Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Criar e gerenciar políticas de rede
Neste documento, descrevemos como usar políticas de rede para controlar se as cargas de trabalho da VMware podem acessar ou ser
acessadas pela Internet.
Cada política de rede está associada a uma rede do VMware Engine, e
as redes do VMware Engine podem ser regionais ou globais. As redes padrão do VMware Engine são recursos globais, e as redes legadas do VMware Engine são regionais.
Uma política de rede se aplica a todas as nuvens privadas associadas à
rede do VMware Engine. Para redes legadas, se você tiver nuvens privadas implantadas em mais de uma região e quiser ativar o acesso à Internet ou o serviço de endereço IP externo, crie uma política de rede em cada região.
Criar uma política de rede
Crie uma política de rede usando o console, o gcloud ou a API.
Console
Para criar uma política de rede usando o console Google Cloud :
No Google Cloud console, acesse a página Políticas de rede.
Clique em Selecionar um projeto e escolha a organização, a pasta ou o projeto
que contém a rede do VMware Engine que você quer associar à
política de rede.
Clique em Criar.
Forneça informações sobre a nova política de rede:
Nome da política de rede: um nome para identificar a política de rede.
Descrição da política de rede: uma descrição da política de rede.
Rede do VMware Engine: a rede do VMware Engine para
associar a política a
Região:a região em que a política de rede será aplicada.
Na seção Detalhes da política, ative ou desative os serviços de rede:
Serviço de acesso à Internet:quando ativado, o VMware Engine permite
o tráfego de saída de endereços IP internos para a Internet.
Serviço de endereço IP externo: quando ativado, o VMware Engine
permite reservar endereços IP externos para
endereços IP internos na nuvem privada associada. Os endereços IP externos fornecem acesso de tráfego de entrada a endereços IP internos da Internet.
Esse serviço só pode ser ativado quando o
serviço de acesso à Internet também está ativado.
No campo Intervalo de endereços dos serviços de borda, insira o intervalo de endereços a ser usado
ao se direcionar ao gateway de IP público do VMware Engine (intervalo de endereços
/26).
Clique em Criar. O VMware Engine começa a criar a nova política de
rede.
NETWORK_POLICY_ID: um nome para esta política de rede.
LOCATION: o local da política
de rede. ele precisa corresponder à rede do VMware Engine
NETWORK_ID: o nome da rede do VMware Engine
EDGE_SERVICES_CIDR: o intervalo de endereços IP a ser
usado ao endereçar o gateway de IP público do VMware Engine (intervalo de
endereços /26).
--external-ip-access: se é necessário ativar endereços IP
externos para serem atribuídos às cargas de trabalho do VMware. --internet-access também precisa estar ativado.
--internet-access: se as cargas de trabalho do VMWare podem
acessar a Internet.
LOCATION: o local da política
de rede. ele precisa corresponder à rede do VMware Engine
NETWORK_POLICY_ID: um nome para esta política de rede.
INTERNET_ACCESS: se as cargas de trabalho do VMWare
podem acessar a Internet. Defina como true ou false
EXTERNAL_IP: se é necessário ativar endereços IP
externos para serem atribuídos às cargas de trabalho do VMware. Também precisa ter
internetAccess ativado. Defina como true ou false.
NETWORK_ID: o nome da rede do VMware Engine
EDGE_SERVICES_CIDR: o intervalo de endereços IP a ser
usado ao endereçar o gateway de IP público do VMware Engine (intervalo de
endereços /26).
Editar uma política de rede
Console
Para editar uma política de rede usando o console Google Cloud , faça o seguinte:
No Google Cloud console, acesse a página Políticas de rede.
EDGE_SERVICES_CIDR: o intervalo de endereços IP a ser
usado ao endereçar o gateway de IP público do VMware Engine (intervalo de
endereços /26).
--external-ip-access: se é necessário ativar endereços IP
externos para serem atribuídos às cargas de trabalho do VMware. --internet-access também precisa estar ativado.
--internet-access: se as cargas de trabalho do VMWare podem
acessar a Internet.
API
NA API, faça uma solicitação PATCH:
POST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID
'{
"internetAccess": INTERNET_ACCESS,
"externalIp": EXTERNAL_IP,
"edgeServicesCidr": "EDGE_SERVICES_CIDR"
}'
Substitua:
PROJECT_ID: o projeto para esta solicitação
LOCATION: o local da política de rede.
NETWORK_POLICY_ID: o nome desta política de rede
INTERNET_ACCESS: se as cargas de trabalho do VMWare
podem acessar a Internet. Defina como true ou false
EXTERNAL_IP: se é necessário ativar endereços IP
externos para serem atribuídos às cargas de trabalho do VMware. Também precisa ter
internetAccess ativado. Defina como true ou false.
EDGE_SERVICES_CIDR: o intervalo de endereços IP a ser
usado ao endereçar o gateway de IP público do VMware Engine (intervalo de
endereços /26).
Excluir uma política de rede
Para excluir uma política de rede, siga as etapas abaixo.
Console
No Google Cloud console, acesse a página Políticas de rede.
Clique em Selecionar um projeto e escolha a organização, a pasta ou o projeto
que contém a rede do VMware Engine para a qual você quer excluir a política de rede.
Na lista de políticas de rede, encontre a política que você quer
excluir.
Clique no ícone Maismore_vert
no final de uma linha e selecione Excluir.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["# Create and manage network policies\n==================================\n\nThis document describes how to use network policies to control whether your\nVMware workloads can access or be accessed from the internet.\n\nEach network policy is associated with a VMware Engine network, and\nVMware Engine networks can be either regional or global. *Standard VMware Engine Networks* are global resources, while *Legacy VMware Engine Networks* are regional.\n\nA network policy applies to all private clouds associated with the\nVMware Engine network. For legacy networks, if you have private clouds\ndeployed in more than one region and you want to enable internet access or the\nexternal IP address service, you must create a network policy in each region.\n\nCreate a network policy\n-----------------------\n\nCreate a network policy using the console, `gcloud`, or the API. \n\n### Console\n\nTo create a new network policy using the Google Cloud console:\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to associate the\n network policy with.\n\n3. Click **Create**.\n\n4. Provide information about the new network policy:\n\n - **Network policy name:** a name to identify the network policy\n - **Network policy description:** a description of the network policy\n - **VMware Engine network:** the VMware Engine network to associate the policy with\n - **Region:** the region where you want the network policy to apply\n5. In the **Policy details** section, enable or disable network services:\n\n - **Internet access service:** When enabled, VMware Engine allows outbound traffic from internal IP addresses to the internet.\n - **External IP address service:** When enabled, VMware Engine\n lets you [reserve external IP addresses](/vmware-engine/docs/preview/networking/howto-allocate-external-ip) for\n internal IP addresses in the associated private cloud. External IP\n addresses provide inbound traffic access to internal IP addresses from the\n internet.\n\n This service can only be enabled when the internet access service is also\n enabled.\n | **Note:** If you enable internet access and leave the external IP address service disabled, you won't be able to reserve external IP addresses for internal IP addresses covered by this network policy.\n6. In the **Edge services address range** field, enter the IP address range to\n use when addressing the VMware Engine public IP gateway (*/26*\n address range).\n\n7. Click **Create**. VMware Engine begins creating your new network\n policy.\n\n### gcloud\n\nIn `gcloud`, run the [`network-policies create`](/sdk/gcloud/reference/vmware/network-policies/create)\ncommand: \n\n```\ngcloud vmware network-policies create NETWORK_POLICY_ID \\\n --location LOCATION --vmware-engine-network NETWORK_ID \\\n --edge-services-cidr=EDGE_SERVICES_CIDR [--external-ip-access] \\\n [--internet-access]\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: a name for this network policy\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy; this must match the VMware Engine network\n- \u003cvar translate=\"no\"\u003eNETWORK_ID\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: the VMware Engine network name\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n- `--external-ip-access`: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `--internet-access` enabled.\n- `--internet-access`: whether VMWare workloads can access the internet\n\n### API\n\nIn the API, make a `POST` request: \n\n```\nPOST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID\n\n'{\n \"internetAccess\": INTERNET_ACCESS,\n \"externalIp\": EXTERNAL_IP,\n \"vmwareEngineNetwork\": \"projects/PROJECT_ID/locations/LOCATION/vmwareEngineNetworks/NETWORK_ID\"\n \"edgeServicesCidr\": \"EDGE_SERVICES_CIDR\"\n}'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy; this must match the VMware Engine network\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: a name for this network policy\n- \u003cvar translate=\"no\"\u003eINTERNET_ACCESS\u003c/var\u003e: whether VMWare workloads can access the internet; set this to `true` or `false`\n- \u003cvar translate=\"no\"\u003eEXTERNAL_IP\u003c/var\u003e: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `internetAccess` enabled; set this to `true` or `false`.\n- \u003cvar translate=\"no\"\u003eNETWORK_ID\u003cvar translate=\"no\"\u003e\u003c/var\u003e\u003c/var\u003e: the VMware Engine network name\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n\nEdit a network policy\n---------------------\n\n### Console\n\nTo edit an existing network policy using the Google Cloud console, do the following:\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to edit the network policy for.\n\n3. In the list of network policies, find the network policy that you want to\n edit.\n\n4. Click the **More** more_vert\n icon at the end of a row and select **Edit**.\n\n5. On the page that appears, adjust the network policy as you need.\n\n6. Click **Save**.\n\n### gcloud\n\nTo update a network policy, use the [`network-policies update` command](/sdk/gcloud/reference/vmware/network-policies/update): \n\n```\ngcloud vmware network-policies update NETWORK_POLICY_ID \\\n --location LOCATION \\\n --edge-services-cidr=EDGE_SERVICES_CIDR [--external-ip-access] \\\n [--internet-access]\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of the network policy\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n- `--external-ip-access`: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `--internet-access` enabled.\n- `--internet-access`: whether VMWare workloads can access the internet\n\n### API\n\nIn the API, make a `PATCH` request: \n\n```\nPOST https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies?networkPolicyId=NETWORK_POLICY_ID\n\n'{\n \"internetAccess\": INTERNET_ACCESS,\n \"externalIp\": EXTERNAL_IP,\n \"edgeServicesCidr\": \"EDGE_SERVICES_CIDR\"\n}'\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of this network policy\n- \u003cvar translate=\"no\"\u003eINTERNET_ACCESS\u003c/var\u003e: whether VMWare workloads can access the internet; set this to `true` or `false`\n- \u003cvar translate=\"no\"\u003eEXTERNAL_IP\u003c/var\u003e: whether to enable external IP addresses to be assigned to VMware workloads. Must also have `internetAccess` enabled; set this to `true` or `false`.\n- \u003cvar translate=\"no\"\u003eEDGE_SERVICES_CIDR\u003c/var\u003e: the IP address range to use when addressing the VMware Engine public IP gateway (*/26* address range)\n\nDelete a network policy\n-----------------------\n\nTo delete an existing network policy, take the following steps. \n\n### Console\n\n1. In the Google Cloud console, go to the **Network policies** page.\n\n [Go to Network policies](https://console.cloud.google.com/vmwareengine/network-policies)\n2. Click **Select a project** and then select the organization, folder, or project\n that contains the VMware Engine network you want to delete the network policy for.\n\n3. In the list of network policies, find the network policy that you want to\n delete.\n\n4. Click the **More** more_vert\n icon at the end of a row and select **Delete**.\n\n### gcloud\n\nIn `gcloud`, use the [`network-policies delete` command](/sdk/gcloud/reference/vmware/network-policies/delete): \n\n```\ngcloud vmware network-policies delete NETWORK_POLICY_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e with the name of the network\npolicy to delete.\n\n### API\n\nMake a `DELETE` request to the network policy resource: \n\n```\nDELETE https://vmwareengine.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/networkPolicies/NETWORK_POLICY_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for this request\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: the location of this network policy\n- \u003cvar translate=\"no\"\u003eNETWORK_POLICY_ID\u003c/var\u003e: the name of this network policy\n\nWhat's next\n-----------\n\n- [Manage your private cloud resources and activity](/vmware-engine/docs/private-clouds/howto-manage-private-cloud)."]]
