VMware NSX Technical Deep Dive

This section is answering the fundamental questions one should know when considering VMware NSX:

• What problem is it trying to solve?
• What are the differences between NSX-V and NSX-T, and where would you use one or the other?
• How is the product licensed?

It also describes the high-level architecture of NSX-V, its components and their interaction.

VMware NSX logical switches implement overlay virtual networks emulating Ethernet (layer-2) segments with VXLAN encapsulation.

This section describes how NSX implements VXLAN data and control plane, and what it expects from the physical (underlay) network infrastructure.

Overlay virtual networks are more scalable than traditional VLAN-based virtual networks... but the clients accessing the servers connected to the overlay networks still reside in the physical world.

This section describes three variants of physical-to-virtual gateways (bridge, router, network services device) and their software and hardware implementation in VMWare NSX-V.

Distributed logical routers provide optimal any-to-any packet forwarding within overlay virtual networks. This section describes the details of NSX-V distributed logical routers (DLR), including:

• DLR control- and data plane architecture;
• Packet forwarding with DLR;
• DLR integration with the outside world.

NSX-T provides a two-tier logical routing functionality with packet forwarding split between distributed routers running on every transport node and services routers running on NSX Edge nodes.

This section describes the details of NSX-T logical routers, including:

• NSX-T logical routers and network services
• Distributed- and services routers architecture
• Packet flow across NSX-T logical routers
• Connectivity to the outside world
• VRF-Lite and EVPN support
• IP Multicast in NSX-T 3.0
• Internal routing and BGP routing with external routers
• Logical router high availability

VMware NSX includes stateful distributed firewall that can filter traffic not only based on traditional attributes (IP, MAC, TCP/UDP ports) but also based on vCenter objects, users logged into virtual machines, or application fingerprints.

Other security solutions available in VMware NSX framework include integration of third-party security appliances, comprehensive service insertion (NSX-T only), distributed IDS (NSX-T only), and guest introspection and service composer (NSX-V only).

VMware NSX provides a plethora of network services including:

• Firewalling and NAT
• Load balancing and SSL proxy functionality
• SSL VPN, IPsec VPN and L2VPN
• DHCP and DNS proxy

These services are running in ESG (NSX-V) or NSX Edge nodes (NSX-T)

Even though VMware NSX was never designed for cross-site deployments, VMware force-fit it into stretched VLAN segments concept.

In this section you'll discover the architecture of cross-site NSX deployments, NSX-V universal objects, routing hacks needed to prevent traffic trombones, and NSX-V/NSX-T behavior under split-brain scenarios.

NSX-T federation is a management-plane solution that allows you to configure virtual networking and security objects across multiple NSX-T deployments. It also includes security group synchronization between NSX-T Local Managers, and stretched layer-2 segments and distributed routers.