As explained in the introduction, NSX DFW uses VMware Tools to retrieve a virtual machine IP address and enforces firewall rules on the virtual machine. However, in some cases virtual machines may not have VMware Tools installed and running. To avoid the DFW dependency on VMware Tools, NSX 6.2.0 introduced two new mechanisms to discover a virtual machine's IP address that can be configured on a vSphere cluster-level basis:
- DHCP snooping: Tracks IPv4 and IPv6 DHCP protocol messages
- ARP snooping: Tracks ARP messages from the guest virtual machines
The NSX Manager can use either of these mechanisms to discover the IP address and apply firewall rules to a virtual machine. In this recipe, we will enable ARP snooping for virtual machine IP discovery.
