DeanPung
Contributor
Contributor

NSX Distributed Firewall - Can you firewall vNICs that are connected to distributed port groups

Jump to solution

Hi,

If your virtual machines were connected to various distributed port groups (I.E. vlans) on a vSphere Distributed Switch and then you installed NSX, does NSX allow you create firewall rules that can be applied to those virtual machine vNICs which are connected to those same distributed port groups? I wasn't sure if you had to first migrate the virtual machines to virtual switches before NSX allowed you to assign the firewall rules.

Thanks.

0 Kudos
1 Solution

Accepted Solutions
rbenhaim
Enthusiast
Enthusiast

We can use NSX dFW windout enable network virtualization (VXLAN and NSX Controller) on the Cluster.

NSX dFW can work on both VSS or vDS

NSX DFW operates at the VM vNIC level, meaning that a VM is always protected irrespective of the way it is connected to the logical network.

VM can be connected to a VDS VLAN-backed port-group or to a Logical Switch (VXLAN-backed port-group).


View solution in original post

0 Kudos
4 Replies
RussH
Enthusiast
Enthusiast

Hi,

Yes - you can use the distributed firewall to protect VM nics connected to a vDS using standard port-groups.

cmiller78
Enthusiast
Enthusiast

You can use the distributed firewall on either the vDS or a standard switch. The DFW module in the hypervisor enforces policy at the vNIC, dvfilters are not required.

chunchitng
Enthusiast
Enthusiast

Yes it works at the vnic level. So you can start to protect your vm before migrating to vxlan. Use L2 bringing while doing the migration can be useful.

0 Kudos
rbenhaim
Enthusiast
Enthusiast

We can use NSX dFW windout enable network virtualization (VXLAN and NSX Controller) on the Cluster.

NSX dFW can work on both VSS or vDS

NSX DFW operates at the VM vNIC level, meaning that a VM is always protected irrespective of the way it is connected to the logical network.

VM can be connected to a VDS VLAN-backed port-group or to a Logical Switch (VXLAN-backed port-group).


View solution in original post

0 Kudos