Securing the Virtual Data Center with VMware NSX

In this white board session, Solutions Architect Dwayne MacKenzie explains how the distributed firewall functionality in VMware NSX can simplify security in your virtual data center. Topics include: The challenges created by traditional security approaches in the virtual data center; The basics of VMware NSX firewall functionality with examples; "Stateful" security policy; "Microsegmentation"; Software defined data center basics; and more. Visit www.datanetwork... to learn how Data Networks can help you simplify your data center with a broad range of vmware-based virtualization solutions.

[@syedwaseem4798]

So far one of the Best ever videos i have seen. Simply explained the NSX concept within 7 minutes. Thank you!!!

[@sourav9533]

This is a fantastic video. Explaination is very crystal clear

[@dinhomhm]

I spent 2 weeks trying to understand NSX, I could not.
You clarified the whole story in 7 minutes. Thank you very much sir.

[@NavidDariya]

Nice colors and good explanation :) ;) Thank u

[@vasilybikov7249]

Very good and clear explanation. Even for me with English as a second language. Thank you!

[@dwaynemackenzie2423]

Thanks for watching! There have been pretty big improvements with NSX since this was made!

[@vasilybikov7249]

@@dwaynemackenzie2423 I study NSX for endpoint antimalware protection using Kaspersky Agentless Protection. But if you make new updated video about NSX it will be great!!!

[@rajdhingra00]

Very Good ...Simple to understand.

[@BRNavalgund]

Hi dwayni,
Thank you for your best explanation of nsx.However As you promised, when you are going to show us next episode.we are waiting for that video.
Regards
Raj

[@nasserjoolfun]

Simple and efficient -> i love it

[@mk12347]

well explained. now NSX is clear to me

[@whizkidlee811]

definition: green=web vm; brown=app vm; blue=db vm (at 30 sec segment). normally in a 3-tier, web talks to app, and app talks to db. web rarely talks to db (error at 2 min 30 sec), web typically receives requests like html; in a secured design, app talks to db. otherwise nsx network virtualization is clearly explained. thanks!

[@dwaynemackenzie2423]

Thanks! Clearly written by a Network Engineer, rather than an App developer--sorry!

[@michaeloleru]

@@dwaynemackenzie2423 @WhizKid Lee, I believe that was just for 'example' purposes. As far as I know, this is by far the best NSX explanation I have ever seen.

[@sourav9533]

One question : Since we are moving all the networking services from physical to the hypervisor level , won't it lead to high CPU usage on the ESXI hosts?

[@DataNetworksInc]

Thanks for your question.Yes, there is minimal additional overhead on the ESXi hosts. We have seen overhead increase by as much as 15%, however that was a result of what we identified as mis-configuration.

[@RichardWilliams-lz5eq]

I watched another video on NSX that did not help me understand it in the slightest (I like to think after 20 years in IT I'm not a complete idiot!!) But this was really easy to follow. Thanks!

[@dwaynemackenzie2423]

Thanks!

[@matholz90]

Very good video but I don't see the next whiteboard session, Any chance you will be making one?

[@alexd5637]

This is all cool in a way except that Vmware simply refused to add routing in their HV kernel for quite some time, even now without fancy DLR and Edge. Netfilter (+ ebtables), pf, ipfw and of course routing have all been available for so long in general and to other hyperv that run Linux like KVM. I wonder why Vmware didn't adopt routing and packet filtering from the beginning even weirder to watch such presentations like we just learned how to split the atom.

[@edutz321321]

great video. thank you

[@fanosss1]

nicely explained . TY

[@alancamelo381]

Very good explanation, I'm still new to this but if you are using L2 or L3 between NSX boxes the traffic still has has to exit the box travel across the external LAN to reach the other NSX. I'm sure there is an error when he said you can just flatten the external Network, how does it reach its broadcast domain on another box?

[@dwaynemackenzie2423]

Thanks! The flattening in this case is on the physical network--moving away from the 3-2-1 (Core, Distribution/End of Row, Edge/ToR) to a fabric based design. We have done this with many customers and it makes the management of the physical network much easier and allows NSX to deal with L2 and L3 services for the entire virtual data center, so you still have all your network segmentation.

[@miladmehrabi3967]

Very useful, thank you

[@azeezsheth812]

really cool technology

[@ManozKarmacharya]

How to use NSX to connect to internet? Like in case of BGP Multihoming. Is it possible?

[@JKGarageBMW]

It is - you would trunk your routed VLAN down into the NSX environment and create an ESG (edge service gateway) with an "external" interface on that VLAN

[@bradkaplon2346]

Dwayne, please let me know if you receive this comment. Thanks!

[@dperique]

I hate that distracting music