{"id":9061,"date":"2016-09-01T20:53:24","date_gmt":"2016-09-02T03:53:24","guid":{"rendered":"http:\/\/humairahmed.com\/blog\/?p=9061"},"modified":"2017-12-16T12:14:46","modified_gmt":"2017-12-16T20:14:46","slug":"multi-site-with-cross-vc-nsx-consistent-security-and-micro-segmentation-across-sites","status":"publish","type":"post","link":"https:\/\/humairahmed.com\/blog\/?p=9061","title":{"rendered":"Multi-site with Cross-VC NSX: Consistent Security and Micro-segmentation Across Sites [Video]"},"content":{"rendered":"
\n\t\t\t\t\tTweet<\/a>\n\t\t\t\t<\/div><\/div>

I also published this blog post about the security benefits of a multi-site Cross-VC NSX solution on the VMware NSX Network Virtualization Blog<\/a>. The full blog post is provided below and can also be seen on the VMware NSX Network Virtualization Blog<\/a> site. <\/p>\n

Several posts have been written prior on multi-site with Cross-VC NSX describing the fundamentals, use cases, deployment models, and flexibility Cross-VC NSX provides. In this post, we focus on the security benefits of a multi-site Cross-VC NSX solution.<\/p>\n

Prior Cross-VC NSX Blogs:<\/strong>
\nCross-VC NSX: Multi-site Deployments with Ease and Flexibility<\/a>
\nNSX-V: Multi-site Options and Cross-VC NSX Design Guide<\/a>
\nEnhanced Disaster Recovery with Cross-VC NSX and SRM<\/a>
\nCross-VC NSX for Multi-site Solutions<\/a><\/p>\n

So, why multi-site with Cross-VC NSX? The following five reasons should be enough for you to seriously consider Cross-VC NSX as a solution for your multi-site needs:<\/p>\n

1.) Centralized Management<\/strong>
\nCentralized management of security policies across multiple vCenter domains\/sites. You have one central location to configure security policies and only write the security policy once, which is then applied across all vCenter domains\/sites.

\"Figure<\/a>

Figure 1 Central Management of Security Policies Across Sites from Primary NSX Manager<\/p><\/div><\/p>\n

2.) Consistent Security Across vCenter Domains\/Sites<\/strong>
\nConsistent security policies across vCenter domains\/sites provided automatically by Cross-VC NSX enables enhanced workload mobility. Security policies are configured on the primary NSX Manager and automatically synced to the secondary NSX Managers providing for uniform security across all sites.

\"Figure<\/a>

Figure 2 Consistent Security Across Sites with Universal Distributed Firewall<\/p><\/div><\/p>\n

3.) Security Policies Follow the Workload(s)<\/strong>
\nCross-VC NSX enables enhanced workload mobility by making it possible to extend logical networks across multiple vCenter domains\/sites. In addition, Cross-VC NSX ensures the security policies follow the workload as it is vMotioned or migrated across vCenter domains\/sites.

\"Figure<\/a>

Figure 3 Security Policies Follow Workloads Across vCenter Domains and Sites<\/p><\/div><\/p>\n

4.) Ease of Security Automation Across vCenter Domains\/Sites<\/strong>
\nSecurity policies can be configured via GUI on the primary NSX Manager and are then automatically synced to the secondary NSX Managers. However, NSX Rest API calls can also be utilized. One NSX REST API call to the primary NSX Manager applies the same security policy across all vCenter domains\/sites. As such, the respective API calls can be included in advanced workflows to provide for ease of security automation across vCenter domains\/sites.

\"Figure<\/a>

Figure 4 One NSX REST API Call to Primary NSX Manager to Create Security Policy Allows for Ease of Security Automation<\/p><\/div><\/p>\n

5.) Enhanced Disaster Recovery Use Case<\/strong>
\nConsistent networking and security across sites prevents the need for manual security replication across sites for disaster recovery scenarios. Also, universal logical networking across sites allows for the application IP address to remain the same preventing the need to update security policies.

\"Figure<\/a>

Figure 5 Applications Recover with Same IP Address and Security Policies<\/p><\/div><\/p>\n

Bottom-line is Cross-VC NSX allows for consistent security and micro-segmentation across vCenter boundaries with the Universal Distributed Firewall (UDFW) and Universal Distributed Firewall Rules.

\"Consistent<\/a>

Consistent Security and Micro-segmentation Across Sites via Universal Distributed Firewall<\/p><\/div><\/p>\n

Additionally, the Universal<\/strong> section of the DFW supports the below network and security grouping objects. Grouping objects are used to identify endpoints.<\/p>\n

Universal Grouping Objects<\/u><\/strong><\/p>\n