VMware NSX ALB (Avi Networks) and NSX-T Integration, Installation
Tags: avi, bgp, loadbalancing, nsxalb
Published: 2021-09-11 23:36:28

---
title: VMware NSX ALB (Avi Networks) and NSX-T Integration, Installation
published: true
date: 2021-09-10 17:00:00 UTC
tags: Avi,BGP,LoadBalancing,NSXALB
canonical_url: 
---

Note: I created a common baseline for pre-requisites in [this previous post](https://dev.to/ngschmidt/vmware-nsx-advanced-load-balancer-installation-lci). We'll be following [VMware's Avi + NSX-T Design guide](https://avinetworks.com/docs/21.1/nsx-t-design-guide/).

This will be a complete re-install. Avi Vantage appears to develop some tight coupling issues with using the same vCenter for both Layer 2 and NSX-T deployments - which is not an issue that most people will typically have. Let's start with the OVA deployment:

[![](https://1.bp.blogspot.com/-hSpLEyCRFLA/YTO7BJv-WQI/AAAAAAAABdQ/eqOtOVDqMGI4roIhrsKK2GKTsdDsmgI5wCLcBGAsYHQ/s16000/4sept21-1.PNG)](https://1.bp.blogspot.com/-hSpLEyCRFLA/YTO7BJv-WQI/AAAAAAAABdQ/eqOtOVDqMGI4roIhrsKK2GKTsdDsmgI5wCLcBGAsYHQ/s1146/4sept21-1.PNG)

[![](https://1.bp.blogspot.com/-ma-pRBNO9vU/YTO8djTbR8I/AAAAAAAABdY/hY9qVIkFneg0LIzT9UgkR722y-6m0hD7ACLcBGAsYHQ/s16000/4sept21-2.PNG)](https://1.bp.blogspot.com/-ma-pRBNO9vU/YTO8djTbR8I/AAAAAAAABdY/hY9qVIkFneg0LIzT9UgkR722y-6m0hD7ACLcBGAsYHQ/s1150/4sept21-2.PNG)
  

[![](https://1.bp.blogspot.com/-MLByryurJY4/YTO9GYnIqcI/AAAAAAAABdg/gGWqlzY29FgkdUnMphGmxy4ASdnPVAwDwCLcBGAsYHQ/s16000/4sept21-3.PNG)](https://1.bp.blogspot.com/-MLByryurJY4/YTO9GYnIqcI/AAAAAAAABdg/gGWqlzY29FgkdUnMphGmxy4ASdnPVAwDwCLcBGAsYHQ/s1152/4sept21-3.PNG)
Initial setup here will be very different compared to a typical vCenter standalone or read-only deployment. The setup wizard should be very minimally followed:
[![](https://1.bp.blogspot.com/-oh9Su3BdzB4/YTQPwnRaAvI/AAAAAAAABdo/HaQVAhFgBrAj-g8pBM7ZqI9mw1jcnlU9ACLcBGAsYHQ/w556-h640/4sept21-4.PNG)](https://1.bp.blogspot.com/-oh9Su3BdzB4/YTQPwnRaAvI/AAAAAAAABdo/HaQVAhFgBrAj-g8pBM7ZqI9mw1jcnlU9ACLcBGAsYHQ/s511/4sept21-4.PNG)
  

[![](https://1.bp.blogspot.com/-s_m9yRFLj38/YTQPwl4nnzI/AAAAAAAABds/hj9NpBEzyegPJygLhor87LDFqmc7kO0WACLcBGAsYHQ/s16000/4sept21-5.PNG)](https://1.bp.blogspot.com/-s_m9yRFLj38/YTQPwl4nnzI/AAAAAAAABds/hj9NpBEzyegPJygLhor87LDFqmc7kO0WACLcBGAsYHQ/s1121/4sept21-5.PNG)
With a more "standard" deployment methodology, the Avi Service Engines will be running on their own Tier-1 router, and leveraging Source-NAT (misnomer, since it's a TCP proxy) for "one-arm load balancing":
[![](https://1.bp.blogspot.com/-vyXEx3O8yqQ/YTQYYDVJB2I/AAAAAAAABd4/7KQk5RSj7PwUHvWIRBtXTIXHWcLwpjdZACLcBGAsYHQ/w610-h640/diagram.png)](https://1.bp.blogspot.com/-vyXEx3O8yqQ/YTQYYDVJB2I/AAAAAAAABd4/7KQk5RSj7PwUHvWIRBtXTIXHWcLwpjdZACLcBGAsYHQ/s432/diagram.png)
  

To perform this, we'll need to add two segments to the ALB Tier-1. one for management, and one for vIPs. I have created the following NSX-T segments, with 10.7.80.0/24 running DHCP and 10.7.81.0/24 for vIPs:

[![](https://1.bp.blogspot.com/-GVw5XRQJPwA/YTZCgA3nSbI/AAAAAAAABfc/AQU9ZsZaAy4rDj66kLU5lqflDmdrJOv-ACLcBGAsYHQ/s16000/4sept21-6.PNG)](https://1.bp.blogspot.com/-GVw5XRQJPwA/YTZCgA3nSbI/AAAAAAAABfc/AQU9ZsZaAy4rDj66kLU5lqflDmdrJOv-ACLcBGAsYHQ/s475/4sept21-6.PNG)

**Note: I used underscores in this segment name, in my own testing both**  ./ ** are illegal characters. Avi's NSX-T Cloud Connector will report "No Transport Nodes Found" if it cannot match the segment name due to these characters.**

**Note: If you configure an NSX-T cloud and discover this issue, you will need to delete and re-add the cloud after fixing the names!**

**Note: IPv6 is being used, but I will not share my globally routable prefixes.**  

  

First off, let's create NSX-T Manager and vCenter Credentials:

[![](https://1.bp.blogspot.com/-bGq0r0rsem8/YTQf1D3UhKI/AAAAAAAABeg/yVcpyQ3cG_IZgt7PELdsKdCU3v_yRbhjwCLcBGAsYHQ/w640-h458/4sept21-7.PNG)](https://1.bp.blogspot.com/-bGq0r0rsem8/YTQf1D3UhKI/AAAAAAAABeg/yVcpyQ3cG_IZgt7PELdsKdCU3v_yRbhjwCLcBGAsYHQ/s605/4sept21-7.PNG)
There is one thing that needs to be created on vCenter as well - a content library. Just create a blank one and label it accordingly, then proceed with the following steps:
[![](https://1.bp.blogspot.com/-QparXwgqTi0/YTQhe4Gl0mI/AAAAAAAABeo/xZ3qdxIVwvk94KMmXEv4PPdx9pb_muAvwCLcBGAsYHQ/w1078-h660/4sept21-8.PNG)](https://1.bp.blogspot.com/-QparXwgqTi0/YTQhe4Gl0mI/AAAAAAAABeo/xZ3qdxIVwvk94KMmXEv4PPdx9pb_muAvwCLcBGAsYHQ/s1396/4sept21-8.PNG)

[![](https://1.bp.blogspot.com/-qMozN8dvlqs/YTZDp0ZTWQI/AAAAAAAABfk/XvXxfsh5ctIR-u88yT2PvaPJDSEnaku3QCLcBGAsYHQ/s16000/4sept219.PNG)](https://1.bp.blogspot.com/-qMozN8dvlqs/YTZDp0ZTWQI/AAAAAAAABfk/XvXxfsh5ctIR-u88yT2PvaPJDSEnaku3QCLcBGAsYHQ/s1079/4sept219.PNG)
Click Save, and get ready to wait. The Avi controller has automated quite a few steps, and it will take a while to run. If you want, the way to track **any issue in NSX ALB** is to navigate to **Operations -> Events -> Show Internal:**
[![](https://1.bp.blogspot.com/-MLjyxrwKlR8/YTQiyycJh6I/AAAAAAAABe4/eNMkKoi4lzEwwVk12SnbSwVxXtOD5pLugCLcBGAsYHQ/w1081-h264/4sept21-10.PNG)](https://1.bp.blogspot.com/-MLjyxrwKlR8/YTQiyycJh6I/AAAAAAAABe4/eNMkKoi4lzEwwVk12SnbSwVxXtOD5pLugCLcBGAsYHQ/s1641/4sept21-10.PNG)
Once the NSX Cloud is reporting as "Complete" under **Infrastructure -> Dashboard** , we need to specify some additional data to ensure that the service engines will deploy. To do this, we navigate to **Infrastructure -> Cloud Resources -> Service Engine Groups,** and select the Cloud:
[![](https://1.bp.blogspot.com/-ryUJ314rQWs/YTT7KcVsKNI/AAAAAAAABfE/_Zc-AL8TpYwJHIuDzcvwEl2wAwP5jTp6wCLcBGAsYHQ/w640-h302/4sept21-11.PNG)](https://1.bp.blogspot.com/-ryUJ314rQWs/YTT7KcVsKNI/AAAAAAAABfE/_Zc-AL8TpYwJHIuDzcvwEl2wAwP5jTp6wCLcBGAsYHQ/s1034/4sept21-11.PNG)
Then let's build a **Service Engine Group**. This will be the compute resource attached to our vIPs. Here I configured a naming convention and a compute target - and it can automatically drop SEs into a specific folder.  

[![](https://1.bp.blogspot.com/-LUOtc3eqHOU/YTT7KfNl-UI/AAAAAAAABfA/J6xk19BOE-sUgF_Jw9LWiDr3HblkE2flgCLcBGAsYHQ/w1126-h579/4sept21-12.PNG)](https://1.bp.blogspot.com/-LUOtc3eqHOU/YTT7KfNl-UI/AAAAAAAABfA/J6xk19BOE-sUgF_Jw9LWiDr3HblkE2flgCLcBGAsYHQ/s1632/4sept21-12.PNG)
The next step here is to configure the built-in IPAM. Let's add an IP range under **Infrastructure -> Cloud Resources -> Networks** by editing the appropriate network ID. Note that you will need to select the NSX-T cloud to see the correct network:

[![](https://1.bp.blogspot.com/-z6bAPzTI8VQ/YTZEk8nrIyI/AAAAAAAABfs/6mJFxRxi8UkxPH4_t9jP-QC1cPZIfjMMwCLcBGAsYHQ/w640-h290/4sept21-13.PNG)](https://1.bp.blogspot.com/-z6bAPzTI8VQ/YTZEk8nrIyI/AAAAAAAABfs/6mJFxRxi8UkxPH4_t9jP-QC1cPZIfjMMwCLcBGAsYHQ/s1041/4sept21-13.PNG)

[![](https://1.bp.blogspot.com/-XlD3y5EQBjA/YTZEyj4krCI/AAAAAAAABfw/9Kcxzzr_BtQVUR1kerwwhLHz0kGbTURBACLcBGAsYHQ/w1135-h585/4sept21-14.PNG)](https://1.bp.blogspot.com/-XlD3y5EQBjA/YTZEyj4krCI/AAAAAAAABfw/9Kcxzzr_BtQVUR1kerwwhLHz0kGbTURBACLcBGAsYHQ/s1632/4sept21-14.PNG)

**Those of you who have been LTM Admins will appreciate this. Avi SE also perform "Auto Last Hop," so you can reach a vIP without a default route, but monitors (health checks) will fail.** The spot to configure the custom routes is under **Infrastructure -> Cloud Resources -> Routing:**

[![](https://1.bp.blogspot.com/-2GOnJb7QrGM/YTZRILjPlRI/AAAAAAAABg4/kkxVd3x62MgRT0q8stQR6UWg5i7QCQdWQCLcBGAsYHQ/w1127-h569/4sept21-21.PNG)](https://1.bp.blogspot.com/-2GOnJb7QrGM/YTZRILjPlRI/AAAAAAAABg4/kkxVd3x62MgRT0q8stQR6UWg5i7QCQdWQCLcBGAsYHQ/s1204/4sept21-21.PNG)
  

  

Finally, let's verify that the NSX-T Cloud is fully configured. An interesting thing I saw here is that Avi 21 shows an unconfigured or "In Progress" cloud as green now, so we'll have to mouse over the cloud status to check in on it. 

[![](https://1.bp.blogspot.com/-UP0uEKbRDQ8/YTZH2Gf9MsI/AAAAAAAABgM/F22Dfsy5cuImwjUWAMeIsqmZJSPpTW0lACLcBGAsYHQ/w1136-h587/4sept21-17.PNG)](https://1.bp.blogspot.com/-UP0uEKbRDQ8/YTZH2Gf9MsI/AAAAAAAABgM/F22Dfsy5cuImwjUWAMeIsqmZJSPpTW0lACLcBGAsYHQ/s1628/4sept21-17.PNG)

[![](https://lh3.googleusercontent.com/-Y4p3f6yE0g4/YTZFZLeHmfI/AAAAAAAABf8/HIH6wPMK15MCkVFriiOnnRTS0doyGfAyACLcBGAsYHQ/image.png)](https://lh3.googleusercontent.com/-Y4p3f6yE0g4/YTZFZLeHmfI/AAAAAAAABf8/HIH6wPMK15MCkVFriiOnnRTS0doyGfAyACLcBGAsYHQ/image.png)
Now that everything is configured (at least in terms of infrastructure), Avi will not deploy Service Engines until there's something to do! So let's do that:

[![](https://1.bp.blogspot.com/--aPCidDNM9E/YTZH2IhaEyI/AAAAAAAABgI/14aNwRNz0A8IwioHNww1DiTIKF1aKQcIQCLcBGAsYHQ/w1158-h595/4sept21-18.PNG)](https://1.bp.blogspot.com/--aPCidDNM9E/YTZH2IhaEyI/AAAAAAAABgI/14aNwRNz0A8IwioHNww1DiTIKF1aKQcIQCLcBGAsYHQ/s1630/4sept21-18.PNG)
**Let's define a pool (back-end server resources):**  
[![](https://1.bp.blogspot.com/-Fm0jpCkZPAA/YTZH2ANvc1I/AAAAAAAABgE/hOAZiUgDoyo4A-djStbUwjh-yKxDJue5QCLcBGAsYHQ/w1161-h591/4sept21-16.PNG)](https://1.bp.blogspot.com/-Fm0jpCkZPAA/YTZH2ANvc1I/AAAAAAAABgE/hOAZiUgDoyo4A-djStbUwjh-yKxDJue5QCLcBGAsYHQ/s1628/4sept21-16.PNG)  

**Let's set a HTTP-to-HTTPS redirect as well:**
[![](https://1.bp.blogspot.com/-EKIpLB3pMuI/YTZIVxsDMjI/AAAAAAAABgo/G2Md6EY9n9ss7Hs14_TgfSQFaEJrGhZwQCLcBGAsYHQ/w1166-h599/4sept21-18.PNG)](https://1.bp.blogspot.com/-EKIpLB3pMuI/YTZIVxsDMjI/AAAAAAAABgo/G2Md6EY9n9ss7Hs14_TgfSQFaEJrGhZwQCLcBGAsYHQ/s1630/4sept21-18.PNG)  

**Finally, let's make sure that the correct SE group is selected:**

[![](https://1.bp.blogspot.com/-0COBSzdtZUY/YTZH2VhZ_0I/AAAAAAAABgQ/asC7eaXKZK01kX6Fjyanh6As0pWOde2UgCLcBGAsYHQ/w1162-h598/4sept21-19.PNG)](https://1.bp.blogspot.com/-0COBSzdtZUY/YTZH2VhZ_0I/AAAAAAAABgQ/asC7eaXKZK01kX6Fjyanh6As0pWOde2UgCLcBGAsYHQ/s1628/4sept21-19.PNG)

**And that's it! You're up and running with Avi Vantage 21!** After a few minutes, you should see deployed service engines:

[![](https://1.bp.blogspot.com/-0lNNJzbV77A/YTZJZOzHl9I/AAAAAAAABgw/JEJ6bOIAlXwrb-tG1vV5YYZf7cC00zGxwCLcBGAsYHQ/s16000/4sept21-20.PNG)](https://1.bp.blogspot.com/-0lNNJzbV77A/YTZJZOzHl9I/AAAAAAAABgw/JEJ6bOIAlXwrb-tG1vV5YYZf7cC00zGxwCLcBGAsYHQ/s664/4sept21-20.PNG)
The service I configured is also now up - In this case,[I'm using Hyperglass](https://dev.to/ngschmidt/leveraging-hyperglass-and-nsx-t-1bng), and I can leverage the load-balanced vIP to check and see what the route advertisement from Avi looks like. As you can see, it's firing a multipath BGP host address:

[![](https://lh3.googleusercontent.com/-OLSwtVaLu2I/YTZR5309vZI/AAAAAAAABhA/Aj79sY1A1lkLddGNBIRlYot9mRh9fNEOACLcBGAsYHQ/w1210-h462/image.png)](https://lh3.googleusercontent.com/-OLSwtVaLu2I/YTZR5309vZI/AAAAAAAABhA/Aj79sY1A1lkLddGNBIRlYot9mRh9fNEOACLcBGAsYHQ/image.png)