VMware ESXi SDN connector using server credentials

Dynamic addresses for VMware ESXi and vCenter servers can be automatically updated by using a VMware ESXi SDN connector, including mapping the following attributes from VMware ESXi and vCenter objects to dynamic address groups in FortiOS:

• vmid
• host
• name
• uuid
• vmuuid
• vmnetwork
• guestid
• guestname
• annotation

To configure VMware ESXi SDN connector using the GUI:

1. Configure the VMware ESXi SDN connector:
   1. Go to Security Fabric > External Connectors.
   2. Click Create New, and select VMware ESXi.
   3. Configure the fields, using the server IP address, username, and password for your deployment.

      The update interval is in seconds. The password cannot contain single or double quotes.

      

2. Create a dynamic firewall address for the configured VMware ESXi SDN connector:
   1. Go to Policy & Objects > Addresses.
   2. Click Create New, then select Address.
   3. Configure the address:
      1. From the Type dropdown list, select Dynamic.
      2. From the Sub Type dropdown list, select Fabric Connector Address.
      3. From the SDN Connector dropdown list, select the connector that you created.
      4. In the Filter dropdown list, select the desired filter. In this example, the VMware ESXi SDN connector automatically populates and updates IP addresses only for instances that belong to VLAN80.

      5. Configure other fields as desired, then click OK.

         

3. Ensure that the VMware ESXi SDN connector resolves dynamic firewall IP addresses:
   1. Go to Policy & Objects > Addresses.
   2. Hover over the address created in step 2 to see a list of IP addresses for instances that belong to VLAN80 as configured in step 2:

      

To configure VMware ESXi SDN connector using CLI commands:

1. Configure the VMware ESXi SDN connector:

   config system sdn-connector

   edit "vmware1"

   set type vmware

   set server "172.17.48.222"

   set username "example_username"

   set password xxxxx

   set update-interval 30

   next

   end

2. Create a dynamic firewall address for the configured VMware ESXi SDN connector with the supported VMware ESXi filter. In this example, the VMware ESXi SDN connector automatically populates and updates IP addresses only for instances that belong to the specified VLAN:

   config firewall address

   edit "vmware-network"

   set type dynamic

   set sdn "vmware1"

   set filter "vmnetwork=VLAN80"

   next

   end

3. Confirm that the VMware ESXi SDN connector resolves dynamic firewall IP addresses using the configured filter:

   config firewall address

   edit "vmware-network"

   set type dynamic

   set sdn "vmware1"

   set filter "vmnetwork=VLAN80"

   config list

   edit "192.168.8.240"

   next

   end

   next

   end