Until recently I always used pfSense with the OpenBGPD package as the NSX-T Edge counterpart in my lab environment. It’s quick and easy to set up and works well enough. But pfSense is not what I typically find in a customer’s production environment. I started to investigate other virtualized “top-of-rack solutions” for the lab that…
Now that I started studying for the AWS Certified Advanced Networking – Specialty I have to learn pretty much everything about AWS networking. Naturally VPN is a part of that. When it comes to AWS VPN the most common use case is establishing secure Site-to-Site connections between the customer’s data center and a Virtual Private…
A while back Dumlu Timuralp published an excellent guide on integrating NSX-T 2.5 with K8s. If you haven’t read it already I strongly recommend that you have a look at it. The guide goes through every step of configuring the integration and does a great job explaining the architecture and components that make up this…
Like any other firewall the NSX-T Distributed Firewall (DFW) consumes memory and CPU. Unlike other firewalls the DFW’s resource consumption is distributed, taking place on the transport nodes where the workloads it protects reside. Memory allocation An ESXi transport node allocates a fixed amount of memory for the different DFW components. The amount of memory…
After receiving a couple questions about the NSX-T firewall policy locking feature, I decided to write a short blog post about it. The purpose of locking a firewall policy The easy part first. As explained in the official NSX-T documentation we lock a firewall policy to prevent multiple users from editing the same section. Locks…
With every new release of NSX-T interesting features are added to the platform. Take failure domain for example. Introduced in version 2.5, failure domain adds another layer of protection for the centralized services running on Tier-1 Gateways. It basically facilitates a rack aware placement mechanism for the Tier-1 service router (SR) components. In today’s article…
Imagine this, you’ve been tasked with implementing micro-segmentation in your vSphere environment. You just deployed and configured NSX-T and the next step is to migrate VMs from their VDS port groups to N-VDS segments. You fire up the vSphere Client and expand the VDS to have a look at the current situation: It’s pretty bad.…
Read more Bulk Create NSX-T Segments Using A Postman Data File
Welcome back! I’m in the process of setting up NSX-T in a stretched cluster environment. In part 1 I deployed the NSX manager cluster and configured the ESXi hosts as NSX transport nodes. The N-VDS was installed on the ESXi hosts and their vmkernel adapters migrated from the VDS to the N-VDS. In this second…
A stretched cluster architecture facilitates for higher levels of availability and things like inter-site load balancing. It’s a common multisite solution and also part of VMware’s Validated Design for SDDCs with multiple availability zones. Traditionally compute networking in an active-active multisite setup has had its challenges, but with vSAN storage and NSX networking technologies that’s…
Recently a new version of the NSX-T Reference Design Guide was released. This guide, which now covers NSX-T versions 2.0 – 2.5, is a must read for anyone interested in the NSX-T solutions and their recommended design. One of the things you’ll find in the updated guide is a new recommended deployment mode for the…
