Exploring Networking, Security, and AWS Integrations

This chapter is dedicated to the networking and security aspects of VMware NSX architecture in VMware Cloud on AWS, including the firewall architecture, a Compute Gateway (CGW), a Management Gateway (MGW), understanding the concept of micro-segmentation, IPS/IDS, a Layer 7 firewall, and native AWS integration architectures through VMware Managed Transit Gateway (vTGW).

The chapter will cover the following topics:

• Exploring VMware NSX
• VMware Cloud on AWS networking architectures
• VMware Cloud on AWS SDDC connectivity to the AWS cloud
• VMware NSX and AWS security architecture and capabilities
• VMware NSX micro-segmentation
• Discovering the NSX advanced security add-on

Exploring VMware NSX

Careful networking design and planning are essential for a successful cloud project, and this section will examine the basics of NSX and AWS networking.

A VMware NSX overview

VMware NSX network virtualization offers a complete logical overlay network and security abstraction service, independent from the underlying physical infrastructure.

Distributed functions such as routing, switching, and firewalls are available as kernel-level modules to the hypervisor hosts. Edge components provide external connectivity and stateful services such as VPN, NAT, and a firewall. VMware Cloud on AWS relies on the proven capabilities of VMware NSX, extended with configuration constructs specific to the AWS cloud.

VMware NSX architecture

The networking architecture of an SDDC comprises a multi-tier topology of tier-0/1 gateways, distributed routers, and service routers.

A tier-0 gateway

A tier-0 (T0) gateway serves as the border point of connectivity for all...

Understanding the network architecture of the VMware Cloud on AWS SDDC

In this section, we will cover network design principles and architecture considerations for different network services in the VMware Cloud on AWS SDDC.

AWS networking

This section provides background on the AWS networking constructs in the VMware Cloud on AWS SDDC.

Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network that spans across an AWS Region. You can create a VPC using you own IP CIDR range. Additionally, you then create subnets that are mapped to Availability Zones (AZs). Once subnets are created, you can create resources that are part of them. The resources in the VPC subnet can establish communication with other VPCs and network constructs using route tables.

A VMware-owned and managed AWS account is dedicated to each VMC on AWS customer. A VPC and several subnets are created in this account where all the Amazon EC2 bare-metal hosts reside. This VPC also acts as a network...

Understanding connectivity to the AWS cloud

VMware Cloud on AWS supports multiple options to establish connectivity to workloads running in an AWS VPC. We will take a closer look at various options, including vTWG and a connected VPC.

VMware Transit Connect

The AWS TGW service can be described as a managed router within an AWS Region. It connects using high-speed VPC attachments without the complexities of traditional routing protocols.

The AWS TGW simplifies the networking operations and supports the attachment types illustrated in the following diagram:

Figure 2.17 – AWS TGW attachment options

The primary function of an AWS Transit Gateway is to establish connectivity between Amazon VPCs, site-to-site VPNs, and AWS DX connections. The AWS TGW is capable of performing transitive routing between the various networks connected to it. To be able to route between the various networks, the TGW uses one or more TGW route tables that are populated...

Exploring NSX and AWS security architecture and capabilities

In the following section, we’ll describe the firewalling and security capabilities of a VMware Cloud on AWS SDDC and AWS.

AWS security groups

An AWS security group regulates all the incoming and outgoing traffic of the resources. These resources can include Amazon EC2, elastic network interfaces, Amazon Elastic File System (EFS), and Amazon FSx filesystems. A security group is associated with resources within the VPC it was created for. Unlike Network Access Control Lists (NACLs), which are applied to VPC subnets, a security group is tied to individual resources. Additionally, security groups are stateful, which means they are bidirectional. In other words, if inbound traffic is permitted, the corresponding response packets in the opposite direction are always allowed by default.

The AWS security groups control the traffic flow from and to the connected VPC. The security groups control traffic on the AWS side...

Learning NSX micro-segmentation

NSX supports advanced ways of defining firewall rules beyond traditional sources – destination IPs. When leveraging micro-segmentation powered by Distributed Firewall (DFW), customers can use native vSphere objects to control the traffic flow.

The benefits of micro-segmentation architecture

Micro-segmentation allows customers to logically separate an SDDC into security zones and provide security control for services that run across each zone, as described in the example of securing a multi-tiered application. DFW is unique, as it is applied to all network parts and dissociates network security policies from network architecture. It allows for the maintenance of security policies while the network infrastructure is modified. Workloads can be migrated, and IP addresses can change while applying the same security policies. Security administrators can leverage traditional non-contextual parameters, such as IP addresses and ports for policies...

Discovering the NSX Advanced Firewall Add-On

The NSX Advanced Firewall Add-On is available to customers as a purchase option on top of the SDDC costs, and it has to be activated for all hosts in the SDDC cluster. NSX Advanced Firewall helps customers enhance the NSX security capabilities beyond distributed Layer 4 firewall security to advanced application security capabilities, such as distributed IPS/IDS, Layer 7 Context Profiles (app IDs), FQDN filtering, and Identity-Based Firewall.

IPS/IDS

NSX Distributed IPS/IDS inspects all traffic inside an SDDC without any dependency on its architecture, which contrasts with traditional IPS/IDS solutions where networking architecture needs to be taken into significant consideration when deploying an IPS/IDS solution.

Security administrators can create a virtual zone in a SDDC using the DFW and IDS/IPS features. IPS/IDS can detect and prevent the lateral movement of attackers who infiltrate data centers, leveraging attack signatures...

Summary

In this chapter, we learned about the unique NSX architecture running over VMware Cloud on AWS, including security and firewall architecture, the roles of the CGW and MGW, and advanced security features such as micro-segmentation and IPS/IDS. We also looked at advanced networking architectures such as native AWS TGW integrations. With those lessons in hand, we can now move on to designing and implementing a scalable and secure deployment of applications in VMware Cloud.

In the next chapter, we will further explore add-on services, such as migrations with HCX, monitoring with vRLI, and Kubernetes with Tanzu services.