Why VMware NSX?

            –  Prashant Pandey, VCAP-NV-2021

 Background: I often get few common questions about VMware NSX, specially from my colleagues & friends from different expertise other than NSX, that...

• Why VMware NSX is so popular now a days and why organizations are adapting it ?
• And most importantly... is it replacing or going to replace traditional / Physical networking?  

So, this blog is majorly to target same audience only, where I have tried to discuss few basic points which is going to answer all above queries.

We will agree that main reason to opt for new technology is because it solves existing challenges with some new approach, same case with NSX. It is solving multiple challenges faced with Physical networking or better to say that it is leveraging and utilizing physical networking to fullest.

Below are few basic challenges which we are going to discuss in this blog.

S. No.	Challenge faced with Traditional/Physical Network and how NSX handles the same
1	Initial Hardware cost	During the initial setup, we all know that we need to spend huge amount of money to get Physical network devices like L2/L3 Switches, Routers, Load Balancers, Firewalls etc. majority of the scenario we might not be fully utilizing these devices, but we need all of them to build a network. With NSX where all above functionalities can be achieved via Virtual devices, that are nothing but a virtual construct/VM which runs over an underlay hardware. consider it like a Virtual servers running over ESXi host in any vSphere environment.
2	Deployment time	Deployment time has been reduced significantly, spinning up a virtual construct is super easy and quick, In comparison to get a physical router installed. which usually consist of procurement of device, its physical mount and cabling time also.
3	limited scope of scalability	A traditional Ethernet switch can support up to 2^12 (4096) Ethernet broadcast domains or VLAN numbers. VXLAN in NSX supports 2^24 Ethernet broadcast domains or VXLAN numbers. That is 16,777,216 Ethernet broadcast domains.
4	Huge Forwarding/Routing Information Base	To facilitate L2 and L3 functionality, network devices has to maintain/store MAC tables(forwarding information base) and Routing tables(routing information base), with time when environment scales, size of these tables becomes huge, which becomes challenging to handle as device can go out of memory. NSX handles this problem by maintaining these tables at ESX/host level only, So now physical/underlay Network devices only need to maintain about these ESX and not VMs running over ESX/hosts.
5	Hair pinning while handling East-West traffic	In any DC majority of the traffic (more than 70%) is East-West only. With traditional networking any L3 traffic within DC goes till L3 device/Spine and then again comes down causing hair pinning in the network. NSX handles this issue with the feature OTP stands for Overlay tunneling protocol, which is nothing but L2 over L3. i.e. encapsulating layer-3 packet with Layer-2, VXLAN & Geneve are two OTP protocols used by NSX-v & NSX-T respectively. Will discuss about this OTP working in detail in upcoming blogs.
6	East-West traffic Security	In case of any security breach, stopping lateral spread was major challenge, as the traditional firewall policy does not restrict traffic within same broadcast domain and gets applied on whole subnet. NSX introduced Micro segmentation, which is based on Zero trust policy, which means we need to write a rule for every communication we need, rest all traffic are blocked by default including traffic within same broadcast domain. Will discuss about Micro segmentation in detail in upcoming blogs.

 

Hope above points are valid and helpful to understand the queries like - Why NSX is getting popular.

Now the final question – Is it replacing or going to replace traditional/Physical networking: The answer is NO, not at all… Physical network is the backbone of NSX/Software defined network.

• With NSX, we are utilizing the physical networking in a better way, since we are virtualizing it, as we did with vSphere in case of compute virtualization.
• With this approach we can optimize the functionality of Physical networking with multi-tenancy feature, where Physical network is one only, but we can maintain multiple tenants/costumers on it.
• Each tenant network will act like fully functional personal network only & will be unaware of other network, despite they share physical network, you can think of an example of getting network services from public cloud.
• Below diagram shows Physical & logical view of NSX setup.

 

 

PS: Any Improvement points or suggestions are welcome.

-----Thank You-----

Prashant Pandey