Distributed firewall. Stateful rules from NSX (vDefend) are enforced right at each virtual NIC inside the hypervisor, giving micro-segmentation between workloads. Gateway firewalls on Tier-0/1 are a separate thing.
Also called Distributed Firewall.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains DFW in context, with comparison tables and the common traps.
Terms in this definition
- NSX
Software that handles networking and security across VCF, covering firewalling, load balancing, NAT, VPCs, overlay segments and Tier-0/1 gateways.
- vNIC
The network adapter a VM sees, which is virtual and connects to a subnet.
- Hypervisor
The virtualisation software allowing many isolated virtual machines to run on a single physical server. The cloud provider looks after it whichever service type is used.
Related terms
- Data source
Compliance benchmarks and analytics only cover systems added as data sources, which VCF Operations for networks (or VCF Operations via an integration) then collects from. Examples are physical switches, NSX Manager, vCenter, and flow exporters: the NSX distributed firewall with IPFIX and distributed switches with NetFlow.
- DVPG
Short for distributed port group, this is a vSphere Distributed Switch object holding shared port settings (VLAN, teaming and so on) for whichever ports join it. Importing a domain into VCF enables NSX and its DFW on all DVPGs belonging to the imported clusters.
- Gateway Firewall
Stateful NSX filtering at Tier-0 or Tier-1 gateways for north-south flows crossing them. The distributed firewall handles east-west flows at each virtual NIC instead.