Karl Erik Filip Modén
Guides 4 min read

NSX for Dummies, Part 3: Gateways, Edges, and the Route Out

Tier-0, Tier-1, edge nodes, and BGP explained in one practical model: how an NSX segment reaches another segment, a VLAN, or the outside world.

In Part 2, a Tier-1 and Tier-0 appeared because NSX asked for them. This part is about what they actually do, because most early NSX mistakes happen at the point where the overlay meets the physical network.

The route in one picture

Use this as the default mental model:

app VM
  |
[segment]  - a subnet and its attached workloads
  |
[Tier-1]   - routing for an application, tenant, or environment
  |
[Tier-0]   - the shared border for the NSX domain
  |
[edge node] - services that must live in an edge appliance
  |
physical router / firewall / WAN

A Tier-1 (T1) is where an application environment belongs. It routes between the segments attached to it. A Tier-0 (T0) is the shared upstream border: it connects one or more T1s to VLAN-backed networks, physical routers, and external services.

This separation is useful even in a small environment. The infrastructure team can own the T0 and its BGP peering; an application or platform team can build T1s and segments without changing the physical border each time.

Where traffic is routed

Not every gateway packet takes the same path.

VM-A and VM-B on the same segment       -> switching only
VM-A and VM-B on different T1 segments  -> distributed routing on ESXi hosts
VM to a physical network or north/south service -> T0 and edge node

Distributed routing is why NSX can handle east-west traffic efficiently. When two VMs on different segments live on the same ESXi host, their routed traffic can stay in that host’s data path. When they are on different hosts, it crosses the overlay directly between the hosts. It does not need a detour through a central appliance merely to move from one app subnet to another.

The T0/edge path is different. Services such as north-south routing, NAT, load balancing where licensed and deployed, and connections to the physical network need the edge appliance layer. That is why an edge node is not just another name for NSX Manager.

BGP without the ceremony

Static routes are fine for a lab. In production, BGP is usually the cleaner contract between NSX and the physical network.

Physical router learns: 10.10.0.0/16 is reachable through the NSX T0
NSX T0 learns:        0.0.0.0/0 and physical prefixes through the router

The physical router does not need a route for every VM. It needs to know how to reach the NSX-owned prefixes. The T0 does not need a static route for every physical subnet. It learns them from the router. Both sides can then adapt when routes change, subject to the BGP policy you configure.

For a first deployment, keep the routing design deliberately boring:

  1. Advertise only the prefixes you intend to expose from NSX.
  2. Receive only the prefixes NSX needs, often a default route plus approved internal ranges.
  3. Document which team owns the ASN, peer IPs, filters, and failure testing.
  4. Test one failure at a time: BGP session down, one edge down, one uplink down.

Edge high availability: the part that should be designed first

If a T0 provides production north-south connectivity, plan edge availability before attaching workloads. A single edge node is an acceptable lab shortcut, not production resilience. The exact high-availability mode and service behaviour depend on the NSX release and services you use, so validate the current design guide for your version.

At minimum, decide:

  • Which failure domains host the edge nodes.
  • Which uplinks and physical switches they use.
  • How BGP fails over and how quickly your upstream network notices.
  • Whether stateful services have the capacity and availability design they require.

A routing troubleshooting ladder

When a VM cannot reach outside its segment, do not start by rebuilding the T0. Walk the path in order:

VM address and default gateway
  -> segment attachment and T1 route
    -> T1-to-T0 connection and route advertisement
      -> edge uplink and BGP session
        -> physical router return route

Return routing matters just as much as the outbound route. A packet can leave NSX perfectly and still fail because the physical network has no route back to the segment.

The useful design rule

Build the overlay so that east-west routing stays distributed and repeatable. Build the edge so that north-south services are explicit, observable, and resilient. When you can draw which traffic uses which path, NSX stops feeling like a black box.

Official references