How is multi-tenancy enabled within vCloud Director?

[JoDo23]

Hey,

I would like to know, how exactly the multi-tenancy is enabled in vCD. So how are ressources from user a isolated from user b ressources. I think this is about user roles and of course networking. Maybe someone can supply some more infos on this ;>

[JayhawkEric]

First and main separation is at the Organization level.  This is the separation of security for each tenant.  Compute and storage resources can run on same hosts or different hosts depending on the way you set it up. These resources get carved up as Virtual Datacenters (VDC) and assigned to earch organization.  Deploying vShield Edge devices separates network connectivity as well, if needed.  It all depends on use case and SLA needs.

Eric

[JoDo23]

OK so I have vDCs for each tenant with its own user accounts. For network separation I need a vShield Edge device for each tenant?! Ok, I also can separate networks by using VLANs, not so cool Then I can use VXLAN right? And for using this i need those vShield Edge devices?!

[JayhawkEric]

Networking can be VERY complicated within VCD.  If you are running VCD internally and you're not worried about network security you can run all Organizations on the same VLANs.  You can also setup different External Networks for each Organization and put them on their own VLAN.  This can all be done by standard VLAN's or VXLAN, that is up to you and your network setup.  There are physical switch requirements for VXLAN to work though so read up on that.

If you want your tenants to control what traffic comes into their Organization VM's you can deploy a vShield Edge device to their Organization.  This allows that tenant to control Firewall and Nat rules to their entire Network.

-Eric

[JoDo23]

ah ok, so networks are already separeted through VLAN/VXLAN and Edge device is then used as firewall/nat/...

[JayhawkEric]

Networks do not have to already be separated though.  For my internal deployment I run all 8 Organizations on the same network.  They can all see eachother's VM's.  I separate them by Organizations based on divisions within the company.

[JoDo23]

hm ok but if I sign up for a public vCloud service I get my own organization vDC and I only have external network connection. So I can create my own networks within my organisation and I dont need to set up an edge device and others cant access my VMs. How is that done?!

[JayhawkEric · Accepted solution]

When you sign up for a public vCloud service they setup your Organization and deploy a vShield Edge device for your Organization.  All of your VM's will run within an internal network on a VLAN just for you (usually 192.168.x.x).  The VM's have access to the internet but there is no access into the VM's from the internet by default.  YOU have to configure Firewall and NAT rules on the Edge device to allow traffic into your VDC.  You usually get a few Public IP Addresses with your VCD service.  You pic one and setup the NAT or Port Forwarding rules.

Eric

[JoDo23]

good to know. Last question, the provider sets up a VLAN or can use VXLAN, right?

[JayhawkEric]

Correct.  When you are then tenant you can only setup internal vApp networks and connect them to the External Networks the hosting provider has created for you.

-Eric

[JoDo23]

thx for your help