The diagram above depicts the topology if a dedicated ALB Service Engine Group is created for a tenant . For this implementation, Service Engines are dedicated to a particular tenant and no other tenants will share these SEs. This is a good use case for tenants that want dedicated performance for load balancing their services or when they want total data isolations (e.g. financial institutions or government requirements).

The diagram above depicts the topology if shared Service Engine Group is created for multitenant utilization. This implementation is a recommended implementation as it allows shared service engine resources to be fully utilized. We also do not need to worry too much on over-sizing as NSX ALB can auto-scale the service engines in the service engine groups on demand.

Access the webUI of vcsa-01a and key in the credentials to access vCenter:

1. Click on the vCenter shortcut on the browser
2. Username: administrator@corp.local
3. Password: VMware1!
4. Click Login

When integrating NSX ALB, you will be required to create a Content Library. This is to allow NSX ALB Controllers to place the image files of the Service Engines so that it can request on-demand creations of Service Engines to the vCenter

To access the NSX-T Manager:

1. Access the browser and click on the NSX-T shortcut
2. Username: admin
3. Password: VMware1!VMware1!
4. Click Log In

The NSX-T Tier-1 Gateway will be used as the gateway for the NSX ALB Service Engine's gateway. This is an infrastructure requirement from NSX ALB integration with NSX-T. This NSX-T Tier-1 gateway will then be connected to a Tier-0 gateway which can be the same Tier-0 router as the tenant's external network or it can be a separate Tier-0 router (if you would like to have a segregation of management and tenant networks. In this lab, we'll utilize the same Tier-0 router as the tenant's external network to conserve resources.

The NSX ALB Service Engines management vnic will need to connect to an NSX-T Segment. This Segment will be connected to the nsxalb-se-mgmt NSX-T Tier-1 router that was created in the previous step, then given a gateway IP.

To access the VMware Cloud Director provider portal:

1. Access the browser and click on the vCD - Provider shortcut
2. Username: admin
3. Password: VMware1!
4. Click Sign In

To review the configuration:

1. Go to Resources
2. Ensure it is on Cloud Resources
3. On the left pane, select Network Pools
4. Click on regionA name

1. Note down the Transport Zone: TZ-HOL-Overlay

Access the NSX ALB webUI via the browser:

1. Click on the Avi Controller shortcut
2. Password & Confirm Password: VMware1!
3. Click on Create Account

Provide system settings for:

1. DNS Resolver(s): 192.168.110.10
2. DNS Search Domain: corp.local
3. Backup Passphrase & Confirm Backup Passphrase: VMware1!

1. Scroll down to the end
2. Replace the first NTP Server to 192.168.100.1 (from 0.us.pool.ntp.org)
3. Click Next

1. Leave everything default and click Next

1. Select No Orchestrator

1. Select Yes for multiple tenant support

Under the multi-tenant settings:

1. Select Per tenant IP
2. Select Service Engines are managed within the tenant context, not shared across tenants
3. Click on Complete

To create the NSX-T cloud:

1. Click on Clouds
2. Click on Create
3. Select NSX-T Cloud

1. Name: nsxt-cloud
2. Object Name Prefix: alb

Under NSX-T Credentials section:

1. Scroll down a little
2. NSX-T Manager Address: nsx-mgr.corp.local
3. Click on the 3 dots (options menu)
4. Click on Create

1. Click on Connect to connect to NSX-T Manager

1. Select TZ-HOL-Overlay

1. Select earlier created Tier1 Logical Router ID: nsxalb-se-mgmt
2. Select earlier created Segment ID: nsxalb-se-seg
3. Click Add
4. Select same Tier1 router: nsxalb-se-mgmt
5. Select same Segment:  nsxalb-se-seg

1. Scroll down a little more
2. Under vCenter Server(s), click Add

1. Click Save to finish

To access the certificate page, you will need to:

1. Click on top left corner menu
2. Select Templates
3. Select Security tab
4. Click on Create

1. Select Controller Certificate

Key in these configuration:

1. Name: avicorplocal
2. Common Name: avi-controller
3. Organization Unit: HOL
4. Organization: VMware
5. Locality or City: Palo Alto
6. State Name or Province: California
7. Country: US

1. Scroll down to the end
2. Subject Alternate Name (SAN): avi-controller.corp.local
3. Click on Save

After creating the new self-signed certificate, we will need to apply it:

1. Click on top left corner menu of the webUI
2. Select Administration
3. Select the Settings tab
4. Choose Access Settings sub-tab
5. Click on the pencil (edit) button on the right

Delete the 2 existing SSL/TLS Certificate:

1. Delete System-Default-Portal-Cert
2. Delete System-Default-Portal-Cert-EC256

Add the newly created self-signed certificate:

1. From SSL/TLS Certificate dropdown menu, select avicorplocal
2. Click on Save

This is where you configure the Service Engine Group. Here we are trying to configure a group for VCD to use as a shared service engine mode

1. Service Engine Group Name: VCD-Shared-SE-Group
2. Max Number of Service Engines: 2
3. Click on Save

Key in the configurations for the NSX ALB Controller:

1. Name: avi-controller
2. URL: https://avi-controller.corp.local
3. Username: admin
4. Password: VMware1!
5. Enterprise License toggle green
6. Click on Save

Configure these settings:

1. Select avi-controller from the dropdown menu
2. Name: avi-controller
3. Select nsxt-cloud from the Available Clouds
4. Click on Add

Configure these settings:

1. Select avi-controller from the NSX-T Cloud dropdown menu
2. Reservation Model select Shared
3. Name: VCD-Shared-SEGroup-01
4. Select VCD-Shared-SE-Group under the Available Service Engine Groups
5. Click on Add

To access the load balancer configuration, you must access the edge gateway:

1. Select Edges on the left pane
2. Select the existing Edge Gateway ecorp-gw

Before using the load balancer, we'll need to enable it first:

1. Click on General Settings under Load Balancer
2. Select Edit

After enabling the Load Balancer service, we will see more options under Load Balancer. Next, we have to select the Service Engine Group to be assigned to this tenant:

1. Click on Service Engine Groups
2. Click on Add

To load balance workloads, we must first create the pool in which the servers in that pool will be load balanced.

1. Click on Pools
2. Click on Add to add a new server pool

Virtual Service is where we configure the Virtual IP of the service we want to load balance. To configure the virtual service:

1. Click on Virtual Services
2. Click on Add