nsx
-
NSX-T version 3.0 brings a new routing construct to the table: VRF Lite. With VRF Lite we are able to configure per tenant data plane isolation all the way up to the physical network. Creating dedicated tenant Tier-0 Gateways for this particular use case is now a thing of the past! With 100 VRFs per…
-
Some weeks ago I introduced you to my GitHub repository containing a set of Ansible playbooks helping people deploy a highly customizable vSphere 6.7/7.0 with NSX-T 2.5/3.0 nested lab environment. As I mentioned in the “launch” post, this project is a work in progress and during the last couple of weeks I’ve been spending many…
-
It’s finally here. NSX-T 3.0 adds support for Active Directory identity sources to be used with NSX-T role-based access control. This will make life a little easier for many customers. Previously, a separate VMware Identity Manager (vIDM) virtual appliance was required to be able to map Active Directory users and groups to NSX-T roles. Now…
-
With VMware releasing new major versions of vSphere and NSX-T last week, it’s high season for nested lab deployments. My Norwegian Proact colleague Rudi Martinsen just published a great two part series on how to deploy a nested lab using vRealize Automation. My Dutch buddy at VMware Iwan Hoogendoorn is doing something very exciting with…
-
With the release of vSphere 7 comes the vSphere Distributed Switch 7.0. This latest version comes with support for NSX-T Distributed Port Groups. Now, for the first time ever it is possible to use a single vSphere Distributed Switch for both NSX-T 3.0 and vSphere 7 networking! First and foremost, this new integration enables a…
-
Welcome back! Today we continue our NSX-T Multisite adventure. Let’s begin with a short recap of what we did in part 1. We started off in an environment with a production site and a partially deployed disaster recovery site. Tasked with configuring the NSX-T 2.5.1 implementation for the new multisite environment, we took the following…
-
When it comes to creating a design for NSX-T Multisite, use case and geography are two key factors. Two common use cases for organizations to start looking at a multisite architecture are: Disaster Recovery – Protection against site failure. Availability – Workload pooling with active workloads at each site facilitating higher service availability. Site geography…
-
Integrating third party security services with NSX has always been a popular feature of the platform. While NSX comes with its own set of robust security services, there are scenarios where additional workload protection is required. The ability for a partner solution to leverage the rather unique layer in which the NSX platform operates with…
-
Recently somebody asked me if it was possible to see the current status for individual NSX-T load balancer server pool members. This information is indeed available in the NSX Manager simplified UI as you can see below: The same info can be found under Advanced Networking & Security: It’s nice that we can find this…
-
The next release of Terraform’s NSX-T provider will add support for the NSX-T policy API. I know many people (including myself) have been waiting for this so it’s kind of a big thing within that space. While the new NSX-T provider is not released yet (it’s still being tested), the source code is available on…
-
With NSX-T logical networking the Tier-0 uplinks become the central passage for all of the North-South traffic—i.e., traffic between the NSX-T logical networks and the physical network. A critical point in the NSX-T data plane and one that we might want to place under a magnifying glass from time to time. In this short article…
-
Welcome back! We’re in the process of building an NSX-T Edge – FRRouting environment. In part 1 we prepared the FRR routers by doing he following: Installed two Debian Linux servers Installed VLAN support Enabled packet forwarding Configured network interfaces Installed and configured VRRP Installed FRRouting In this second part we will first deploy the…
-
Until recently I always used pfSense with the OpenBGPD package as the NSX-T Edge counterpart in my lab environment. It’s quick and easy to set up and works well enough. But pfSense is not what I typically find in a customer’s production environment. I started to investigate other virtualized “top-of-rack solutions” for the lab that…
-
Now that I started studying for the AWS Certified Advanced Networking – Specialty I have to learn pretty much everything about AWS networking. Naturally VPN is a part of that. When it comes to AWS VPN the most common use case is establishing secure Site-to-Site connections between the customer’s data center and a Virtual Private…
-
A while back Dumlu Timuralp published an excellent guide on integrating NSX-T 2.5 with K8s. If you haven’t read it already I strongly recommend that you have a look at it. The guide goes through every step of configuring the integration and does a great job explaining the architecture and components that make up this…
-
Like any other firewall the NSX-T Distributed Firewall (DFW) consumes memory and CPU. Unlike other firewalls the DFW’s resource consumption is distributed, taking place on the transport nodes where the workloads it protects reside. Memory allocation An ESXi transport node allocates a fixed amount of memory for the different DFW components. The amount of memory…
-
After receiving a couple questions about the NSX-T firewall policy locking feature, I decided to write a short blog post about it. The purpose of locking a firewall policy The easy part first. As explained in the official NSX-T documentation we lock a firewall policy to prevent multiple users from editing the same section. Locks…
-
With every new release of NSX-T interesting features are added to the platform. Take failure domain for example. Introduced in version 2.5, failure domain adds another layer of protection for the centralized services running on Tier-1 Gateways. It basically facilitates a rack aware placement mechanism for the Tier-1 service router (SR) components. In today’s article…
-
Imagine this, you’ve been tasked with implementing micro-segmentation in your vSphere environment. You just deployed and configured NSX-T and the next step is to migrate VMs from their VDS port groups to N-VDS segments. You fire up the vSphere Client and expand the VDS to have a look at the current situation: It’s pretty bad.…
-
Welcome back! I’m in the process of setting up NSX-T in a stretched cluster environment. In part 1 I deployed the NSX manager cluster and configured the ESXi hosts as NSX transport nodes. The N-VDS was installed on the ESXi hosts and their vmkernel adapters migrated from the VDS to the N-VDS. In this second…