VMware NSX-T - Innovation in Multi-Cloud Networking Solutions
VMware NSX is a powerful software-based networking solution that enables businesses to meet the security, automation, and flexibility challenges of today's data centers.
Whereas in the past, implementing even simpler network changes involving physical hardware was a time-consuming and complex activity that required the involvement of the entire IT team, now new approaches make it much easier to implement changes, configurations, new designs, and architectures in code.
Today, most virtual data centers already use hardware virtualization, which has made the provision of cloud services much more flexible and cost-effective. Virtualization allows the data center to be scaled more efficiently, which in turn provides better cloud services to data center customers at lower cost.
One of the most exciting new approaches in the virtualization world is the Software-defined Network (SDN). In this approach, the physical network is simply the underlying environment on which virtual network packets are exchanged and routed.
VMware NSX is a powerful software-based networking solution that enables businesses to meet the security, automation, and flexibility challenges of today's data centers.
The four main benefits of VMware NSX
Micro-segmentation
Micro-segmentation helps organizations to implement what is often referred to as the “zero-trust” model of security where all network endpoints are viewed as dangerous. In traditional network security, you have an edge firewall that separates what was traditionally thought of as “untrusted” zones such as the Internet and then “trusted” zones such as your LAN.
However, what if an attacker successfully infiltrates inside the LAN?
With traditional network security tactics, an attacker would gain control of all "trusted" network endpoints on the LAN. With NSX, however, this situation is ruled out by a virtual NSX-T horizontal (intra-network traffic) and vertical (external network traffic) firewall.
According to the principle of micro-segmentation, a network endpoint is not trusted and is only allowed to communicate with specific network endpoints and services that you specify. Whether your goal is to lock critical applications or create a logical subnet, it's easy to do with NSX. Micro-segmentation and a horizontal firewall significantly reduce the size of a potential attack area.
Multi-Cloud Networking and Federation
Many companies have deployed hybrid infrastructure that spans from an on-premises data center to one or more public clouds. If you need to effectively scale and expand network traffic to the cloud without sacrificing security and network policies, NSX can easily let do that.
VMware NSX enables the creation of software-sophisticated segmented networking solutions at the virtualization level across different data centers. With the next-generation NSX-T, you can easily connect your data center to the public clouds of VMware Cloud service providers or to AWS and Azure services.
With virtualized networks, businesses can deploy and move their applications seamlessly across locations, regardless of geographic boundaries.
Network Automation
VMware NSX is a fully software-defined solution that is fully accessible, configurable, and manageable through APIs.
All of NSX's virtualized networking and security features can be automated to help reduce downtime and associated bottlenecks and errors, and to help ensure that security policies are met and brought into line with business requirements. Common solutions such as Ansible, Terraform and vRealize automation are supported.
Cloud-Native Apps
Cloud-based applications, such as host-based apps, benefit from the same networking benefits as microsegmentation and all other NSX services. NSX allows you to implement common network policies and rules no matter where or on which platform it runs. The next generation VMware NSX-T is tightly integrated with VMware Tanzu Kubernetes solutions.
When creating a new application in the VMware Tanzu solution, the network, firewall, access policies and load balancer are automatically configured.
The new generation solution NSX-T
Currently, VMware NSX has two variants: the end-of-life NSX-V and the next-generation NSX-T. In January 2022, support for the NSX-V product, launched in 2012 by VMware, ended, and its users must switch to NSX-T. NSX-V was a powerful VMware SDN solution, but it was limited by its dependence on vCenter Server and its outdated architecture.
The applications of the future will be cloud-centric and independent of the specific hypervisor and the data center. VMware has strategically developed NSX-T to provide functionality for networking problems in on-premises, hybrid, and multi-cloud environments.
The main difference between NSX-V and NSX-T is that NSX-T is "disconnected" from VMware vSphere, which means that you do not need to have a vCenter server to deploy NSX-T. This enables VMware's innovative and better managed network services. NSX-T has built-in support for various hypervisors (vSphere ESX, CentOS Linux KVM, Ubuntu KVM, etc.) and environments (Kubernetes, Docker, OpenStack, etc.).
Encapsulation protocol
Instead of NSX-V VXLAN, NSX-T has adopted the more modern GENEVE protocol. The GENEVE encapsulation protocol is more efficient and offers more performance than VXLAN, and has better latency in distributed networks.
Routing and IP addresses
The NSX-V used DLR (Distributed Logical Router) and centralized routing, which is not optimal in a multi-location network and can increase latency. In addition, DLR does not offer good support for multi tenant solutions which is a basic requirement for modern cloud services.
NSX-T uses a two-tier Tier 0 and Tier 1 distributed routing model, where all network segments are automatically provisioned. A Tier 0 router is used to connect to external networks, while Tier 1 acts as an organization's edge gateway. Their interconnections are automated and do not require time to plan the network components of the service.
Security
NSX-T allows you to set security policies for all cloud-based applications at once, helping you make better use of transport nodes. It can be applied dynamically to each workload based on application attributes and user-specific tags. IPS allows you to automatically quarantine compromised applications. NSX-T allows you to send selective traffic to third-party security services.
Using NSX-T in the VMware Cloud
VMware Cloud is a service provided by VMware Service Provider partners that use a VMware software stack managed by the VMware Cloud Director. Through Cloud Dircetor, customers can manage their cloud services and also use all the functionality offered by NSX-T. The customer can create routed or isolated networks and define vApp subnets and gateways that are horizontally protected by a distributed firewall. Edge or vApp gateway includes firewall, NAT (SNAT, DNAT), IPSEC, L2 VPN, load balancer and more. The new NSX-T solution creates the ability to use Routed and Isolated networks across cloud service sites. Previously, this was available for an additional fee using the Cross VDC Federation functionality. In the same way, network services and gateways work on cloud sites. This in turn allows services/virtual servers to be hosted using the same networks and settings in different data centers to achieve the highest possible availability. The new solution also makes it significantly easier to use the VMware Cloud Availability disaster recovery service. The network services used in the main data center are immediately available in the disaster recovery data center, and users do not need to make complex network solutions to ensure the connectivity of the applications restored in the disaster recovery data center with networks and services. The network components of NSX-T are also distributed in different data centers, in the event of a failure of one center, network services are not interrupted.
