Fortinet black logo

New Features

SDN Connector - VMware ESXi

Copy Link
Copy Doc ID 761d83e3-4a7b-11e9-94bf-00505692583a:111376
Download PDF

SDN Connector - VMware ESXi

FortiOS now supports automatically updating dynamic addresses for VMware ESXi and vCenter servers using a VMware ESXi SDN connector, including mapping the following attributes from VMware ESXi and vCenter objects to dynamic address groups in FortiOS:

  • vmid
  • host
  • name
  • uuid
  • vmuuid
  • vmnetwork
  • guestid
  • guestname
  • annotation
To configure VMware ESXi SDN connector using the GUI:
  1. Configure the VMware ESXi SDN connector:
    1. Go to Security Fabric > Fabric Connectors.
    2. Click Create New, and select VMware ESXi.
    3. Configure as shown, substituting the server IP address, username, and password for your deployment. The update interval is in seconds, and the password cannot contain single or double quotes.

  2. Create a dynamic firewall address for the configured VMware ESXi SDN connector:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New, then select Address.
    3. Configure the address as shown, selecting the desired filter in the Filter dropdown list. In this example, the VMware ESXi SDN Connector will automatically populate and update IP addresses only for instances that belong to VLAN80:

  3. Ensure that the VMware ESXi SDN connector resolves dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to see a list of IP addresses for instances that belong to VLAN80 as configured in step 2:

To configure VMware ESXi SDN connector using CLI commands:
  1. Configure the VMware ESXi SDN connector:

    config system sdn-connector

    edit "vmware1"

    set type vmware

    set server "172.17.48.222"

    set username "example_username"

    set password xxxxx

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the configured VMware ESXi SDN connector with the supported VMware ESXi filter. In this example, the VMware ESXi SDN Connector will automatically populate and update IP addresses only for instances that belong to the specified VLAN:

    config firewall address

    edit "vmware-network"

    set type dynamic

    set sdn "vmware1"

    set filter "vmnetwork=VLAN80"

    next

    end

  3. Confirm that the VMware ESXi SDN connector resolves dynamic firewall IP addresses using the configured filter:

    config firewall address

    edit "vmware-network"

    set uuid abfa1748-1b80-51e9-d0fd-ea322b3bba2d

    set type dynamic

    set sdn "vmware1"

    set filter "vmnetwork=VLAN80"

    config list

    edit "192.168.8.240"

    next

    end

    next

    end

SDN Connector - VMware ESXi

FortiOS now supports automatically updating dynamic addresses for VMware ESXi and vCenter servers using a VMware ESXi SDN connector, including mapping the following attributes from VMware ESXi and vCenter objects to dynamic address groups in FortiOS:

  • vmid
  • host
  • name
  • uuid
  • vmuuid
  • vmnetwork
  • guestid
  • guestname
  • annotation
To configure VMware ESXi SDN connector using the GUI:
  1. Configure the VMware ESXi SDN connector:
    1. Go to Security Fabric > Fabric Connectors.
    2. Click Create New, and select VMware ESXi.
    3. Configure as shown, substituting the server IP address, username, and password for your deployment. The update interval is in seconds, and the password cannot contain single or double quotes.

  2. Create a dynamic firewall address for the configured VMware ESXi SDN connector:
    1. Go to Policy & Objects > Addresses.
    2. Click Create New, then select Address.
    3. Configure the address as shown, selecting the desired filter in the Filter dropdown list. In this example, the VMware ESXi SDN Connector will automatically populate and update IP addresses only for instances that belong to VLAN80:

  3. Ensure that the VMware ESXi SDN connector resolves dynamic firewall IP addresses:
    1. Go to Policy & Objects > Addresses.
    2. Hover over the address created in step 2 to see a list of IP addresses for instances that belong to VLAN80 as configured in step 2:

To configure VMware ESXi SDN connector using CLI commands:
  1. Configure the VMware ESXi SDN connector:

    config system sdn-connector

    edit "vmware1"

    set type vmware

    set server "172.17.48.222"

    set username "example_username"

    set password xxxxx

    set update-interval 30

    next

    end

  2. Create a dynamic firewall address for the configured VMware ESXi SDN connector with the supported VMware ESXi filter. In this example, the VMware ESXi SDN Connector will automatically populate and update IP addresses only for instances that belong to the specified VLAN:

    config firewall address

    edit "vmware-network"

    set type dynamic

    set sdn "vmware1"

    set filter "vmnetwork=VLAN80"

    next

    end

  3. Confirm that the VMware ESXi SDN connector resolves dynamic firewall IP addresses using the configured filter:

    config firewall address

    edit "vmware-network"

    set uuid abfa1748-1b80-51e9-d0fd-ea322b3bba2d

    set type dynamic

    set sdn "vmware1"

    set filter "vmnetwork=VLAN80"

    config list

    edit "192.168.8.240"

    next

    end

    next

    end