Typically, the Edge Appliance acts as the North/South gateway and firewall. There are many approaches that can be taken:
While the physical world often relies on physical separation, NSX allows building a collapsed DMZ environment utilizing micro-segmentation and advanced firewall services to restrict and inspect traffic flow, accomplishing the same goals accomplished by traditional approaches of physical separation with physical firewalls.
Of course, security administrators may take time to adjust to the new cloud model of the collapsed DMZ, and may still require some level of separation. It is not uncommon to create a DMZ off of interfaces directly connected to the Edge Appliance servicing North-South traffic.
NSX components can be configured in many ways to facilitate both physical and logical isolation. Transport zones can be used to ensure protected VXLAN networks reside only on specific hosts. Logical switches can be created based on application profile, and rules put in place to secure based on logical switch. It's even possible to place all VMs on the same logical switch and apply rules at the group or VM level. Regardless of approach, the rules applied will result in the same level of security.
