VMware NSX DataCenter

VMware NSX® Data Center is the network virtualization and security platform that enables the virtual cloud network, a software-defined approach to networking that extends across data centers, clouds, and application frameworks. With NSX Data Center, networking and security are brought closer to the application wherever it’s running, from virtual machines (VMs) to containers to bare metal.

Like the operational model of VMs, networks can be provisioned and managed independent of underlying hardware. NSX Data Center reproduces the entire network model in software, enabling any network topology—from simple to complex multitier networks—to be created and provisioned in seconds.

Users can create multiple virtual networks with diverse requirements, leveraging a combination of the services offered via NSX or from a broad ecosystem of third-party integrations ranging from next-generation firewalls to performance management solutions to build inherently more agile and secure environments. These services can then be extended to a variety of endpoints within and across clouds.

Networking in software

VMware NSX Data Center delivers a completely new operational model for networking defined in software, forming the foundation of the software-defined data center (SDDC) and extending to a virtual cloud network. Data center operators can now achieve levels of agility, security and economics that were previously unreachable when the data center network was tied solely to physical hardware components.

NSX Data Center provides a complete set of logical networking and security capabilities and services, including logical switching, routing, firewalling, load balancing, virtual private network (VPN), quality of service (QoS) and monitoring.

These services are provisioned in virtual networks through any cloud management platform leveraging NSX Data Center APIs. Virtual networks are deployed non-disruptively over any existing networking hardware and can extend across data centers, public and private clouds, container platforms and bare-metal servers.

Key features

• Enable logical Layer 2 overlay extensions across a routed (Layer 3) fabric within and across data center boundaries. Support for VXLAN- and GENEVE-based network overlays.
• Dynamic routing between virtual networks performed in a distributed manner in the hypervisor kernel, scale-out routing with active-active failover with physical routers. Static routing and dynamic routing protocols supported, including support for IPv6.
• Stateful firewalling up to Layer 7 (including app identification and distributed FQDN allowlisting), embedded in the NSX gateway, distributed across entire environment with centralized policy and management.
• Stateful firewalling up to Layer 7 (including app identification and distributed FQDN allowlisting), embedded in the hypervisor kernel, distributed across entire environment with centralized policy and management. In addition, the NSX Distributed Firewall integrates directly into cloud native platforms such as Kubernetes and Pivotal Cloud Foundry, native public clouds such as AWS and Azure, as well as bare-metal servers.
• L4–L7 load balancer with SSL offload and pass-through, server health checks (and passive health checks), and application rules for programmability and traffic manipulation via GUI or API.
• Site-to-site and remote-access VPN capabilities, unmanaged VPN for cloud gateway services.
• Support for bridging between VLANs configured on the physical network and NSX overlay networks, for seamless connectivity between virtual and physical workloads.
• NSX Intelligence™ provides automated security policy recommendations and continuous monitoring and visualization of every network traffic flow for enhanced visibility, enabling a highly and easily auditable security posture. As part of the same UI as NSX-T™ Data Center, NSX Intelligence provides a single pane of glass for both network and security teams.
• NSX Distributed IDS/IPS™ is an advanced threat detection and prevention engine purpose-built to detect lateral threat movement on east-west traffic. The unique distributed architecture, combined with precise application context, enables security teams to replace discrete appliances while easily achieving regulatory compliance and creating virtual security zones without physical separation of infrastructure.
• Centralized policy configuration and enforcement across multiple locations from a single pane of glass, enabling network-wide consistent policy, operational simplicity and simplified disaster recovery architecture.
• Complete data plane isolation among tenants with a separate routing table, NAT and edge firewall support in each VRF on the NSX Tier 0 gateway.
• RESTful API based on JSON for integration with cloud management platforms, DevOps automation tools and custom automation.
• Native operations capabilities such as central CLI, traceflow, overlay logical SPAN and IPFIX to troubleshoot and proactively monitor the virtual network infrastructure. Integration with tools such as VMware vRealize® Network Insight™ for advanced analytics and troubleshooting.
• Security groups and policies can be dynamically created and automatically updated based on attributes— beyond just IP addresses, ports and protocols—to include elements such as machine name and tags, operating system type and Layer 7 application information to enable adaptive micro-segmentation policy.
• Policies based on identity information from Active Directory and other sources enable user-level security down to the individual user session level in remote desktop services and virtual desktop infrastructure (VDI) environments.