20150311 NSX update 301

NSX Overview with microsegmentation. Watch the video here: https://goo.gl/Ugj5Ay

1. “NSX will transform what’s possible for our IT team in terms of network and security operations.” NSX is the future

2. This is YOUR opportunity to be the thought leader for your customers. NSX is the network virtualization platform for the SDDC, transforming data center networking and making a new level of security possible.

3. OSI Layers & Platforms 1 Physical 2 Datalink 3 Network 4 Transport 5 Session 6 Presentation 7 Application 1 Physical 2 Datalink 3 Network 4 Transport 5 Session 6 Presentation 7 Application vCNS NSX

4. NSX is the Future Legacy Computing Model Zoning ( dpar / lpar ) Sun Solaris Sun Sparc Vendor-specific HW (Sun e10K) Any Applications Legacy Networking Model Proprietary Features Platform-dependent NOS Custom ASIC Vendor-specific HW Any Applications

5. NSX is the Future VSWITCH OS Hypervisor Network & Security Services Now in the Hypervisor L2 Switching L3 Routing Firewalling/ACLs Load Balancing Next Gen Networking Model Virtual Machines Virtual Networks Virtual Storage Data Center Virtualization Location Independence Software Hardware Pooled compute, network and storage capacity; Vendor independent, best price/ perf ; Simplified config and mgt. Compute Capacity Network Capacity Storage Capacity Software Any Applications

6. Data center micro-segmentation becomes operationally feasible East / West is now reality. This is the future of data center networking and security

7. Micro-Segmentation Self-Service IT NSX Across Data Centers

8. CONFIDENTIAL 8 Automated Policy Mgt & Operations, Distributed Enforcement Kernel-based Performance, Distributed Scale-out Capacity (20 Gbps /host) Distributed Firewalling Host VM VM VM Hypervisor Host VM VM VM Hypervisor Host VM VM VM Hypervisor Host VM VM VM Hypervisor Hypervisor Host VM VM VM Traditional Firewall Rule Mgt & Operations Physical Firewalls (2 – 100 Gbps ) Traditional Firewall Rule Mgt & Operations Virtual Firewalls (1 – 3 Gbps ) Virtual Firewalls Physical Firewalls There is a BIG difference…

9. Why NSX for MicroSegmentation ? Hypervisor-based, in kernel distributed firewalling High throughput rates on a per hypervisor basis Every hypervisor adds additional east-west firewalling capacity Native feature of the VMware NSX platform Platform-based automation Automated provisioning and workload adds/moves/changes Accurate firewall policies follow workloads as they move Centralized management of single logical, distributed firewall NSX vSwitch VM VM VM VM Hypervisor

10. So how do we fix this problem? #1. Assume everything is a threat: “Zero Trust Security” #2. Security Design Principle: Micro-segmentation Isolation and segmentation 1 VM VM VM Unit-level trust / least privilege 2 VM Ubiquity and centralized control 3 VM VM VM VM VM Ensure all resources are accessed securely regardless of location. Adopt a least privilege strategy and strictly enforce access control. Inspect and log all traffic. 1 2 3

11. So how do we fix this problem? Each VM can now be its own perimeter Policies align with logical groups Prevents threats from spreading Segmentation simplifies network security App DMZ Services DB Perimeter firewall AD NTP DHCP DNS CERT Inside firewall Finance Engineering VM VM VM VM VM VM HR VM VM VM VDI VDI VDI VDI VDI

12. Secure Micro-Segmentation with NSX 12 Logical Switching Web Tier App Tier DB Tier Distributed Firewalling

13. Micro-Segmentation Deployment Examples 13 Perimeter firewall DMZ/Web VM VM App VM VM DB VM VM HR Group VM VM App VM VM DMZ/Web VM VM DB Finance Group Services VM VM Mgmt Services/Management Group NSX Data Center Perimeter firewall DMZ/Web VM VM App VM VM DB VM VM HR Group VM VM App VM VM DMZ/Web VM VM DB Finance Group Services VM VM Mgmt Services/Management Group Perimeter firewall DMZ/Web VM VM App VM VM DB VM VM HR Group VM VM App VM VM DMZ/Web VM VM DB Finance Group Services VM VM Mgmt Services/Management Group Network Segmentation / DMZ Multi-Tenancy with Adv. Service Isolation Tenant 1 Tenant 2

14. Scale 100,000 Virtual Machines 30,000 Virtual Networks vSphere 5.5 vCenter limits 1,000 hosts, 15,000 VMs (registered), 10,000 VMs (concurrent), 10,000 networks Controller Controller Controller

15. Today’s VDI Security Challenges 15 A converged infrastructure means virtual desktops run on the same infrastructure as servers… Bringing desktops into the data center opens up new risks for attack. And a matrix of policies is needed on centralized, choke-point firewalls for the correct security posture. Desktops VDI VDI to VDI Desktop-to-desktop hacking inside the DC VDI to VM Desktop-to-server hacking inside the DC Servers Finance HR Engineering VDI VDI

16. Solving VDI Security with NSX Micro-Segmentation 16 VM VDI VDI VDI VDI VDI VDI VM VM VDI VDI VDI Enterprise Applications Virtual Desktops VM VM VM VM VM VM VM VM Shared Infrastructure Firewall based on Logical Grouping BENEFITS Distributed Firewall provides Isolation & Segmentation 3 rd Party Integration for AV, IPS/IDS, NGFW, etc. Programmable & Automated Application of Networking & Security

17. Self-Service IT with VMware NSX NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor NSX vSwitch Hypervisor Logical Switching Logical Routing Load Balancing Physical to Virtual Firewalling & Security Cloud Management Platform

18. More to vCloud Air 18 The updated iteration of vCloud Air will now include NSX capabilities!

19. NSX for Data Center Multi-Site Extensions 19 L2 Extensions Data Center 2 NSX NSX Data Center 1 Logical Switch Extension L2 VPN vCloud Air Software-based solution with support for Logical Switching, Distributed Routing, Distributed Firewall

20. NSX for Data Center Multi-Site Extensions 20 Data Center 2 NSX NSX Data Center 1 SRM-based Disaster Recovery No Re- IPing , Instantaneous Availability of Apps upon Disaster Failover of Logical Switching, Routing & Firewall Rules

21. Visibility with vRealize Operations Manager

22. Thank you @ kgroat