Stateful NSX filtering at Tier-0 or Tier-1 gateways for north-south flows crossing them. The distributed firewall handles east-west flows at each virtual NIC instead.
Also called GWFW.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains Gateway Firewall in context, with comparison tables and the common traps.
Terms in this definition
- NSX
Software that handles networking and security across VCF, covering firewalling, load balancing, NAT, VPCs, overlay segments and Tier-0/1 gateways.
- DFW
Distributed firewall. Stateful rules from NSX (vDefend) are enforced right at each virtual NIC inside the hypervisor, giving micro-segmentation between workloads. Gateway firewalls on Tier-0/1 are a separate thing.
- vNIC
The network adapter a VM sees, which is virtual and connects to a subnet.
Related terms
- VMware vDefend Firewall
Broadcom's NSX-based Layer 2-7 stateful firewall. It runs either distributed, inside each ESX host for east-west micro-segmentation, or as a gateway firewall at NSX Edges for north-south traffic; full distributed use requires an extra security licence over base VCF.
- VPC Getting Started
Edge-less NSX workload networking model: a distributed transit gateway and dedicated external VLAN link VPCs to the fabric, at the cost of centralised services like VPN, NAT, Auto SNAT and the gateway firewall.
- VPC Security Profile
Holds the default security settings for VPCs in NSX; out of the box, it switches on the gateway firewall for every VPC in the project.