NSX installation guidance-Firewall feature only.

[neel_mani]

Folks,

We are in process to get our NSX feature rolled out to the vCentre.

This includes the firewall feature only.

We are pretty new to this and would like to get some initial guidance on recommended practice.

What I understand is when we do not needed a vSwitch and a vRouter the cluster controllers are not needed, correct?

When we want to roll out a firewall feature only all we need is the NSX manager.

Regards,

N!!

[Sreec · Accepted solution]

For microsegmentation use case we don't need to leverage Controllers/Logical Router/Logical Switches,Edges etc . You can certainly use the feature on vSphere port groups.However Logical switches with DFW is the best combination.

[amolnjadhav]

Hi Neel_Mani,

  Yeah, you don't need any NSX Component accept NSX Manager but make sure you DFW is not Supported on Standard Switch only DVS.

Regards

Amol

[rajeevsrikant]

The below link says that DFW will work in Standard switch but it is not officially supported by VMware.

Let me know if this is right.

NSX & vSphere Standard Switch Compatibility · vrandom

[rajeevsrikant]

Also I found the below.

Its mentioned that the Applied To can be applied to Legacy Port group - VSS port group

[toroki]

It's better to migrate to vDS. Here is the snapshot from the official slide from VMWorld 2017 for the logical recommendation.