VMware NSX Review

Originally posted at vcdx133.com.

This post provides a Tech101 breakdown of VMware NSX. If you have heard the buzz-word “NSX” or “Network Virtualisation” and want to learn more about it, this post is for you.

VMware NSX has two distinct variants – NSX for vSphere (NSX-v) and NSX Multi-Hypervisor (NSX-MH). The most feature rich version is NSX-v (as you would expect) and the most flexible and vendor agnostic is NSX-MH (albeit with less features). Currently these are separate binaries that you download and deploy, however there is talk that in the future it will be a single binary set with a V/MH software setting during deployment.

A little bit of history will also clarify things. VMware acquired Nicira in 2012 and integrated/developed the NSX product suite by combining VMware’s vCNS (aka vShield Edge and App) with Nicira’s NVP. So if you understand vShield, it will give you a good start to mastering NSX.

The diagram below illustrates the NSX architecture, complete with physical infrastructure. Note, storage virtualisation has been deliberately left out of the diagram since it is not in-scope. The “P2V” lines denote the possible NSX overlay to physical network integrations.

NSX for vSphere (NSX-v)

NSX-v has the following components:

• vSphere ESXi – server hypervisor.
• vSphere Distributed Switch – the advanced Layer 2 virtual Switch that VMware provides with the Enterprise Plus licence (you cannot use the vSphere Standard Switch with NSX).
• NSX Manager – management interface of NSX, presented via the vSphere Web Client and has a northbound NSX API.
• NSX Controller – the control plane of NSX which also has the northbound NSX API.
• Logical Switch – VXLAN tunnels that run across disparate networks.
• Edge Services Gateway (ESG) – provides L3-L7 network services to the outside world.
• Distributed Logical Router (DLR) – provides L3-L7 network services to the physical and virtual infrastructure via a hypervisor service for the data plane and a virtual appliance for the control plane.
• Distributed Firewall – this is a service that runs on ESXi and provides micro-segmentation of virtual infrastructure
• Third Party integrations – advanced L3-L7 services provided by Third Parties via the NSX API. eg. Palo Alto Networks, McAfee, Trend Micro, F5, Citrix, Silver Peak, etc.
• Physical Network – traditional core, aggregate, distribution, access or Clos-type Leaf & Spine architectures
• Virtual overlay to Physical network gateways – the NSX virtual overlay integrates with the physical world via a gateway. eg. Routing, L2 Extension, VXLAN, etc.

What are L2 to L7 services? VLAN, VXLAN tunnels, Network Firewall, IPS, Application Firewall, NAT, Routing (OSPF, BGP, IS-IS), Load Balancing, SSL VPN, IPSec VPN, Route redistribution, etc.

NSX for Multi-Hypervisor (NSX-MH)

The NSX-MH has the same functional components, except it uses Open vSwitch (instead of vDS) with KVM, Hyper-V or XenServer and does not have a Distributed Firewall (no micro-segmentation).

Why do it this way?

You may have heard about the “Goldilocks zone” (not too hot, not too cold, just right – used to describe Earth’s placement in the solar system for sustaining life). The hypervisor is the “Goldilocks zone” of the Data Center, it is the natural meeting place for the Software Defined Data Center (SDDC) – Compute, Network and Storage.

If you understand the benefits of server virtualisation with vSphere (abstraction of the Operating System from the hardware, etc.), you can apply the same logic to network virtualisation. There is also the driving force of creating blueprints within the Service Catalogue of the Cloud Management Platform and linking polices (compute, network, storage and security) to the blueprint.

Weaknesses

• The biggest weakness of NSX – no associated hardware, since VMware is a software company, is also its greatest strength. You can run NSX across any physical network (as long as it meets the fundamental requirements of scalability, performance and reliability) and use it to connect disparate networks together.
• Because NSX is software, it cannot match dedicated physical hardware in terms of performance, however this weakness is balanced with flexibility and scale. Ensure that your SDDC is designed to match your business requirements – this way the risk of lack of performance is mitigated.
• NSX on its own is not the greatest use-case, you really want to use it to complete your SDDC solution (ie. Cloud Management Platform, Compute Virtualisation, Network Virtualisation, Storage Virtualisation and Service Catalogue).