The foundational core components of NSX are divided across three different planes. The core components of a NSX deployment consist of an NSX manager, controller clusters, and hypervisor kernel modules. Each of these is crucial for your NSX deployment; however, they are decoupled to a certain extent allowing for resiliency during failure of multiple components. For example, if your controller clusters fail, your virtual machines will still be able to communicate with each other without any network disruption. You have to always ensure that NSX components are always deployed in a clustered environment so they are protected by vSphere HA.

The high-level architecture of NSX primarily describes three different planes wherein each of these core components fits in. They are the Management Plane, the Control Plane, and the Data Plane. The following...

The NSX manager allows us to create, configure, and manage NSX components in an environment. The NSX manager provides a graphical user interface and also the REST APIs that allow you to interact with various NSX components. NSX manager is a virtual machine that you can download as an OVA and deploy it on any ESX host managed by vCenter.

NSX manager, once deployed and configured, can then deploy controller clusters and prepare the ESXi host, which involves installing various vSphere installation bundles (VIB) that allow for network virtualization features such as VXLAN, logical switching, and logical routing. The NSX manager can also deploy and configure Edge gateway appliances and its services.

Because NSX manager is deployed as a single virtual machine, it relies on VMware&apos...

NSX controller provides a control plane functionality to distribute logical routing and VXLAN network information to the underlying hypervisor. Controllers are deployed as virtual appliances and should be deployed in the same vCenter NSX manager is connected to. In a production environment it is recommended to deploy a minimum of three controllers. For better availability and scalability we need to ensure DRS ant-affinity rules are configured to deploy controllers on a separate ESXI host. Control plane to management and data plane traffic is secured by certificate-based authentication.

It is important to note that controller nodes employ a scale-out mechanism where by each controller node uses a slicing mechanism that divides the workload equally across all the nodes. This renders all controller nodes active at all times. If one controller node fails...

One of the most important functions of NSX is enabling virtual networks. These virtual networks or overlay networks have become very popular due to that fact that they can leverage an existing network infrastructure without the need to modify it in any way. The decoupling of logical networks from the physical infrastructure allows users to scale rapidly. Overlay networks or VXLANs were developed by a host of vendors that include Arista, Cisco, Citrix, Red Hat, and Broadcom. This allows the VXLAN standard to be implemented by multiple vendors due to this joint effort in developing its architecture.

VXLAN is a layer 2 over layer 3 tunneling protocol that allows for logical network segments to extend on routable networks. This is achieved by encapsulating the Ethernet frame with additional UPD, IP, and VXLAN headers. Consequently, this increases the...

A group of ESXi hosts that are able to communicate with one another over the physical network by means of VTEPs is said to be in the same transport zone. A transport zone defines the extension of a logical switch across multiple ESXi clusters that span across multiple virtual distributed switches.

A typical environment has more than one virtual distributed switch that spans across multiple hosts. A transport zone enables a logical switch to extend across multiple virtual distributed switches and any ESXi hosts that are part of this transport zone can have virtual machines as part of that logical network. A logical switch is always created as part of a transport zone and ESXi hosts can participate in them.

The following figure shows a transport zone that defines the extension of a logical switch across multiple virtual distributed switches:

The NSX Edge Services Gateway (ESG) offers a feature-rich set of services that include NAT, routing, firewall, load balancing, L2/L3 VPN, and DHCP/DNS relay. NSX API allows each of these services to be deployed, configured, and consumed on-demand. You can install the NSX Edge as an ESG or as a DLR.

The Edge Services Gateway is deployed as a virtual machine from the NSX manager, which is accessed using the vSphere web client. Four different form factors are offered for different-sized environments. It is important that you factor in enough resources for the appropriate Edge Services Gateway when building your environment.

Edge Services Gateway can be deployed in different sizes. The following are the available size options for Edge Services Gateway appliances:

• X-Large:...

NSX provides L2-L4 stateful firewall services by means of a distributed firewall that runs in the ESXi hypervisor kernel. Because the firewall is a function of the ESXi kernel it provides massive throughput and performs at near line rate. When the ESXi host is initially prepared by NSX, the distributed firewall service is installed in the kernel by deploying the kernel VIB—VMware internetworking service insertion platform (VSIP). VSIP is responsible for monitoring and enforcing security policies on all the traffic flowing through the data plane. The distributed firewall (DFW) throughput and performance scales horizontally as more ESXi hosts are added.

DFW instances are associated to each vNIC and every vNIC requires one DFW instance. A virtual machine with 2 vNICs has two DFW instances associated with it, each monitoring its own vNIC and applying security...

Beginning from NSX 6.2, you can manage multiple vCenter NSX environments using the cross-vCenter functionality. This allows you to manage multiple vCenter NSX environments from a single primary NSX manager. This allows ease of management and also enables many new functions that include extending networks and other features such as distributed logical routing. Cross-vCenter NSX deployment also allows for centralized management and also eases disaster recovery architectures.

In a cross-vCenter deployment, multiple vCenters are all paired with their own NSX manager per vCenter. One NSX manager is assigned the primary while other NSX managers become secondary. This primary NSX manager can now deploy a universal controller cluster that provides the control plane. Unlike a standalone vCenter-NSX deployment, secondary NSX managers do not deploy their own controller...

We began this chapter with a brief introduction to NSX core components and looked at management, control, and the data plane. Next we discussed the NSX manager and NSX controller clusters. This was followed by a VXLAN architecture overview discussion where we looked at the VXLAN packet. We then discussed transport zones and NSX Edge gateway services. The chapter ended with NSX Distributed firewall services and also an overview of Cross-vCenter NSX deployment.

In the Chapter 3, NSX Installation and Configuration, we will start deploying our NSX environment and deploy all of its components starting with the NSX manager. We will configure the NSX manager using its user interface and build our control plane by deploying controller clusters.