Architecting a vCloud Director Solution : vCloud Director Design : 7.4 Networks : 7.4.5 vCloud Director Edge Gateways
   
7.4.5 vCloud Director Edge Gateways
vCloud Director deploys edge VMs to provide Organization VDC or vApp network connectivity. The actual deployment is done through NSX Manager, but it is vCloud Director that makes the decision about placement and configuration of the edges. The vCloud Director edge gateway provides connectivity between one or more vCloud Director external networks and one or more Organization VDC networks. It is deployed inside the provider VDC in a special System VDC resource pool on a datastore belonging to the Org VDC default storage policy. The vCloud Director placement engine selects the most appropriate cluster where the edge gateway VM is deployed based on which clusters belong to the provider VDC, their available capacity, and most importantly, their access to the appropriate storage and external networks.
In vCloud Director 8.0 and earlier, Organization VDC and vApp edge gateways are deployed in vShield (legacy) compatibility mode (NSX Edge version 5.5.4). In vCloud Director 8.10 and 8.20, edge gateways and vApp edges are deployed as full NSX Edge nodes (version 6.x) with the same feature set, accessible through the user interface or API, as legacy NSX Edge nodes.
Legacy edge gateways deployed before the upgrade to vCloud Director 8.10/8.20 are still supported. VMware recommends redeploying the old edges in vCloud Director or upgrading them in VMware NSX to leverage the more efficient message bus communication mode with NSX Manager as opposed to the legacy VIX API mode. If the NSX Edge nodes are upgraded directly in VMware NSX, verify that vCloud Director is still running because it needs to be notified about the NSX Edge version change.
vCloud Director 8.20 enables additional NSX services on Org VDC Edge Gateways by converting them to Advanced Gateway. If the backing NSX Edge Gateway is still version 5.5.4, it is redeployed to version 6.x. vApp Edges cannot be converted to Advanced Gateway. The following table provides comparison for the Org VDC Edge Gateway before and after conversion to Advanced Gateway.
Table 12. Org VDC Edge Gateway Feature Set
Feature
Regular
Advanced Gateway
Routing
Static
Static, OSPF, BGP
Firewalling
Basic
Yes, with objects and IP sets
DHCP
Basic
DHCP bindings, relay
NAT
Basic
TCP/UDP/ICMP/any protocol NAT
IP/CIDR/ranges can be used
Load balancing
Layer 4
Up to Layer 7 with SSL termination, X-header forwarding, custom health check, application rules and TCP L4 acceleration
IPsec VPN
Yes
More flexibility in configuration (PSK characters, PFS can be disabled, DH 2, 15 and 14 groups)
SSL VPN-Plus (client-server VPN)
No
Yes
Layer 2 VPN
No
Yes (with another Org VDC Edge Gateway or with Standalone Edge1)
CLI
No
Read only
Syslog
API only
Yes
API
vCloud API
vCloud Director API for NSX
UI
Legacy Flash UI
New HTML5 UI

1 https://docs.vmware.com/en/VMware-NSX-for-vSphere/6.3/com.vmware.nsx.admin.doc/GUID-C9E2B0E4-F1C1-44A7-B142-F814F801FA42.html

 
Each Org VDC Edge Gateway can have up to 10 network interfaces that can be external or internal. In vCloud Director 8.20 internal interfaces can be converted to subinterfaces which creates one trunk interface that can have up to 200 subinterfaces.
In vCloud Director 8.20 Org VDC Edge Gateways can be deployed in four form factors (Compact, Large, Quad Large, and X-Large) and optionally in high availability (application active/passive) mode. vApp and DHCP Edge Gateways are always deployed in compact, single-node configuration.
Table 13. Org VDC Edge Gateway Form Factors
Edge Gateway Size
vCPU
RAM (MB)
Purpose
Compact
1
512
Moderate usage of networking services
Large
2
1024
Large number of concurrent SSL VPN sessiosn
Quad Large
4
1024-2048*
High throughput, high connection rate
X-Large
6
8192
Load balancing with millions of concurrent sessions
* Depends on NSX Version
External IP addresses are sub-allocated by the vCloud system administrator on the Internet networks. These addresses are used by organization administrators to configure NAT for internal VMs to allow access to and from the Internet.
vApp Edge Gateways provide connectivity between an organization VDC network and a vApp network. They always have only one external and one internal interface. They are also deployed by vCloud Director to the provider VDC System VDC resource pool and exist only when the vApp is in deployed mode (powered on).
One arm DHCP Edge Gateways are deployed on isolated Org VDC networks and optionally on vApp networks to provide DHCP service.