AWS evs documentation change
Summary
Removed VPC CIDR recommendation, simplified route table and DNS/NTP configuration instructions, updated VPC Route Server links, removed troubleshooting section, added HCX prerequisites including public IPAM requirements.
Security assessment
The changes involve documentation restructuring, removing redundant details, and adding HCX setup requirements. While the removal of the 'no direct internet gateway support' note could imply architectural changes, there is no explicit evidence of addressing a security vulnerability. The HCX public IPAM requirements focus on connectivity prerequisites rather than security controls. No security features or vulnerability mitigations are explicitly added.
Diff
diff --git a/evs/latest/userguide/setting-up.md b/evs/latest/userguide/setting-up.md index 7e2034b72..ece35654a 100644 --- a//evs/latest/userguide/setting-up.md +++ b//evs/latest/userguide/setting-up.md @@ -219,2 +218,0 @@ Ensure that you have sufficient IP address space for both your VPC subnet and th -When you create a VPC, we recommend that you specify a CIDR block from the private IPv4 address ranges as specified in [RFC 1918](http://www.faqs.org/rfcs/rfc1918.html). - @@ -227 +225 @@ Amazon EVS does not support IPv6 at this time. -Amazon EVS deploys your environment into a VPC that you provide. This VPC must contain a subnet for Amazon EVS service access ([service access subnet](./concepts.html#concepts-service-access-subnet)). For steps to create a VPC with subnets for Amazon EVS, see [Create a VPC with subnets and route tables](./getting-started.html#getting-started-create-vpc). +Amazon EVS deploys your environment into a VPC that you provide. This VPC must contain a subnet for Amazon EVS service access ([Service access subnet](./concepts.html#concepts-service-access-subnet)). For steps to create a VPC with subnets for Amazon EVS, see [Create a VPC with subnets and route tables](./getting-started.html#getting-started-create-vpc). @@ -231,3 +229 @@ Amazon EVS deploys your environment into a VPC that you provide. This VPC must c -Amazon EVS VLAN subnets are implicitly associated to the VPC main route table. To enable connectivity to dependent services such as DNS or on-premises systems for successful environment deployment, you must configure the main route table to allow traffic to these systems. The main route table must include a route for the VPC’s CIDR. For more information about managing subnet route tables, see [Manage subnet route tables](https://docs.aws.amazon.com/vpc/latest/userguide/WorkWithRouteTables.html#Route_Replacing_Main_Table) in the _Amazon VPC User Guide_. - -After environment deployment, you must explicitly associate each of the Amazon EVS VLAN subnets with a route table in your VPC. NSX connectivity fails if your VLAN subnets are not explicitly associated with a VPC route table. We strongly recommend that you explicitly associate your subnets with a custom route table after environment deployment. For more information, see [Explicitly associate Amazon EVS VLAN subnets to a VPC route table](./getting-started.html#getting-started-associate-vlans). +Amazon EVS VLAN subnets are implicitly associated to the VPC main route table. To enable connectivity to dependent services such as DNS or on-premises systems for successful environment deployment, you must configure the main route table to allow traffic to these systems. For more information, see [Explicitly associate Amazon EVS VLAN subnets to a VPC route table](./getting-started.html#getting-started-associate-vlans). @@ -243,4 +238,0 @@ Configure routes for these gateway types based on your connectivity requirements -###### Note - -Amazon EVS does not support direct internet gateway connectivity at this time. - @@ -316,95 +308 @@ Your environment deployment fails if you don’t meet these Amazon EVS requireme -Amazon EVS uses your VPC’s DHCP option set to retrieve the following: - - * Domain Name System (DNS) servers for host IP address resolution. Amazon EVS requires a minimum of two DNS servers in the DHCP option set. - - * Domain names for DNS resolution. - - * Network Time Protocol (NTP) servers for time synchronization. - - - - -You can create a DHCP option set using the Amazon VPC console or AWS CLI. For more information, see [Create a DHCP option set](https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html#CreatingaDHCPOptionSet) in the _Amazon VPC User Guide_. - -### Configure DNS servers - -DNS configuration enables hostname resolution in your Amazon EVS environment. You can: - - * Configure up to four custom DNS servers. - - * Create private hosted zones for internal domain resolution. - - - - -To successfully deploy an environment, your VPC’s DHCP option set must have the following DNS settings: - - * A primary DNS server IP address and a secondary DNS server IP address in the DHCP option set. - - * A DNS forward lookup zone with A records for each VCF management appliance and Amazon EVS host in your deployment. - - * A reverse lookup zone with PTR records for each VCF management appliance and Amazon EVS host in your deployment. For NTP configuration, you can use the the default Amazon NTP address `169.254.169.123`, or another IPv4 address that you prefer. - - - - -For more information about configuring DNS servers in a DHCP option set, see [Create a DHCP option set](https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html#CreatingaDHCPOptionSet). - -For on-premises connectivity, we recommend the use of Route 53 private hosted zones with inbound resolvers. This setup enables hybrid DNS resolution, where you can use Route 53 for internal DNS within your VPC and integrate it with your existing on-premises DNS infrastructure. This allows resources within your VPC to resolve domain names hosted on your on-premises network, and vice versa, without requiring complex configurations. If required, you can also use your own DNS server with Route 53 outbound resolvers. For steps to configure, see [Creating a private hosted zone](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zone-private-creating.html) and [Forwarding inbound DNS queries to your VPC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-inbound-queries.html) in the _Amazon Route 53 Developer Guide_. - -###### Note - -Using both Route 53 and a custom Domain Name System (DNS) server in the DHCP option set may cause unexpected behavior. - -###### Note - -If you use custom DNS domain names defined in a private hosted zone in Route 53, or use private DNS with interface VPC endpoints (AWS PrivateLink), you must set both the `enableDnsHostnames` and `enableDnsSupport` attributes to `true`. For more information, see [DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/AmazonDNS-concepts.html#vpc-dns-support). - -### Troubleshoot DNS reachability issues - -Amazon EVS requires a persistent connection to SDDC Manager and DNS servers in your VPC’s DHCP option set to reach DNS records. If the persistent connection to SDDC Manager becomes unavailable, Amazon EVS will no longer be able to validate environment status, and you may lose environment access. For steps to troubleshoot this issue, see [Reachability check failed](./troubleshooting.html#troubleshoot-reachability). - -### Configure NTP servers - -NTP servers provide the time to your network. A consistent and accurate time reference on your Amazon EC2 instance is crucial for many VCF environment tasks and processes. Time synchronization is essential for: - - * System logging and auditing - - * Security operations - - * Distributed system management - - * Troubleshooting - - - - -You can enter the IPv4 addresses of up to four NTP servers in your VPC’s DHCP option set. You can specify the Amazon Time Sync Service at IPv4 address `169.254.169.123`. By default, the Amazon EC2 instances that Amazon EVS deploys use the Amazon Time Sync Service at IPv4 address `169.254.169.123`. - -For more information about NTP servers, see [RFC 2123](https://datatracker.ietf.org/doc/html/rfc2132#section-8.3). For more information about Amazon Time Sync Service, see [Precision clock and time synchronization in your EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html) and [Configure NTP on VMware Cloud Foundation Hosts](https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-5-2-and-earlier/5-2/configure-ntp-on-vmware-cloud-foundation-hosts.html) in the VMware Cloud Foundation documentation. - -**To configure NTP settings** - - 1. Choose your NTP source: - - * Amazon Time Sync Service (recommended) - - * Custom NTP servers - - 2. Add NTP servers to your DHCP options set. For more information, see [Create a DHCP option set](https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html#CreatingaDHCPOptionSet) in the _Amazon VPC User Guide._ - - 3. Verify time synchronization. - - - - -**Recommended best practices** - - * Use multiple NTP sources for redundancy. - - * Monitor time synchronization regularly. - - * Address synchronization issues promptly. - - - +For more information, see [Configure DNS and NTP servers using the VPC DHCP option set](./getting-started.html#getting-started-config-dns-ntp-dhcp). @@ -452 +350 @@ Before you begin, you need: -For steps to create a VPC Route Server, see [Create a route server](https://docs.aws.amazon.com/vpc/latest/userguide/route-server.html#route-server-create) in the _Amazon VPC User Guide_. +For steps to set up VPC Route Server, see the [Route Server get started tutorial](https://docs.aws.amazon.com/vpc/latest/userguide/route-server-tutorial.html). @@ -466,17 +363,0 @@ BGP connectivity status will be down until the Amazon EVS environment is deploye -### Troubleshooting - -If you encounter issues: - - * Verify that each route table has an explicit subnet association. - - * Check that the peer ASN values entered for route server and the NSX Tier-0 gateway match. - - * Confirm that Route Server endpoint IP addresses are unique. - - * Review route propagation status in your route tables. - - * Use VPC Route Server peer logging to monitor BGP session health and troubleshoot connection issues. For more information, see [Route server peer logging](https://docs.aws.amazon.com/vpc/latest/userguide/route-server-peer-logging.html) in the _Amazon VPC User Guide_. - - - - @@ -485 +366 @@ If you encounter issues: -You can configure connectivity for your on-premises data center to your AWS infrastructure using AWS Direct Connect with an associated transit gateway, or using an AWS Site-to-Site VPN attachment to a transit gateway. For more information, see [(Optional) Configure on-premises network connectivity](./getting-started.html#getting-started-connect-on-prem). +You can configure connectivity for your on-premises data center to your AWS infrastructure using AWS Direct Connect with an associated transit gateway, or using an AWS Site-to-Site VPN attachment to a transit gateway. For more information, see [Configure on-premises network connectivity (optional)](./getting-started.html#getting-started-connect-on-prem). @@ -534,0 +416,15 @@ VMware HCX is not installed in the EVS environment by default. + * If you need HCX internet connectivity, you must complete the following prerequisite tasks: + + * Ensure that your IPAM quota for Amazon-provided contiguous public IPv4 CIDR block netmask length is /28 or greater. + +###### Important + +For HCX internet connectivity, Amazon EVS requires use of IPv4 CIDR block from a public IPAM pool with a netmask length of /28 or greater. Use of any CIDR block with a netmask length smaller than /28 will result in HCX connectivity issues. For more information about increasing IPAM quotas, see [Quotas for your IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/quotas-ipam.html). + + * Create an IPAM and a public IPv4 IPAM pool with CIDR that has a a minimum netmask length of /28. + + * Allocate at least two Elastic IP addresses (EIPs) from the IPAM pool for the HCX Manager and HCX Interconnect (HCX-IX) appliances. Allocate an additional Elastic IP address for each HCX network appliance that you need to deploy. + + * Add the public IPv4 CIDR block as an additional CIDR to your VPC. + + @@ -536,0 +433 @@ VMware HCX is not installed in the EVS environment by default. +For more information about HCX setup, see [Choose your HCX connectivity option](./getting-started.html#hcx-connectivity-choice) and [HCX connectivity options](./migrate-evs-hcx.html#migrate-evs-hcx-connectivity).