Fr

ee

VMware NSX is the network virtualization and security

platform that has emerged from VMware. It is a platform
for the software-defined data center. This software
networking platform allows complex networking
topologies to be deployed programmatically in seconds.
Software-Defined Networking (SDN) allows for ease of
deployment, management, and automation in deploying
and maintaining new networks while reducing, and in
some cases completely eliminating, the need to deploy
traditional networks.

Who this book is written for

This book is for those who want to learn to install, manage,
and configure the VMware NSX Network Virtualization
platform. If you want to explore, understand, or deploy
VMware NSX in your environment, this book is for you.
Also, this book can assist you to prepare for VMware NSX
certification. Knowledge of basic networking concepts
and VMware components such as vCenter and vSphere
is required.

Explore the foundational components

of VMware NSX
Install and configure NSX Manager and
its components

Secure your environment using Distributed

Firewall and data security
Configure third-party services in NSX
Manage, configure, and deploy Edge
Services Gateway
Understand software-defined networks

$ 39.99 US
25.99 UK

professional expertise distilled

P U B L I S H I N G

pl
e

Deploy and configure VXLAN-enabled

logical switches

P r o f e s s i o n a l

Ranjit Singh Thakurratan

In Learning VMware NSX, you will learn the features of the

SDN and explore VMware NSX, beginning with network
virtualization. We'll then walk you through the components
of NSX and provide step-by-step instructions to help you
install and configure NSX. We also cover all the functional
services of NSX, Edge Services Gateway, service
composer, and data security. In addition, we'll teach you to
integrate partner solutions with NSX. Finally, we'll show you
how to manage your NSX deployment and monitor NSX.

What you will learn from this book

Learning VMware NSX

Learning VMware NSX

Sa

E x p e r t i s e

D i s t i l l e d

Learning VMware NSX

Virtualize your network with this step-by-step configuration guide
to installing, configuring, and managing VMware NSX

Prices do not include

local sales tax or VAT
where applicable

Visit www.PacktPub.com for books, eBooks,

code, downloads, and PacktLib.

Ranjit Singh Thakurratan

professional expertise distilled

P U B L I S H I N G

In this package, you will find:

The author biography

A preview chapter from the book, Chapter 1 'An Introduction to
Network Virtualization'
A synopsis of the books content
More information on Learning VMware NSX

About the Author

Ranjit Singh Thakurratan (RJ) is a VMware vExpert (2014 and 2015) and works

as a VMware cloud solutions architect, specializing in architecting Enterprise cloud

solutions. He works for Rackspacethe #1 managed cloud company and home of
Fanatical Supportwhich is based out of San Antonio, Texas.

RJ holds a master's degree in information technologyinfrastructure assurance,

an engineering degree in computer science, and has over ten years of hands-on
IT experience. He has presented at numerous VMUG UserCon conferences
held at Boston, Washington DC, New York, Denver, and Dallas. He also runs
a technology blog, www.rjapproves.com, and can be reached via his Twitter
handle@RJAPPROVES. Apart from technology, RJ is also interested in astrophysics,
animal welfare, and open source projects.
One of his favorite quotes is:
"The greatness of a nation and its moral progress can be judged by the way its
animals are treated."
Mahatma Gandhi

Preface
Networking is the most critical component of any IT architecture. Architects always
want to lay the right foundations of networks and solve networking issues before
the computation and storage is looked at. This is why I have always felt the need
to have a better understanding of networking and how things work.
Network virtualization technology allowed me to have a behind-the-scenes,
hands-on look at how networking works and the concepts that made it happen.
The ability to deploy virtual appliances such as switches, load balancers, and routers
and examine their functionality was very appealing. The pace at which I learned
network virtualization (NSX) gave me the confidence to grow in a field in which
I thought I lacked significant knowledge. Through my journey, I understood that
network virtualization not only made me think like a network engineer, but also
made me apply networking concepts very creatively to a virtualized environment,
and this made it all the more appealing. What was complex before, now became
extremely simple.
In 2015, I went about giving presentations at multiple VMUG UserCon sessions
all around the country. My presentation was on Getting started with VMware NSX Basics and Best Practices. Here, my aim was not to talk about what NSX can do but to
talk about how easy it was to get started with NSX and also to squash some common
misconceptions about it. I wasn't sure whether this was a topic worth talking about
and wasn't expecting a large crowd. (My time slot to present was right after lunch,
which wasn't very encouraging.)
Soon, I was proved wrong. In each and every city where I gave my presentations,
all of my sessions had a full audience. People were eager to know how to get started
with NSX and in fact, preferred this presentation to any of the other VMware NSX
presentations happening at the same conference. I was able to quickly identify the
huge knowledge gap and the plethora of common misconceptions about NSX and
network virtualization, in general. I also observed that many of the attendees were
network administrators with an interest in network virtualization.

Preface

This feedback from the tech community gave me a desire to write a book that
covers the basics and teaches how to get started with NSX. I want to connect to the
day-to-day administrator and the network engineer who is wondering how all the
dots connect, and this is something I am passionate about. The book explains the
basics and covers the deployment of the various features of network virtualization
in simple and clear language and with screenshots that allow you to visualize
the workflow as you read. I did have to work around a page restriction set by the
publisher, so I focused on the most commonly used or sought-after features in the
book even though I covered all of the NSX features and functionality. The audience
feedback from various conferences helped me greatly.
I hope you enjoy working with this book and that it helps you to learn to use and
understand NSX and network virtualization.

What this book covers

Chapter 1, An Introduction to Network Virtualization, gets you started with an
introduction to network virtualization and an overview of its concepts. You will
briefly learn about some of NSX's features and capabilities. We also have a NSX
limits table to help you understand NSX's capabilities.
Chapter 2, NSX Core Components, talks about all the different components of NSX and
how they all work together. You will also learn about VXLAN architecture that is the
backbone of overlay or virtual networking. We will also briefly talk about transport
zones that define the scope of a virtual network. You will learn about NSX Edge
services and the distributed firewall as well.
Chapter 3, NSX Installation and Configuration, is where we will start deploying and
configuring NSX. We will go over the installation process step by step and then
configure our NSX deployment with a vCenter server. You will learn how to manage
NSX using the vSphere web client and build your control and data planes.
Chapter 4, NSX Functional Services, discusses the deployment and configuration of
different NSX services, such as logical switching, L2 bridging, and Edge gateway
services. We will go over the configuration of transport zones and logical switching
step by step. This will be an interesting chapter, where you will also learn the
deployment of Edge appliances and set up L2 bridging, which allows you to extend
a layer 2 network into NSX.
Chapter 5, Edge Services Gateway, discusses the NSX Edge gateway, which offers a lot
of features and capabilities. We will go deeper into the services offered by the Edge
gateway and look at how to deploy and configure them. We will look at how to
configure routing and load balancing. You will also spend some time learning
to set up DHCP and DNS services.

Preface

Chapter 6, Data Security, discusses one of the most important capabilities of NSX, its
security, and also discusses the different NSX security offerings. We will discuss and
learn how to set up security groups and configure them by mapping a security group
to a specific policy. You will also learn briefly about the network extensibility feature
of NSX.
Chapter 7, Monitoring, looks at how to enable monitoring for our environment using
NSX. Activity monitoring is one of the features of NSX that is a boon for network
and system administrators. You will learn how to configure it along with generating
a virtual machine activity report. You will also learn about flow monitoring and
Traceflow, which can simulate and allow you to test the network.
Chapter 8, Managing NSX, talks about NSX administrative tasks such as backup and
restore and NSX Manager settings. We will revisit NSX Manager and explore all
the different settings that can be set. We will look at setting up syslog, time, and
DNS settings. We will also look at taking controller snapshots as well. We will also
have a look at the setup of our NSX Manager with CA signed certificates along with
configuring NSX with a domain.
Chapter 9, Conclusion, is the concluding chapter that includes important information
and links

An Introduction to Network
Virtualization
This chapter begins with a brief introduction to Network Virtualization followed
by an overview of its concepts. We then introduce VMware's NSX-V Network
Virtualization solution that allows you to deploy and manage your own softwaredefined networking stack. We will go over all the features and services of NSX
followed by its configuration maximums. By the end of this chapter, you will have a
thorough understanding of the concepts of Network Virtualization and NSX-V as a
Network Virtualization solution.
In this chapter, we will cover the following:

An introduction to Network Virtualization

The concepts of Network Virtualization

An introduction to the NSX-V Network virtualization platform

NSX features and services

NSX configuration maximums

An introduction to Network Virtualization

Today's datacenter demands have undergone a paradigm shift from what they
were a decade ago. As the cloud consumption model is being rapidly adopted
across the industry, the need for on-demand provisioning of compute, storage, and
networking resources is greater than ever. One of the biggest contributing factors to
enable the cloud consumption model is Server virtualization. Server virtualization
has enabled fast consumption of compute resources along with add-on functionality
and services. Snapshots, clones, and templates are all now easier than ever with
Server virtualization.
[1]

An Introduction to Network Virtualization

If you have worked in a datacenter, you would agree that networking is always
challenging to work with. Once the networking design is established, any changes
that need to be made are always challenging because of a lack of flexibility due to
increasing complexity and demands on the environment. While compute and storage
have rapidly improved on their speed of deployment and consumption, networking
continues to remain a challenge in today's environments where simple tasks, such as
creating a new VLAN, are becoming increasingly complex and time-consuming.
A metaphor: Today's networking is similar to building roads
and highways in a city. Once you have the highways and roads
established, it is not easy to expand them or simply remove and
replace them without affecting the city or the traffic. You always have
to think forward and have to build to handle future growth and have
the flexibility to expand and maintain. Similarly, traditional networks
in a datacenter have to be built to handle future growth and should
be flexible enough to allow for changes as they happen.

Network Virtualization is the "virtualization" of network resources using software

and networking hardware to enable faster provisioning and deployment of
networking resources. Network Virtualization lays the foundation for Software
Defined Networking that allows instant deployment of services to be offered to
the consumers. Services such as Edge Gateways, VPN, DHCP, DNS, and load
balancers can be instantly provisioned and deployed because of the software aspect
of Network Virtualization. The networking hardware allows physical connectivity,
while the software is where all the network logic resides that allows a feature-rich
network service offering.
Network Virtualization allows the consumption of simplified logical networking
devices and services that are completely abstracted from the complexities of the
underlying physical network. Lastly, Network Virtualization is the key for a
Software-Defined Datacenter (SDDC).

The concepts of Network Virtualization

Now that we have defined what network virtualization is about, let's go over some
of the key concepts of network virtualization and software defined networking:

Decoupling: An important concept of Network Virtualization is the

decoupling of software and the networking hardware. The software works
independently of the networking hardware that physically interconnects the
infrastructure. Remember that your throughput on the wire will be always
limited by your network hardware performance.

[2]

Chapter 1

Control Plane: The decoupling of software and networking hardware allows

you to control your network better because all the logic resides in software.
This control aspect of your network is called the control plane. The control
plane provides the means to configure, monitor, and troubleshoot and also
allows automation against the network.

Data Plane: The networking hardware forms the data plane where all the
data is forwarded from source to destination. The management of data
resides in the control plane; however, the data plane consists of all the
networking hardware whose primary function is to forward traffic over the
wire from source to destination. The data plane holds all the forwarding
tables that are constantly updated by the control plane. This also prevents
any traffic interruptions if there is a loss of the control plane because the
networking hardware, which constitutes the data plane, will continue to
function without interruptions.

API: Application Programming Interface or API is one of the important

aspects of a virtualized Network that allows us to have true software-defined
networking by instantly changing the network behavior. With the API, you
can now instantly deploy rich network services in your existing network.
Network services such as Edge Gateway, VPN, firewalls, and load balancers
can all be deployed on the fly by means of an API.

An introduction to the NSX-V network

virtualization platform
VMware NSX-V is a network virtualization platform that allows us to have softwaredefined networks and is a critical component of software-defined datacenter
architecture. VMware's NSX-V software abstracts the underlying physical network
by introducing a software layer that makes it easy to consume network resources by
creating multiple virtual networks. NSX-V also allows the deployment of multiple
logical network services on top of the abstracted layer.
VMware acquired NSX from Nicira in July, 2012. Nicira's NSX was
primarily being used for network virtualization in a Xen-based hypervisor.

VMware now has two flavors of NSX: NSX-V and NSX-MH. NSX-V is NSX
for VMware-based hypervisor, while NSX-Multi Hypervisor (NSX-MH) is for
OpenStack environments. The two versions have many similarities but are also
dissimilar in some aspects. This book covers only the NSX-VMware (NSX-V)
version of NSX. NSX-V will be referred to as NSX in the rest of the book.
[3]

An Introduction to Network Virtualization

The following figure represents the software abstraction of the physical network
and networking hardware by NSX. This is synonymous with how VMware vSphere
hypervisor achieves the software abstraction of CPU, memory, and storage that
makes it possible to create multiple virtual machines.

Similar to how the vSphere hypervisor allows you to create, delete, take a snapshot
of, and monitor a virtual machine, NSX also allows you to programmatically create,
delete, take a snapshot of, and monitor a virtual network. NSX can be deployed on
your current physical network infrastructure and does not require you to upgrade
your existing infrastructure. Lastly, NSX deployment is not disruptive to your
existing network and traffic. It can be seamlessly deployed on top of your existing
infrastructure, and the consumption of its services can take place in conjunction
with your traditional network.

NSX features and services

Before we get started with NSX, it is important to understand some of its features
and services. Some NSX features are listed as follows. We will discuss these features
in greater detail in the following chapters.
NSX 6.2 is the current NSX version as of this writing.

Logical switching: NSX allows the ability to create L2 and L3 logical

switching that allows workload isolation and the separation of IP address
space between logical networks. NSX can create logical broadcast domains
in the virtual space that prevent the need to create any logical networks on
physical switches. This means you can are no longer limited to 4096 physical
broadcast domains (VLANs).
[4]

Chapter 1

NSX Gateway Services: The Edge Gateway services interconnect your

logical networks with your physical networks. This means a virtual machine
connected to a logical network can send and receive traffic directly to your
physical network through the gateway.

Logical Routing: Multiple virtual broadcast domains (logical networks)

can be created using NSX. As multiple virtual machines subscribe to these
domains, it becomes important to be able to route traffic from one logical
switch to another. Logical routing helps to achieve this by routing traffic
between logical switches, or even between a logical switch and the public
networks. Logical routing can be extended to perform east-west routing that
saves unnecessary network hops by increasing network efficiency. Logical
routers can also provide north-south connectivity by allowing access to
workloads living in physical networks. Logical routers also help to avoid
the hairpinning of traffic, thereby increasing network efficiency.
East-west traffic is the traffic between the virtual machines within
a datacenter. In the current context, this typically will be the traffic
between logical switches in a VMware environment.
North-south traffic is the traffic moving in and out of your
datacenter. This is any traffic that either enters your datacenter or
leaves your datacenter.

Logical firewall: NSX allows you to have the options of a Distributed

Logical Firewall and an Edge firewall for use within your software-defined
networking architecture. A distributed logical firewall allows you to build
rules based on attributes that include not just IP addresses and VLANs, but
also virtual machine names and vCenter objects. The Edge Gateway features
a firewall service that can be used to impose security and access restrictions
on north-south traffic.

Extensibility: NSX allows you to integrate with many third-party partner

solutions. There are many VMware partners who offer solutions such as
traffic monitoring, IDS, and application firewall services that can integrate
directly into NSX. This enhances management and end user experience by
having one management system to work with.

[5]

An Introduction to Network Virtualization

The features listed previously enable NSX to offer a wide variety of services that can
be applied to your infrastructure. These services can be deployed and configured by
the NSX API as well. Some of the NSX services are listed as follows:

Load balancer NSX Edge offers a variety of services, and logical load
balancer is one of them. The logical load balancer distributes incoming
requests among multiple servers to allow load distribution while abstracting
this functionality from end users. The logical load balancer can also be used
as a high availability (HA) mechanism to ensure that your application has
the most uptime.

Virtual Private Networks (VPN): The Edge offers a VPN service that allows
you to provision a secure encrypted connectivity for end users to your
applications and workloads. The Edge VPN service offers SSL-VPN plus that
allows user access and IPSEC site-to-site connectivity that allows two sites
to be interconnected securely.

Dynamic Host Configuration Protocol (DHCP): NSX Edge offers DHCP

services that allows IP address pooling and also static IP assignments.
An administrator can now rely on the DHCP service to manage all the IP
addresses in your environment rather than maintaining a separate DHCP
service. The DHCP service can also relay DHCP requests to your existing
DHCP server. The NSX Edge DHCP service can relay any DHCP requests
generated from your virtual machines to a pre-existing physical or virtual
DHCP server without any interruptions.

Domain Name System (DNS): NSX Edge offers a DNS relay service that can
relay any DNS requests to an external DNS server.

Service composer: The service composer allows you to allocate network

and multiple security services to security groups. Services are automatically
applied to virtual machines that are part of these security groups.

Data Security: NSX Data Security provides visibility to sensitive data,

ensures data protection, and reports back on any compliance violations. A
data security scan on designated virtual machines allows NSX to analyze
and report back on any violations based on the security policy that applies
to these virtual machines.

Other NSX features include cross-vCenter networking and security, which allows
you to manage multiple vCenter NSX environments using a primary NSX manager.
This not only permits a centralized management, but also extends one or more
services and features across multiple vCenter environments. We will discuss more
about cross vCenter networking in the upcoming chapters.

[6]

Chapter 1

NSX configuration maximums

Let's take a look at what NSX configuration maximums are. VMware has not
published an official document, so the limits listed in the following tables were
gathered by reviewing the NSX documentation and from online research. Some
websites that contributed include www.vmguru.com.
Some of these limits are hard limits, but most are soft limits beyond which VMware
does not support such configurations. For example if you exceed the number of
concurrent connections per Edge Gateway, it will affect your gateway's performance
but won't cause it to halt or reject new connections. The hard limits versus soft
limits documentation is not explicitly published; however, VMware NSX support
can clarify the differences if needed. Chances are that you will scale out your
environment before reaching these maximums.
The following tables are the maximums for NSX.
Configuration maximums can differ based on software releases. Always
refer to the most up-to-date documentation to ensure accuracy.

The following table shows the limits for NSX vCenter Maximums:
Description

Limit

vCenters

NSX Managers

DRS Clusters

12

NSX Controllers

Hosts per cluster

32

Hosts per Transport Zone

256

A Transport Zone defines the scope of a logical switch and can span one or more
vSphere clusters. We will discuss this in greater detail in the upcoming chapters.
The following table shows the limits for Switching Maximums:
Description

Limit

Logical Switches

10,000

Logical Switch Ports

50,000

Bridges per Distributed Logical Router

500

[7]

An Introduction to Network Virtualization

The following table shows the limits for Distributed Logical Firewall Maximums:
Description

Limit

Rules per NSX Manager

100,000

Rules per VM

1,000

Rules per Host

10,000

Concurrent connections per Host

2,000,000

Security Groups per NSX Manager

10,000

The following table shows the limits for Distributed Logical Router (DLR)
Maximums:
Description

Limit

DLRs per Host

1,000

DLR per NSX Manager

1,200

Interfaces per DLR

999

Uplink interfaces per DLR

Active routes per DLR

2,000

Active routes per NSX Manager

12,000

OSPF Adjacencies per DLR

10

BGP Peers per DLR

10

Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP)
are routing protocols.

The following table shows the limits for NSX Edge Services Gateway (ESG)
Maximums:
Description

Limit

Total number of Edge Service

Gateways per NSX Manager

2,000

Interfaces per ESG (internal, uplink,

or trunk)

10

Sub-interfaces on a trunk

200

NAT Rules per ESG

2,000

Static routes per ESG

2,048

[8]

Chapter 1

The following table shows the limits for Edge Services Gateway Compact
Maximums:
Description

Limit

OSPF Routes per ESG

20,000

OSPF Adjacencies per ESG

10

BGP Peers per ESG

10

BGP Routes per ESG

20,000

Total Routes per ESG

20,000

Concurrent connections per ESG

64,000

The following table shows the limits for Edge Services Gateway Large Maximums:
Description

Limit

OSPF Routes per ESG

50,000

OSPF Adjacencies per ESG

20

BGP Peers per ESG

20

BGP Routes per ESG

50,000

Total Routes per ESG

50,000

Concurrent connections per ESG

1,000,000

The following table shows the limits for Edge Services Gateway X-Large
Maximums:
Description

Limit

OSPF Routes per ESG

100,000

OSPF Adjacencies per ESG

40

BGP Peers per ESG

50

BGP Routes per ESG

250,000

Total Routes per ESG

250,000

Concurrent connections per ESG

1,000,000

[9]

An Introduction to Network Virtualization

The following table shows the limits for Edge Services Gateway Quad-Large
Maximums:
Description

Limit

OSPF Routes per ESG

100,000

OSPF Adjacencies per ESG

40

BGP Peers per ESG

50

BGP Routes per ESG

250,000

Total Routes per ESG

250,000

Concurrent connections per ESG

1,000,000

The following table shows the limits for Edge Services Gateway Overall
Maximums:
Description

Limit

Load Balancer VIPs

64

Load Balancer Pools

64

Load Balancer Servers per Pool

32

Firewall rules per ESG

2,000

The following table shows the limits for DHCP: VPN Service Maximums:
Description

Limit

DHCP Pools per Edge Service

Gateway (all sizes)

20,000

Number of IPSEC tunnels per

Edge gatewayCompact

512

Number of IPSEC tunnels per

Edge gatewayLarge

1,600

Number of IPSEC tunnels per

Edge gatewayX-Large

4,096

Number of IPSEC tunnels per

Edge gatewayQuad-Large

6,000

SSL VPN number of Concurrent

connections (compact/large/xlarge/quad-large)

50/100/100/1000

[ 10 ]

Chapter 1

The following table shows the limits for Multi-vCenter NSX Supported Features:
Description

Limit

Logical Switch

Yes

L2 Bridges

No

Logical Distributed Router

Yes

Distributed Firewall

Yes

Edge Services

No

IP Security Groups

Yes

Summary
We started this chapter with an introduction to Network Virtualization and
software-defined networking. We discussed the concepts of Network virtualization
and introduced VMware's NSX Network virtualization platform. Then we discussed
different NSX features and services, including logical switching, logical routing, edge
gateway services, extensibility, service composer, and data security. Also, we briefly
discussed the multi vCenter NSX feature. We ended the chapter with configuration
maximums for NSX.
In the next chapter, we will discuss the core components that make up NSX. We will
learn more about VXLAN architecture, Transport Zones and NSX Edge Gateways.

[ 11 ]

Get more information Learning VMware NSX

Where to buy this book

You can buy Learning VMware NSX from the Packt Publishing website.
Alternatively, you can buy the book from Amazon, BN.com, Computer Manuals and most internet
book retailers.
Click here for ordering and shipping details.

www.PacktPub.com

Stay Connected: