VMware NSX-T: Software-Defined Networking Fundamentals

Introduction

NSX-T (now called VMware NSX) is VMware's network virtualization platform. It creates a complete virtual network layer (switching, routing, firewall, load balancing) in software — independent of the physical underlay. This guide covers NSX-T fundamentals for data center engineers.

NSX-T vs Traditional Networking

Feature	Traditional	NSX-T
Segmentation	VLAN	Logical Switch (Geneve overlay)
Routing	Physical router	Tier-0/Tier-1 Gateways
Firewall	Physical appliance	Distributed Firewall (on every hypervisor)
Load Balancing	Physical LB	NSX Load Balancer
Scope	Physical network	Any workload (VMs, containers, bare metal)

NSX-T Architecture

TEXT

NSX Manager (3-node cluster for HA)
    |
NSX Controllers (embedded in Manager in NSX-T 3.x)
    |
Transport Nodes (ESXi hosts + KVM hosts + bare metal)
    |
Transport Zones (defines scope of logical networks)
    |
Logical Switches → Segments (virtual networks)
Tier-0 Gateway → Connects to physical network (BGP peering)
Tier-1 Gateway → Connected to Tier-0, segments connect here

Key Concepts

Segments (Logical Switches)

Virtual L2 network, spans multiple hosts via Geneve overlay
Each segment = one broadcast domain
VMs connect to segments like physical NICs to a switch

Tier-0 Gateway (T0)

Northbound connectivity — connects to physical router via BGP or static
Runs on Edge Nodes (dedicated NSX Edge VMs)
Handles N/S traffic (to/from internet/WAN)

Tier-1 Gateway (T1)

Connects segments to T0
Handles E/W routing between segments
Distributed — runs on every hypervisor (no traffic hair-pinning)

Distributed Firewall (DFW)

Stateful firewall running inside each hypervisor kernel
Applied at VM vNIC level — east-west traffic never leaves host
Policy follows the VM wherever it vMotions

NSX-T Installation Overview

Deploy NSX Manager OVF (3 nodes for HA)
Configure cluster VIP
Connect to vCenter (for ESXi fabric)
Prepare hosts (install NSX kernel modules)
Configure transport zones
Configure uplink profiles and transport nodes
Create segments, T0, T1

Creating Logical Network (Segments)

Via NSX Manager UI → Networking → Segments → Add Segment:

TEXT

Name: web-segment
Connected Gateway: tier1-gateway
Transport Zone: overlay-TZ
Subnets: 192.168.10.1/24

Tier-0 Gateway with BGP

TEXT

Networking → Tier-0 Gateways → Add:
  Name: T0-Production
  HA Mode: Active-Active (for scale) or Active-Standby

Routing → BGP:
  Local AS: 65100
  BGP Neighbors: physical router IP, remote AS 65000

Route Redistribution:
  Connected Interfaces: Enable
  Tier-1 Subnets: Enable

Distributed Firewall Rules

TEXT

Security → Distributed Firewall → Add Policy:

Policy: "Web Tier Policy"
Rules:
  Allow Web → DB:3306 (TCP) - from web-sg to db-sg
  Allow HTTPS → Web:443 (TCP) - from any to web-sg
  Deny All → Web (TCP/UDP) - from any to web-sg

Security Groups:
  web-sg: VMs with tag "Role:Web"
  db-sg: VMs with tag "Role:Database"

NSX-T with Kubernetes (NCP)

NSX integrates with Kubernetes via NCP (NSX Container Plugin):

YAML

# NSX-T provides each Kubernetes namespace its own segment
# When a Pod is created, NSX automatically provisions:
# - IP from IPAM pool
# - Logical port on the segment
# - Firewall rules from NetworkPolicy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-to-db
spec:
  podSelector:
    matchLabels:
      role: database
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: web
    ports:
    - protocol: TCP
      port: 3306

Troubleshooting NSX-T

BASH

# On NSX Manager
get logical-switches
get logical-routers
get transport-nodes

# On ESXi host (after SSH)
nsxcli

# Check overlay tunnels
get host-switch
get vtep

# Check DFW rules
get firewall section list

# View DFW connection table
get firewall flows

# Path trace (GUI: Tools → Traceflow)
# Simulates a packet and shows exact path through overlay