VCF Demystified, Part 5: NSX - The Network and Security Fabric
How NSX fits inside VCF 9: the difference between the underlay and overlay, workload-domain boundaries, routing, and why distributed security matters to a private-cloud platform.
NSX is VCF’s networking and security fabric. It supplies the logical networks, routing, edge connectivity, and distributed security controls that let a workload domain behave as a coherent platform rather than a collection of VLANs and firewall tickets.
Underlay and overlay
Physical underlay: IP reachability, MTU, redundant uplinks, routing between hosts
NSX overlay: segments, Tier-1 and Tier-0 gateways, workload policy, microsegmentationThe underlay must be boring and reliable. The overlay provides the flexible, software-defined behaviour. Confusing the two leads to familiar troubleshooting pain: an overlay symptom can be caused by a physical MTU or routing problem, while a packet that reaches the overlay can still be stopped by intended security policy.
Why NSX matters in VCF
Workload domains need a consistent way to provide networks and protect traffic. NSX enables that through segments, gateways, and the distributed firewall. The distributed firewall is especially important because it enforces policy close to protected workload virtual NICs, including traffic between VMs on the same subnet.
In VCF, this is not merely a network add-on. NSX is part of the platform contract that operations, automation, and workload teams rely on. A catalog service can request a governed network; an operations team can understand network health in fleet context; a security policy can follow a VM through placement changes.
The design questions
- Which traffic belongs in the physical underlay versus the NSX overlay?
- Which boundaries are domain, application, tenant, or security boundaries?
- Who owns Tier-0 routing and the physical return route?
- Which tags and NSX groups will define workload policy?
- How are edge capacity and availability designed for north-south services?
The NSX for Dummies series covers these network concepts in more depth. Here, the essential point is that VCF treats networking and security as a first-class platform service.