Upgrading everyday security Commpact Manuale Utente Scaricare il pdf (Pagina 8)

This chapter includes the following topics:

“NSX Capabilities,” on page 8

“NSX Components,” on page 9

NSX Capabilities

NSX offers a variety of logical networking services.

Logical Switches

A cloud deployment or a virtual data center has a variety of applications across multiple tenants. These

applications and tenants require isolation from each other for security, fault isolation, and avoiding

overlapping IP addressing issues. The NSX logical switch creates logical broadcast domains or segments to

which an application or tenant virtual machine can be logically wired. This allows for flexibility and speed

of deployment while still providing all the characteristics of a physical network's broadcast domains

(VLANs) without physical Layer 2 sprawl or spanning tree issues.

A logical switch is distributed and can span arbitrarily large compute clusters. This allows for virtual

machine mobility (vMotion) within the datacenter without limitations of the physical Layer 2 (VLAN)

boundary. The physical infrastructure does not have to deal with MAC/FIB table limits since the logical

switch contains the broadcast domain in software.

Logical Routers

Dynamic routing provides the necessary forwarding information between layer 2 broadcast domains,

thereby allowing you to decrease layer 2 broadcast domains and improve network efficiency and scale. NSX

extends this intelligence to where the workloads reside for doing East-West routing. This allows more direct

virtual machine to virtual machine communication without the costly or timely need to extend hops. At the

same time, NSX also provides North-South connectivity, thereby enabling tenants to access public networks.

Logical Firewall

Logical Firewall provides security mechanisms for dynamic virtual data centers. The Distributed Firewall

component of Logical Firewall allows you to segment virtual datacenter entities like virtual machines based

on VM names and attributes, user identity, vCenter objects like datacenters, and hosts as well as traditional

networking attributes like IP addresses, VLANs, etc. The Edge Firewall component helps you achieve key

perimeter security needs such as building DMZs based on IP/VLAN constructs, tenant to tenant isolation in

multi-tenant virtual data centers, Network Address Translation (NAT), partner (extranet) VPNs, and User

based SSL VPNs.

The Flow Monitoring feature displays network activity between virtual machines at the application protocol

level. You can use this information to audit network traffic, define and refine firewall policies, and identify

threats to your network.

Logical Virtual Private Networks (VPN)s

SSL VPN-Plus allows remote users to access private corporate applications. IPSec VPN offers site-to-site

connectivity between an NSX Edge instance and remote sites. L2 VPN allows you to extend your datacenter

by allowing virtual machines to retain network connectivity across geographical boundaries.

NSX Installation and Upgrade Guide

8 VMware, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 ... 57 58

Nessun commento

Upgrading everyday security Commpact Manuale Utente Pagina 8