Isolated networks are good for testing; however, getting stuff in or out is hard. The following section shows how to make it easier. I call it "hole-in-the-Fence".
You need a fully deployed vApp with an internal vApp Network and at least one VM (preferably two) in it. You can use the Deploying a vApp with vApp router recipe in this chapter to get started. However, you will need to connect a Direct Organization Network to the vApp so that you can test this configuration using your desktop. To add a single VM to the vApp, have a look at the Adding a VM to a vApp recipe in Chapter 3, Better vApps.