VCF 4.2 and later versions support NSX-T Federation, which is the foundation to support a multisite dual-region deployment. It allows two separate VCF instances in data centers at two different locations in large distance regions to be connected. This connection provides for centralized management, consistent networking, and security policy configuration with enforcement and synchronized operational state. With NSX-T Federation, VCF can use stretched networks and unified security policies across multi-region VCF deployments, providing workload mobility and simplified disaster recovery. The deployment and configuration are done manually following prescriptive guidance in VMware VVD documentation.

The NSX-T Global Manager is part of multi-region deployments where NSX-T Federation is required. NSX-T Global Manager is a central component deployed as a cluster for availability and can connect multiple NSX-T Local Manager instances under a single global management plane. NSX-T Global Manager provides the user interface and the RESTful API for creating, configuring, and monitoring NSX-T global objects, such as global virtual network segments, and global Tier-0 and Tier-1 gateways.

Connected NSX-T Local Manager instances create the global objects on the underlying software-defined network that you define from NSX-T Global Manager. An NSX-T Local Manager instance in an individual region directly communicates with NSX-T Local Manager instances in other regions to synchronize configuration and state needed to implement a global policy.

Consider the following additional requirements for an NSX-T Federation deployment:

• A maximum round-trip time of 150 milliseconds is permitted between the following nodes:

• Global Manager and Local Manager
• Local Manager and remote Local Manager

• Each site must have a Remote Tunnel Endpoint (RTEP) VLAN, which is used for inter-site communications.
• The management WLD must be sized accordingly to allow for the additional Global Manager clusters that will be deployed if NSX-T Federation is implemented.
• The Global Manager and Local Manager appliances must all have NSX-T Data Center 3.1.0 or later installed. All appliances in an NSX-T Federation environment must have the same version installed.
• The required ports must be open to allow communication between the Global Manager and Local Managers. See VMware Ports and Protocols at NSX-T Federation Ports.

An NSX-T Global Manager cluster is deployed in the management WLD at region A and region B. The cluster in the second region acts as a standby and becomes active if the first region cluster fails or is lost. A cluster consists of three manager VMs. Each NSX-T domain that needs to be federated require an NSX-T Global Manager cluster deployed in the management workload at each region. The following figure shows a dual region deployment with a single NSX-T VI WLD. A Global Manager cluster is deployed at each location for the Mgmt WLD and the VI WLD NSX-T domains.

Figure 58.    Multi-site – Dual-region NSX-T Global Manager placement

In a dual region deployment, each region has its own NSX-T Edge cluster. In each region, the Edge Nodes and clusters are deployed with the same design but with region-specific settings such as IP addressing, VLAN IDs, and names. Each Edge cluster is managed by the NSX-T Local Manager instance for that region and WLD. After a VCF deployment of the Mgmt WLD, all NSX-T network components will be local to the Mgmt WLD NSX-T instance. As part of the NSX-T Federation deployment, the network components are configured to span both regions. For more detail for the deployment of NSX-T Federation, see the VCF documentation Deploy NSX-T Federation for the Management Domain in the Dual-Region SDDC.

Region-to-region workload traffic traverses the inter-region overlay tunnels which terminate on the RTEPs on the NSX-T Edge Nodes. To support this inter-region communication, you must provision additional RTEP VLANs for the Edge Nodes. If the region also contains multiple availability zones, this network must be stretched across all availability zones in Region A.

The VVD routing design uses region preference for north-south traffic and does not use local-egress. All segments have a preferred and failover region for network traffic ingress and egress for that segment. This design eliminates the complexities of trying to prevent asymmetrical routing and control of local ingress at the physical network layer. For full details about the north-south routing design, see NSX-T Routing for a Multi-Region SDDC for the Management Domain.

The NSX-T Global Managers are deployed manually outside of VCF. LCM of these components must be done outside of SDDC Manager because SDDC Manager has no awareness of the Global Managers. The upgrade of the NSX-T Global Managers must be done using the upgrade coordinator available on the Global Manager appliance. When planning an upgrade of VCF when NSX-T Federation has been deployed:

• Before the upgrade of any WLD, evaluate the impact of any version upgrades on the need to upgrade NSX-T Global Manager.
• Use NSX-T Upgrade Coordinator to perform life cycle management on the NSX-T Global Manager appliances.
• Before the upgrade of the NSX-T Global Manager, evaluate the impact of any version change on the existing NSX-T Local Manager nodes and WLDs.