guide

docs/_deploy_vmware_hub_router_network_design.md

@@ -0,0 +1,23 @@
+<!--- VMware Router Deployment Guide - Network Design Reference --->
+
+The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network.
+
+| Parameter | Example Value | Description |
+|-----------|--------------|-------------|
+| Authority Name | `Authority128` | Organizational authority name |
+| Conductor Name | `Conductor` | Pre-existing conductor system name |
+| Conductor IP Address | `192.168.100.10` | Conductor IP — must be reachable from the router WAN |
+| Router Name | `Hub1` | VMware router system name |
+| Router Node Name | `node0` | Router node name |
+| Router Asset ID | `Hub1` | Asset ID reported after initialization; see [Step 2](deploy_vmware_hub_router_install.mdx#set-the-asset-id)  |
+| WAN Device Interface | `wan-dev` | WAN device interface name |
+| WAN Network Interface | `wan1` | WAN network interface name |
+| WAN PCI Address | _(discovered in [Step 3](deploy_vmware_hub_router_pci.mdx))_ | VMXNet3 WAN NIC PCI address |
+| LAN Device Interface | `lan-dev` | LAN device interface name |
+| LAN Network Interface | `lan1` | LAN network interface name |
+| LAN PCI Address | _(discovered in [Step 3](deploy_vmware_hub_router_pci.mdx))_ | VMXNet3 LAN NIC PCI address |
+| Router LAN IP Address | `192.168.1.1/24` | LAN gateway address |
+| Tenant Name | `corp` | LAN-side user tenant |
+| Service Name | `Internet-Traffic` | Internet breakout service |
+| Service Address | `0.0.0.0/0` | All internet-bound traffic |
+| Neighborhood | `internet` | SVR neighborhood name |

docs/_vmware_router_find_pci.md

@@ -22,5 +22,5 @@ The SSR router configuration requires the PCI address of each VMXNet3 NIC. Becau
    | LAN (`lan-dev`) | `ge-0-1` _(example)_ | `0000:13:00.0` _(example)_ |
 
    :::important
-   These are example values. Your actual PCI addresses will differ. Use the values you discover here in [Step 4 — Configure the Router on the Conductor](deploy_vmware_router_config.mdx).
+   These are example values. Your device names and PCI addresses will differ. Use the values you discover here when you configure the router on the conductor.
    :::

docs/_vmware_router_vm_create_hub.md

@@ -0,0 +1,132 @@
+<!--- VMware ESXi VM Creation for SSR Hub Router ---> 
+
+## Log In to VMware ESXi
+
+Open a web browser and navigate to your ESXi host. Log in with administrative credentials.
+
+   ![VMware ESXi Login](/img/vmware_login.png)
+
+## Upload the SSR ISO to the Datastore
+
+1. From the ESXi Navigator, select **Storage**.
+
+   ![Storage](/img/dep-vmware-router-uploadssr1.png)
+
+2. Click the **Datastore Browser** button.
+
+   ![Datastore Browser](/img/dep-vmware-router-uploadssr2.png)
+
+3. Click **Upload**, navigate to the SSR 7.1.4-3r2 ISO on your local workstation, and click **Open**. The ISO appears in the datastore.
+
+   ![Upload SSR Software](/img/dep-vmware-router-uploadssr3.png)
+
+4. Click **Close**. 
+
+## Create the Virtual Machine
+
+1. From the VMWare Navigator window, click on **Create/Register VM**.
+
+   ![Create VM](/img/dep1-vm-create-vm.png)
+
+2. In the **Select creation type** window click **Create a new virtual machine** and then click **Next**.
+
+   ![VM Type](/img/dep2-vm-creation-type.png)
+
+### Name and Guest OS
+
+Use the steps below to configure the following:
+
+   | Field | Value |
+   |-------|-------|
+   | Name | A descriptive name, for example `Hub1` |
+   | Compatibility | `ESXi 7.0 U2 virtual machine` |
+   | Guest OS family | `Linux` |
+   | Guest OS version | Select the highest available Oracle Linux (64-bit) version |
+
+3. Name the Virtual Machine **Hub1**.  
+
+4. Select **Linux** from the Guest OS family dropdown selection.
+
+5. Select the highest available Oracle Linux (64-bit) Guest OS version. Click **Next**.
+
+   ![Name the VM](/img/dep3-vmrouter-hub-name-os.png)
+
+### Storage
+
+6. From the Storage screen, select **datastore1** and click **Next**. 
+
+   ![VM Storage](/img/dep4-vm-storage.png)
+
+### Virtual Hardware
+
+7. On the **Customize settings** screen, click **Virtual Hardware** and configure the following settings. 
+
+  These values meet the minimum router requirements:
+
+   | Setting | Value | Notes |
+   |---------|-------|-------|
+   | CPUs | `8` | Minimum |
+   | Hardware virtualization | Select (checkbox) **Expose hardware assisited virtualization to the guest OS** | Set under CPU → expand |
+   | Memory | `64 GB` | Minimum |
+   | Hard Disk 1 | `256 GB` | Minimum |
+   | SCSI Controller 0 | `VMware Paravirtual` | |
+
+   ![Storage Parameters](/img/dep5-vmrouter-params.png)
+
+### Boot Settings
+
+8. Click the **VM Options** tab.
+
+   ![VM Options](/img/vmware_vmoptions1.png)
+
+9. Expand **Boot Options**.
+
+10.  In the Firmware field, choose **BIOS** from the drop down. 
+
+    ![Boot Options](/img/vmware_router_vmoptions2.png)
+
+11. Click **Next**.
+
+### Network Adapters
+
+A VMware router requires at least two VMXNet3 network adapters: one for WAN and one for LAN. By default, one adapter is already in place. For the Hub router, we will create three additional network adapters, which will allow it to connect to multiple branch/spoke routers.
+
+   ![Network Adapter Type](/img/dep6-vmrouter-hub-4nics.png)
+
+12. Set the existing adapter's **Adapter Type** to **VMXNET3** and select the appropriate **portgroup** name for the virtual network that will provide access to your WAN.
+
+13. Click **Add network adapter** to add a second adapter. Set its **Adapter Type** to **VMXNET3** and select the appropriate **portgroup** name for the virtual network that will provide access to your LAN.
+
+   Repeat this step two more times to create a total of four network interfaces. 
+
+   :::note
+   If you need help creating portgroups and connecting them to your appropriate infrastructure, please consult your VMWare documentation.
+   :::
+
+   ![Add Network Adapter](/img/dep6-vmrouter-nics2.png)
+
+   :::note
+   The order of the adapters (NIC 1 = WAN, NIC 2 = LAN) corresponds to the PCI addresses you will identify in [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx). 
+
+   Need to add information here for the other two NICs
+   :::
+
+### CD/DVD Media - Software Selection
+
+14. Expand **CD/DVD Drive 1**. 
+
+   ![CD Drive 1](/img/dep-vmrouter-hub-image-select.png)
+
+15. Place a check next to **Connect at power on**. In the dropdown to the right, select **Datastore ISO file** and then click **Browse**. The Datastore Browser opens.
+
+16. Select the `SSR-7.1.4-3.r2.el9.x86_64.ibu-v1.iso` and click **Select**.
+
+   ![CD ISO Selected](/img/dep7-vm-selectversion.png)
+
+17. Confirm the settings, and then click **Next**.
+
+   ![Confirm Settings](/img/dep8-vm-hub-all-settings.png) 
+
+18. Review the summary, then click **Finish**.
+
+   ![VM Complete](/img/dep9-vmrouter-hub-summary.png)

docs/deploy_appendix_vmware_hub_router.mdx

@@ -0,0 +1,216 @@
+---
+title: "Appendix: VMware Hub Router Configuration"
+sidebar_label: "Appendix: VMware Hub Router Configuration"
+---
+import NetworkDesign from './_deploy_vmware_hub_router_network_design.md';
+
+This appendix contains the complete SSR PCLI configuration for the `Hub1` VMware router described in this guide. This configuration reflects the final state after completing all steps through [Step 4 — Configure the Router on the Conductor](deploy_vmware_router_config.mdx).
+
+:::important
+This appendix uses **example** PCI addresses (`0000:0b:00.0` for WAN, `0000:13:00.0` for LAN). Replace these with the actual values discovered in [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx).
+:::
+
+## Network Design Reference
+
+<NetworkDesign/>
+
+## Applying This Configuration
+
+This configuration can be applied to the conductor using the PCLI import function.
+
+1. Save the router configuration block below to a file — for example, `vmware-router-Hub1.cfg`.
+
+2. Copy the file to the conductor:
+
+   ```
+   scp vmware-router-Hub1.cfg admin@192.168.100.10:/tmp/
+   ```
+
+3. Log in to the conductor PCLI:
+
+   ```
+   ssh admin@192.168.100.10
+   ```
+
+4. Enter configuration mode and import:
+
+   ```
+   admin@node0.conductor1# import config /tmp/vmware-router-Hub1.cfg
+   ```
+
+5. Review any validation warnings, then commit:
+
+   ```
+   admin@node0.conductor1 (config)# commit
+   Are you sure you want to commit the candidate config? [y/N]: y
+   ```
+
+Alternatively, copy and paste each block into the PCLI while in `configure` → `edit` mode.
+
+:::note
+The authority-level objects this router depends on (`Internet-Traffic` service, `corp` tenant, and conductor address) must already exist in the running configuration. For the complete authority-level configuration, see [Appendix — VMWare Conductor Configuration](deploy_appendix_vmware_conductor.mdx).
+:::
+
+## Router Configuration
+
+![Hub and Spoke Config diagram](/img/dep-vmware-router-hub-spoke.png))
+
+The following block shows the `Hub1` router configuration as it appears within the authority configuration.
+
+```
+config
+
+    authority
+        conductor-address  10.0.0.63
+
+
+
+        router             Conductor
+            name                  Conductor
+            location-coordinates  +38.7127105-077.0060152/
+
+            node                  node0
+                name           node0
+                asset-id       Conductor
+                platform-type  "440BX Desktop Reference Platform"
+            exit
+        exit
+
+        router             hub1
+            name                  hub1
+            location-coordinates  +40.741895-073.989308/
+            inter-node-security   internal
+
+            node                  node0
+                name              node0
+                asset-id          Hub1
+                role              combo
+                platform-type     "440BX Desktop Reference Platform"
+
+                device-interface  wan-dev
+                    name               wan-dev
+                    pci-address        0000:0b:00.0
+
+                    network-interface  wan1
+                        name                   wan1
+                        global-id              3
+                        conductor              true
+                        default-route          true
+
+                        neighborhood           internet
+                            name      internet
+                            topology  hub
+                        exit
+                        inter-router-security  internal
+                        source-nat             true
+                        management             true
+
+                        management-vector
+                            name      mgmt-vec-wan
+                            priority  100
+                        exit
+
+                        address                10.0.128.128
+                            ip-address     10.0.128.128
+                            prefix-length  16
+                            gateway        10.0.0.127
+
+                            host-service   web
+                                service-type   web
+                            exit
+                        exit
+                        dhcp                   disabled
+                    exit
+                exit
+
+                device-interface  lan
+                    name               lan
+                    pci-address        0000:13:00.0
+
+                    network-interface  lan
+                        name        lan
+                        global-id   4
+                        tenant      corp
+                        source-nat  true
+
+                        address     192.168.2.1
+                            ip-address     192.168.2.1
+                            prefix-length  24
+
+                            host-service   dhcp-server
+                                service-type  dhcp-server
+
+                                address-pool  192.168.2.2
+                                    start-address  192.168.2.2
+                                    end-address    192.168.2.20
+                                    router         192.168.2.1
+                                    domain-server  8.8.8.8
+                                exit
+                            exit
+                        exit
+                        dhcp        disabled
+                    exit
+                exit
+            exit
+
+            service-route         internet-route
+                name          internet-route
+                service-name  Internet-Traffic
+
+                next-hop      node0 wan1
+                    node-name   node0
+                    interface   wan1
+                    gateway-ip  10.0.0.1
+                exit
+            exit
+        exit
+
+        tenant             corp
+            name  corp
+        exit
+
+
+
+        software-access
+            username  (removed)
+            token     (removed)
+        exit
+
+        service            internet
+            name      internet
+            security  internal
+        exit
+
+        service            Internet-Traffic
+            name           Internet-Traffic
+            address        0.0.0.0/0
+
+            access-policy  corp
+                source  corp
+            exit
+        exit
+    exit
+exit
+
+```
+
+## Interface Summary
+
+| Interface | Device Interface | PCI Address | Type | Configuration |
+|-----------|-----------------|-------------|------|---------------|
+| `wan1` | `wan-dev` | `0000:0b:00.0` _(example)_ | External | DHCP, conductor, default-route, source-nat, management, neighborhood `internet` |
+| `lan1` | `lan-dev` | `0000:13:00.0` _(example)_ | External | tenant `corp`, static `192.168.1.1/24` |
+
+## Service Route Summary
+
+| Service Route | Service | Type | Next Hop |
+|--------------|---------|------|---------|
+| `internet-route` | `Internet-Traffic` | `service-agent` | `node0 / wan1` |
+
+## Design Notes
+
+**Management over Forwarding** — The `wan1` interface carries both internet traffic and conductor management sessions simultaneously. Management traffic from the `169.254.x.x` range is source-NAT'd to the WAN DHCP address before leaving the interface. This eliminates the need for a separate out-of-band management network at the branch site.
+
+**Internet Breakout** — The `internet-route` service route directs all `corp`-tenant traffic matching the `Internet-Traffic` service (destination `0.0.0.0/0`) out through `wan1` as a service-agent. The source NAT setting on `wan1` ensures LAN client traffic is translated to the WAN IP before it reaches the ISP.
+
+**PCI Address Binding** — VMware assigns PCI addresses based on the VM's hardware slot configuration. The example addresses in this appendix (`0000:0b:00.0`, `0000:13:00.0`) are illustrative only. Always use the values discovered by following [Step 3 — Find VM NIC PCI Addresses](deploy_vmware_router_pci.mdx).

docs/deploy_appendix_vmware_router.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Appendix: VMware Router Configuration"
-sidebar_label: "Appendix: VMware Router Config"
+sidebar_label: "Appendix: VMware Router Configuration"
 ---
 import NetworkDesign from './_deploy_vmware_router_network_design.md';
 
@@ -78,7 +78,7 @@ config
 
         router             spoke1
             name                  spoke1
-            location-coordinates  +40.741895-073.989308/
+            location-coordinates  +34.7127281-118.0060152/
             inter-node-security   internal
 
             node                  node0