using NSX-T distributed firewall in VCF 4.5 environment

[kmcd03]

I would like to start using NSX-T distributed firewall (dFW) in my VCF 4.5 domains, but won't be using logical routing at this time.

VCF has prepared the nodes, e.g. created transport zone, the uplink and transport node profiles, configured NSX on the nodes, etc.

If I want to start using dFW, but don't care about overlay, do I simply create a segment with a VLAN in NSX Manager and associate it with the transport zone created by VCF? Then binding VMs vNIC to the VDS portgroup so dFW policies and rules are applied.

Or should I create a new VLAN transport zone and associate with hosts in the domain?  And then create the segment and bind VM vNICs.

Thanks!

[CyberNils · Accepted solution]

Hi, you need to attach a VLAN TZ to be able to create VLAN Backed Segments. Take a look at my blog post for details:

https://cybernils.net/2023/07/17/creating-vlan-backed-segments-in-vmware-cloud-foundation-vcf/

[mkeshsundrani]

Also read through below 7 minutes blog, would give you much more insight on how to use DFW only feature in NSX-T,

https://www.vgarethlewis.com/2022/06/20/vmware-nsx-micro-segmentation-only-deployment/

Credit to Gareth Lewis -Blog

[kmcd03]

Thank you for documenting this.

I was leaning towards creating a new vlan TZ.  And applying to the nodes using the Transport Node Profile that VCF created. 

Is  attaching, or detaching, the TNP to a Baseline WLD disruptive?  I assume in this case only adding additional TZ to the nodes, so it won't take VMs or nodes offline.

[CyberNils]

It should not be disruptive as far as I know.