Skip to main content

Step 4: Configure the Router on the Conductor

With the router VM initialized and connected to the conductor, you can now stage the full router configuration on the conductor. Once you commit the configuration, the conductor pushes it to the router and the router comes fully online.

All steps are performed from the Conductor GUI. Complete all steps before committing.

note

Your conductor must already have the following objects configured before proceeding:

  • Authority name — set to your organization's name.
  • Conductor address — set to 192.168.100.10.
  • corp tenant — the LAN-side user tenant.
  • Internet-Traffic service — with address 0.0.0.0/0 and access policy permitting corp.

If any of these are missing, complete Configure the Conductor first.

Network Design Reference​

The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network.

ParameterExample ValueDescription
Authority NameAuthority128Organizational authority name
Conductor NameConductorPre-existing conductor system name
Conductor IP Address192.168.100.10Conductor IP — must be reachable from the router WAN
Router NameSpoke1VMware router system name
Router Node Namenode0Router node name
Router Asset IDSpoke1Asset ID reported after initialization; see Step 2
WAN Device Interfacewan-devWAN device interface name
WAN Network Interfacewan1WAN network interface name
WAN PCI Address(discovered in Step 3)VMXNet3 WAN NIC PCI address
LAN Device Interfacelan-devLAN device interface name
LAN Network Interfacelan1LAN network interface name
LAN PCI Address(discovered in Step 3)VMXNet3 LAN NIC PCI address
Router LAN IP Address192.168.1.1/24LAN gateway address
Tenant NamecorpLAN-side user tenant
Service NameInternet-TrafficInternet breakout service
Service Address0.0.0.0/0All internet-bound traffic
NeighborhoodinternetSVR neighborhood name

Complete the Router Configuration on the Conductor​

During the Initialization process for your router, some basic information was provided, including router name (Spoke1), router location (Los Angeles), node name (node0), the inter-node security policy (internal), asset-id (Spoke1), and role (Combo). All of this allows the router to connect with the Conductor and onboard successfully.

This procedure configures network connections for the router.

note

If you prefer to use the CLI to perform configuration tasks, the example configuration is available in the Appendix.

  1. Open a browser tab on your computer and navigate to your VMWare conductor; https://192.168.100.10 and initiate a web session to the conductor GUI.

    Self signed Certificate warning

  2. Accept the self-signed certificate warning, and login.

  3. In the Conductor GUI, click on Authority.

    Conductor Authority

  4. Scroll to Routers and select the router Spoke1.

  5. Scroll down to Nodes and select node0.

1. Configure the WAN Interface​

The WAN interface (NIC 1) connects to the ISP, obtains a DHCP address, and carries both internet forwarding and conductor management traffic via Management over Forwarding.

1a. Create the WAN Device Interface​

  1. Under the Node, scroll to Device Interfaces and select ADD.

  2. Enter the name wan-dev and select SAVE.

    note

    To ensure successful onboarding, the ge-0-0 interface MUST be configured as the WAN device interface.

    Name the WAN Interface

  3. In the Device Interface window, set the following fields:

    FieldValueNotes
    Typeethernet
    PCI Address(WAN PCI address from Step 3)For example, 0000:0b:00.0
    Forwardingtrue

    Device Interface window

  4. Select SAVE.

1b. Create the WAN Network Interface​

  1. Under the WAN Device Interface, scroll to Network Interfaces and select ADD.

  2. Enter the name wan1 and select SAVE.

    New Network Interface

  3. Set the following fields:

    FieldValueNotes
    Typeexternal
    DHCPdisabled
    Global-ID1
    ConductortrueMarks this interface for conductor connectivity
    ManagementtrueEnables management over forwarding on this interface
    Default RoutetrueLinux uses this interface as its default route
    Source NATtrueRequired for management over forwarding

    WAN Basic Info

  4. Scroll down to Management Vector and select ADD.

    • Enter name mgmt-vec-wan and priority 100.
    • Select SAVE.

    Management Vector

  5. Scroll down to Neighborhoods and select ADD.

    Neighborhood Name

    • Select internet as the neighborhood name.
    • Verify Topology is set to spoke.

    Topology

  6. Select SAVE.

important

Conductor must be set to true or management traffic will not be able to reach the conductor.

Source NAT and Default Route must both be set to true on the WAN management interface. Management traffic originates from the 169.254.x.x range and must be source-NAT'd to a routable address before leaving the interface. The default route ensures Linux routes non-SVR traffic through the SSR forwarding engine.

2. Configure the LAN Interface​

The LAN interface (NIC 2) connects to the branch LAN and assigns the corp tenant to traffic arriving from that direction.

2a. Create the LAN Device Interface​

  1. From the Authority level in the Conductor GUI, click on spoke1 to begin configuration.

  2. Click on node0 and scroll to the bottom of the page.

  3. Select Device Interfaces, and ADD.

  4. In the New Device Interface window, add the LAN device name lan, and click SAVE. This adds a physical device name for you to assign your LAN interface.

    New LAN

Set the following fields:

FieldValueNotes
Typeethernet
PCI Address(LAN PCI address from Step 3)For example, 0000:13:00.0
Forwardingtrue

2b. Create the LAN Network Interface​

  1. Under the LAN Device Interface, scroll to Network Interfaces and select ADD.

Add LAN1

  1. Enter the name lan1 and select SAVE.

  2. Set the following fields:

    FieldValueNotes
    Typeexternal
    Global-ID2
    DHCPdisabled
    TenantcorpAssigns all LAN traffic to the corp tenant
    Source-NATtrue

    External Corp

  3. Scroll down to Interface Addresses and select ADD.

    • IP Address: 192.168.1.1
    • Prefix Length: 24

  4. Select SAVE.

3. Configure DNS​

Configure DNS so the router can resolve FQDNs for conductor connectivity and software downloads.

  1. Return to the Router level.

  2. Scroll to DNS Config and select ADD.

  3. Set Mode to manual and enter DNS server addresses — for example, 1.1.1.1 and 8.8.8.8.

  4. Select SAVE.

    Interface and DNS addresses

4. Create the Internet Service Route​

The service route directs traffic matched by the Internet-Traffic service out through the WAN interface as a direct internet breakout.

  1. Return to the Router level.

  2. Scroll to Service Routes and select ADD.

  3. Enter the name internet-route and select SAVE.

    Service Route Name

  4. Set the following fields:

    FieldValue
    Service NameInternet-Traffic
    Service Route Typeservice-agent

    Service Route Details

  5. Scroll to Next Hop and select ADD.

    • Node: node0
    • Network Interface: wan1
    • Select SAVE.

    New Next Hop

  6. Select VALIDATE and COMMIT.

Configuration Summary​

After committing, the conductor pushes the following configuration to Spoke1. The router applies the configuration and comes fully online within approximately 2–5 minutes.

ObjectNameKey Settings
RouterSpoke1combo node, asset-id Spoke1
WAN Device Interfacewan-devVMware WAN NIC PCI address, forwarding enabled
WAN Network Interfacewan1DHCP, conductor, default-route, source-nat, management, neighborhood internet
LAN Device Interfacelan-devVMware LAN NIC PCI address, forwarding enabled
LAN Network Interfacelan1tenant corp, address 192.168.1.1/24
DNS Configmanualservers 1.1.1.1, 8.8.8.8
Service Routeinternet-routeservice Internet-Traffic, type service-agent, next-hop node0/wan1

Next Step​

Congratulations! At this point your router is ready for your testing and deployment!