NSX-T Service Insertion

This is a very specific feature of NSX-T, and I needed to study this as I was doing a client's project which involve integrating their NSX-T with a 3rd party services. One of the reasons clients may opt to do this is when they already have a large footprint of Palo Alto or Checkpoint firewall, and feel comfortable managing them. Other reasons may be because the client feels that some of these 3rd party services have some features which NSX-T does not provide.

Service Insertion Basics

• Allows NSX-T to integrate 3rd party services

  • Must be on the supported list

  • Network Introspection

    • i.e. IDS, IPS, Next Gen FW, URL filtering

  • Endpoint Protection

    • i.e. Agentless Antivirus

  • Can be applied to East-West traffic, and North-South

    • Not all partner services are supported for both use cases

Checking for supported partner services

• Access to https://www.vmware.com/resources/compatibility/search.php

• Under 'What are you looking for:', select 'Networking and Security Services for NSX-T'

• Select version, partner name, API integration, solution category (Edge service insertion refers to N-S insertion)

Service Virtual Machine (SVM)

• A 3rd party VM that provides services to NSX-T traffic

  • North-South Service Insertion:

    • Deployed on/near edge nodes, and attached to T0/T1

  • East-West Service Insertion (2 modes):

    1. Deployed on each ESX host (Traffic need not go out of the host, but not resource-efficient)

    2. or deployed in a separate service cluster (Traffic needs to go out of the host and come back even if the target VM sites are on the same ESXi host)

• Routing to SVM is based on policy

  • Redirection policy (Which traffic to be/not to be redirected)

• Service Chains

  • To 'chain' multiple SVMs together

  • To specify inspection by multiple SVMs in the forwarding path

  • E.g. Use a redirection policy that uses a Service Chain that directs traffic to Checkpoint for Next-Gen FW services 1st. If it passed, then forward to Palo Alto for URL filtering. If it passed, then the traffic is allowed to proceed.

Service Insertion Deployment

1. Service Registration

• From the 3rd party service's management console (or API/CLI), to make a call to register itself with NSX-T.

• This makes the 3rd party service available for deployment in NSX-T (Catalog)

2. Service Deployment

• Deployment of SVMs (Specify datastore, networks, etc)

• For North-South

  • SVM can only connect to a single gateway (T0/T1)

  • SVM sits on the host where edge sits

  • The host which SVM sits must be prepped for NSX-T (Transport node), because overlay networking is used to send traffic to the SVM. If not, actually edge host doesn't need to be prepped for NSX-T

3. Service Consumption

• Creation of service profile, service chain

• Set up redirection policies

---

"What do you think?"

Let me know if you think there are any important/useful details I have missed in the above write-up.