For decades, traditional data centres have been the most predictable and controlled infrastructure to house high-risk and proprietary assets, such as personal information, medical records, and financial information. Yet, today’s modern infrastructures allow organisations to extend their data centres into cloud services, and this change does come with a unique set of risks. Keeping these risks in check requires businesses to reassess their data centre security and even partner with a modern solution provider. However, choosing the right solution isn’t easy – every business is different, and there is no ‘one size fits all’ solution.

Over 388,000 professionals have used IT Central Station research to inform their purchasing decisions. Its latest paper looks at Trend Micro Deep Security and VMware NSX, two of the highest reviewed solutions in the cloud and data centre security market.

Below is a brief summary of the report, highlighting what real IT Central Station users think of each solution – from their most valuable features, to how they’ve improved individual businesses, as well as what each solution could do better.

Trend Micro Deep Security
Protects applications and data and prevents business disruptions, while helping meet regulatory compliance

With an average rating of 8.9 from nine reviews, Deep Security is one of the most popular solutions currently available. Deployed largely throughout the healthcare, financial services, and manufacturing industries, the solution enjoys market share with organisations of all sizes. 46% of reviewers are from organisations with over 1000 employees, whilst small and medium size organisations make up 31% and 23% of reviewers.

When evaluating the solution, users highlight the excellent customer service and technical support that it provides. The product’s advocates also believe that it integrates well with the cloud, making it a very valuable feature along with the virtual path function that it offers. However, Deep Security does falter slightly in the eyes of reviewers, with critics arguing that its setup can be too complex and difficult, and it also lacks an EDR function for the servers.

VMware NSX
The network virtualisation platform for the Software-Defined Data Centre (SDDC)

Achieving an average rating of 8.1 from 11 reviews, VMware NSX is one of the most frequently reviewed products on the market with reviews coming from a range of industries and business sizes. Retail, government, and financial services firms prove the most popular industry users alongside large businesses which account for 59% of reviewers. Small and midsize companies make up the remaining share of reviewers with 23% and 18% respectively.

Many of VMware NSX’s users are impressed with the solution’s micro-segmentation and integrated security options which offer tangible benefits when compared to other products in the market. NSX is also considered one of the most scalable products of its type, which is further complimented by its low cost and excellent security features. There are only a few areas where critics believe the solution could be improved. Some users would like to see automation capabilities implemented in the deployment process, whilst others would like to see improvements made to the technical support it offers.

The Hardware Underneath the Cloud

“There is no cloud; it’s just someone else’s computer” is a well-worn phrase in infrastructure circles, but it carries real weight at events like VMworld. Beneath every abstraction layer — every virtual machine, container, and software-defined network — sits physical hardware. At VMworld in San Francisco, networking and storage vendors gathered to remind the industry that hardware choices still shape what is possible in multicloud architectures.

Bob Ghaffari, General Manager of Intel’s Enterprise & Cloud Networking Division, used the event to outline how Intel is positioning its networking portfolio for hybrid and multicloud environments — from foundational network interface cards (NICs) to programmable FPGA-based accelerators and edge computing solutions.

A Decade of Network Transformation: Intel’s Role in DPDK

Ghaffari traced Intel’s networking involvement back roughly ten years, to the industry’s shift away from proprietary network processors toward standard, open architectures. A pivotal contribution was Intel’s open-sourcing of the Data Plane Development Kit (DPDK) — a set of libraries and drivers for fast packet processing that runs in user space and bypasses the kernel networking stack for dramatically higher throughput.

DPDK became foundational infrastructure for software-defined networking (SDN) and network functions virtualization (NFV). By enabling high-speed packet processing on commodity x86 hardware, it helped precipitate the broader shift toward software-defined, cloud-native networking that VMware NSX and similar platforms depend on today.

“We open-sourced [DPDK], which is really this fast packet processing library that we basically enabled the industry on. And with that, there’s basically been this revolution in terms of how networking has come together.”

— Bob Ghaffari, Intel

Intel and VMware NSX: Enabling Hybrid and Multicloud Networking

Ghaffari highlighted VMware NSX as a key integration point, noting that NSX had matured significantly in the preceding year and was enabling newer, more sophisticated networking use cases. For Intel, NSX represents a direct enabler of hybrid cloud and multicloud connectivity — the ability to extend consistent networking policies across on-premises infrastructure and multiple public cloud environments.

Intel’s strategy is to offer a tiered hardware portfolio — from cost-optimized NICs to high-performance FPGA-based SmartNICs — so that operators can match hardware capability to workload requirements regardless of which cloud or edge location they are targeting.

“We think we have a really good position here with our platforms — giving you this mix-and-match capability but easily be able to scale up and do what our customers want.”

— Bob Ghaffari, Intel

Microsegmentation: Security Through Policy Isolation

Interviewer Justin Warren raised microsegmentation — a topic that was generating significant interest and some frustration among enterprise customers at the time. Microsegmentation divides a network into small, isolated zones so that a breach or exploit in one segment cannot propagate laterally to others. While the security benefits are compelling, operational complexity has been a common barrier to adoption.

Ghaffari acknowledged the complexity but framed microsegmentation as ultimately simplifying the security posture for enterprises that implement it correctly:

• Policy containment: Security and compliance policies are enforced within defined segments rather than relying on a single network perimeter.
• Threat containment: A successful attack or exploit is confined to its originating segment, limiting blast radius.
• Environment clarity: Segmentation can make it easier to reason about what is running where and who has access to what.

The challenge, as Warren noted, is that many customers find initial configuration and ongoing management difficult — which has created a market for third-party tools that layer policy management on top of NSX and competing SDN platforms.

The Intel FPGA N3000: Programmable Acceleration for Virtual Switching

One of the more technically specific topics in the interview was Intel’s FPGA-based network adapter. Ghaffari cited the Intel FPGA N3000 as an example of how customers can go beyond standard NIC capabilities to accelerate custom networking functions and virtual switches in hardware.

FPGA-based SmartNICs occupy a middle ground between fixed-function ASICs and general-purpose CPUs:

• They can be reprogrammed to accelerate specific workloads — including virtual switching, security functions, or 5G baseband processing — without replacing the physical card.
• They offload networking functions from the host CPU, freeing compute resources for application workloads.
• They allow infrastructure operators to adapt hardware behavior as software-defined networking requirements evolve.

For operators running VMware NSX or other SDN overlays at scale, offloading virtual switch processing to a SmartNIC can meaningfully reduce CPU overhead on the host.

Edge Computing: Challenging the “All Intel Does Is Big Xeons” Assumption

Ghaffari described a common misconception among customers evaluating edge deployments: the assumption that Intel hardware is only cost-effective at the high end. Customers planning small-footprint deployments — in retail locations, branch offices, or distributed edge sites — often assume Intel’s price points are prohibitive.

Intel’s response has been to develop add-on processors and purpose-built platforms that hit lower price points while retaining the scalability and software ecosystem compatibility that x86 architecture provides. The implication for DevOps and infrastructure teams is that a consistent programming model — including DPDK-based networking — can be maintained from the core data center out to distributed edge nodes, even at constrained cost targets.

5G and What Comes Next

The full interview also touched on 5G wireless technologies and their intersection with edge computing — a topic that was early-stage in mid-2019 but has since become central to infrastructure planning for carriers and enterprises alike. The core thesis: as 5G shifts more processing to the network edge, the same DPDK-based, software-defined networking capabilities Intel has been building for data centers become relevant for radio access network (RAN) infrastructure.

Key Takeaways for Infrastructure and DevOps Teams

• DPDK remains foundational: If you are running any high-throughput SDN overlay — NSX, OVS-DPDK, or similar — understanding the underlying packet processing library matters for performance tuning.
• SmartNICs are a practical offload option: FPGA-based and ASIC-based SmartNICs are increasingly viable for offloading vSwitch and security functions, particularly in high-density virtualization environments.
• Microsegmentation complexity is real: Plan for operational tooling when deploying microsegmentation at scale; policy management does not end at initial configuration.
• Edge hardware has matured: x86-based edge platforms are no longer exclusively high-cost server-class hardware; purpose-built edge processors have closed the price gap for lightweight deployments.
• Multicloud networking requires a hardware strategy: Consistent connectivity across clouds and edge sites depends on NIC capabilities, driver support, and offload features — not just software configuration.

The original interview was conducted by theCUBE at VMworld, San Francisco. Full interview and transcript available via SiliconANGLE.

Companies are turning to open source network automation tools as less expensive, good-enough alternatives to Cisco ACI and VMware NSX.

Companies trying to avoid or lessen the use of expensive network automation software from Cisco and VMware are turning to open source tools that are often good enough for many tasks associated with managing complex modern networks.

Cisco’s application-centric infrastructure (ACI) and VMware’s NSX are powerful technologies for operating networks built on the vendors’ respective products. But many large enterprises have data centers filled with perfectly good multivendor hardware and software that very few organizations are willing to swap for an all Cisco or VMware alternative.

Therefore, companies are turning to open source networking products, such as Ansible, Chef, Puppet and SaltStack, for automating many network-related chores across as much of the data center as possible, while relegating ACI and NSX to Cisco- or VMware-only portions of the network.

“I’m seeing a lot more appetite — quite honestly — for more of a roll-your-own solution,” said Teren Bryson, a network consultant for Fortune 500 companies. “Neither one of those solutions [ACI, NSX] is by any means necessary, and a lot of companies are actually finding them fairly onerous, expensive, complicated and not able to do some of the things they can do using other tools.”

In July, Gartner reported in its Data Center Networking Magic Quadrant that companies have difficulty justifying the cost of NSX. “We believe this is a primary reason that the adoption of NSX data center remains less than 10% of the VMware ESX installed base,” the research firm said. ESX is VMware’s platform for server virtualization.

Gartner found similar resistance to Cisco ACI.

“Based on client feedback, Cisco ACI is complex for a combination of financial, technical and cultural reasons,” the report said. “We believe this has limited ACI’s usage and adoption.”

Using open source network automation

Companies striving for vendor independence are building network orchestration systems comprised of Ansible, Jenkins and GitLab, which is a repository for code version control, Bryson said. In place of Ansible, companies might use Chef, SaltStack or Puppet.

The list of network tasks engineers can automate using the open source tools is long. “It’s a big tapestry of automation that people are looking at,” said Shamus McGillicuddy, an analyst at Enterprise Management Associates (EMA), based in Boulder, Colo.

Engineers who once used open source networking tools primarily to configure network devices find they can do much more. Other routine tasks the software can handle include ensuring a switch booted up for the first time has the correct version of the operating system and the latest security patches. Automated chores could also include verifying the network is operating as intended after engineers use a tool like Ansible to make configuration changes to switches, load balancers and firewalls.

Engineers write reusable scripts — typically in Python — that execute the automation. Programmers store the scripts in a repository, such as GitLab, while using other data storage software, such as NetBox, for critical network data. Examples include the locations, and IP or network addresses of all hardware, and the default settings of devices and the versions of programs installed on them.

An EMA survey of 250 IT pros — scheduled for release in a few weeks — found that they had automated roughly a third of the tasks performed on network devices, McGillicuddy said. More than 90% of the survey respondents used more than one network automation tool, and almost 30% of those engineers had homegrown software often built with open source components.

“Almost nobody is hiring network engineers anymore that don’t have some ability to program at least at a rudimentary level,” Bryson said. “It’s a big change from when I first got into the industry. It’s a big change even from five or six years ago. It’s definitely where the industry is moving.”

Advanced features in ACI, NSX

Configuration management tools are not comparable to ACI or NSX in functionality. Both can do much more when managing networks built with Cisco and VMware, respectively.

NSX is a hardware-agnostic software layer that delivers switching, routing and distributed firewall features to applications running on VMware’s virtualization platform. Cisco has designed ACI as a software alternative to the manual task of managing the company’s switches through their command-line interfaces.

Nevertheless, companies are finding that the best strategy is to tap the technologies only when needed.

“The cost of ICT [information and communications technology] needs to come down,” said Chris Antlitz, an analyst at Technology Business Research Inc. “There [are] CIOs out there saying, ‘we can’t keep spending this kind of money. It’s just not sustainable.'”

What Is HCI and Why Automate It?

Hyper-Converged Infrastructure (HCI) collapses traditional three-tier data-centre architecture — separate compute, storage, and networking layers — into a single, software-defined building block. By pooling commodity x86 servers running VMware vSphere and vSAN, organisations can scale out storage and compute together, reduce cabling complexity, and manage the entire stack through a single pane of glass.

Despite its operational simplicity at runtime, initial deployment of an HCI stack can still be tedious and error-prone when performed manually. Applying DevOps principles — infrastructure-as-code, idempotent configuration management, and continuous validation — to the bring-up process eliminates configuration drift, accelerates time-to-production, and makes the environment fully reproducible.

The VMware SDDC Stack in Focus

The automation approach described in the original VMware blog post targets a full Software-Defined Data Centre (SDDC) stack composed of four main products:

• VMware vSphere (ESXi + vCenter Server) — the compute and hypervisor layer that hosts all workloads.
• VMware vSAN — software-defined storage distributed across vSphere hosts, eliminating the need for external SANs or NAS.
• VMware NSX — software-defined networking and security, providing micro-segmentation, logical switching, routing, and load balancing independent of physical hardware.
• VMware Integrated OpenStack (VIO) — an enterprise-supported OpenStack distribution that sits on top of vSphere and NSX, exposing a standard OpenStack API surface for tenant self-service.

Together these components form an HCI platform capable of running both traditional VM workloads and cloud-native tenant environments, all on the same converged hardware.

Applying DevOps Principles to HCI Bring-Up

A DevOps-style deployment pipeline for this stack typically involves several stages, each automated and version-controlled:

1. Infrastructure-as-Code for Configuration

All cluster parameters — host IP addresses, vSAN disk groups, NSX controller counts, VIO sizing — are captured in declarative configuration files (for example, YAML or JSON). This means every environment, from a lab proof-of-concept to a production cluster, is described in source control and can be peer-reviewed before deployment begins.

2. Scripted Deployment with VMware APIs

VMware exposes rich APIs across its product portfolio — the vSphere API (accessible via PowerCLI or the vSphere SDKs), the NSX REST API, and the VIO management API. Automation tooling can chain calls to these APIs to:

• Configure ESXi hosts, vCenter clusters, and HA/DRS settings.
• Claim vSAN capacity and cache disk groups and verify the vSAN health checks pass.
• Deploy NSX Manager, register it with vCenter, and provision controllers and transport zones.
• Bootstrap VIO, connect it to the vSphere and NSX backends, and validate the OpenStack services come up healthy.

3. Idempotency and Validation Gates

Each automation step should be idempotent — running it a second time should produce the same outcome without creating duplicate objects or failing with errors. After each major phase (vSphere cluster ready, vSAN healthy, NSX control plane up, VIO services active), automated validation tests confirm the expected state before the pipeline advances. Failures at any gate halt the pipeline and surface a clear error, rather than allowing a misconfigured component to propagate into later stages.

4. Version-Controlled and Repeatable

Because the entire bring-up procedure lives in a version-controlled repository, teams can:

• Reproduce the exact same environment in a new data centre or a disaster-recovery site.
• Roll back to a known-good configuration definition if a change introduces problems.
• Audit exactly what changed between deployments using standard diff and pull-request workflows.

Key Benefits for Operations Teams

• Reduced deployment time: Multi-day manual bring-up processes can be compressed into hours when fully scripted.
• Consistency: Every cluster built by the pipeline is configured identically, removing the variability introduced by different engineers following a run-book.
• Self-documenting infrastructure: The configuration files and pipeline code serve as living documentation of the environment’s intended state.
• Faster recovery: If a cluster must be rebuilt, the same pipeline re-creates it to spec without relying on tribal knowledge.
• Compliance-friendly: Change history is captured in Git; automated validation gates can enforce security baselines at deploy time.

Tooling Considerations

Common tooling choices for automating this type of VMware SDDC stack include:

• PowerCLI — VMware’s PowerShell module for vSphere automation, well suited for cluster configuration and vSAN management tasks.
• Ansible — agentless automation that can orchestrate multi-product workflows using VMware and NSX modules from Ansible Galaxy.
• Terraform — the VMware vSphere provider can manage vCenter objects declaratively; NSX-T also has a Terraform provider.
• Python with the vSphere Automation SDK — useful for custom tooling or integrating with existing CI/CD pipelines.
• CI/CD platforms (Jenkins, GitLab CI, etc.) — orchestrate pipeline stages, enforce gate checks, and provide audit trails.

Further Reading

For the full implementation walkthrough, scripts, and architecture diagrams, refer to the original VMware Virtual Blocks blog post:

HCI Automated Deployment & Configuration: vSphere, vSAN, NSX, VIO The DevOps Way — VMware Virtual Blocks Blog