An NSX feature that VCF uses to stretch security policy and overlay segments across VCF instances, for example for fleet-level components. A Global Manager federates the Local Managers (NSX Managers) of several locations, so firewall rules, segments and gateways are created once and span them all.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains NSX Federation in context, with comparison tables and the common traps.
Terms in this definition
- NSX
Software that handles networking and security across VCF, covering firewalling, load balancing, NAT, VPCs, overlay segments and Tier-0/1 gateways.
- VMware Cloud Foundation
Broadcom's platform for private cloud. It unifies management of NSX, vSAN, vSphere, VCF Automation and VCF Operations as one fleet; VVF, by contrast, lacks automation and cloud management.
- Security policy
Implements row-level security for Fabric warehouses or SQL analytics endpoints by attaching an inline table-valued function, acting as filter predicate, onto a table. Excluded rows vanish quietly from reads, updates and deletes.
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
- LSDOU
The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.
- Once flow
A flow that executes a single time and repeats only if the pipeline is fully refreshed. It's a common choice for a first full load ahead of a change feed, and that refresh becomes dangerous once the original files no longer exist.
- Span
One operation inside a trace, such as a single LLM call or prompt flow node, carrying attributes plus start and end times. Nested spans reveal the order of calls.
- ALL
A DAX function that ignores any filters and gives back every row of a table or every value of the named columns. Used within CALCULATE, it works as a modifier that clears filters, although REMOVEFILTERS states that intent more clearly where it is available.
Related terms
- Fleet Level Components on NSX Overlay Stretched Segment Model
Lets fleet management components be restarted or restored at a second VCF instance without changing their IP addresses, because NSX Federation stretches the overlay segment they sit on across both instances.
- MSS
Maximum segment size. Clamping this TCP value avoids fragmentation in tunnels like HCX Network Extension and NSX IPsec VPNs and lets NSX Federation carry cross-domain traffic over any MTU; the value is the largest single-segment payload a host will accept, worked out from the egress MTU.
- NSX Global Manager
In NSX Federation, the single point for running several Local Manager sites, from which multi-site gateways, segments and firewall rules are created.
- NSX Local Manager
Under NSX Federation, this is the manager that runs networking and security for one site, with a Global Manager federating it above. Register HCX against it; it is also the only manager that VCF imports or converges.
- NSX Multisite
Unlike NSX Federation, with its Global Manager and per-location manager clusters, this option runs NSX across two metropolitan sites (latency below 10 ms, VLAN stretched) from one NSX Manager cluster and keeps every NSX feature. Management-plane recovery is automatic only if NSX Manager sits on a stretched vCenter cluster, where vSphere HA restarts it at the other site.
- NSX segment model
A way to consume networking that gives every advanced NSX feature, with the network team building topologies from segments plus Tier-0 and Tier-1 gateways. Designs choose it over the default VPC model for advanced Tier-1 security, VPNs on Tier-1 gateways, or Layer 2/Layer 3 extension between VCF Instances with NSX Federation; VCF Automation All Apps organizations cannot use it.
- NSX Segment Scalable
A VPC-free workload networking model: Tier-1 gateways, ideally DR-only, attach directly to a stateless Active/Active Tier-0 spread over two to eight NSX Edge nodes. It is selected for centralised Tier-1 security services, NSX Federation stretch and north-south scale, though VKS and VCF Automation All Apps organizations are not supported.
- RTEP
Remote tunnel endpoint. VCF places this NSX Edge interface on its own VLAN, kept apart from the one used by edge overlay TEPs, and uses it to tunnel traffic with Geneve from one NSX Federation location to another; every Local Manager has an IP pool that supplies its addresses.