topic Re: using NSX-T distributed firewall in VCF 4.5 environment in VMware Cloud Foundation Discussions

using NSX-T distributed firewall in VCF 4.5 environment

kmcd03 — Tue, 15 Aug 2023 16:53:03 GMT

I would like to start using NSX-T distributed firewall (dFW) in my VCF 4.5 domains, but won't be using logical routing at this time.

VCF has prepared the nodes, e.g. created transport zone, the uplink and transport node profiles, configured NSX on the nodes, etc.

If I want to start using dFW, but don't care about overlay, do I simply create a segment with a VLAN in NSX Manager and associate it with the transport zone created by VCF? Then binding VMs vNIC to the VDS portgroup so dFW policies and rules are applied.

Or should I create a new VLAN transport zone and associate with hosts in the domain? And then create the segment and bind VM vNICs.

Thanks!

Re: using NSX-T distributed firewall in VCF 4.5 environment

CyberNils — Wed, 16 Aug 2023 06:34:07 GMT

Hi, you need to attach a VLAN TZ to be able to create VLAN Backed Segments. Take a look at my blog post for details:

https://cybernils.net/2023/07/17/creating-vlan-backed-segments-in-vmware-cloud-foundation-vcf/

Re: using NSX-T distributed firewall in VCF 4.5 environment

mkeshsundrani — Wed, 16 Aug 2023 07:03:31 GMT

Also read through below 7 minutes blog, would give you much more insight on how to use DFW only feature in NSX-T,

https://www.vgarethlewis.com/2022/06/20/vmware-nsx-micro-segmentation-only-deployment/

Credit to Gareth Lewis -Blog

Re: using NSX-T distributed firewall in VCF 4.5 environment

kmcd03 — Wed, 16 Aug 2023 20:28:10 GMT

Thank you for documenting this.

I was leaning towards creating a new vlan TZ. And applying to the nodes using the Transport Node Profile that VCF created.

Is attaching, or detaching, the TNP to a Baseline WLD disruptive? I assume in this case only adding additional TZ to the nodes, so it won't take VMs or nodes offline.

Re: using NSX-T distributed firewall in VCF 4.5 environment

CyberNils — Thu, 17 Aug 2023 06:38:26 GMT

It should not be disruptive as far as I know.