Part 6 of the 10-part VCF series. Part 5 covered the physical hardware. Now we move into the software-defined networking layer. NSX is the component that most traditional vSphere admins find unfamiliar, so this part is designed to bridge that gap.
Networking Architecture with NSX
NSX decouples switching, routing, and security lines from the physical fabric, executing network operations directly inside the hypervisor kernel. In VCF, NSX handles underlying Geneve encapsulation tunnels and establishes the global distributed security baseline.
Core Structural Components
- Transport Nodes: Physical ESXi hosts configured with the NSX kernel modules.
- Transport Zones: Define network bounds. Virtual Local Area Network (VLAN) zones map to legacy fabrics, while Overlay zones use Geneve encapsulation to stretch virtual networks over physical layer 3 infrastructure.
- Geneve Tunnels and TEPs: Tunnel Endpoints (TEPs) assign unique IP addresses to nodes. Physical infrastructure switches require a strict minimum MTU of 1600 bytes (9000 bytes recommended for jumbo frames) to transport encapsulated payloads without packet fragmentation.
- Uplink Profiles: Enforce deterministic teaming policies (Active/Active or Active/Standby), VLAN tagging, and MTU boundaries assigned during SDDC automation.
Two-Tier Routing Topology
- Tier-0 (T0) Gateway: Operates as the physical border router interfacing virtual overlay networks with upstream physical infrastructure (North-South traffic).
- Tier-1 (T1) Gateway: Connects tenant workloads and enforces local isolation. East-West routing between localized segments functions entirely within the host hypervisor kernel, preventing unnecessary physical fabric hops.
Zero-Trust Micro-Segmentation
The Distributed Firewall (DFW) applies security profiles directly at the virtual NIC (vNIC) layer of individual VMs. In VCF 9.x, basic stateful policies are augmented by VMware vDefend Advanced Threat Prevention, bringing lateral intrusion detection (IDS/IPS) and malware isolation directly into the platform.
VCF 9.1 Enterprise Networking Models
- Virtual Private Clouds (VPCs): Provide self-service, isolated network boundaries provisioned directly through VCF Automation.
- Distributed Transit Gateways (DTGW): Shifts tenant inter-VPC routing away from traditional centralized edge topologies. Under VCF 9.1, distributed tenant routing maps alongside Virtual Network Appliance (VNA) Clusters to decentralise stateful layer 4 to 7 services.
- Shared NSX Instances: For resource conservation, subsequent workload domains can share an existing workload domain’s NSX Manager cluster, eliminating dedicated management overhead where full isolation is not required. The Management Domain always retains its own dedicated NSX instance to insulate core operations.
Network Pools
Before you add a host or create a workload domain, VCF requires a pre-configured network pool that defines IP ranges for vMotion, vSAN, and Geneve TEP traffic. When VCF provisions a host into a domain, it pulls addresses from this pool and configures the distributed switch, vmkernel adapters, and TEPs automatically. This removes the manual IP assignment and switch configuration that traditionally consumes hours of engineering time during host builds.
The Bottom Line
NSX in VCF provides overlay networking, distributed two-tier routing, and zero-trust micro-segmentation that turn a collection of ESXi hosts into a software-defined private cloud. The key constructs are transport nodes and zones, Geneve encapsulation with TEPs, the T0/T1 routing topology, and the distributed firewall. VCF 9.1 adds VPCs, distributed transit gateways, and shared NSX instances for more flexible tenant connectivity. Next in Part 7 we look at the storage layer, comparing vSAN ESA and OSA and explaining how storage integrates with the rest of the platform.