Today's datacenter demands are a paradigm shift from what they were a decade ago. As the cloud consumption model is being rapidly adopted across the industry, the need for on-demand provisioning of compute, storage, and networking resources is greater than ever. One of the biggest contributing factors to enable the cloud consumption model is server virtualization.

Server virtualization has enabled fast consumption of compute resources along with add-on functionality and services. Snapshots, clones, and templates are all now easier than ever with server virtualization.

If you have worked in a datacenter, you would agree that networking is always challenging to work with. Once the networking design is established, any changes that need to be made are always challenging because of a lack of flexibility due to increasing complexity and demands on the environment. While compute and storage have rapidly improved in their speed of deployment and consumption, networking continues to remain a challenge in today's environments, where simple tasks such as creating a new VLAN are becoming increasingly complex and time consuming.

Network virtualization is the virtualization of network resources using software and networking hardware that enables faster provisioning and deployment of networking resources. Network virtualization lays the foundation for software-defined networking, which allows instant deployment of services to be offered to the consumers. Services such as Edge gateways, VPN, DHCP, DNS, and load balancers can be instantly provisioned and deployed because of the software aspect of network virtualization. The networking hardware allows for physical connectivity, while the software is where all the network logic resides allowing for a feature-rich network service offering.

Network virtualization allows for consumption of simplified logical networking devices and services that are completely abstracted from the complexities of the underlying physical network. Lastly, network virtualization is key for a software-defined data center (SDDC).

Now that we have defined what network virtualization is about, let's go over some of the key concepts of network virtualization and software-defined networking:

• Decoupling: An important concept of network virtualization is the decoupling of software and the networking hardware. The software works independently of the networking hardware that physically interconnects the infrastructure. Any networking hardware that can inter-op with the software is always going to enhance the functionality, but it is not necessary. Remember that your throughput on the wire will be always limited by your network hardware performance.
• Control plane: The decoupling of software and networking hardware allows you to control your network better because all the logic resides in the software. This control aspect of your network is called the control plane. The control plane provides the means to configure, monitor, troubleshoot, and also allow automation against the network.
• Data plane: The networking hardware forms the data plane where all the data is forwarded from source to destination. The management of data resides in the control plane; however, the data plane consists of all the networking hardware whose primary function is to forward traffic over the wire from source to destination. The data plane holds all the forwarding tables that are constantly updated by the control plane. This also prevents any traffic interruptions if there is a loss of the control plane, because the networking hardware, which constitutes the data plane, will continue to function without interruptions.
•  Application Programming Interface (API): The API is one of the important aspects of a virtualized network and allows for true software-defined networking by instantly changing the network behavior. With the API, you can now instantly deploy rich network services in your existing network. Network services such as Edge gateway, VPN, Firewall, and load balancers can all be deployed on the fly by means of an API.

VMware NSX-V is a network virtualization platform that allows for software-defined networks and is a critical component of software-defined datacenter architecture. VMware's NSX-V software abstracts the underlying physical network by introducing a software layer that makes it easy to consume network resources by creating multiple virtual networks. NSX-V also allows for deploying multiple logical network services on top of the abstracted layer.

VMware now has two flavors of NSX: NSX-V, and NSX-MH. NSX-V is NSX for a VMware-based hypervisor while NSX-Multi Hypervisor (NSX-MH) is for OpenStack environments. The two versions have many similarities but also are dissimilar in some aspects. This book focuses on the NSX-VMware (NSX-V) version of NSX only. NSX-V will be referred to as NSX for the rest of the book.

The following figure represents the software abstraction of a physical network and networking hardware by NSX. This is synonymous with how the VMware vSphere hypervisor achieves software abstraction of CPU, memory, and storage, making it possible for the creation of multiple virtual machines:

Just as the vSphere hypervisor allows you to create, delete, snapshot, and monitor a virtual machine, NSX allows you to programmatically create, delete, snapshot, and monitor a virtual network. NSX can be deployed on your current physical network infrastructure, and does not require you to upgrade your existing infrastructure.

Lastly, NSX deployment is non-disruptive to your existing network and traffic. It can seamlessly be deployed on top of your existing infrastructure, and consumption of its services can take place in conjunction with your traditional network.

Before we get started with NSX, it is important to understand some of its features and services.

Some NSX features are listed as follows. We will discuss these features in great detail in the following chapters:

• Logical switching: NSX allows the ability to create L2 and L3 logical switching that enables workload isolation and separation of IP address space between logical networks. NSX can create logical broadcast domains in the virtual space that prevent the need to create any logical networks on the physical switches. This means you are no longer limited to 4096 physical broadcast domains (VLANS).
• NSX gateway services: The Edge gateway services interconnect your logical networks with your physical networks. This means a virtual machine connected to a logical network can send and receive traffic directly to your physical network through the gateway.
• Logical routing: Multiple virtual broadcast domains (logical networks) can be created using NSX. As multiple virtual machines subscribe to these domains, it becomes important to be able to route traffic from one logical switch to another. Logical routing helps achieve this by routing traffic between logical switches, or even between a logical switch and public networks. Logical routing can be extended to perform east-west routing that saves unnecessary network hops, increasing network efficiency. Logical routers can also provide north-south connectivity allowing access to workloads living in the physical networks. Logical routers also help avoid hairpinning of traffic, thereby increasing network efficiency.

• Logical firewall: NSX allows you the option of a distributed logical firewall or an Edge firewall for use within your software-defined networking architecture. A distributed logical firewall allows you to build rules based on attributes that include not just IP addresses and VLANs, but also virtual machine names and vCenter objects. The Edge gateway features a firewall service that can be used to impose security and access restrictions on north-south traffic.
• Extensibility: There are third-party VMware partner solutions to integrate directly into the NSX platform that allow a vendor choice in multiple service offerings. There are many VMware partners who offer solutions such as traffic monitoring, IDS, and application firewall services that can integrate directly into NSX. This enhances management and end user experience by having one management system to work with.

The features listed earlier enable NSX to offer a wide variety of services that can be consumed in your infrastructure. These services can be deployed and configured by the NSX API as well. Some of the NSX services are listed as follows:

• Load balancer: NSX Edge offers a variety of services and the logical load balancer is one of them. The logical load balancer distributes incoming requests among multiple servers to allow for load distribution while abstracting this functionality from end users. The logical load balancer can also be used as a high availability (HA) mechanism to ensure your application has the most uptime.
• Virtual private networks (VPN): The NSX Edge offers the VPN service that allows you to provision secure encrypted connectivity for end users to your applications and workloads. Edge VPN service offers SSL-VPN plus it allows for user access and IPSEC site-to-site connectivity, which enables two sites to be interconnected securely.
• Dynamic Host Configuration Protocol (DHCP): NSX Edge offers DHCP services that allow IP address pooling, and also static IP assignments. An administrator can now rely on the DHCP service to manage all IP addresses in your environment, rather than having to maintain a separate DHCP service. The DHCP service can also relay DHCP requests to your existing DHCP server as well. The NSX Edge DHCP service can relay any DHCP requests generated from your virtual machines to a pre-existing physical or virtual DHCP server, without any interruptions.
• Domain name system (DNS): NSX Edge offers a DNS relay service that can relay any DNS requests to an external DNS server.
• Service composer: The service composer allows you to allocate network and multiple security services to security groups. Virtual machines that are part of these security groups are automatically allocated the services.
• Data security: NSX data security provides visibility into sensitive data, ensures data protection, and reports back on any compliance violations. A data security scan on designated virtual machines allows NSX to analyze and report back on any violations based on the security policy that applies to these virtual machines.

Other NSX features include cross-vCenter networking and security, which allow you to manage multiple vCenter NSX environments using a primary NSX manager. This not only allows centralized management, but also extends one or more services and features across multiple vCenter environments. We will talk more about cross vCenter networking in the upcoming chapters.

Let's have a look at what the NSX configuration maximums are. VMware has not published an official document, so the following limits listed were gathered by reviewing NSX documentation and online research. Some websites that contributed include www.vmguru.com.

Some of these limits are hard limits while most of them are soft limits, beyond which VMware does not support such configurations. For example, if you exceed the number of concurrent connections per Edge gateway, it will affect your gateway's performance, but won't cause it to halt or reject new connections. The hard limit verses soft limit documentation is not explicitly published, but VMware NSX support can clarify if needed. The chances are that you will scale out your environment before reaching these maximums.

The maximums for NSX follow.

The following table shows the limits for NSX – vCenter Maximums:

A Transport Zone defines the scope of a logical switch and can span one or more vSphere clusters. We will this discuss in greater depth in the upcoming chapters.

The following table shows the limits for Switching Maximums:

The following table shows the limits for Distributed Logical Firewall Maximums:

The following table shows the limits for NSX Edge Services Gateway (ESG) Maximums:

The following table shows the limits for Edge Services Gateway Compact Maximums:

The following table shows the limits for Edge Services Gateway Large Maximums:

The following table shows the limits for Edge Services Gateway X-Large Maximums:

The following table shows the limits for Edge Services Gateway Quad-Large Maximums:

The following table shows the limits for Edge Services Gateway Overall Maximums:

The following table shows the limits for DHCP, VPN Service Maximums:

The following table shows the limits for Multi-vCenter NSX Supported Features:

We started this chapter with an introduction to network virtualization and software-defined networking. We discussed the concepts of network virtualization and introduced VMware's NSX network virtualization platform. We then discussed different NSX features and services, including logical switching, logical routing, Edge gateway services, extensibility, service composer, and data security. We also briefly discussed the multi-vCenter NSX feature. We ended the chapter with configuration maximums for NSX. In Chapter 2,  NSX Core Components, we will look at the different components of NSX and VXLAN.