Blogs

NSX builds logical networks on top of your existing physical network. Virtual machines connect to segments, which behave like switches but are created in software. Tier-0 and Tier-1 gateways provide routing between segments and out to the physical network.

The distributed firewall

The biggest change for security teams is the distributed firewall. Rules are enforced at each virtual machine's network interface, not only at the edge. That makes micro-segmentation practical: you can allow the web tier to reach the application tier and nothing else, and the policy follows the workload when it moves between hosts.

What improves

• New networks and policies can be created in minutes instead of waiting for hardware changes.
• Security rules can be written around applications, not IP addresses and ports on a particular switch.
• The same policy model can span several sites.

What does not change

The physical network still matters. NSX relies on a healthy underlay, with reliable routing and a larger MTU than the standard 1500 to carry the encapsulated traffic. Many NSX problems turn out to be underlay problems, so networking fundamentals remain essential.

In short: NSX gives you faster change and finer security, as long as the physical network beneath it is designed well.

1. Networking foundations. Subnetting, VLANs, routing, BGP basics and firewall concepts. If you can explain how a packet travels between two subnets, you are ready for the next stage.
2. Virtualisation foundations. How hosts, vCenter, storage and virtual machine networking fit together. NSX and VCF both sit on top of this.
3. NSX. Segments, gateways, the distributed firewall, load balancing and troubleshooting. Spend most of your time here building and breaking things.
4. VCF 9. How the platform is deployed, upgraded and operated, and how its components work together as one system.

Three habits that help

• Build a lab. Reading is not enough. Configuring a network and then troubleshooting it teaches more than any slide deck.
• Learn from official documentation. Broadcom's documentation for your exact version is the most reliable source, and it changes between releases.
• Treat certification as a guide. Check the current certification track for the role you want and use it as a syllabus, not as the goal.

1. Address plan. Choose ranges that do not overlap with your other sites or your VPN, and leave room to grow.
2. Segmentation. Separate staff, guests, servers, voice and devices into their own VLANs with clear rules between them.
3. Internet and WAN redundancy. Decide what should happen when the primary link fails, and test that it does.
4. Firewall baseline. Start from default deny, allow only what is needed, and record the reason for each rule.
5. Wi-Fi design. Plan access point placement and capacity for the real number of users and devices.
6. Remote management. Make sure you can reach the equipment when the main link is down, and that management access is restricted.
7. Monitoring and logging. Know about a failed link or a full disk before your users tell you.
8. Documentation and handover. Keep a diagram, the address plan and the configuration records somewhere your whole team can find them.

Settling these before go-live turns the first week from firefighting into routine checks.