Is VMware NSX-T secure?

Simon Edward • 29 November 2024

NSX-T is a dynamic network virtualisation platform. But is it secure? Discover its integrated security features.

VMware NSX-T is a powerful, versatile network virtualisation and security platform. It combines a range of features to achieve one goal: with NSX-T, enterprises can build complex software-defined networks.

Unlike its predecessor, NSX-V, NSX-T can be deployed in a wide range of environments, including virtual machines (VMs), containers and bare-metal servers. "No network too complex" could be its motto.

Once NSX-T is deployed, IT can use it to automate network policies – and avail themselves of powerful, integrated security features.

This last point is all-important. We're living at a time when networks are constantly changing shape. Gone are the days when a network was contained within the four walls of a branch office. Enterprises today run networks with multiple points of entry, multiple devices and multiple locations.

Here's Ahmed joining the call from the Seychelles. Now, here's a third-party client on a train to Basel. How can you be sure that all these moving parts are kept secure?

Complacency is not an option. That's why a platform like NSX-T needs to be super-secure.

Well, the good news is that NSX-T provides enterprise-grade security features to keep even the most sprawling network in check.

Micro-segmentation. Distributed firewalls. Network intrusion detection and prevention. All of these help IT to enforce security with versatility and ease.

But first: what is NSX-T, exactly?

What is VMware NSX-T?

NSX-T is one of the world's largest and most popular network virtualisation platforms. It can virtualise networks and data centres of all shapes, sizes and functionalities.

With NSX-T, multiple cloud networks can interact in an agile software-defined network infrastructure. This is a step up from NSX-T's predecessor, NSX-V, which couldn't be deployed in heterogeneous environments.

And no matter how complex the virtualised network, NSX-T allows you to control it all from a single pane of glass.

Is NSX-T secure?

In a word, yes. VMware has designed NSX-T so that its security features are hard-baked into the network virtualisation infrastructure. This enables IT to scan and protect all data traffic at all points of the network, be they virtual, physical, cloud-based or containerised.

Hard-baked – and easy to deploy. Configuration is as easy as pie as these features are always on and always ready to deploy.

The other key point is that the security controls have been decoupled from your workloads and placed in the hypervisor. This means no internal or external bad actor can tamper with your security features.

Distributed architecture

NSX-T uses distributed architecture. This means security enforcement controls are located at the virtual network interface of each and every workload. In other words, traffic flows can be scanned and policed at a granular level, so you enjoy total visibility over all workloads and applications.

What is NSX Distributed Firewall?

NSX Distributed Firewall (DFW) is a distributed, scaled-out firewall built to protect all east-west traffic across all workloads. It provides a firewall at every VM network interface (NIC). Administrators can write firewall rules around Security Group Tags and microsegment to the level of communication between two VMs on the same subnet.

The bottom line is that NSX-T lets you enforce security policies on all traffic that enters and exits each VM. This is managed at a scale that perimeter firewalls simply can't match. NSX-T has an astonishing ability to tame the complex.

It includes a stateful L4-L7 firewall, a network sandbox, behaviour-based network traffic analysis and an intrusion detection/prevention system (IDS/IPS). This distributed IDS/IDP can be run on traffic invisible to a perimeter box.

DFW is instantiated per gateway. It's supported at both Tier-0 and Tier-1.

NSX-T also features Gateway Firewall. This covers services that can't be distributed. These include NAT, DHCP, VPNs and load balancing.

Gateway Firewall is configured and enforced independently of DFW. However, it is possible to share objects from DFW with Gateway Firewall.

What is NSX Intelligence?

NSX Intelligence is a distributed security analytics and policy management solution. It provides deep visibility into network traffic flows and makes security policy recommendations.

It's a kind of virtual traffic cop, checking that all traffic is flowing in line with your security policies. It does this with features like real-time flow visualisation, security policy management and automated micro-segmentation.

Essentially, NSX Intelligence lets you see your whole network through a single pane of glass. In this respect, it's a handy metaphor for NSX-T at large.

Is VMware NSX-T right for my company?

NSX-T is an astonishing bit of kit – but it's not for everyone.

If your enterprise runs – or will run – a lot of VMs, it's a wise investment. But if your network is relatively small, NSX-T is too big and complex to justify the expense.

If you're unsure about its suitability, your best bet is to talk to a cloud consultant. They'll be able to scrutinise your infrastructure and let you know the best network virtualisation tools for you.

Why do you need NSX-T's security features?

If your enterprise has a complex network and handles substantial workloads, you need distributed firewalling, microsegmentation and the other features that NSX-T affords.

This is because today's enterprise networks can't be contained and protected by traditional perimeter-based security. There's simply too much traffic coming from too many devices and locations.

Instead, you need granular control over your network traffic and applications. Distributed firewalling and microsegmentation are two powerful ways of achieving this.

Distributed firewalling lets you enforce security policies at the level of an individual virtual machine. Microsegmentation, meanwhile, slices and dices your network and enforces security policies on each segment.

At the end of the day, life should be hard for a hacker, whether they're operating internally or externally. Barriers should be erected to stop them from moving east to west within the network. NSX-T creates a veritable obstacle course to prevent them from compromising any aspect of your security.

Looking for a cloud security consultant? Ascend Cloud Solutions is a trusted cloud transformation consultancy staffed by former VMware employees. We help businesses implement and manage watertight security strategies to safeguard their future and lock down their data. Get in touch today for a no-obligation consultation.

< Older Post

Newer Post >