Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Membuat dan mengelola kebijakan jaringan
Dokumen ini menjelaskan cara menggunakan kebijakan jaringan untuk mengontrol apakah
workload VMware Anda dapat mengakses atau diakses dari internet.
Setiap kebijakan jaringan dikaitkan dengan jaringan VMware Engine, dan jaringan VMware Engine dapat bersifat regional atau global. Jaringan VMware Engine Standar adalah resource global, sedangkan Jaringan VMware Engine Lama bersifat regional.
Kebijakan jaringan berlaku untuk semua cloud pribadi yang terkait dengan jaringan VMware Engine. Untuk jaringan lama, jika Anda memiliki cloud pribadi yang di-deploy di lebih dari satu region dan ingin mengaktifkan akses internet atau layanan alamat IP eksternal, Anda harus membuat kebijakan jaringan di setiap region.
Membuat kebijakan jaringan
Buat kebijakan jaringan menggunakan konsol, gcloud, atau API.
Konsol
Untuk membuat kebijakan jaringan baru menggunakan Google Cloud konsol:
Di konsol Google Cloud , buka halaman Kebijakan jaringan.
Klik Select a project, lalu pilih organisasi, folder, atau project
yang berisi jaringan VMware Engine yang ingin Anda kaitkan dengan
kebijakan jaringan.
Klik Create.
Berikan informasi tentang kebijakan jaringan baru:
Nama kebijakan jaringan: nama untuk mengidentifikasi kebijakan jaringan
Deskripsi kebijakan jaringan: deskripsi kebijakan jaringan
Jaringan VMware Engine: jaringan VMware Engine yang akan
dihubungkan dengan kebijakan
Region: region tempat Anda ingin kebijakan jaringan diterapkan
Di bagian Policy details, aktifkan atau nonaktifkan layanan jaringan:
Layanan akses internet: Jika diaktifkan, VMware Engine mengizinkan
traffic keluar dari alamat IP internal ke internet.
Layanan alamat IP eksternal: Jika diaktifkan, VMware Engine
memungkinkan Anda mencadangkan alamat IP eksternal untuk
alamat IP internal di cloud pribadi terkait. Alamat IP eksternal menyediakan akses traffic masuk ke alamat IP internal dari internet.
Layanan ini hanya dapat diaktifkan jika layanan akses internet juga
diaktifkan.
Di kolom Rentang alamat layanan Edge, masukkan rentang alamat IP yang akan
digunakan saat menangani gateway IP publik VMware Engine (rentang alamat
/26).
Klik Create. VMware Engine mulai membuat kebijakan jaringan baru Anda.
LOCATION: lokasi kebijakan jaringan
ini; ini harus cocok dengan jaringan VMware Engine
NETWORK_POLICY_ID: nama untuk kebijakan jaringan ini
INTERNET_ACCESS: apakah beban kerja VMWare dapat
mengakses internet; tetapkan ke true atau false
EXTERNAL_IP: apakah akan mengaktifkan alamat IP eksternal
untuk ditetapkan ke beban kerja VMware. internetAccess juga harus
diaktifkan; tetapkan ke true atau false.
NETWORK_ID: nama jaringan VMware Engine
EDGE_SERVICES_CIDR: rentang alamat IP yang akan
digunakan saat menangani gateway IP publik VMware Engine (rentang alamat
/26)
Mengedit kebijakan jaringan
Konsol
Untuk mengedit kebijakan jaringan yang ada menggunakan konsol Google Cloud , lakukan tindakan berikut:
Di konsol Google Cloud , buka halaman Kebijakan jaringan.
EDGE_SERVICES_CIDR: rentang alamat IP yang akan
digunakan saat menangani gateway IP publik VMware Engine (rentang alamat
/26)
--external-ip-access: apakah akan mengaktifkan alamat IP eksternal
untuk ditetapkan ke beban kerja VMware. Juga harus mengaktifkan
--internet-access.
--internet-access: apakah beban kerja VMWare dapat
mengakses internet
API
Di API, buat permintaan PATCH:
POST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID
'{
"internetAccess": INTERNET_ACCESS,
"externalIp": EXTERNAL_IP,
"edgeServicesCidr": "EDGE_SERVICES_CIDR"
}'
Ganti kode berikut:
PROJECT_ID: project untuk permintaan ini
LOCATION: lokasi kebijakan jaringan
ini
NETWORK_POLICY_ID: nama kebijakan jaringan ini
INTERNET_ACCESS: apakah beban kerja VMWare dapat
mengakses internet; tetapkan ke true atau false
EXTERNAL_IP: apakah akan mengaktifkan alamat IP eksternal
untuk ditetapkan ke beban kerja VMware. internetAccess juga harus
diaktifkan; tetapkan ke true atau false.
EDGE_SERVICES_CIDR: rentang alamat IP yang akan
digunakan saat menangani gateway IP publik VMware Engine (rentang alamat
/26)
Menghapus kebijakan jaringan
Untuk menghapus kebijakan jaringan yang ada, lakukan langkah-langkah berikut.
Konsol
Di konsol Google Cloud , buka halaman Kebijakan jaringan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Create and manage network policies\n==================================\n\nThis document describes how to use network policies to control whether your\nVMware workloads can access or be accessed from the internet.\n\nEach network policy is associated with a VMware Engine network, and\nVMware Engine networks can be either regional or global. *Standard VMware Engine Networks* are global resources, while *Legacy VMware Engine Networks* are regional.\n\nA network policy applies to all private clouds associated with the\nVMware Engine network. For legacy networks, if you have private clouds\ndeployed in more than one region and you want to enable internet access or the\nexternal IP address service, you must create a network policy in each region.\n\nCreate a network policy\n-----------------------\n\nCreate a network policy using the console, `gcloud`, or the API. \n\n### Console\n\nTo create a new network policy using the Google Cloud console:\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to associate the\n network policy with.\n\n3. Click **Create**.\n\n4. Provide information about the new network policy:\n\n - **Network policy name:** a name to identify the network policy\n - **Network policy description:** a description of the network policy\n - **VMware Engine network:** the VMware Engine network to associate the policy with\n - **Region:** the region where you want the network policy to apply\n5. In the **Policy details** section, enable or disable network services:\n\n - **Internet access service:** When enabled, VMware Engine allows outbound traffic from internal IP addresses to the internet.\n - **External IP address service:** When enabled, VMware Engine\n lets you [reserve external IP addresses](/vmware-engine/docs/preview/networking/howto-allocate-external-ip) for\n internal IP addresses in the associated private cloud. External IP\n addresses provide inbound traffic access to internal IP addresses from the\n internet.\n\n This service can only be enabled when the internet access service is also\n enabled.\n | **Note:** If you enable internet access and leave the external IP address service disabled, you won't be able to reserve external IP addresses for internal IP addresses covered by this network policy.\n6. In the **Edge services address range** field, enter the IP address range to\n use when addressing the VMware Engine public IP gateway (*/26*\n address range).\n\n7. Click **Create**. VMware Engine begins creating your new network\n policy.\n\n### gcloud\n\nIn `gcloud`, run the [`network-policies create`](/sdk/gcloud/reference/vmware/network-policies/create)\ncommand: \n\n```\ngcloud vmware network-policies create NETWORK_POLICY_ID \\\n --location LOCATION --vmware-engine-network NETWORK_ID \\\n --edge-services-cidr=EDGE_SERVICES_CIDR [--external-ip-access] \\\n [--internet-access]\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: a name for this network policy\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy; this must match the VMware Engine network\n- \u003cvar translate=\"no\"\u003eNETWORK_ID\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: the VMware Engine network name\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n- `--external-ip-access`: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `--internet-access` enabled.\n- `--internet-access`: whether VMWare workloads can access the internet\n\n### API\n\nIn the API, make a `POST` request: \n\n```\nPOST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID\n\n'{\n \"internetAccess\": INTERNET_ACCESS,\n \"externalIp\": EXTERNAL_IP,\n \"vmwareEngineNetwork\": \"projects/PROJECT_ID/locations/LOCATION/vmwareEngineNetworks/NETWORK_ID\"\n \"edgeServicesCidr\": \"EDGE_SERVICES_CIDR\"\n}'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy; this must match the VMware Engine network\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: a name for this network policy\n- \u003cvar translate=\"no\"\u003eINTERNET_ACCESS\u003c/var\u003e: whether VMWare workloads can access the internet; set this to `true` or `false`\n- \u003cvar translate=\"no\"\u003eEXTERNAL_IP\u003c/var\u003e: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `internetAccess` enabled; set this to `true` or `false`.\n- \u003cvar translate=\"no\"\u003eNETWORK_ID\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: the VMware Engine network name\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n\nEdit a network policy\n---------------------\n\n### Console\n\nTo edit an existing network policy using the Google Cloud console, do the following:\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to edit the network policy for.\n\n3. In the list of network policies, find the network policy that you want to\n edit.\n\n4. Click the **More** more_vert\n icon at the end of a row and select **Edit**.\n\n5. On the page that appears, adjust the network policy as you need.\n\n6. Click **Save**.\n\n### gcloud\n\nTo update a network policy, use the [`network-policies update` command](/sdk/gcloud/reference/vmware/network-policies/update): \n\n```\ngcloud vmware network-policies update NETWORK_POLICY_ID \\\n --location LOCATION \\\n --edge-services-cidr=EDGE_SERVICES_CIDR [--external-ip-access] \\\n [--internet-access]\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of the network policy\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n- `--external-ip-access`: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `--internet-access` enabled.\n- `--internet-access`: whether VMWare workloads can access the internet\n\n### API\n\nIn the API, make a `PATCH` request: \n\n```\nPOST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID\n\n'{\n \"internetAccess\": INTERNET_ACCESS,\n \"externalIp\": EXTERNAL_IP,\n \"edgeServicesCidr\": \"EDGE_SERVICES_CIDR\"\n}'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of this network policy\n- \u003cvar translate=\"no\"\u003eINTERNET_ACCESS\u003c/var\u003e: whether VMWare workloads can access the internet; set this to `true` or `false`\n- \u003cvar translate=\"no\"\u003eEXTERNAL_IP\u003c/var\u003e: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `internetAccess` enabled; set this to `true` or `false`.\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n\nDelete a network policy\n-----------------------\n\nTo delete an existing network policy, take the following steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to delete the network policy for.\n\n3. In the list of network policies, find the network policy that you want to\n delete.\n\n4. Click the **More** more_vert\n icon at the end of a row and select **Delete**.\n\n### gcloud\n\nIn `gcloud`, use the [`network-policies delete` command](/sdk/gcloud/reference/vmware/network-policies/delete): \n\n```\ngcloud vmware network-policies delete NETWORK_POLICY_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e with the name of the network\npolicy to delete.\n\n### API\n\nMake a `DELETE` request to the network policy resource: \n\n```\nDELETE https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies/NETWORK_POLICY_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of this network policy\n\nWhat's next\n-----------\n\n- [Manage your private cloud resources and activity](/vmware-engine/docs/private-clouds/howto-manage-private-cloud)."]]
