ServerWatch content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
VMware NSX is a network virtualization and security technology that supports VMware’s cloud networking solution. It provides a software-defined networking strategy that spans data centers, clouds, and application frameworks.
NSX brings networking and security closer to the application, regardless of where it runs, from virtual machines (VMs) to containers to physical servers. Networks, like VMs, may be deployed and operated regardless of the underlying hardware.
VMware NSX replicates the complete network architecture in software, allowing any network configuration to be created and provisioned in seconds. These configurations may range from simple to complicated multi-tier networks.
Users can develop intrinsically more flexible and secure environments by combining NSX services with a large ecosystem of third-party integrations to establish various virtual networks with diverse needs. Potential integrations range from next-generation firewalls to performance monitoring solutions. These services may subsequently be extended to a wide range of endpoints both inside and outside of clouds.
VMware NSX as a Software-Defined Networking Solution
VMware NSX is an entirely new operational paradigm for software-defined networking, which serves as the foundation for a Software-Defined Data Center (SDDC) and extends to a cloud network. When a data center network was bound primarily to physical hardware components, it was impossible to attain the same levels of agility, security, and economy that are possible with the cloud.
Logical switching, routing, firewalling, load balancing, VPN, Quality of Service (QoS), and monitoring are all included in VMware NSX’s logical networking and security capabilities and services. These services may be provided in virtual networks using NSX APIs from any cloud management platform. Virtual networks may expand across data centers, public and private clouds, container platforms, and physical servers without causing any disruption to the current network topology.
Capabilities and Major Features
VMware NSX features include routing, switching, load balancing, distributed firewalling, and VPN.
Routing
Scale-out routing with active-active failover using hardware routers, as well as dynamic routing across virtual networks implemented in a distributed way in the hypervisor kernel. Static and dynamic routing protocols are available, as well as IPv6 support.
Switching
Within and beyond data center borders, VMware NSX enables logical Layer 2 overlay extensions across a routed (Layer 3) fabric.
Load Balancing
From the data center to the cloud, VMware NSX Advanced Load Balancer delivers enterprise-grade multi-cloud load balancing, global server load balancing (GSLB), application security and web application firewall, application analytics, and container ingress services.
Distributed Firewalling
Stateful firewalling from Layer 2 to Layer 7 is incorporated in the hypervisor kernel and spread over the whole environment with centralized policy and management including app identity, user identification, and distributed FQDN. Furthermore, the NSX Distributed Firewall interfaces seamlessly integrate with cloud-native technologies like Kubernetes and Pivotal Cloud Foundry, as well as native public clouds like AWS and Azure and physical servers.
VPN
VMware NSX offers cloud gateway services with site-to-site and unmanaged VPN. This offers security and privacy for remote workers and an additional layer of access controls for sensitive data.
Advanced Features in VMware NSX-T 3.2
VMware has released VMware NSX-T 3.2, which includes several advanced capabilities. These include multi-cloud networking and security, gateway firewall, context-aware microsegmentation, NSX Intelligence, NSX Federation, and container networking and security.
Multi-cloud networking and security
Regardless of the underlying physical architecture or cloud platform, provide consistent networking and security across data center locations and private and public cloud infrastructures.
Gateway Firewall
A comprehensive stateful L4–L7 firewall is used to offer security in a full-featured, enterprise-grade network firewall. This includes things like L7 application identification, user identity, and network address translation (NAT).
Context-Aware Microsegmentation
To allow adaptive micro-segmentation policy, security groups and policies may be dynamically established and automatically updated depending on attributes other than IP addresses, ports, and protocols, such as Layer 7 program information, machine name, and tags, operating system type. In Remote Desktop Services (RDS) and Virtual Desktop Infrastructure (VDI) systems, policies based on identity information from Active Directory and other sources provide user-level security down to the individual user session-level.
NSX Intelligence
The NSX Network Detection and Response (NDR) solution can correlate signals from IDS/IPS, NTA, and the sandbox to identify actual intrusions after being integrated into our centralized management platform, NSX Intelligence. To make network segmentation across application traffic easier and more automated, NSX Intelligence now includes scale-out performance as well as enhancements to firewall rule suggestions.
NSX Federation
Network-wide uniform policy, operational simplicity, and simpler disaster recovery architecture are all enabled by centralized policy setting and enforcement across numerous sites via a single pane of glass.
Container Networking and Security
The VMware NSX Container Plugin enables container networking for VMware Tanzu Kubernetes Grid, VMware Tanzu Application Service, VMware vSphere with Tanzu, Red Hat OpenShift, and upstream Kubernetes. With commercial support and signed binaries, VMware Container Networking with Antrea enables in-cluster networking and Kubernetes network policies. Through the NSX management plane, integration with NSX allows multi-cluster network policy administration and centralized connection troubleshooting through trace flow.
VMware NSX Licensing and Pricing
VMware NSX is licensed per processor, with at least one processor licensing key issued to each physical processor (CPU) on a server. CPUs with up to 32 physical cores will be covered by each per-processor license. Additional CPU licenses are necessary if the CPU has more than 32 cores. With fully licensed VMware NSX, the number of VMs that may be secured is limitless.
VMware NSX editions may be purchased on a per-processor basis via VMware channel partners or resellers.
VMware NSX Editions
NSX editions include Professional, Advanced, Enterprise Plus, and Remote Office Branch Office (ROBO).
VMware NSX Professional
VMware NSX Professional is an intermediate-level edition that allows you to link and safeguard applications across your data center, multi-cloud, bare metal, and container infrastructure with your virtual cloud network. VMware NSX Data Center is a full L2-L7 networking and security virtualization platform that gives you the agility, automation, and cost savings that only a software-based solution can provide.
VMware NSX Advanced
For larger and multiple sites, NSX Advanced includes more functionality, including load balancing, multi-vCenter networking and security, and context-aware micro-segmentation. It also has networking and security features for containers.
VMware NSX Enterprise Plus
NSX Enterprise Plus enables Federation and provides VM-to-VM traffic analysis. It also includes VMware HCX Advanced and vRealize Network Insight Advanced.
VMware NSX Remote Office Branch Office (ROBO)
Organizations who need to virtualize networking and security for applications in distant offices and branch offices utilize NSX ROBO.
VMware NSX: Pros and Cons
Software-defined networking (SDN) encompasses NSX, which extends the server virtualization idea pioneered by VMware into the networking realm. In virtualized settings, VMware NSX may be used to execute micro-segmentation, isolating specific workloads inside a specified trust zone and reducing an organization’s attack surface.
The conventional, centralized data center has given way to increasingly dispersed designs as IT infrastructures have progressed. Multiple clouds, multi-hypervisor environments, cloud-native applications, and bare-metal workloads are all supported by VMware NSX-T. The following are some advantages and disadvantages:
Pros
- The ability to utilize tags to handle rules makes it very simple.
- If you’re a frequent vSphere user, integration is simple.
- Micro-segmentation
- End-to-end encryption
- VXLANs’ internal routing without the need for switches, as an appealing virtual machine on the same host
- Rich features
Cons
- Because the data collector creates a lot of data that isn’t transmitted, the migration is still complicated, and if it is decided automatically through the data collector, the environment might be risky
- In multi-vendor environments, interoperability is essential
- If a rule is configured incorrectly, it might prevent communication between hosts, vCenter(s), and NSX components, resulting in long recovery times
VMware NSX Use Cases
VMware NSX use cases include zero-trust security, managing containers, extending your data center, and disaster recovery.
Zero-Trust Security
NSX’s segmentation features may be used to lock down key programs, create a logical DMZ in software, and decrease the attack surface of a virtual desktop environment. In both private and public cloud contexts, zero-trust security is now possible and efficient. With granular micro-segmentation protection, stateful Layer 7 controls, and radically simplified management, you can safeguard critical workloads and environments.
Manage Containers
Just like your VMs, VMware NSX delivers integrated, full-stack networking and security for your containerized apps and microservices. Microservices can benefit from Kubernetes‘s native container networking, micro-segmentation, and end-to-end observability.
Data Center Extension
NSX Data Center extends on-premises data centers to additional physical locations and the cloud via NSX Cloud, allowing businesses to benefit from the scalability, redundancy, and cost savings. Furthermore, VMware NSX Hybrid Connect allows IT administrators to move apps across VMware vSphere environments securely and seamlessly, allowing for zero-downtime live migrations and planned low-downtime, large-scale migrations.
Disaster Recovery
NSX Data Center provides consistent logical networking and security across protected and recovery sites in the event of a disaster, reducing the Recovery Time Objective (RTO). Applications can recover at the recovery site while retaining their network (IP) and security settings since networks and security span consistently different sites. VMware NSX Data Center also makes it simple to build up test networks for testing recovery techniques without disrupting production.
Is VMware NSX Right for You?
VMware NSX Data Center virtualizes all networking and security operations, allowing for speedier deployment through automation and the elimination of error-prone manual procedures. Complete application lifecycle automation guarantees that policies are supplied, maintained, and decommissioned in sync with workloads, removing operational bottlenecks in the application lifetime.
This automated approach ensures fast, consistent networking and security for both old and new applications, regardless of whether they are located in the data center or, with NSX Cloud, in public clouds. Traditional IT chores may be automated, and new cloud-native architectures and platforms, as well as continuing operations, enable IT organizations and developers to move at the speed of business.
The VMware NSX-T 3.2 release broadens and deepens the range of NSX-T use cases, including multi-cloud security, scale-out networking for containers, VMs, and bare-metal workloads, and simpler operations. The version is accessible to the general public, complete with extensive Release Notes outlining all of the new features and capabilities.
By tying networking services to the application workload, VMware NSX Data Center enables quick migration and failover by retaining an application’s networking services (e.g., same IP address, security policy, and other services). As a consequence, the IP address and security policies associated with workloads, whether a VM or container-based, remain consistent as they migrate from one place to another dynamically.
Compare VMware NSX with other network virtualization tools on Enterprise Networking Planet: Best Network Virtualization Software & Products 2022
