firewall update inside the cluster, vSfwd demon will parse it but only the ESXi host run VM name will applied rule id 1005. To” benefits: “Applied Reduce the amount of per VMware-sfw, this improves efficiency because the DFW will have less rules to evaluate for every new session. In case of an overlap IP address within multi-tenancy environment we must use To” to “Applied distinguish between one tenant and others. Cross cluster vMotion with To”: “Apply When we do use the To” feature and the VM traffic perform a vMotion across clusters then the “Applied NSX Manger will be involved in the process to update destination VM cluster with the relevant firewall rules. The NSX manager must be up to complete this operation. For example VM name web-sv-01a need to vMotion from cluster A” to Edge “Compute “Management Cluster”, vCenter will send vMotion notification to NSX Manager, as a results NSX Manager will trigger policy push to all ESXi host in Edge Cluster”. web-sv-01a will get same rule before “Management vMotion with just change in the domain object from to “domain-c25” “domain-c7” If the NSX Manager is down, No update rule will be push! When VM land on destination cluster no VM specific rule apply for that VM. It’s important to note that when the NSX manager is down all existing VM’s forwarding plane with DFW rules continue to work, only VMs cannot have firewall rules “New” until NSX Manager come back. The NSX DFW the rule table as a file at the ESXi host at the following path: “.dat” /etc/vmware/vsfwd/vsipfw_ruleset.dat . NSX L2 to L4 Firewall: The VMware NSX DFW can enforce security policy from L2 (Data Link Layer) to L4 (Transport Layer). With L2 we can create DFW rules base on the MAC address or L2 protocol like: ARP,RARP,LLDP.
firewall update inside the cluster, vSfwd demon will parse it but only the ESXi host run VM name will applied rule id 1005. “Applied To” benefits: Reduce the amount of per VMware-sfw, this improves efficiency because the DFW will have less rules to evaluate for every new session. In case of an overlap IP address within multi-tenancy environment we must use “Applied To” to distinguish between one tenant and others. Cross cluster vMotion with “Apply To”: When we do use the “Applied To” feature and the VM traffic perform a vMotion across clusters then the NSX Manger will be involved in the process to update destination VM cluster with the relevant firewall rules. The NSX manager must be up to complete this operation. For example VM name web-sv-01a need to vMotion from “Compute cluster A” to “Management Edge Cluster”, vCenter will send vMotion notification to NSX Manager, as a results NSX Manager will trigger policy push to all ESXi host in “Management Edge Cluster”. web-sv-01a will get same rule before vMotion with just change in the domain object from “domain-c25” to “domain-c7” If the NSX Manager is down, No update rule will be push! When VM land on destination cluster no VM specific rule apply for that VM. It’s important to note that when the NSX manager is down all existing VM’s forwarding plane with DFW rules continue to work, only “New” VMs cannot have firewall rules until NSX Manager come back. The NSX DFW the rule table as a “.dat” file at the ESXi host at the following path: /etc/vmware/vsfwd/vsipfw_ruleset.dat . NSX L2 to L4 Firewall: The VMware NSX DFW can enforce security policy from L2 (Data Link Layer) to L4 (Transport Layer). With L2 we can create DFW rules base on the MAC address or L2 protocol like: ARP,RARP,LLDP.
NSX-dFW_v31.docx