This article is based on reporting originally published by Network World and statements from VMware at the time of the NSX-T 3.0 release in April 2020.
Overview: What Changed in NSX-T 3.0
VMware released NSX-T 3.0, a significant update to its flagship software-defined networking platform, delivering more than 100 new features focused on scalability, security, and multi-cloud management. The release targets enterprises running hybrid and multi-cloud workloads across private data centers, public clouds, and Kubernetes environments.
NSX-T is the foundation of VMware’s Virtual Cloud Networking (VCN) architecture — the company’s overarching framework for delivering consistent network connectivity and security policy from the data center, across the WAN, and into multi-cloud deployments. NSX-T supports bare-metal workloads, multi-vendor hypervisors, and integrates with major public clouds including AWS, Microsoft Azure, Google Cloud, and IBM Cloud, as well as leading Kubernetes container platforms.
NSX Federation: Managing Multiple Virtual Networks as One
One of the most significant additions in NSX-T 3.0 is NSX Federation, which lets organizations manage multiple geographically distributed virtual networks as a single unified entity. This capability addresses a key operational challenge in large enterprise environments: maintaining consistent network configuration, policy, and security controls across many sites.
- Fault-tolerant zones: NSX Federation allows administrators to define fault-isolation domains, containing network problems within a single zone and preventing them from cascading across the environment.
- Global policy synchronization: Configuration and security policies can be authored once and propagated consistently across all federated locations.
- Workload mobility: Security policies attach to workloads and travel with them during failover or migration between sites, ensuring compliance is never lost during movement.
“NSX Federation will provide a means of implementing fault-isolation domains and global policies synchronized across all locations. This is all about making NSX useful across a heterogeneous, hybrid, multicloud landscape.”
— Brad Casemore, IDC Research Vice President, Data Center Networks
Enhanced Security: Distributed IDS/IPS and URL Analysis
NSX-T 3.0 significantly upgrades the platform’s built-in security capabilities, extending the Service-defined Firewall with two notable enhancements:
NSX Distributed IDS/IPS
VMware introduced a distributed intrusion detection and prevention system (IDS/IPS) purpose-built for detecting lateral threat movement on east-west traffic across multi-cloud environments. Rather than routing traffic through a centralized hardware appliance — a traditional architecture that creates bottlenecks — NSX Distributed IDS/IPS pushes threat analysis out to every individual workload. It curates which threat signatures each engine evaluates based on precise knowledge of the applications running at that workload, reducing noise and improving detection accuracy.
URL Classification and Reputation Analysis
The NSX Edge Firewall gains URL Analysis for classifying and assessing the reputation of inbound and outbound URLs at the data center perimeter. This gives security teams granular visibility into external-facing traffic without requiring separate dedicated appliances.
Kubernetes and vSphere 7.0 Integration
NSX-T 3.0 extends L2–L7 container networking services to several newly released VMware platforms, reflecting the company’s broader push to unify VM and container workloads:
- VMware vSphere 7.0 with Kubernetes: By embedding Kubernetes directly into the vSphere control plane, VMware allows customers to run container and VM workloads on a single hypervisor. NSX-T provides the underlying networking fabric for this converged environment.
- VMware Cloud Foundation 4: NSX-T serves as the network layer for Cloud Foundation 4, VMware’s integrated private cloud stack.
- VMware Tanzu portfolio: NSX-T provides networking support for Tanzu, VMware’s suite of products for building, running, and managing Kubernetes-based applications.
- Non-VMware Kubernetes platforms: NSX-T 3.0 extends networking services to third-party Kubernetes environments, addressing heterogeneous infrastructure deployments.
vRealize Network Insight 5.2: Visibility and Analytics
Alongside NSX-T 3.0, VMware announced VMware vRealize Network Insight (vRNI) 5.2, its network observability and analytics platform. Key additions include:
- Flow-Based Application Discovery: Machine learning automatically groups virtual machines into applications and service tiers, giving operators a clearer picture of real traffic patterns and application dependencies without manual mapping.
- AWS Direct Connect visibility: End-to-end network path tracing now extends from on-premises VMs through VMware Cloud on AWS, including the AWS Direct Connect segment — valuable for troubleshooting hybrid connectivity.
- VMware SD-WAN (VeloCloud) statistics: Additional visibility into SD-WAN application and business policy performance metrics.
- Enhanced Kubernetes visibility: Better observability into container network traffic patterns.
- NSX-T 3.0 support: Full integration with the new NSX-T release to correlate network and security events across the overlay.
Deeper Microsoft Azure Integration
VMware also announced expanded integration with Microsoft Azure, including support for Azure Edge Zones and Azure Private Edge Zones. These integrations allow customers to deploy and run virtual network functions — including VMware SD-WAN by VeloCloud — across Azure regions and on-premises Azure Edge Zone deployments, extending the reach of VMware’s networking stack further into Microsoft’s cloud infrastructure.
Market Context
At the time of the release, VMware reported that its Virtual Cloud Network customer base exceeded 15,000 organizations, including 89 of the Fortune 100 and eight of the top 10 global telecommunications providers. Tom Gillis, VMware’s Senior Vice President and General Manager of Networking and Security, stated that the VCN portfolio had grown approximately 50% each fiscal year since its introduction in May 2018.
“The driving idea enabled through NSX and the Virtual Cloud Network is to let customers have a public cloud experience and efficiencies on-premise, removing the inefficient IT ticket requests and long waits for networking and security changes.”
— Tom Gillis, SVP and GM, VMware Networking and Security
VMware also cited internal data claiming customers could experience up to a 59% reduction in capital expenditures and a 55% reduction in operational expenditures compared to traditional networking solutions when adopting VCN — figures worth validating independently against your own infrastructure costs.
Availability
VMware stated that NSX-T 3.0 was available immediately at the time of announcement (April 2020). VMware vRealize Network Insight 5.2 was expected to ship in Q1 of VMware’s FY21, which ended May 1, 2020.
Note: This article covers a product release from April 2020. Readers evaluating VMware NSX should consult current VMware documentation and release notes for the latest capabilities and supported platforms.