{"id":30009,"date":"2019-10-31T21:33:10","date_gmt":"2019-10-31T18:33:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1\/"},"modified":"2019-10-31T21:33:10","modified_gmt":"2019-10-31T18:33:10","slug":"vmware-nsx-dlya-samyh-malenkih-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1","title":{"rendered":"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/22caedbcfd1d6fa4e19bc5b0fe71e0c9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud se pod\u00edv\u00e1te na konfiguraci jak\u00e9hokoli firewallu, pravd\u011bpodobn\u011b uvid\u00edte dlouh\u00fd seznam s mno\u017estv\u00edm IP adres, port\u016f, protokol\u016f a pods\u00edt\u00ed. Tak se klasicky realizuj\u00ed politiky s\u00ed\u0165ov\u00e9 bezpe\u010dnosti pro p\u0159\u00edstup u\u017eivatel\u016f k zdroj\u016fm. Zpo\u010d\u00e1tku se v konfiguraci sna\u017e\u00ed udr\u017eovat po\u0159\u00e1dek, ale pak zam\u011bstnanci za\u010dnou p\u0159ech\u00e1zet z odd\u011blen\u00ed do odd\u011blen\u00ed, servery se mno\u017e\u00ed a m\u011bn\u00ed sv\u00e9 role, vznikaj\u00ed p\u0159\u00edstupy pro r\u016fzn\u00e9 projekty tam, kde obvykle nemaj\u00ed, a vznikaj\u00ed stovky nezn\u00e1m\u00fdch stezek.<\/p>\n<p>Kolem n\u011bjak\u00fdch pravidel, pokud m\u00e1 \u010dlov\u011bk \u0161t\u011bst\u00ed, jsou naps\u00e1ny koment\u00e1\u0159e \u201ePo\u017e\u00e1dal o to Va\u0161ek\u201c nebo \u201eToto je pr\u016fchod do DMZ\u201c. S\u00ed\u0165ov\u00fd administr\u00e1tor odch\u00e1z\u00ed a v\u0161echno se st\u00e1v\u00e1 naprosto nejasn\u00fdm. Pak se n\u011bkdo rozhodl vy\u010distit konfiguraci od Va\u0161ka a spadl SAP, proto\u017ee kdysi Va\u0161ek po\u017e\u00e1dal o tento p\u0159\u00edstup pro fungov\u00e1n\u00ed opera\u010dn\u00edho SAP.<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/f79759ed590ad9b3a1f4878abdb47e6c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDnes v\u00e1m pov\u00edm o \u0159e\u0161en\u00ed VMware NSX, kter\u00e9 pom\u00e1h\u00e1 c\u00edlen\u011b aplikovat politiky s\u00ed\u0165ov\u00e9 interakce a bezpe\u010dnosti bez chaosu v konfigurac\u00edch firewallu. Uk\u00e1\u017eu, jak\u00e9 nov\u00e9 funkce se objevily ve srovn\u00e1n\u00ed s t\u00edm, co d\u0159\u00edve VMware v t\u00e9to oblasti nab\u00edzelo. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>VMWare NSX \u2013 platforma pro virtualizaci a zabezpe\u010den\u00ed s\u00ed\u0165ov\u00fdch slu\u017eeb. NSX \u0159e\u0161\u00ed \u00fakoly sm\u011brov\u00e1n\u00ed, p\u0159ep\u00edn\u00e1n\u00ed, vyv\u00e1\u017een\u00ed z\u00e1t\u011b\u017ee, firewallu a um\u00ed mnoho dal\u0161\u00edch zaj\u00edmav\u00fdch v\u011bc\u00ed. <\/p>\n<p>NSX je n\u00e1stupcem vlastn\u00edho produktu VMware vCloud Networking and Security (vCNS) a zakoupen\u00e9ho Nicira NVP.<\/p>\n<h3>Od vCNS k NSX<\/h3>\n<p>\nD\u0159\u00edve m\u011bl klient v cloudu postaven\u00e9m na VMware vCloud samostatnou virtu\u00e1ln\u00ed stroj vCNS vShield Edge. Ten plnil roli okrajov\u00e9ho br\u00e1ny, kde bylo mo\u017en\u00e9 nastavit \u0159adu s\u00ed\u0165ov\u00fdch funkc\u00ed: NAT, DHCP, Firewall, VPN, vyv\u00e1\u017een\u00ed z\u00e1t\u011b\u017ee atd. vShield Edge omezoval interakci virtu\u00e1ln\u00edho stroje se sv\u011bt\u011bm podle pravidel, kter\u00e1 byla naps\u00e1na v firewallu a NAT. V r\u00e1mci s\u00edt\u011b si virtu\u00e1ln\u00ed stroje mezi sebou voln\u011b komunikovaly v r\u00e1mci pods\u00edt\u00ed. Pokud je pot\u0159eba odd\u011blovat a ovl\u00e1dat provoz, lze vytvo\u0159it samostatnou s\u00ed\u0165 pro r\u016fzn\u00e9 \u010d\u00e1sti aplikac\u00ed (r\u016fzn\u00e9 virtu\u00e1ln\u00ed stroje) a napsat do firewallu p\u0159\u00edslu\u0161n\u00e1 pravidla pro jejich s\u00ed\u0165ovou interakci. Ale to je zdlouhav\u00e9, slo\u017eit\u00e9 a nezaj\u00edmav\u00e9, zvl\u00e1\u0161\u0165 kdy\u017e m\u00e1te n\u011bkolik des\u00edtek virtu\u00e1ln\u00edch stroj\u016f.<\/p>\n<p>V NSX VMware realizovala koncept mikrosegmentace pomoc\u00ed distribuovan\u00e9 firewally, integrovan\u00e9 do j\u00e1dra hypervizoru. V n\u011bm se definuj\u00ed bezpe\u010dnostn\u00ed a s\u00ed\u0165ov\u00e9 politiky nejen pro IP a MAC adresy, ale i pro dal\u0161\u00ed objekty: virtu\u00e1ln\u00ed stroje, aplikace. Pokud je NSX nasazen uvnit\u0159 organizace, mohou t\u011bmito objekty b\u00fdt u\u017eivatel nebo skupina u\u017eivatel\u016f z Active Directory. Ka\u017ed\u00fd takov\u00fd objekt se st\u00e1v\u00e1 mikrosegmentem ve sv\u00e9m bezpe\u010dnostn\u00edm konturu, ve spr\u00e1vn\u00e9 pods\u00edti, se svou \u00fatulnou DMZ :). <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/67ab3d12da30a0fcfad4f2b4f14368f5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>D\u0159\u00edve byl bezpe\u010dnostn\u00ed perimetr jeden pro cel\u00fd bal\u00edk zdroj\u016f, chr\u00e1n\u011bn\u00fd okrajov\u00fdm p\u0159ep\u00edna\u010dem, a s NSX lze odd\u011blit jednotliv\u00fd virtu\u00e1ln\u00ed stroj od nadbyte\u010dn\u00fdch interakc\u00ed i v r\u00e1mci jedn\u00e9 s\u00edt\u011b. <\/i><\/p>\n<p>Bezpe\u010dnostn\u00ed a s\u00ed\u0165ov\u00e9 politiky se p\u0159izp\u016fsobuj\u00ed, pokud objekt p\u0159ejde do jin\u00e9 s\u00edt\u011b. Nap\u0159\u00edklad pokud p\u0159esuneme stroj s datab\u00e1z\u00ed do jin\u00e9ho s\u00ed\u0165ov\u00e9ho segmentu nebo dokonce do jin\u00e9ho propojen\u00e9ho virtu\u00e1ln\u00edho datov\u00e9ho centra, pravidla definovan\u00e1 pro tento virtu\u00e1ln\u00ed stroj budou i nad\u00e1le platn\u00e1 bez ohledu na jeho nov\u00e9 um\u00edst\u011bn\u00ed. Aplika\u010dn\u00ed server bude moci st\u00e1le interagovat s datab\u00e1z\u00ed.<\/p>\n<p>Na m\u00edsto samotn\u00e9ho okrajov\u00e9ho br\u00e1ny vCNS vShield Edge p\u0159i\u0161el NSX Edge. Ten m\u00e1 cel\u00fd gentleman's set star\u00e9ho Edge plus n\u011bkolik nov\u00fdch u\u017eite\u010dn\u00fdch funkc\u00ed. O nich bude \u0159e\u010d d\u00e1le.<\/p>\n<h3>Co je nov\u00e9ho u NSX Edge?<\/h3>\n<p>\nFunkcionalita NSX Edge z\u00e1vis\u00ed na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vmware.com\/content\/dam\/digitalmarketing\/vmware\/en\/pdf\/products\/nsx\/vmware-nsx-compare-editions.pdf\">edici<\/a><\/noindex> NSX. Celkem jich je p\u011bt: Standard, Professional, Advanced, Enterprise, Plus Remote Branch Office. V\u0161e nov\u00e9 a zaj\u00edmav\u00e9 lze vid\u011bt pouze od edice Advanced. V\u010detn\u011b nov\u00e9ho rozhran\u00ed, kter\u00e9 je do \u00fapln\u00e9ho p\u0159echodu vCloud na HTML5 (VMware slibuje l\u00e9to 2019) otev\u00edr\u00e1no v nov\u00e9 z\u00e1lo\u017ece.<\/p>\n<p><b>Firewall.<\/b> Jako objekty, na kter\u00e9 budou aplikov\u00e1na pravidla, si lze vybrat IP adresy, s\u00edt\u011b, rozhran\u00ed br\u00e1ny a virtu\u00e1ln\u00ed stroje. <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/fa05b6c018bea8f968df340693d1eeab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/3b5844efa756f46f47e3ebf2b876a790.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>DHCP.<\/b> Krom\u011b nastaven\u00ed rozsahu IP adres, kter\u00e9 budou automaticky p\u0159id\u011blov\u00e1ny virtu\u00e1ln\u00edm stroj\u016fm t\u00e9to s\u00edt\u011b, jsou v NSX Edge k dispozici funkce <b>Binding<\/b> a <b>Relay<\/b>.<\/p>\n<p>Na z\u00e1lo\u017ece <b>Bindings<\/b> lze p\u0159idru\u017eit MAC adresu virtu\u00e1ln\u00edho stroje k IP adrese, pokud pot\u0159ebujete, aby IP adresa z\u016fstala stejn\u00e1. Hlavn\u00ed je, aby tato IP adresa nepat\u0159ila do DHCP Pool.<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/da013f13cd762936df173ff601590f8b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa z\u00e1lo\u017ece <b>Relay<\/b> Nastavuje se p\u0159esm\u011brov\u00e1n\u00ed DHCP zpr\u00e1v na DHCP servery, kter\u00e9 jsou mimo va\u0161i organizaci v vCloud Director, v\u010detn\u011b DHCP server\u016f fyzick\u00e9 infrastruktury. <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/c5b8762d49364db13cccd0c79f2692a8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Sm\u011brov\u00e1n\u00ed.<\/b> U vShield Edge bylo mo\u017en\u00e9 nastavovat pouze statick\u00e9 sm\u011brov\u00e1n\u00ed. Nyn\u00ed je zde dynamick\u00e9 sm\u011brov\u00e1n\u00ed s podporou protokol\u016f OSPF a BGP. Tak\u00e9 bylo zp\u0159\u00edstupn\u011bno nastaven\u00ed ECMP (Active-active), co\u017e znamen\u00e1, \u017ee je mo\u017en\u00e9 realizovat p\u0159ep\u00edn\u00e1n\u00ed typu \"aktivn\u00ed-aktivn\u00ed\" na fyzick\u00e9 routery.<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/cc4a6a30f8ab130766009ed250e2e514.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Nastaven\u00ed OSPF<\/i><\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/efdf3f78b3b7123aaca6b017c7507827.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Nastaven\u00ed BGP<\/i><\/p>\n<p>Dal\u0161\u00ed novinkou je nastaven\u00ed p\u0159enosu tras mezi r\u016fzn\u00fdmi protokoly,<br \/>\nredistribuce tras (route redistribution). <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/c0a5c7b3055ba80b0c4fcda4c03e7d4c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>L4\/L7 Z\u00e1t\u011b\u017eov\u00fd vyrovn\u00e1va\u010d.<\/b> Nyn\u00ed je k dispozici X-Forwarded-For pro HTTPs hlavi\u010dku. Bez n\u011bj si v\u0161ichni st\u011b\u017eovali. Nap\u0159\u00edklad m\u00e1te web, kter\u00fd vyrovn\u00e1v\u00e1te. Bez p\u0159ed\u00e1n\u00ed t\u00e9to hlavi\u010dky v\u0161e fungovalo, ale ve statistik\u00e1ch webov\u00e9ho serveru jste vid\u011bli nikoli IP adresy n\u00e1v\u0161t\u011bvn\u00edk\u016f, ale IP adresu vyrovn\u00e1va\u010de. Nyn\u00ed je v\u0161e spr\u00e1vn\u011b. <\/p>\n<p>Tak\u00e9 na z\u00e1lo\u017ece Aplika\u010dn\u00ed pravidla je nyn\u00ed mo\u017en\u00e9 p\u0159id\u00e1vat skripty, kter\u00e9 budou p\u0159\u00edmo \u0159\u00eddit vyva\u017eov\u00e1n\u00ed provozu.<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/8f28ba0a4e870cca84a295af68f90c02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>VPN. <\/b>Krom\u011b IPSec VPN, NSX Edge podporuje:<\/p>\n<ul>\n<li>L2 VPN, kter\u00e1 umo\u017e\u0148uje roz\u0161\u00ed\u0159it s\u00edt\u011b mezi geograficky vzd\u00e1len\u00fdmi lokalitami. Takov\u00e1 VPN je pot\u0159ebn\u00e1, nap\u0159\u00edklad aby se p\u0159i p\u0159est\u011bhov\u00e1n\u00ed do jin\u00e9 lokality virtu\u00e1ln\u00ed stroj udr\u017eel ve stejn\u00e9 pods\u00edti a uchoval si IP adresu.\n<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/688ce2e7d26f63ea5cf9c9525294388b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<ul>\n<li>SSL VPN Plus, kter\u00e1 umo\u017e\u0148uje u\u017eivatel\u016fm vzd\u00e1len\u011b se p\u0159ipojit k firemn\u00ed s\u00edti. Na \u00farovni vSphere tato funkce byla, ale pro vCloud Director je to novinka. \n<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/e624c7c61b1954e78a37fc512d121140.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>SSL certifik\u00e1ty.<\/b> Na NSX Edge je nyn\u00ed mo\u017en\u00e9 instalovat certifik\u00e1ty. To op\u011bt souvis\u00ed s ot\u00e1zkou, kdo pot\u0159eboval vyrovn\u00e1va\u010d bez certifik\u00e1tu pro https.<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/7dca479fbc19be397d3666980def43d3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Skupiny objekt\u016f (Grouping Objects).<\/b> Na t\u00e9to z\u00e1lo\u017ece se pr\u00e1v\u011b definuj\u00ed skupiny objekt\u016f, pro kter\u00e9 budou platit ur\u010dit\u00e1 pravidla s\u00ed\u0165ov\u00e9 interakce, nap\u0159\u00edklad pravidla firewallu. <\/p>\n<p>T\u011bmito objekty mohou b\u00fdt IP a MAC adresy. <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/8a28bdb82f8dd982c1edf9af99c5e6b7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u00a0<br \/>\n<img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/d67a661168e8dbe0a457f55843637ec4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZde je tak\u00e9 uveden seznam slu\u017eeb (kombinace protokol-port) a aplikac\u00ed, kter\u00e9 lze pou\u017e\u00edvat p\u0159i vytv\u00e1\u0159en\u00ed pravidel firewallu. Nov\u00e9 slu\u017eby a aplikace m\u016f\u017ee p\u0159id\u00e1vat pouze administr\u00e1tor port\u00e1lu vCD. <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/c282c7918004a9bab2084e4eadae1062.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u00a0<br \/>\n<img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/95fd637be49655d7467f49218b32751b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Statistika.<\/b> Statistiky p\u0159ipojen\u00ed: provoz, kter\u00fd proch\u00e1z\u00ed br\u00e1nou, firewallem a vyrovn\u00e1va\u010dem. <\/p>\n<p>Stav a statistiky pro ka\u017ed\u00fd tunel IPSEC VPN a L2 VPN. <\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/af05223598fb569f74a4e6aa0c8f5595.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Protokolov\u00e1n\u00ed.<\/b> V kart\u011b Edge Settings m\u016f\u017eete nastavit server pro z\u00e1znam log\u016f. Protokolov\u00e1n\u00ed funguje pro DNAT\/SNAT, DHCP, Firewall, sm\u011brov\u00e1n\u00ed, vyrovn\u00e1v\u00e1n\u00ed z\u00e1t\u011b\u017ee, IPsec VPN, SSL VPN Plus.<br \/>\n\u00a0<br \/>\nPro ka\u017ed\u00fd objekt\/slu\u017ebu jsou k dispozici n\u00e1sleduj\u00edc\u00ed typy upozorn\u011bn\u00ed: <\/p>\n<p> \u2014 Debug<br \/>\n \u2014 Alert<br \/>\n \u2014 Critical<br \/>\n \u2014 Error<br \/>\n \u2014 Warning<br \/>\n \u2014 Notice<br \/>\n \u2014 Info<\/p>\n<p><img decoding=\"async\" alt=\"VMware NSX pro ty nejmen\u0161\u00ed. \u010c\u00e1st 1\" src=\"\/wp-content\/uploads\/2019\/03\/ccd8345e8756004f1fbf2e2935ea5499.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Velikosti NSX Edge <\/h3>\n<p>\nV z\u00e1vislosti na \u0159e\u0161en\u00fdch \u00faloh\u00e1ch a objemech VMware <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.vmware.com\/en\/VMware-NSX-Data-Center-for-vSphere\/6.3\/com.vmware.nsx.install.doc\/GUID-311BBB9F-32CC-4633-9F91-26A39296381A.html\">doporu\u010duje <\/a><\/noindex>vytvo\u0159it NSX Edge n\u00e1sleduj\u00edc\u00edch velikost\u00ed:<\/p>\n<p><b>NSX Edge<br \/>\n(Kompaktn\u00ed)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(Velk\u00e9)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(Quad-Velk\u00e9)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(X-Large)<\/b><\/p>\n<p>vCPU<\/p>\n<p>1<\/p>\n<p>2<\/p>\n<p>4<\/p>\n<p>6<\/p>\n<p>Pam\u011b\u0165<\/p>\n<p>512MB<\/p>\n<p>1GB<\/p>\n<p>1GB<\/p>\n<p>8GB<\/p>\n<p>Disk<\/p>\n<p>512MB<\/p>\n<p>512MB<\/p>\n<p>512MB<\/p>\n<p>4.5GB + 4GB<\/p>\n<p>\u00da\u010del<\/p>\n<p>Jedna<br \/>\naplikace, testovac\u00ed<br \/>\ndatov\u00e9 centrum<\/p>\n<p>Mal\u00fd <br \/>\nnebo st\u0159edn\u00ed<br \/>\ndatov\u00e9 centrum<\/p>\n<p>Zat\u00ed\u017een\u00fd<br \/>\nfirewall<\/p>\n<p>Vyv\u00e1\u017een\u00ed<br \/>\nzat\u00ed\u017een\u00ed na \u00farovni L7<\/p>\n<p>N\u00ed\u017ee v tabulce \u2013 pracovn\u00ed metriky s\u00ed\u0165ov\u00fdch slu\u017eeb podle velikosti NSX Edge.<\/p>\n<p><b>NSX Edge<br \/>\n(Kompaktn\u00ed)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(Velk\u00e9)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(Quad-Velk\u00e9)<\/b><\/p>\n<p><b>NSX Edge<br \/>\n(X-Large)<\/b><\/p>\n<p>Interfaces<\/p>\n<p>10<\/p>\n<p>10<\/p>\n<p>10<\/p>\n<p>10<\/p>\n<p>Sub Interfaces (Trunk)<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>NAT Pravidla<\/p>\n<p>2,048<\/p>\n<p>4,096<\/p>\n<p>4,096<\/p>\n<p>8,192<\/p>\n<p>ARP Z\u00e1znamy<br \/>\nA\u017e do p\u0159eps\u00e1n\u00ed<\/p>\n<p>1,024<\/p>\n<p>2,048<\/p>\n<p>2,048<\/p>\n<p>2,048<\/p>\n<p>FW Pravidla<\/p>\n<p>2000<\/p>\n<p>2000<\/p>\n<p>2000<\/p>\n<p>2000<\/p>\n<p>V\u00fdkon FW<\/p>\n<p>3Gbps<\/p>\n<p>9.7Gbps<\/p>\n<p>9.7Gbps<\/p>\n<p>9.7Gbps<\/p>\n<p>DHCP Pooly<\/p>\n<p>20,000<\/p>\n<p>20,000<\/p>\n<p>20,000<\/p>\n<p>20,000<\/p>\n<p>ECMP Cesty<\/p>\n<p>8<\/p>\n<p>8<\/p>\n<p>8<\/p>\n<p>8<\/p>\n<p>Statick\u00e9 Trasy<\/p>\n<p>2,048<\/p>\n<p>2,048<\/p>\n<p>2,048<\/p>\n<p>2,048<\/p>\n<p>LB Pooly<\/p>\n<p>64<\/p>\n<p>64<\/p>\n<p>64<\/p>\n<p>1,024<\/p>\n<p>LB Virtu\u00e1ln\u00ed Servery<\/p>\n<p>64<\/p>\n<p>64<\/p>\n<p>64<\/p>\n<p>1,024<\/p>\n<p>LB Server \/ Pool<\/p>\n<p>32<\/p>\n<p>32<\/p>\n<p>32<\/p>\n<p>32<\/p>\n<p>LB Zdravotn\u00ed Kontroly<\/p>\n<p>320<\/p>\n<p>320<\/p>\n<p>320<\/p>\n<p>3,072<\/p>\n<p>LB Aplika\u010dn\u00ed Pravidla<\/p>\n<p>4,096<\/p>\n<p>4,096<\/p>\n<p>4,096<\/p>\n<p>4,096<\/p>\n<p>L2VPN Klienti Hub to Spoke<\/p>\n<p>5<\/p>\n<p>5<\/p>\n<p>5<\/p>\n<p>5<\/p>\n<p>L2VPN S\u00edt\u011b na Klienta\/Server<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>200<\/p>\n<p>IPSec Tunnels<\/p>\n<p>512<\/p>\n<p>1,600<\/p>\n<p>4,096<\/p>\n<p>6,000<\/p>\n<p>SSLVPN Tunnels<\/p>\n<p>50<\/p>\n<p>100<\/p>\n<p>100<\/p>\n<p>1,000<\/p>\n<p>SSLVPN Soukrom\u00e9 S\u00edt\u011b<\/p>\n<p>16<\/p>\n<p>16<\/p>\n<p>16<\/p>\n<p>16<\/p>\n<p>Sou\u010dasn\u00e9 Relace<\/p>\n<p>64,000<\/p>\n<p>1,000,000<\/p>\n<p>1,000,000<\/p>\n<p>1,000,000<\/p>\n<p>Relace\/Sekunda<\/p>\n<p>8,000<\/p>\n<p>50,000<\/p>\n<p>50,000<\/p>\n<p>50,000<\/p>\n<p>LB Propustnost L7 Proxy)<\/p>\n<p>2.2Gbps<\/p>\n<p>2.2Gbps<\/p>\n<p>3Gbps<\/p>\n<p>LB Propustnost L4 M\u00f3d)<\/p>\n<p>6Gbps<\/p>\n<p>6Gbps<\/p>\n<p>6Gbps<\/p>\n<p>LB Spojen\u00ed\/s (L7 Proxy)<\/p>\n<p>46,000<\/p>\n<p>50,000<\/p>\n<p>50,000<\/p>\n<p>LB Sou\u010dasn\u00e1 Spojen\u00ed (L7 Proxy)<\/p>\n<p>8,000<\/p>\n<p>60,000<\/p>\n<p>60,000<\/p>\n<p>LB Spojen\u00ed\/s (L4 M\u00f3d)<\/p>\n<p>50,000<\/p>\n<p>50,000<\/p>\n<p>50,000<\/p>\n<p>LB Sou\u010dasn\u00e1 Spojen\u00ed (L4 M\u00f3d)<\/p>\n<p>600,000<\/p>\n<p>1,000,000<\/p>\n<p>1,000,000<\/p>\n<p>BGP Trasy<\/p>\n<p>20,000<\/p>\n<p>50,000<\/p>\n<p>250,000<\/p>\n<p>250,000<\/p>\n<p>BGP Sousedi<\/p>\n<p>10<\/p>\n<p>20<\/p>\n<p>100<\/p>\n<p>100<\/p>\n<p>BGP Trasy Redistribuovan\u00e9<\/p>\n<p>Bez Omezen\u00ed<\/p>\n<p>Bez Omezen\u00ed<\/p>\n<p>Bez Omezen\u00ed<\/p>\n<p>Bez Omezen\u00ed<\/p>\n<p>OSPF Trasy<\/p>\n<p>20,000<\/p>\n<p>50,000<\/p>\n<p>100,000<\/p>\n<p>100,000<\/p>\n<p>OSPF LSA Z\u00e1znamy Max 750 Typ-1<\/p>\n<p>20,000<\/p>\n<p>50,000<\/p>\n<p>100,000<\/p>\n<p>100,000<\/p>\n<p>OSPF Adjacence<\/p>\n<p>10<\/p>\n<p>20<\/p>\n<p>40<\/p>\n<p>40<\/p>\n<p>OSPF Trasy Redistribuovan\u00e9<\/p>\n<p>2000<\/p>\n<p>5000<\/p>\n<p>20,000<\/p>\n<p>20,000<\/p>\n<p>Celkov\u00e9 Trasy<\/p>\n<p>20,000<\/p>\n<p>50,000<\/p>\n<p>250,000<\/p>\n<p>250,000<\/p>\n<p>\u2192 <noindex><a rel=\"nofollow\" href=\"https:\/\/anthonyspiteri.net\/nsx-bytes-updated-nsx-edge-feature-and-performance-matrix-2\/\"><i>Zdroj<\/i><\/a><\/noindex><\/p>\n<p>Z tabulky je patrn\u00e9, \u017ee vyrovn\u00e1n\u00ed z\u00e1t\u011b\u017ee na NSX Edge pro produktivn\u00ed sc\u00e9n\u00e1\u0159e se doporu\u010duje organizovat a\u017e od velikosti Large. <\/p>\n<p>Na dnes m\u00e1m v\u0161e. V n\u00e1sleduj\u00edc\u00edch \u010d\u00e1stech podrobn\u011b projdu nastaven\u00edm ka\u017ed\u00e9 s\u00ed\u0165ov\u00e9 slu\u017eby NSX Edge.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dataline\/blog\/432980\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433 \u043b\u044e\u0431\u043e\u0433\u043e \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0430, \u0442\u043e, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043d\u044e \u0441 \u043a\u0443\u0447\u0435\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u043f\u043e\u0440\u0442\u043e\u0432, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 \u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439. \u0422\u0430\u043a \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043a \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0435 \u0441\u0442\u0430\u0440\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0440\u044f\u0434\u043e\u043a, \u043d\u043e \u043f\u043e\u0442\u043e\u043c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u044c \u0438\u0437 \u043e\u0442\u0434\u0435\u043b\u0430 \u0432 \u043e\u0442\u0434\u0435\u043b, \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0430\u0437\u043c\u043d\u043e\u0436\u0430\u0442\u044c\u0441\u044f \u0438 \u043c\u0435\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u043e\u043b\u0438, \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30009","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47VMware NSX \u0434\u043b\u044f \u0441\u0430\u043c\u044b\u0445 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:33:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:33:10+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47VMware NSX pro nejmen\u0161\u00ed. \u010c\u00e1st 1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47VMware NSX \u0434\u043b\u044f \u0441\u0430\u043c\u044b\u0445 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/vmware-nsx-dlya-samyh-malenkih-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:33:10+00:00","article:modified_time":"2019-10-31T18:33:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30009","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:24:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:44:38","updated":"2026-01-20 23:24:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=30009"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/30009\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=30009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=30009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=30009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}