Implementing Micro-Segmentation and Overlay Networks with VMware NSX

VMware NSX: Setting Up Network Virtualization for Production

We have been integrating VMware NSX into vSphere infrastructures for many years—completing over 30 projects on micro-segmentation and overlay networks. A typical request: "Our old VLAN firewalls can't handle isolation; we want NSX." And then the interesting part begins: instead of physical switches and routers, virtual constructs appear, the network is described in code, deployed in minutes, and firewall rules live independently of physical topology.

NSX-T (versions 3.x and 4.x) is a serious platform requiring understanding of TEP tunnels, Geneve encapsulation, and BGP on Edge Nodes. But our experience shows that a justified approach is to start with an audit and a pilot project to avoid common mistakes.

How Micro-Segmentation Works in NSX

Micro-segmentation is a key advantage of NSX. Unlike VLANs, where isolation is tied to a switch port, Distributed Firewall rules act at the vNIC level of each VM. This means even VMs in the same subnet can be isolated from each other. Operational cost savings on security policy management reach 40% compared to traditional VLAN approaches.

Dynamic groups, based on vSphere tags (e.g., env:production, tier:web), allow rules to be tied to the environment, not IP addresses. When scaling, groups update automatically, eliminating manual errors.

Why Overlay Networks Are Faster Than VLANs

Overlay networks using Geneve tunnels allow creating thousands of isolated segments without tying to physical topology. A new segment is deployed in minutes via API—5 times faster than configuring VLANs on switches. This reduces response time to developer requests and accelerates product delivery.

VLAN vs NSX Comparison

Architecture: What NSX Is Made Of

NSX Manager—control plane. Three nodes in cluster for fault tolerance. Manages everything via API. Transport Nodes—ESXi or Edge Nodes with NSX kernel module installed. Transport Zone—logical domain defining which nodes communicate via overlay (Geneve) or VLAN. TEP (Tunnel Endpoint)—virtual interface on each transport node for Geneve tunnels. TEP IPs must be routable between all nodes.

How We Install NSX Manager

NSX Manager is deployed as an OVA on vCenter. For automation, we use govc:

govc import.ova -ds=datastore1 -pool=Resources -name=nsx-manager-01 nsx-unified-appliance-4.1.0.ova 

After deployment, we initialize the management cluster:

curl -k -u admin:password https://nsx-manager.example.com/api/v1/cluster/status 

The response should contain "status": "STABLE". If not, we check network connectivity between nodes.

Overlay Networks: Segments and Micro-Segmentation

A segment is an analog of VLAN but works over Geneve tunnels. All VMs on the segment see each other at L2, even on different ESXi hosts. Example segment configuration web-tier via API:

{ "display_name": "web-tier",
  "connectivity_path": "/infra/tier-1s/tier-1-gw",
  "subnets": [
    {
      "gateway_address": "10.1.1.1/24",
      "dhcp_ranges": ["10.1.1.100-10.1.1.200"]
    }
  ],
  "transport_zone_path": "/infra/sites/default/enforcement-points/default/transport-zones/<overlay-tz-id>"
}

A VM connects to the segment—gets IP from DHCP pool and communicates with neighbors through tunnels.

How the Distributed Firewall Works

Distributed Firewall is the main feature of NSX. Filtering occurs at the vNIC level of each VM before traffic leaves the hypervisor. No single point of failure, performance scales linearly. Rules are built on dynamic groups (e.g., env:production). Example policy:

{
  "rules": [
    {
      "action": "ALLOW",
      "source_groups": ["group-web"],
      "destination_groups": ["group-app"],
      "services": ["HTTPS"],
      "logged": true
    },
    {
      "action": "DROP",
      "source_groups": ["ANY"],
      "destination_groups": ["ANY"],
      "services": ["ANY"],
      "logged": false
    }
  ]
}

Group group-app can include all VMs with tag tier:application—rules apply instantly when composition changes.

Steps to Configure DFW Policy

1. Create dynamic groups based on vSphere tags (e.g., env:production, tier:web).
2. Define services (TCP/443, UDP/53) and groups in NSX Manager.
3. Write rules in order: allow for permitted traffic, drop for everything else.
4. Enable logging for allow rules to debug incidents.
5. Test on a pilot segment before deploying on all VMs.

What Is an Edge Node and When Is It Needed?

East-West traffic (VM ↔ VM) is routed through Distributed Router on hypervisors. For North-South traffic (VM ↔ internet/external network), Edge Nodes are needed. These are separate VMs or bare-metal with a specialized NSX module. An Edge Node can act as a Tier-0 Gateway, peer with physical ToR switches via BGP, and advertise segment subnets externally.

Typical Installation Mistakes

1. MTU less than 9000. Geneve adds 50+ bytes; with MTU 1500 fragmentation kills performance. We recommend Jumbo Frames on all ports.
2. Transport Node in 'Not Ready' status. Cause: TEP IP not routable or IP pool exhausted. Use nsxcli> get tunnel-ports on ESXi for diagnosis.
3. DFW not applied. If VM is not in an overlay transport zone, DFW does not affect it. Check nsxcli> get firewall status on the host.

Timelines and What Is Included

The cost is calculated individually after an audit. Contact us—we will evaluate your project. Our certified VMware engineers guarantee SLA and full documentation. Order an infrastructure audit to get a migration plan from VLAN to NSX. With us, you get a network that is managed by code, not scripts.