5.5.5.2. Fenced
For a fenced network, the external and internal IP subnet is the same, with proxy ARP used to move traffic. vCloud Networking and Security Edge provides the network fencing functionality for vCloud environments. The option to fence a vApp is available if the vApp directly connects to an organization virtual datacenter network.
Depending on the organization virtual datacenter network connection, NAT or double NAT may take place for incoming or outgoing traffic from a vApp network perspective. The following scenarios describe a single and double NAT situation.
The following figure illustrates a scenario where a vApp network connected to a direct organization virtual datacenter network is fenced.
Figure 21. vApp Network (Fenced) –> Organization Virtual Datacenter Network (Direct)
If you are fencing a vApp network connected to a routed organization virtual datacenter network, double NAT occurs with two vCloud Networking and Security Edge instances deployed.
The following figure illustrates this scenario.
Figure 22. vApp Network (Fenced) –> Organization Virtual Datacenter Network (Routed)
The following figure shows a fenced vApp network connected to an isolated organization virtual datacenter network. There is only one NAT.
Figure 23. vApp Network (Fenced) –> Organization Virtual Datacenter Network (Isolated)
