NSX Edge Gateway Substitutes

[TheVMinator]

The NSX Edge gateway can be used for North - South firewall services, NAT, and so on.  If I'm already using Palo Alto Physical Firewalls, and I want the features that their OS offers for North South Firewalling, can I use a Palo Alto VIRTUAL Firewall in conjunction with NSX edge to provide NAT and North-South Firewalling in place of NSX edge?

(I know Palo Alto VM-1000 firewall can be used to enhance the NSX Distributed Firewall by installing it on every host - that isn't what I'm talking about doing here - I want to see if I can use Palo Alto for North South firewalling to get rid of NSX edge gateway completely)

[ocecil]

You will definitely need the ESG for North/South traffic to connect the physical to logical, so you will not be able to get rid of ESG completely. You will however have the option of completely turning off the ESG Firewall so you can use other firewall solutions while ESG provides network connectivity.

[larsonm]

ESG is not required.  DLR can perform north-south routing.  See the explanation of deployment scenarios here:  NSX DLR – ChansBlog

[ocecil]

Interesting, I just heard directly from Scott Lowe that although DLR can handle N/S, it isn't recommend due to it's inability to handle the encapsulation needed for the NSX, and that ESG will have to handle that in order for NSX to function properly. I have personally never seen any NSX design that bypassed ESG all together for any purpose so I believe this link is a bit misleading.

[larsonm]

The use of strictly the DLR to handle north-south traffic is not ideal due to the fact that the Designated Interface, which is specific to one host, is the only way for physical traffic to re-enter the VXLAN network.  While the ESG is recommended, it is NOT required.

[ocecil]

If ESG provides the only way of allowing physical traffic to enter the VXLAN network, how would using DLR only still allow proper N/S traffic to the NSX infrastructure? I honestly cannot imagine any scenario where someone would want to NOT use ESG (unless they just wanted E/W traffic and no N/S), which is a crucial component of NSX regardless of whether someone wants to use ESG firewall or not. I would appreciate it if you can elaborate any scenario/reason where ESG could be completely bypassed and still have a fully functional NSX environment.

[larsonm]

A logical router uplink interface might connect to an NSX edge services gateway, a 3rd-party router VM for that, or a VLAN-backed dvPortgroup to make the logical router connect to a physical router directly.

Page 62 of the NSX Administration Guide

http://pubs.vmware.com/NSX-62/topic/com.vmware.ICbase/PDF/nsx_62_admin.pdf

[ocecil]

Might be a typo, but there are no related information on page 62 of the administration guide.

So we know using ESG will allow proper N/S into the VXLAN network, but you are saying by connecting DLR to a VLAN backed dvPortGroup, it will accomplish the same network connectivity from physical to NSX infrastructure? Also, you still have not mentioned any situation where it will be optimal to bypass the ESG altogether, it might not be REQUIRED, but would there be any benefit of doing so?

[larsonm]

Yup, wrong page.  On Page 59 is written the following statement:  Uplink interfaces are for North-South communication. A logical router uplink interface might connect to an NSX edge services gateway, a 3rd-party router VM for that, or a VLAN-backed dvPortgroup to make the logical router connect to a physical router directly.

I am not saying that the DLR has the same capabilities as the ESG.  I'm saying that, if an NSX customer wants to connect the DLR to a VLAN-backed dvPortGroup to provide north-south communication to/from the VXLAN environment, that is an option they can choose.  Doing so has limitations, but it is an option available. 

A possible use case might be if the NSX customer wants to use a 3rd party router VM (or possibly a firewall VM like in the original post) instead of the ESG.  Maybe this 3rd party router plays better with their existing network infrastructure, or supports features not available with the ESG. 

Another example might be if you have single ESXi hosts at remote sites and want to leverage the distributed firewall to restrict traffic on that host for say a video recording application, but do not want to commit host resources to the deployment an ESG or two because you do not need the services that it provides.

Many customers have very unique business requirements.  While it is important to make recommendations based on best practice, it is also important to accurately articulate the true requirements of the product.

[ocecil]

TheVMinator, I apologize for getting a bit sidetracked, but I believe LarsonM is technically correct on saying ESG is NOT required, although I believe it is highly not recommended and you will be losing tremendous amount of capabilities ESG has to offer. I understand that you plan on using Palo Alto physical firewall solution, but you can still set up ESG for proper N/S traffic and disable the ESG firewall, while gaining access to DHCP, NAT, L2 VPN, SSLVPN, and Load balancing. It is rather simple to set up, and will act as a link between your physical network directly to your DLR while Palo Alto handles your N/S security. You can even use distributed firewall for micro-segmentation on top of your physical firewall, perhaps that is something you might be interested in also.

[ocecil]

I absolutely agree that clients have different solutions for their infrastructure, but in OP's case (well for any case for that matter), losing all the capabilities that ESG offers seem like too much of a waste, especially when it can still be used easily with OP's Palo Alto physical firewall solution while retaining all the ESG services. I should've been more clear from the start, while ESG definitely is NOT required as you stated, I believe it is HIGHLY recommended to utilize it for any NSX infrastructure.  

[pkts]

Use of DLR with vlan-backed port group for N/S traffic will lead to the N/S vlan having to be plumbed to all hosts, including the compute hosts. Use of ESG limits the trunking of the external vlan (and hence vlan-based flooding) to the Edge Cluster. This may or may not be a concern depending on your architecture.

[TheVMinator]

Thanks all for this great input.  Some more background here:

• A Palo Alto Physical Firewall is in place as mentioned
• Palo Alto has some great features in its PAN OS virtual appliance that we would like to implement with North South Traffic for multiple tenants.  Things like Application ID based rules and the whole suite of features in Pan OS. 
• The physical Palo Alto has limits in terms of how much traffic and processing can happen there.  If we can move some of that processing onto virtual appliances and make it specific to certain tenants, that eases the choke-point on the physical firewall and distributes it to the virtual appliances, and the solution can scale much more easily than adding / replacing physical appliances.
• If we add a Palo Alto virtual appliance, then we have a number of stops on the communication path already: for example for traffic coming in - > 1.  The Palo Alto Physical Appliance (on the perimiter), -> 2.  The Palo Alto virtual appliance (specific to each tenant) - 3. The tenant environment.

I would like to retain the feature set available in PanOS while reducing the complexity of the deployment of the solution for each new tenant, reduce of the number of devices / VMs required in the communication path, require the fewest points of management.  If every required service  that ESG gateway offers  could be done by a Palo Alto VM Series firewall, and there is nothing ESG does that a Palo Alto VM Series firewall can't do (is there?), then does it make sense to use both ESG and the Palo Alto VM Series Firewall?

[ocecil · Accepted solution]

TheVMinator, I personally do not have enough knowledge with Palo Alto Physical Firewall or PAN OS to determine how it should best be used with NSX. However, you did mention wanting to reduce complexity of deploying new tenants, and that can definitely be achieve by using ESG. A single ESG setup will easily allow up to 9 virtual tenants to be deployed off of it, and if you require more that 9 tenants, you can deploy a aggregation layer ESG that will be able to support up to 9 tenant ESG for scalability. A diagram of this topology can be seen here,

https://richdowling.wordpress.com/2014/10/09/objective-2-1-define-benefits-of-running-vmware-nsx-on-...

Combined with variety of other features ESG comes with, which you might or might not need, I believe it is a must to any NSX infrastructure. Even if the Palo Alto Physical Firewall offers much more capability than ESG firewall does, there is very little reason why you should avoid deploying ESG altogether in my opinion.

[TheVMinator]

OK thanks again for all the input