Why VMware NSX? – Part-2
– Prashant Pandey, VCAP-NV-2021
In Previous blog, we discussed about some basic points
talking about some challenges faced by traditional/physical network & how NSX
handles the same, where I mentioned that we will discuss about Overlay Tunneling Protocol (OTP) and Micro-segmentation separately in
upcoming blogs.
Previous blog link - https://nsxworld.blogspot.com/2022/07/why-vmware-nsx.html
So today we will talk about Overlay Tunneling Protocol &
Micro Segmentation in this blog.
First thing first –
1.what is OTP?
2.which OTP is being used by NSX?
3.why and 4. where NSX uses OTP?
1. OTP stands for overlay tunneling protocol, it does nothing but encapsulates the virtual network traffic data and carries it over the physical network.
2. Geneve is the protocol, which is being used by NSX-T latest versions, older version of NSX, which is called NSX-v (NSX for vSphere) used to have VXLAN as OTP, However NSX-v has been obsoleted for more than 1 year now.
3. NSX data center overlay network implementation is based on tunneling only, NSX uses Geneve for its overlay encapsulation, it provides isolation between the underlay network (physical network) and the overlay network (virtual network).
4. Tunnels are formed in between tunnel endpoints exists on Physical Hosts/ESX hosts/BareMetal.
Challenge existed with Physical network –
· In any DC majority of the traffic (more than 70%)
is East-West only.
· With traditional networking any L3 traffic
within DC goes till L3 device/Spine and then again comes down causing hair
pinning in the network.
· In the below example both machines are connected to
different subnets/broadcast domain, so the communication path will be via below
path, where it reaches L3 first & then again comes back causing hair
pinning, point to be noted that the communication is internal to DC only.
Source VM > Physical Switch1 > Physical
Router > Physical Switch2 > Destination VM
· NSX handles above challenges with the feature Overlay tunneling protocol, which is nothing but L2 over L3, that is encapsulating layer-3 packet with Layer-2.
· If both VMs are part of same hardware/Transport Node, distributed routing module (NSX VDS) will take care of the communication & packet will not leave hardware itself. It is possible because of the reference tables which each NSX capable hardware maintains locally.
Source VM > VDS > Destination VM
- If both VMs are part of different hardware/Transport Node (does not matter if part of same subnet or different), Tunneling will come into picture, below is the example for the same.
Source VM > VDS > TEP of TN1 > TEP of TN2
> VDS > Destination VM
(L2
encapsulation over L3)
Below is the actual Geneve encapsulated
packet looks like:
<------------------------ 8 –
260 MTU ---------------------> < ---------------- 1500 MTU
---------- >
Geneve MTU Range ----- 1508 – 1760
NSX Micro
Segmentation
Traditional data centers face many security challenges:
- Traditional security policies align with the environment (web/app/db) rather than with applications.
- Traditional segmentation does not prevent lateral communication between workloads in a tier, if one machine of /24 (just an example, can be any CIDR) subnet gets compromised, Attacker can move freely around the entire /24 broadcast domain and access valuable data, since does not get applied within single broadcast domain.
- Typically, certain high-level segmentation security policies are built in a traditional data center. These policies prevent various types of workloads from communicating with other types of workloads. However, this high-level segmentation does not prevent lateral communication between workloads in a tier. When threats breach the perimeter, their lateral spread is hard to stop
- Shared services can traverse tier boundaries without being checked.
NSX Security Model: In addition to perimeter / gateway firewall, NSX offers
distributed firewall and micro segmentation, which handles all above challenges
faced in traditional DC security model.
Micro segmentation supports a zero-trust architecture for IT security. This architecture establishes a security perimeter around each VM or container workload with a dynamically defined policy. it performs several functions:
• Logically divides a data center into distinct
security segments to the individual workload level
• Attaches the centrally controlled and
operationally distributed firewalls directly to each VM
- With above approach now every VM can have:
— Individual firewalls
— Individual security policies
- Security policies can be based on:
— VM attributes
— Network attributes
— Application attributes
— User attributes
•
Micro-segmentation
denies attackers the opportunity to pivot laterally within the internal
network, even after the perimeter is breached. NSX-T Data center
micro-segmentation prevents the lateral spread of threats across an
environment.
•
We can
apply rules that are specific
to the requirements of each workload. In addition, these capabilities are
not limited to homogeneous vSphere environments. NSX-T Data center supports
various platforms and infrastructure.
Example - Now if we take similar example which we discussed above, but this time micro-segmentation is in place: if one machine of /24 subnet gets compromised, Attacker will not be able to freely in entire broadcast, since each VM has its only firewall/security policy. This is how lateral spread is restricted in an NSX environment.
PS: Any Improvement points or suggestions are
welcome.
-----Thank You-----
Prashant Pandey
Comments
Post a Comment