The document discusses VMware NSX and its technical overview. It begins with defining what software defined networking means, including decoupling the control plane from the data plane. It then provides an agenda and overview of NSX architecture, including its components in the data plane, control plane, and management plane. Key features of NSX like logical switching, routing, and distributed firewalling are described.

1. VMware NSX
21st VMUGBE+ Meeting
Filip Verloy
Sr. Specialist Systems Engineer, Networking and Security
Twitter: @filipv

2. Agenda
1 What does Software Defined mean?
2 VMware NSX Technical Overview
3 Q&A
2

4. Software Defined: Technical What & Technical Why
• Decoupling and abstracting
control and policy (control plane)
from physical stuff that does work
(data plane).
• Where the physical stuff that does
work (data plane) can be software
on commodity hardware, do it that
way
• Programmable infrastructure
APIs: automate everything
4
• Reduce infrastructure “fragility” by
abstraction and reducing
operational complexity
• Increase agility
• Open up new architectural options
(converged, software data planes)

5. From the POV of a switch
5

6. Software Defined vs Hardware Defined
6
• Tesla OTA firmware update v6.0 adds
location-based smart air suspension.
Example: Auto raise when arriving at
home’s steep entry way.
• You make an appointment at your local
garage and 3 weeks later Joe the
mechanic installs new suspension and
throws old the old ones.

7. Agenda
1 What does Software Defined mean?
2 VMware NSX Technical Overview
3 Q&A
7

8. A data center network…
Internet

9. Compute infrastructure….
Internet

10. Hypervisors and vSwitches…
Internet

11. NSX | Network Virtualization Platform
Internet

12. The Operational Model of a VM for Networking
Internet

13. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

14. Provides
A Faithful Reproduction of Network & Security Services
in Software
Switching Routing Firewalling Load
Balancing
VPN Connectivity
to Physical
What is NSX?
14

15. Creating Sophisticated Application Topologies
Web-Tier
App-Tier
DB-Tier
VMs Connect to
Virtual Networks
Virtual Networks Connect to
non-virtualized Workloads
Security Enforcement at
vnic level

16. Creating Sophisticated Application Topologies
Web-Tier
App-Tier
DB-Tier
VMs Connect to
Virtual Networks
Virtual Networks Connect to
non-virtualized Workloads
Security Enforcement at
vnic level
With Physical Services
Integration

17. NSX Architecture and Components
Cloud Consumption • Self Service Portal
• vCloud Automation Center, OpenStack, Custom
Data Plane
NSX Edge
Distributed Services
ESXi Hypervisor Kernel Modules
• High – Performance Data Plane
• Scale-out Distributed Forwarding Model
Management Plane
NSX Manager
• Single configuration portal
• REST API entry-point
Control Plane
NSX Controller
• Manages Logical networks
• Control-Plane Protocol
• Separation of Control and Data Plane
Distributed Firewall
Logical Router
Logical
Switch
Logical Network
Physical
Network
…
…

18. NSX Data Plane Components
Data Plane
Edge Clusters (Physical-to-Virtual)
Security VXLAN DLR DFW
Security VXLAN DLR DFW Security VXLAN DLR DFW
• vSphere Distributed Switch
• VMkernel Modules
• Logical Switching (VXLAN)
• Distributed Logical Router
• Distributed Firewall
NSX Edge Service Gateways
• VM form factor
• Highly Available
• Dynamic Routing:
• OSPF, IS-IS, BGP
• L3-L7 Services:
• NAT, DHCP, Load Balancer, VPN, Firewall
ESXi
Hypervisor Kernel Modules (VIBs)
Distributed
Firewall
Distributed
Logical Router
Logical
Switch
vSphere Components
… …
Compute Clusters

19. NSX vSwitch
19

20. NSX Control Plane Components
 Properties
NSX Controllers
Virtual Form Factor (4 vCPU, 4GB RAM)
Data plane programming
Control plane Isolation
 Benefits
Scale Out
High Availability
VXLAN - no Multicast
ARP Suppression
vSphere Cluster
 vSphere HA
 DRS with Anti-affinity
Host Agent
Data-Path Kernel Modules
VM ESXi VM VM
20

21. Management Plane Components
vSphere APIs NSX REST APIs
NSX Manager 1:1
NSX Manager
• Runs as a Virtual Machine
• Provisioning and Management of
Network and Network services
• VXLAN Preparation
• Logical Network Consumption
• Network Services Configuration
Management Plane
vCAC/Openstack/Custom
vCenter
3rd Party
Management Console
NSX Manager
vSphere Plugin
Single Pane of Glass

22. NSX Component Interaction - Deployment and Configuration
Deploy NSX Manager
1
2
5
Register with vCenter
Deploy NSX Controllers
3
vCenter
Prepare Hosts
4
Configure and deploy NSX
Edge Gateway(s) and network
services
NSX Manager
NSX Controller
NSX Edge Services GW
vSphere Cluster 1 vSphere Cluster 2 vSphere Cluster N
22

23. Deploying and Configuring VMware NSX
Deploy VMware NSX
NSX
Edge
NSX
Mgmt
Virtual Infrastructure
Component Deployment
Deploy NSX Manager
Deploy NSX Controller Cluster
Preparation
Host Preparation
Logical Network Preparation
One Time
Consumption
+ + +
Programmatic
Virtual
Network Deployment
Logical Networks
Recurring
Logical Network/Security Services
Deploy Logical Switches per tier
Deploy Distributed Logical Router
or connect to existing
Create Bridged Network

24. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

25. NSX Logical Switching
VMware NSX
Logical Switch 1 Logical Switch 2 Logical Switch 3
Challenges Benefits
• Per Application/Multi-tenant segmentation
• VM Mobility requires L2 everywhere
• Large L2 Physical Network Sprawl – STP
Issues
• HW Memory (MAC, FIB) Table Limits
• Scalable Multi-tenancy across data center
• Enabling L2 over L3 Infrastructure
• Overlay Based with VXLAN, etc.
• Logical Switches span across Physical Hosts
and Network Switches

26. Network Overlays
Outer
MAC
HDR L2 Frame
L2 Frame VXLAN
UDP
L2 Frame HDR
HDR
Outer
IP
HDR
1
VM Sends a
standard L2 Frame
2
Source Hypervisor
(VTEP)
Adds VXLAN, UDP &
IP Headers
4
Destination
Hypevisor (VTEP)
de-encapsulates
headers
3
Physical Network
forwards frame as
standard IP frame
5
Original L2 Frame
delivered to VM
VXLAN VXLAN

27. Physical Workload Integration
Use-case: Integrate non-virtualized workloads seamlessly with virtual networks
Solution: NSX providing Bridging Functionality or use of 3rd party hardware Gateways
Physical Workloads
x86-based bridge
VXLAN VLAN
Leverages any x86 server
Physical Workloads
HW VTEP
VXLAN VLAN
Highest density requiring specific hardware

28. Logical View: VMs in a Single Logical Switch
172.16.10.11 172.16.10.12 172.16.10.13
Web LS
172.16.10.0/24
VM1 VM2 VM3
172.16.20.12
VM5
172.16.20.11
VM4
App LS
172.16.20.0/24

29. Physical View: VMs in a Single Logical Switch
VM1
172.16.10.11 172.16.10.12 172.16.10.13
vSphere Distributed Switch
VM2
Logical Switch 5001
VM3
Transport Subnet A 192.168.150.0/24
192.168.150.51 192.168.150.52 192.168.250.51
Physical Network

30. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

31. NSX Routing: Distributed, Feature-Rich
Challenges
CMP
• Physical Infrastructure Scale
Challenges – Routing Scale
• VM Mobility is a challenge
• Multi-Tenant Routing Complexity
• Traffic hair-pins
L2
Tenant A
Tenant B
L2 Tenant C
L2
L2
Benefits
L2
• Distributed Routing in Hypervisor
• Dynamic, API based Configuration
• Full featured – OSPF, BGP, IS-IS
• Logical Router per Tenant
• Routing Peering with Physical Switch
L2
L2
L2
SCALABLE ROUTING – Simplifying Multi-tenancy

32. Logical View: VMs in a Single Logical Switch
172.16.10.11 172.16.10.12 172.16.10.13
VM1 VM2 VM3
VM4 VM5
Web LS
172.16.10.0/24
172.16.20.11 172.16.20.12
App LS
172.16.20.0/24

33. Logical View: VMs with Distributed Routing
172.16.10.1
192.168.10.0/29
192.168.10.1
Distributed Logical
Router Service
172.16.10.11 172.16.10.12 172.16.10.13
VM1 VM2 VM3
VM4 VM5
Web LS
172.16.10.0/24
172.16.20.11 172.16.20.12
App LS
172.16.20.0/24
172.16.20.1

34. Physical View: VMs in a Single Logical Switch
VM1
172.16.10.11 172.16.10.12 172.16.10.13
vSphere Distributed Switch
VM2
Logical Switch 5001
VM3
Physical Network
Transport Subnet A 192.168.150.0/24
192.168.150.51 192.168.150.52 192.168.250.51

35. Physical View: Logical Routing
Transport Subnet A 192.168.150.0/24 Transport Subnet B 192.168.250.0/24
VM5
VM1
vSphere Distributed Switch
VM2
Logical Switch 5001
VM3
Physical Network
VM4
Logical Switch 5002
Controller
Management Cluster
L3 Control Plane Programming
Data Plane
192.168.150.51 192.168.150.52 192.168.250.51

36. Hairpinning vs Network Services Distribution

37. Logical Switching and
Routing Demo

39. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

40. NSX Distributed Firewalling
PHYSICAL SECURITY MODEL DISTRIBUTED FIREWALLING
Challenges Benefits
• Centralized Firewall Model
• Static Configuration
• IP Address based Rules
• 40 Gbps per Appliance
• Lack of visibility with encapsulated traffic
• Distributed at Hypervisor Level
• Dynamic, API based Configuration
• VM Name, VC Objects, Identity-based Rules
• Line Rate ~20 Gbps per host
• Full Visibility to encapsulated traffic
Firewall Mgmt
VMware NSX
API
CMP

41. Distributed Firewall Features
VM5
VM1
Web-LS1
VM2
vSphere Distributed Switch
VM4
App-LS1
192.168.150.51 192.168.150.52 192.168.250.51 Management Cluster
Capabilities
• Firewall rules are enforced at VNIC Level
• Policy independent of location (L2 or L3 adjacency)
• State persistent across vMotion
• Enforcement based on VM attributes like Tags, VM Names, Logical Switch, etc

42. Distributed Firewall Rules
VM5
VM1
Web-LS1
VM2
vSphere Distributed Switch
VM4
App-LS1
192.168.150.51 192.168.150.52 192.168.250.51 Management Cluster
Rules Based on VM Names

43. Distributed Firewall Rules
VM5
VM1
Web-LS1
VM2
vSphere Distributed Switch
VM4
App-LS1
192.168.150.51 192.168.150.52 192.168.250.51 Management Cluster
Rules Based on Logical Switches

44. Hairpinning vs Security Services Distribution

45. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

46. NSX Load Balancing
Tenant A
Tenant B
VM1 VM2 VM1 VM2
Challenges Benefits
• Application Mobility
• Multi-tenancy
• Configuration complexity – manual
deployment model
• On-demand load balancer service
• Simplified deployment model for
applications – one-arm or inline
• Layer 7, SSL, …
LOAD BALANCER – Per Tenant Application Availability Model

47. NSX VPN Services
• VPN Services are delivered as a
service via Edge
• Interoperable with IPSec Clients
• Hardware Offload for Performance
• Ability to extend L2 across sites for
active-active DC
Site to Site
Internet / WAN
Internet / WAN
Public
Cloud
Hybrid Cloud

48. vCAC/vRA integrated with NSX
Dynamic Configuration and Deployment of NSX Logical Services
NSX
Logical Switch
Logical Router
Logical Firewall
Logical Load
Balancer
vCloud Automation Center On Demand Application Delivery
Service Catalog
Resource
Reservation
Cloud
Management
Platform
Multi-Machine
Blueprint
Security Policies
Security Groups
Network Profiles
Web
App
Database
VM VM VM
VM VM
VM

49. Cloud Consumer Profile
The Typical User Wants Easy
I just want my app. Don’t ask me
about networking and security.
Cloud
Consumer
Pre-defined
by Cloud Architect
Logical Load Balancer
Security Policies
Security Groups
Network Profiles
Leverage
Templates
Cloud Admin
Web
App
DB
Policy=Default_TestDev
VM VM VM
VM VM
VM

50. Cloud Consumer Profiles
Some Users Want to Customize
I know exactly what I need for
connecting, securing and scaling my
app. Let me deal with it.
Cloud
Consumer
Multi-Machine
Blueprint
Configurable
Customizable
For Cloud Consumer
Cloud Admin
Web
App
DB
Policy=Default_TestDev
VM VM VM
VM VM
VM

51. So in closing…
51

52. 1 NSX Architecture and Components
2 Switching
3 Routing
4 Distributed Firewall & Micro-Segmentation
5 Services
6 Next Steps

53. Next steps…
• Online resources
– http://labs.hol.vmware.com
– http://blogs.vmware.com/networkvirtualiz
ation/
– https://communities.vmware.com/docs/D
OC-27683
• Community blogs
– http://blog.scottlowe.org/learning-nvp-nsx/
– http://wahlnetwork.com/tag/nsx/
• YouTube VMware NSX TV
– https://www.youtube.com/channel/UCS5
Usoqpad7swl-0qzlD4ww
CONFIDENTIAL 53
• NSX Certification
– http://mylearn.vmware.com/portals/certific
ation/
– VTSP-NV (partner)
– VCP-NV
– VCIX-NV
– VCDX-NV

54. Thank You!
Twitter: @filipv
E-mail: fverloy@vmware.com
Blog: http://filipv.net