[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Creating your first subnet\n==========================\n\nGoogle Cloud VMware Engine creates a network for each private cloud and uses VLANs for\nnetwork management. For workload virtual machines (VMs), you create subnets as\nnetwork segments on NSX Manager for your private cloud.\nVMware Engine includes NSX for workload networking and security\nfeatures such as microsegmentation and firewall policies. This page explains how\nto create subnets for your workloads using NSX Manager.\n\nBefore you begin\n----------------\n\nThis quickstart assumes that you have done the following:\n\n1. Created a Google Cloud VMware Engine private cloud. You can create one by completing the following quickstart: [Creating your first private cloud](/vmware-engine/docs/create-private-cloud).\n2. Allocated address ranges in your network for the following purposes:\n - A DHCP service\n - A subnet for the NSX workload network segment\n\n| **Note:** VMware Engine gives you administrator access to NSX Manager by default. If you prefer role-based access control (RBAC) for NSX, then you must set up VMware Identity Manager (vIDM). If you require [RBAC for NSX](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-1CAC911E-A224-4521-A9A2-0D668B4BFB61.html), [contact\n| Cloud Customer Care](/vmware-engine/docs/support).\n\nAccess NSX Manager from the VMware Engine portal\n------------------------------------------------\n\nThe process of creating a subnet happens in NSX, which you access through\nVMware Engine:\n\n1. In the Google Cloud console, go to the **Private clouds** page.\n\n [Go to Private clouds](https://console.cloud.google.com/vmwareengine/privateclouds)\n2. Click **Select a project** and then select the organization, folder, or project where\n the private cloud is located.\n\n3. Click the private cloud name where you want to create the subnet.\n\n4. Under **Management appliances** , click the **URL** corresponding to NSX\n Manager.\n\n5. When prompted, enter your sign-in credentials. As a reminder, you can\n [retrieve generated credentials](/vmware-engine/docs/vmware-platform/howto-access-vsphere-client#sign-in) from\n the private cloud details page.\n\nIf you've set up vIDM and connected it to an identity source, such as Active\nDirectory, use your identity source credentials instead.\n\nSet up DHCP service for the subnet\n----------------------------------\n\nBefore you can create a subnet, set up a DHCP service:\n\n1. In NSX, go to **Networking \\\u003e DHCP**. The networking dashboard shows that the service creates one tier-0 and one tier-1 gateway.\n2. To begin provisioning a DHCP server, click **Add DHCP Profile**.\n\n | **Note:** NSX supports DHCP relay as well. For more information, see the VMware documentation for [creating a DHCP relay service](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-2505EDA1-769C-46A5-A206-38EF9B760C9A.html)\n3. In the **DHCP name** field, enter a name for the profile.\n\n4. For **Profile type** , select **DHCP server**.\n\n5. In the **Server IP address** column, provide a DHCP service IP address\n range.\n\n6. Click **Save** to create the DHCP service.\n\nNext, attach this DHCP service to the relevant tier-1 gateway. A default tier-1\ngateway has already been provisioned by the service:\n\n1. In NSX, go to **Networking \\\u003e Tier-1 Gateways**.\n2. Click the more_vert vertical ellipses next to your tier-1 gateway and select **Edit**.\n3. In the **DHCP** field, click the **Set DHCP Configuration** link.\n4. Set **Type** to **DHCP Server** and select the **DHCP Server Profile** that you just created.\n5. Click **Save**.\n6. Click **Close Editing**.\n\nYou can now create a network segment in NSX. For more information about DHCP\nin NSX, see the [VMware documentation for DHCP](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-1409548E-C26E-4AAE-9B6F-CFDCC6798175.html).\n\nCreate a network segment in NSX\n-------------------------------\n\nFor workload VMs, you create subnets as NSX network segments for your private\ncloud:\n\n1. In NSX, go to **Networking \\\u003e Segments**.\n2. Click **Add Segment**.\n3. In the **Segment Name** field, enter a name for your segment.\n4. In the **Connected Gateway** list, select **Tier1** to connect to the tier-1 gateway.\n5. In the **Transport zone** list, select **TZ-OVERLAY \\| Overlay**.\n6. In the **Subnets** column, enter the subnet range. Specify the subnet range with `.1` as the last octet. For example, `10.12.2.1/24`.\n7. Click **Set DHCP Config** , and provide values for the **DHCP Ranges** field.\n8. Click **Apply** to save your DHCP configuration.\n9. Click **Save**. You can now select this network segment in vCenter when creating a VM.\n\nIn a given region, you can advertise at most **250** unique routes from\nVMware Engine to your VPC network using private\nservices access. For example, those unique routes include private cloud\nmanagement IP address ranges, NSX workload network segments, and HCX internal\nIP address ranges. This route limit includes all private clouds in the region\nand corresponds to the Cloud Router learned route limit.\n\nFor information about routing limits, see [Cloud Router Quotas and\nlimits](/network-connectivity/docs/router/quotas#limits).\n\nBest practices for subnet configuration and route redistribution in NSX\n-----------------------------------------------------------------------\n\nTo ensure optimal network operation and to prevent routing loops and service\ndisruptions, follow these guidelines when configuring subnets and routes\nredistribution within NSX:\n\n1. **Subnet overlapping**: Avoid overlapping subnets - Ensure that IP subnets used in VMware Engine are unique and don't overlap with subnets in your private cloud or external networks. Overlaps can cause routing problems and disrupt services.\n2. **Tier-0 route redistribution** :\n - Automatic redistribution - VMware Engine redistributes routes for connected Tier-1 segments within the Tier-0 router using BGP for proper connectivity between workloads and the external world.\n - Redistributing static routes - When redistributing static routes on Tier-0, it's crucial to first deny the default route (`0.0.0.0/0`) and then allow all traffic using a prefix list to prevent routing loops. To do this, you should create and attach a prefix-list to both of the BGP neighbors on the Tier-0 gateway, as VMware Engine already configures a default route (`0.0.0.0/0`) on Tier-0 gateways pointing toward the underlying infrastructure, which you can do by following the steps in the next two sections.\n\nCreate a prefix-list in NSX\n---------------------------\n\nTo create a prefix-list in NSX in VMware Engine, do the following:\n\n1. In NSX, go to **Networking \\\u003e Tier-0 Gateways**.\n2. Click the menu icon (three dots) and click **Edit**.\n3. Click **Routing**.\n4. Click **Set** next to IP Prefix List.\n5. Click **Add IP Prefix List**.\n6. Enter a name for the IP prefix list.\n7. Click **Set** to add IP prefixes.\n8. Click **Add Prefix** .\n 1. In the **Network** field, enter a keyword \"any\".\n 2. Leave all fields as is, and in the **Action** field, select **Permit** from the drop-down menu.\n 3. Click **Add**.\n9. Click **Add Prefix** again.\n 1. In the **Network** field, enter an IP address in CIDR format, for example `0.0.0.0/0`.\n 2. Leave all fields as is, and in the **Action** field, select Deny from the drop-down menu.\n 3. Click **Add**.\n10. Click **Apply**.\n11. Click **Save \\\u003e Close**.\n\nAttach the prefix-list to both BGP neighbors\n--------------------------------------------\n\nAfter creating the prefix-list, the next task is to attach the prefix-list to\nboth the BGP neighbors in NSX by doing the following:\n\n1. In NSX, go to **Networking \\\u003e Tier-0 Gateways**.\n2. Click the menu icon (three dots) and click **Edit**.\n3. Click **BGP**.\n4. Click **BGP Neighbors**.\n5. Click the menu icon (three dots) and select **Edit**.\n6. Click **Route Filter**.\n7. Click the menu icon (three dots) and select **Edit**.\n8. Click **Configure** on the **Out Filter** field.\n9. Select the prefix-list name previously created.\n10. Click **Save**.\n11. Click **Add \\\u003e Apply**.\n12. Click **Save**.\n13. Repeat steps 5-13 to update another BGP neighbor.\n14. Click **Close Editing**.\n\nWhat's next\n-----------\n\n- Learn more about [IP address management (IPAM)](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-A27DF20A-5162-40F5-B7D5-2DF8B6AE5DBE.html) using NSX."]]
