VMware Tanzu Licensing – What’s New?

VMware Tanzu Licensing – What’s New?

Last year, VMware gave the Tanzu portfolio a fairly good facelift with all the announcements from VMware Explore 2022. It is clear to me that VMware focuses on multi-cluster and multi-cloud Kubernetes management capabilities (Tanzu for Kubernetes Operations) and a superior developer experience with any Kubernetes on any cloud (Tanzu Application Platform). VMware embraces native public clouds and so it was very exciting for many customers when they announced the lifecycle management of Amazon Elastic Kubernetes Service (EKS) clusters – the direct provisioning and management of EKS clusters with Tanzu Mission Control. But what happened in the last 6 to 9 months since VMware Explore US and Europe? And how do I get parts of the VMware Tanzu portfolio nowadays?

Tanzu Licensing

Let us start with licensing first. in October 2022, VMware made it clear that they do not want to move forward anymore with the Tanzu Basic and Advanced editions, only Tanzu Standard was left. VMware replaced Tanzu Basic with “Tanzu Kubernetes Grid” (TKG), which comes with the following components:

  • vSphere capabilities / K8s Runtime
  • K8s Cluster Lifecycle Management – Cluster API
  • Image Registry – Harbor
  • Container Networking – Antrea/Calico
  • Load Balancing – NSX Advanced Load Balancer
  • Ingress Controller – Contour
  • Observability – Fluent Bit, Prometheus, Grafana
  • Operating System – Photon OS, Ubuntu, bring-your-own node image
  • Data Protection – Velero

Note: Nothing is official yet, but according to this article intended for partners, VMware is going to announce the Tanzu Standard EOA (End of Availability) soon:

…containing updated information on Tanzu Standard entering end of availability (EOA) and the new Tanzu Kubernetes Operations and Tanzu Application Platform partner resources.

Looking at the “Tanzu Explainer” and its changelog from the 5th of May, one can find the following: “Updated to reflect new Tanzu for Kubernetes Operations SKUs“.

Tanzu for Kubernetes Operations Bundles

The Tanzu Explainer on Tech Zone lists the following new bundles/packages for Tanzu for Kubernetes Operations (TKO):

  1. Tanzu for Kubernetes Operations Foundation includes Tanzu Mission Control Advanced and Tanzu Service Mesh Advanced. Two add-on SKUs are available—one adds Antrea Advanced and Aria Operations for Applications, the other adds these plus NSX Advanced Load Balancer Enterprise. Tanzu Kubernetes Grid is not included in this bundle.
  2. Tanzu for Kubernetes Operations includes Tanzu Kubernetes Grid, Tanzu Mission Control Advanced, Tanzu Service Mesh Advanced, Antrea Advanced, and Aria Operations for Applications.
  3. Tanzu for Kubernetes Operations with NSX Advanced Load Balancer includes Tanzu Kubernetes Grid, Tanzu Mission Control Advanced, Tanzu Service Mesh Advanced, Antrea Advanced, Aria Operations for Applications, and NSX Advanced Load Balancer Enterprise.

Note: Since Tanzu Mission Control Standard (TMC) was only sold as part of the Tanzu Standard Edition, we see VMware moving forward with TMC Advanced only. Which is good! But TMC Essentials still comes with vSphere+ and VMC on AWS.

Tanzu Entitlements with vSphere and VMware Cloud Foundation Editions

What about vSphere and VMware Cloud Foundation (VCF)? Let me give you an overview here as well:

  • vSphere+ Standard – No Tanzu entitlements included
  • vSphere+ – Includes TKG and TMC Essentials
  • vSphere Enterprise+ with TKG – Includes TKG
  • VMware Cloud Foundation – All VCF editions have Tanzu Standard included

Note: We do not know yet what the Tanzu Standard EOA means for the Tanzu entitlements with VCF. Need to wait for guidance.

VMware Cloud Packs

In April 2023, VMware introduced new bundles called VMware Cloud Packs and they come in four different flavours:

  1. Compute with Advanced Automation. vSphere+ and Aria Universal Suite Advanced
  2. HCI. vSphere+, vSAN+ Advanced and Aria Universal Suite Standard
  3. HCI with Advanced Automation. vSphere+, vSAN+ Advanced and Aria Universal Suite Advanced
  4. VMware Cloud Foundation. vSphere+, vSAN+ Enterprise, NSX Enterprise Plus, SDDC Manager, Aria Universal Suite Enterprise, Aria Operations for Networks Enterprise add-on

In addition to these four Cloud Packs offerings, customers can get the following add-ons:

  • Data Protection & Disaster Recovery
  • Network Detection and Response
  • Tanzu Mission Control
  • Ransomware Recovery
  • Advanced Load Balancer
  • Workload and Endpoint Security
  • Intrusion Detection and Prevention
  • VDI/Desktops

Note: As you can see, all new cloud packs have TKG included and TMC is an add-on. vCenter Standard is with connected and disconnected subscriptions.

Important: Please note as well that the individual components of the bundles cannot be upgraded independently. Example – Aria Universal Suite Standard as part of the HCI Cloud Pack cannot be upgraded to Aria Universal Suite Enterprise.

Conclusion

VMware is clearly moving in the right direction: They want to simplify their portfolio and improve how customers can consume/subscribe services. As always, it is going to take a while until they have figured out which bundles and product versions make sense for most of the customers. Be patient. 🙂

 

What does VMware Cloud Disaster Recovery have in common with Dell PowerProtect?

What does VMware Cloud Disaster Recovery have in common with Dell PowerProtect?

It was at VMware Explore Europe 2022 when I ran into a colleague from Dell who told me about “transparent snapshots” and mentioned that their solution has something in common VMware Cloud Disaster Recovery (VCDR). After doing some research, I figured out that he was talking about the Light Weight Delta (LWD) protocol.

Snapshots

Snapshots are states of a system or virtual machine (VM) at a particular point in time and should not be considered a backup. The data of a snapshot include all files that form a virtual machine – this includes disks, memory, and other devices like network interface cards (vNIC). To create or delete a snapshot of a VM, the VM needs to be “stunned” (quiesce I/Os).

I would say it is common knowledge that a higher number of snapshots negatively impact the I/O performance of a virtual machine. Creating snapshots results in the creation of a snapshot hierarchy with parent-to-child relationships. Every snapshot creates a delta .vmdk file and redirects all inputs/writes to this delta disk file.

VMware vSphere Storage APIs for Data Protection

Currently, a lot of backup solutions use “VMware vSphere Storage APIs for Data Protection” (VADP), which has been introduced in vSphere 4.0 released in 2009. A backup product using VADP can backup VMs from a central backup server or virtual machine without requiring any backup agents. Meaning, backup solutions using VADP create snapshots that are used to create backups based on the changed blocks of a disk (Changed Block Tracking aka CBT). These changes or this delta is then written to a secondary site or storage and the snapshot is removed after.

Deleting a snapshot consolidates the changes between snapshots and previous disk states. Then it writes all the data from the delta disk that contains the information about the deleted snapshot to the parent disk. When you delete the base parent snapshot, all changes merge with the base virtual machine disk.

To delete a snapshot, a large amount of information must be read and written to a disk. This process can reduce the virtual machine performance until the consolidation is complete.

VMware Cloud Disaster Recovery (VCDR)

In 2020, VMware announced the general availability of VMware Cloud Disaster Recovery based on technology from their Datrium acquisition. This new solution extended the current VMware disaster recovery (DR) solutions like VMware Site Recovery, Site Recovery Manager, and Cloud Provider DR solutions.

VMware Cloud Disaster Recovery is a VMware-delivered disaster recovery as a service (DRaaS) offering that protects on-premises vSphere and VMware Cloud on AWS workloads to VMware Cloud on AWS from both disasters and ransomware attacks. It efficiently replicates VMs to a Scale-out Cloud File System (SCFS) that can store hundreds of recovery points with recovery point objectives (RPOs) as low as 30 minutes. This enables recovery for a wide variety of disasters including ransomware. Virtual machines are recovered to a software-defined data center (SDDC) running in VMware Cloud on AWS. VMware Cloud Disaster Recovery also offers fail-back capabilities to bring your workloads back to their original location after the disaster is remediated.

VMware Cloud DR Architecture

Note: Currently, VCDR is only available as an add-on feature to VMware Cloud on AWS. The support for Azure VMware Solution is expected to come next.

To me, VCDR is one of the best solutions from the whole VMware portfolio.

High-Frequency Snapshots (HFS)

One of the differentiators and game-changers are these so-called high-frequency snapshots, which are based on the Light Weight Delta (LWD) technology that VMware developed. Using HFS allows customers to schedule recurring snapshots for every 30 minutes, meaning, that customers can get an Recovery Point Objective (RPO) of 30min!

To enable and use high-frequency snapshots, your environment must be running on vSphere 7.0 U3 or higher.

With HFS and LWD, there is no Changed Block Tracking (CBT), no VADP, and no VM stun. This results in better performance when maintaining these deltas.

Transparent Snapshots by Dell EMC PowerProtect Data Manager (PPDM)

At VMworld 2021, Dell Technologies presented a session called “Protect Your Virtual Infrastructure with Drastically Less Disruption [SEC2764S]” which was about “transparent snapshots” – image backups with near-zero impact on virtual machines, without the need to pause the VM during the backup process. No more backup proxies, no more agents.

Dell Transparent Snapshot Architecture

As with HFS and VCDR, your environment needs to run on vSphere 7.0 U3 and higher.

How does it work?

PowerProtect Data Manager transparent snapshots use the vSphere API for I/O (VAI/O) Filtering framework. The transparent snapshots data mover (TSDM) is deployed in the VMware ESXi infrastructure through a PowerProtect Data Manager VIB. This deployment creates consistent VM backup copies and writes the copies to the protection storage (PowerProtect appliance).

After, this VIB (Data Protection Daemon (DPD) which is part of the VMware ESXi >7.0 U3 image has been installed on the ESXi host) tracks the delta changes in memory and then transfers the delta changes directly to the protection storage.

VMware Data Protection Daemon

Note: PPDM also provides image backup and restore support for VMware Cloud on AWS and Azure VMware Solution, but requires VADP.

Light Weight Delta (LWD)

It seems that LWD has been developed by VMware but there is no publicly available information out there yet. I only found this screenshot as part of this Dell article:

VMware Light Weight Delta

It also seems that Dell is/was the first who could leverage the LWD protocol exclusively but I am sure it will be made available to other VMware partners as well.

VMware Cloud on Equinix Metal – The New Intercloud?

VMware Cloud on Equinix Metal – The New Intercloud?

It was November 2022 when VMware and Equinix announced an expanded partnership to deliver new infrastructure and multi-cloud services. Called VMware Cloud on Equinix, this solution combines VMware Cloud Infrastructure-as-a-Service (IaaS) with Equinix Metal Hardware-as-a-Services (HWaaS) independently. In other words, the SDDC (software-defined data center) stack is sold by VMware, and HWaaS is sold by Equinix. Looking at this partnership and solution, one could say that Equinix might become “the” intercloud in this multi-cloud era.

What is VMware Cloud on Equinix Metal (VMC-E)?

VMC-E combines VMware’s managed and supported cloud IaaS with Equinix’s baremetal-as-a-service (BMaaS) offering. This gives enterprises the advantage to run this cloud offering almost everywhere globally. Another benefit is that VMC-E will be available in over 30 of the most interconnected global Equinix locations, connected to all the major public clouds and networks (Equinix Fabric).

Equinix Multi-Cloud App

What is Equinix Fabric?

This service allows organizations to connect to other Equinix customers and other internet resources like service providers:

  • Amazon Web Services (AWS)
  • Microsoft Azure
  • Google Cloud
  • Oracle Cloud
  • Alibaba Cloud
  • IBM Cloud
  • and many more

For me, Equinix Fabric is an interesting way to interconnect different VMware-based Clouds like VMware Cloud on AWS, Azure VMware Solution, Google Cloud VMware Engine, Alibaba Cloud VMware Solution, or Oracle Cloud VMware Solution.

VMC-E for multi-cloud apps?

A lot of enterprises are not “cloud-first” anymore, they became “cloud-smart”. They put the right apps in the right cloud based on the right reasons.

VMware Cloud-Smart

VMC-E has the potential to become a true multi-cloud enabler by letting VMware and Equinix customers move their applications to an ideal place. Imagine lifting and shifting a legacy application to VMC-E. This application then sits in the middle of all major clouds and customers can use different services and components for the same application. This is my definition of a multi-cloud app.

Multi-Cloud App on VMC-E

What are the use cases?

VMware and Equinix mention distributed environments and mission-critical applications that rely on high-performance network bandwidth and low latency, such as smart cities, video analytics, game development, VDI, real-time financial market trading, retail POS, IoT, and machine learning.

Which hosts are available?

VMware Cloud on Equinix Metal comes with multiple host configs that can be found here. It is not clear yet which host type(s) will be available during the initial lunch. But the tech preview on YouTube shows the “n3.xlarge.x86” instance type.

Tech Preview VMware Cloud on Equinix Metal - YouTube

How can I get VMC-E?

VMC-E is currently in an early access phase for selected customers in H1 2023.

Tech Preview VMware Cloud on Equinix Metal

Where can I get more information?

To learn more and to participate in the early access program for VMware Cloud on Equinix Metal, please email your interest to  .

10 More Things You Didn’t Know About vSphere+

10 More Things You Didn’t Know About vSphere+

A few months ago I wrote the article 10 Things You Didn’t Know About vSphere+, which gives you a good overview of vSphere+ and VCF+, and some information about licensing. A few things have changed and been added since then and I would like to share some of the information with you.

1) vSphere+ Standard Edition

Some customers only need the feature set of vSphere Standard but were very interested in having the benefits that come with the (VMware) cloud connectivity. VMware listened to its customers and introduced vSphere+ Standard back in December 2022. What is included?

  • vSphere Standard features
  • vCenter Standard (unlimited number of deployments)
  • Admin Services (Cloud Console)

2) vSAN+ Standard and Advanced Edition

To mirror the vSAN perpetual license editions, VMware released vSAN+ Standard and vSAN+ Advanced in December 2022 as well.

3) Grace Period when moving from perpetual to subscription licensing

Customers need to move their existing perpetual licenses within 90 days to vSphere+/vSAN+, see here.

If Customer receives its entitlement to vSphere+ or vSAN+ through a VMware subscription upgrade program, then Customer must, within 90 days after purchase of the entitlement, relinquish its entitlements to any relevant vSphere or vSAN on-premises perpetual licenses (as applicable) that were exchanged through the subscription upgrade program (“Exchanged Licenses”).

5) What if I don’t renew my vSphere+/vSAN+ subscription?

You will be out of compliance, but your environment is still going to work. And you will not receive support from VMware’s Global Support anymore during that time.

6) Which data is transmitted to VMware Cloud?

According to this article, the following data is transmitted:

  • vCenter Server Inventory (transmission frequency: 24h)
  • Log Data (transmission frequency: continuous)
  • Performance Data (transmission frequency: 5min)
  • Consumption Data (transmission frequency: 15min)
  • Feature Usage (transmission frequency: 5min)
  • Entitlement (transmission frequency: as necessary)

7) Aria Universal Suite & vSphere+ (vCloud Suite+)

The subscription version of vCloud Suite is vCloud Suite+ (vCS+). vCS+ comes also in three editions: Standard, Advanced, Enterprise

vCloud Suite+ Editions 2023

8) What about VMware Horizon and vSphere+?

If you are using vSphere (for Desktop) that came as a bundle with VMware Horizon, then vSphere cannot be upgraded to vSphere+. Consult the product interoperability matrix for more information. If you are using Horizon as a standalone product on top of vSphere+, I don’t see any issues.

9) What are vSphere+ add-on services?

Currently, vSphere+ comes with a centralized cloud console that provides consolidated management of all vSphere+ deployments. Customers also get the Cloud Consumption Interface (CCI) and Tanzu Mission Control Essentials as part of vSphere+.

Add-On #1: Aria Operations

vSphere+ vROps Add-On

Powered by Aria Operations (formerly known as vRealize Operations), vSphere+ provides an overview of the resource usage of all the clusters associated with the vCenter Server instances that are connected to your vCenter Cloud Gateway(s). You can monitor and analyze details such as hosts, cores, VMs, and remaining capacity on each cluster. You can also get a view of the number of days remaining until the cluster reaches its usable capacity.

Add-On #2: VMware Cloud Disaster Recovery (VCDR)

vSphere+ VCDR Add-On

You can protect VMs and manage their protection status directly from the VMware Cloud Console if you have a VCDR subscription.

Future Add-Ons

Without making any commitment and knowing the vSphere+ roadmap, it seems that VMware is going to bring parts of the VMware Data Services portfolio as an add-on service. More information can be found here.

10) Counting Cores for vSphere+ and vSAN+ Licensing

VMware has created a tool to identify the number of core licenses that are required to upgrade existing vSphere/vSAN deployment to vSphere+/vSAN+. William Lam has created two blogs that should help you using the script:

 

VMware vSphere – The Enterprise Data Platform

VMware vSphere – The Enterprise Data Platform

The world is creating and consuming more data than ever. There are multiple reasons that can explain this trend. Data creates the foundation for many digital products and services. And we read more and more about companies that want or need to keep their data on-premises because of reasons like data proximity, performance, data privacy, data sovereignty, data security, and predictable cost control. We also know that the edge is growing much faster than large data centers. These and other factors are the reasons why CIOs and decision-makers are now focusing on data more than ever before.

We live in a digital era where data is one of the most valuable assets. The whole economy from the government to local companies would not be able to function without data. Hence, it makes sense to structure and analyze the data, so a company’s data infrastructure becomes a profit center and is not just seen as a cost center anymore.

Data Sprawl

A lot of enterprises are confronted with the so-called data sprawl. Data sprawl means that an organization’s data is stored on and consumed by different devices and operating systems in different locations. There are cases where the consumers and the IT teams are not sure anymore where some of the data is stored and how it should be accessed. This is a huge risk and results in a loss of security and productivity.

Since the discussions about sovereign clouds and data sovereignty have started, it has never been more important where a company’s data resides, and where and how one can consume that data.

Enterprises have started to follow a cloud-smart approach: They put the right application and its data in the right cloud, based on the right reasons. In other words, they think twice now where and how they store their data.

What databases are popular?

When talking to developers and IT teams, I mostly received the following names (in no particular order):

  • Oracle
  • MSSQL
  • MySQL
  • PostgreSQL

I think it would be a fair statement to make that a lot of customers are looking for alternatives to reduce expensive database and database management solutions (DBMS). It seems that Postgres and MySQL earned a lot of popularity over the past years, while Oracle is still considered one of the best databases on the market – even seen as one of the most expensive and least liked solutions. But I also hear other solutions like MongoDB, MariaDB, and Redis mentioned in more discussions.

DBaaS and Public Cloud Characteristics

It is nothing new: Developers are looking for a public-cloud-like experience for their on-premises deployments. They want an easy and smooth self-service experience without the need for opening tickets and waiting for several days to get their database up and running. And we also know that open-source and freedom of choice are becoming more important to companies and their developers. Some of the main drivers here are costs and vendor lock-in.

IT teams on the other side want to provide security and compliance, more standardization around versions and types, and an easy way to backup and restore databases. But the truth is, that a lot of companies are struggling to provide this kind of Database-as-a-Service (DBaaS) experience to their developers.

The idea and expectation of DBaaS are to reduce management and operational efforts with the possibility to easily scale databases up and down. The difference between the public cloud DBaaS offering and your on-premises data center infrastructure is the underlying physical and virtual platform.

On-premises it could be theoretically any hardware, but VMware vSphere is still the most used virtualization platform for an enterprise’s data (center) infrastructure.

VMware vSphere and Data

VMware shared the information that studying their telemetry from their customer base showed that almost 25% of VMware workloads are data workloads (databases, data warehouses, big data analytics, data queueing, and caching) and it looks like that MS SQL Server still has the biggest share of all databases that are hosted on-premises.

They are also seeing a high double-digit growth (approx. 70-90%) when it comes to MySQL and steady growth with PostgreSQL. Rank 4 is probably Redis followed by MongoDB.

VMware Data Solutions

VMware Data Solutions, formerly known as Tanzu Data Services, is a powerful part of the entire VMware portfolio and consists of:

  • VMware GemFire – Fast, consistent data for web-scaling concurrent requests fulfills the promise of highly responsive applications.
  • VMware RabbitMQ – A fast, dependable enterprise message broker that provides reliable communication among servers, apps, and devices.
  • VMware Greenplum – VMware Greenplum is a massively parallel processing database. Greenplum is based on open-source Postgres, enabling Data Warehousing, aggregation, AI/ML and extreme query speed.
  • VMware SQL – VMware’s open-source SQL Database (Postgres & MySQL) is a Relational database service providing cost-efficient and flexible deployments on-demand and at scale. Available on any cloud, anywhere.
  • VMware Data Services Manager – Reduce operational costs and increase developer agility with VMware Data Services Manager, the modern platform to manage and consume databases on vSphere.

VMware Data Services Manager and VMware SQL

VMware SQL allows customers to deploy curated versions of PostgreSQL and MySQL and DSM is the solution that enables customers to create this DBaaS experience their developers are looking for.

VMware DSM Personas

Data Services Manager has the following key features:

  • Provisioning – Provision different configurations of databases (MySQL, Postgres, and SQL Server) with either freely
    configurable or pre-defined sizing of compute and memory resources, depending on user permissions
  • Backup & Restore – Backup, Transactional log, Point in Time Recovery (PiTR), on-demand or as scheduled
  • Scaling – Modify instances depending on usage (scale up, scale down, disk extension)
  • Replication – Replicate (Cold/Hot or Read Replicas) across managed zones
  • Monitoring – Monitor database engine, vSphere infrastructure, networking, and more.

…and supports the following components and versions (with DSM v1.4):

  • MySQL 8.0.30
  • Postgres 10.23.0, 11.18.0, 12.13.0, 13.9.0
  • MSSQL Server 2019 (Standard, Developer, Enterprise Edition)

Companies with a lot of databases have now a way at least to manage, control and secure Postgres, MySQL and MSSQL DB instances from a centralized tool than can be accessed via the UI or API.

Project Moneta

VMware’s vision is to become the cloud platform of choice. What started with compute, storage and network, continues with data: make it as easy to consume as the rest of their software-defined data center stack.

VMware has started with DSM and sees Moneta, which is still an R&D project, as the next evolution. The focus of Moneta is to bring better self-service and programmatic consumption capabilities (e.g., integration with GitHub).

Project Moneta will provide native integration with vSphere+ and the Cloud Consumption Interface (CCI). While nothing is official yet, I think of it as a vSphere+ and VMware Cloud add-on service that would provide data infrastructure capabilities. 

Final Words

If your developers want to use PostgreSQL, MySQL and MSSQL, and if your IT struggles to deploy, manage, secure and backup those databases, then DSM with Tanzu SQL can help. Both solutions are also perfectly made for disconnected use cases or airgapped environments.

Note: The DB engines are certified, tested and supported by VMware.

A Closer Look at VMware NSX Security

A Closer Look at VMware NSX Security

A customer of mine asked me a few days ago: “Is it not possible to get NSX Security features without the network virtualization capabilities?”. I wrote it already in my blog “VMware is Becoming a Leading Cybersecurity Vendor” that you do not NSX’s network virtualization editions or capabilities if you are only interested in “firewalling” or NSX security features.

If you google “nsx security”, you will not find much. But there is a knowledge base article that describes the NSX Security capabilities from the “Distributed Firewall” product line: Product offerings for NSX-T 3.2 Security (87077).

Believe it or not, there are customers that haven’t started their zero-trust or “micro-segmentation” journey yet. Segmentation is about preventing lateral (east-west) movement. The idea is to divide the data center infrastructure into smaller security zones and that the traffic between the zones (and between workloads) is inspected based on the organization’s defined policies.

Perimeter Defense vs Micro-Segmentation

If you are one of them and want to deliver east-west traffic introspection using distributed firewalls, then these NSX Security editions are relevant for you:

VMware NSX Distributed Firewall

  • NSX Distributed Firewall (DFW)
  • NSX DFW with Threat Prevention
  • NSX DFW with Advanced Threat Prevention

VMware NSX Gateway Firewall

  • NSX Gateway Firewall (GFW)
  • NSX Gateway Firewall with Threat Prevention
  • NSX Gateway Firewall with Advanced Threat Prevention

Network Detection and Response

  • Network Detection and Response (standalone on-premises offering)

Note: If you are an existing NSX customer using network virtualization, please have a look at Product offerings for VMware NSX-T Data Center 3.2.x (86095).

VMware NSX Distributed Firewall

The NSX Distributed Firewall is a hypervisor kernel-embedded stateful firewall that lets you create access control policies based on vCenter objects like datacenters and clusters, virtual machine names and tags, IP/VLAN/VXLAN addresses, as well as user group identity from Active Directory.

If a VM gets vMotioned to another physical host, you do not need to rewrite any firewall rules.

The distributed nature of the firewall provides a scale-out architecture that automatically extends firewall capacity when additional hosts are added to a data center.

Should you be interested in “firewalling” only, want to implement access controls for east-west traffic (micro-segmentation) only, but do not need threat prevention (TP) capabilities, then “NSX Distributed Firewall Edition” is perfect for you.

So, which features does the NSX DFW edition include?

The NSX DFW edition comes with these capabilities:

  • L2 – L4 firewalling
  • L7 Application Identity-based firewalling
  • User Identity-based firewalling
  • NSX Intelligence (flow visualization and policy recommendation)
  • Aria Operations for Logs (formerly known as vRealize Log Insight)

What is the difference between NSX DFW and NSX DFW with TP?

With “NSX DFW with TP”, you would get the following additional features:

  • Distributed Intrusion Detection Services (IDS)
  • Distributed Behavioral IDS
  • Distributed Intrusion Prevention Service (IPS)
  • Distributed IDS Event Forwarding to NDR

Where does the NSX Distributed Firewall sit?

This question comes up a lot because customers understand that this is not an agent-based solution but something that is built into the VMware ESXi hypervisor.

The NSX DFW sits in the virtual patch cable, between the VM and the virtual distributed switch (VDS):

NSX Distributed Firewall

Note: Prior to NSX-T Data Center 3.2, VMs must have their vNIC connected to an NSX overlay or VLAN segment to be DFW-protected. In NSX-T Data Center 3.2, distributed firewall protects workloads that are natively connected to a VDS distributed port group (DVPG).

VMware NSX Gateway Firewall

The NSX Gateway Firewall extends the advanced threat prevention (ATP) capabilities of the NSX Distributed Firewall to physical workloads in your private cloud. It is a software-only, L2 – L7 firewall that includes capabilities such as IDS and IPS, URL filtering and malware detection as well as routing and VPN functionality.

If you are not interested in ATP capabilities yet, you can start with the “NSX Gateway Firewall” edition. What is the difference between all NSX GFW editions?

VMware NSX GFW Editions

The NSX GFW can be deployed as a virtual machine or with an ISO image that can run on a physical server and it shares the same management console as the NSX Distributed Firewall.