NSX Guest Introspection: Components & Configuration

What is NSX Guest  Introspection ?

VMware NSX Guest Introspection is a security feature which when enabled, offloads antivirus and anti-malware agent processing to a dedicated virtual appliance (service vm’s). 

When Guest Introspection is enabled on a cluster, it continuously update antivirus signatures, thus giving uninterrupted protection to the virtual machines running in that cluster. New virtual machines that are created (or existing virtual machines that went offline) are immediately protected with the most current antivirus signatures when they come online.

Components of NSX Guest Introspection

The main components of Guest Introspection are: 

1: Guest VM Thin Agent: This is installed as part of the VMware Tools driver. It intercepts Guest VM file/OS events and passes them to ESXi Host.

2: MUX Module: When Guest Introspection is installed on a cluster, NSX installs a new VIB (epsec-mux) on each host of that cluster. The new VIB is responsible for receiving messages from the Thin Agent running in the guest VM’s and passing the information to the Service Virtual Machine via a TCP session.Read the rest

Learning NSX-T-Part 10: Logical Routing

In the last post of this series, we created logical switches and established communication between the App and Web VMs, which were on the same subnet and connected to the same logical switch.

In this post, we will learn about logical routing.

If you are not following along with this series, then I recommend reading earlier posts of this series from the links below:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

5: NSX Controllers Manual Deployment

6: Prepare Esxi host to form NSX-T Fabric

7: Configuring Uplink Profile

8: Configuring Transport Zone and Transport Nodes

9: Creating Logical Switches and Testing Connectivity

Optimal routing is one of the biggest challenges in any data center, and NSX revolutionized the way networking is used in infrastructure. 

NSX-v offered distributed routing to SDDC, and because of this, routing between different subnets on an ESXi hypervisor can be done in the kernel, and traffic never has to leave the hypervisor, thus eliminating the traffic hairpinning problems.Read the rest

Learning NSX-T-Part 9:Creating Logical Switches and Testing Connectivity

In the last post of this series, we configured transport zones and transport nodes. We discussed the modes of transport zone and N-VDS.

In this post, we will learn how to create logical switches in NSX-T, and we will test connectivity between VMs attached to the same logical switch.

If you are not following along with this series, then I recommend reading earlier posts of this series from the links below:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

5: NSX Controllers Manual Deployment

6: Prepare Esxi host to form NSX-T Fabric

7: Configuring Uplink Profile

8: Configuring Transport Zone and Transport Nodes

A logical switch provides layer 2 connectivity for the virtual machines that are attached to it. In the last post, we discussed that transport zones are of two types (overlay and VLAN), and the type of logical switch is based on which type of transport zone it connects to. Read the rest

Learning NSX-T-Part 8:Configuring Transport Zone and Transport Nodes

In the last post of this series, we discussed uplink profiles. In this post, we will be learning about transport zones and their types.

If you are not following along with this series, then I recommend reading earlier posts of this series from the links below:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

5: NSX Controllers Manual Deployment

6: Prepare Esxi host to form NSX-T Fabric

7: Configuring Uplink Profile

What is a transport zone in NSX-T?

As per vmware documentation

A transport zone is a container that defines the potential reach of transport nodes. Transport nodes are hypervisor hosts and NSX Edges that will participate in an NSX-T overlay.

What is meant by the above is that if two or more ESXi hosts that are configured as transport nodes participate in the same transport zone, then VMs on these different hosts using the overlay network can communicate with each other.Read the rest

Learning NSX-T-Part 7:Configuring Uplink Profile

In the last post of this series, we prepared the ESXi host for NSX-T and ensured that the host’s connection to the NSX manager was up and all necessary VIBs had been pushed on the hosts.

In this post, we will learn about the uplink profile.

If you are not following along with this series, then I recommend reading earlier posts of this series from the links below:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

5: NSX Controllers Manual Deployment

6: Prepare ESXi host to form NSX-T Fabric

What is an uplink profile in NSX-T?

From VMware documentation:

An uplink profile defines policies for the links from hypervisor hosts to NSX-T logical switches or from NSX Edge nodes to top-of-rack switches.

Uplink profile is similar to specifying the teaming policy when you enable VXLAN on an ESXi host in NSX-v. The settings that you can define in an uplink profile are teaming policies, active/standby links, the transport VLAN ID, and the MTU setting.Read the rest

Learning NSX-T-Part 6: Host Preparation and forming NSX-T Fabric

In the last 2 posts of this series, we discussed the automated and manual deployment of NSX controllers and how to form a controller cluster. In this post, we will learn how to do host preparation for NSX-T.

If you are not following along with this series, then I recommend reading earlier posts of this series from the links below:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

5: NSX Controllers Manual Deployment

When we perform host preparation, NSX-T pushes a few vibrations on the ESXi host (just like NSX-v), and once the hosts are prepared, they are known as fabric nodes. All ESXi hosts that are fabric nodes have NSX-T modules installed and are registered with the NSX-T management plane.

Before jumping into the host preparation task, ensure that the install-upgrade service status on the NSX-T Manager is reporting as ‘running.’ If this service is down, the NSX Manager won’t be able to push the VIBs onto the ESXi hosts when we add them to the fabric.Read the rest

Learning NSX-T-Part 5: NSX Controllers Manual Deployment & Clustering

In last post of this series, we learnt how to deploy NSX-T controllers automatically via NSX manager and we saw its pretty much same as deploying controllers in a NSX-V environment. 

In this post we will learn how to deploy the NSX controllers manually. 

If you are not following along this series, then I recommend reading earlier posts of this series from below links:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

4: NSX Controllers Automated Deployment

Manual steps are a bit lengthy and complex so we have to be careful with the sequence of commands which we will be running to form controllers cluster. Before deploying the controller nodes, make sure following prerequisites are met:

  • vCenter Server and ESXi hosts are deployed.
  • Esxi hosts have been added to vCenter and networking and storage configuration on hosts are in place. 
  • NSX Manager is deployed.
  • ESXi host must have enough CPU, memory, and hard disk resources to support controller deployment.
Read the rest

Learning NSX-T-Part 4: NSX Controllers Automated Deployment & Clustering

In last post of this series we deployed the NSX manager appliance. In this post we will learn how to deploy the NSX-T controller nodes.

If you are not following along this series, then I recommend reading earlier posts of this series from below links:

1: Introduction to NSX-T

2: NSX-T Architecture

3: NSX Manager Deployment

There are 2 methods of deploying NSX controllers for vSphere integration with NSX-T:

  • Automated Installation of Controller from NSX Manager
  • Manual Installation of NSX Controller on ESXi via GUI or OVF tool

In this post we will not talk about controller deployment for non-vSphere infrastructure.

Also in this post we will be discussing only about Automated method for controllers. Manual installation will be covered in Next post of this series.

In order to deploy NSX controllers to consume NSX-T for your vSphere infrastructure, make sure following prerequisites are met:

  • vCenter Server and ESXi hosts are deployed.
Read the rest

Learning NSX-T-Part 3: NSX Manager Deployment

In last post of this series we discussed about NSX-T architecture. In this post we will be deploying the NSX-T components in lab. 

Lets start with deploying NSX manager first to form the management plane. NSX manager is deployed via ova file which can be downloaded from VMware website.

The current version of NSX-T is 2.2.0 and it can be downloaded from here

Please refer NSX-T 2.2 Installation Guide before going ahead with deployment.

NSX-T 2.2.0 supports following hypervisor versions:

  • vSphere 6.5/6.5 U1/6.5 U2
  • RHEL KVM 7.3
  • Ubuntu KVM 16.04 

NSX manager deployment is pretty straight forward like any standard virtual appliance deployment. Steps are shown in screenshot below. 

For more information on NSX Manager installation, please see this article

Once the NSX Manager boots up, verify that the IP address set during deployment was applied as expected.

nsxt-12.PNG

Also you can try to ping NSX-T from vCenter server and Esxi host to verify its connectivity. Read the rest

Learning NSX-T-Part 2: NSX-T Architecture

As we discussed in first post of this series that NSX-T was born to meet the demands of the containerized workload, multi-hypervisor and multi-cloud.

The best use case that you can think of NSX-T is that it provides seamless connectivity and security services for all types of endpoints including virtual machines, containers and bare metal. It doesn’t really matter where these endpoints are. It could be in your on-prem datacenter, a remote office or in the cloud.

In this post we will look how NSX-T architecture looks like. 

Like NSX-V, NSX-T too contains a management plane, data plane and a control plane. Lets discuss about each plane individually here.

Data Plane

  • NSX-T uses in-kernel modules for ESXi and KVM hypervisors for constructing data plane. 
  • Since NSX-T is decoupled from vSphere, it don’t rely on vSphere vSwitch for network connectivity. NSX-T data plane introduces a host switch called N-VDS (NSX Managed Virtual Distributed Switch).
Read the rest