Gateway that ties NSX's virtual networks to the physical network for north-south traffic. Besides distributed routing it has a service router on Edge nodes for centralised routing and services; each Edge node can only host one.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains Tier-0 gateway in context, with comparison tables and the common traps.
Terms in this definition
- NSX
Software that handles networking and security across VCF, covering firewalling, load balancing, NAT, VPCs, overlay segments and Tier-0/1 gateways.
- Physical
Describes the concrete, real-world parts that put a logical architecture into effect.
- Geographic
A Traffic Manager routing method that picks the endpoint according to where the user is located geographically.
- service router
Runs on NSX Edge nodes as the centralised half of a gateway. Handles north-south routing and stateful features like NAT and VPN. A Tier-0 always includes one, but a Tier-1 only if an Edge cluster has been chosen. See also the distributed router (DR), present on all transport nodes.
Related terms
- BFD
Bidirectional Forwarding Detection quickly notices when a forwarding path breaks, letting an NSX Tier-0 gateway fail over its BGP sessions or static routes without waiting for hold timers to expire. Most VCF edge designs keep standard BGP timers alongside it; the exception is the dual-zone vSphere HA recovery design, which omits BFD, as vMotion can disrupt sessions, and shortens the timers instead.
- DMZ
Buffer zone between the internet and internal networks where services that outsiders can reach are hosted. When VCF Automation is exposed externally, its appliances sit in one VPC and the load balancer in a separate DMZ VPC, with routing and stateful firewalling done by the Tier-0 gateway.
- Forwarding Up Timer
Formerly called forwarding delay, this Tier-0 gateway setting defaults to 5 seconds. After the first BGP, BFD or OSPF session comes up, it waits before announcing the up state, which reduces failover downtime.
- Large Scale Topology
Built mainly for service providers with many tenants, this NSX workload networking model gives each tenant a dedicated Tier-0 gateway or VRF, keeping its own VPN, behind a shared stateless Active/Active aggregation Tier-0 that centralises common services such as internet access.
- proxy ARP
Replying to ARP queries for addresses owned by a different device. A Tier-0 gateway in NSX gets this switched on automatically whenever NAT rules or load balancer VIPs use addresses from the external interface subnet.
- region network configuration
To let an All Apps organization create VPCs in a region, VCF Automation applies this per-region configuration, which provides outbound SNAT towards the Tier-0 gateway, an NSX project, a transit gateway and a default VPC along with its connectivity profile.
- transit gateway
Joins up a project's VPCs with each other and with outside networks in NSX, either in a distributed fashion on the hosts or centrally via a Tier-0 gateway running on an Edge cluster.