NSX-T Data Center Installation Requirements

Set up the KVM environment before installing NSX Manager.

These are the important conditions for installing NSX Manager.

Set up the necessary network access for NSX Manager.

The process of installing NSX Manager on a KVM host.

Install additional software needed by NSX Manager on KVM host.

Connect multiple NSX Manager nodes together for better performance and high availability.

Prerequisites for installing NSX Edge on bare metal.

Filter compatible cards by selecting 'Network' under 'I/O Device Type' in the Compatibility Guide to find compatible network cards.

Check 'GENEVE' under 'Features' in the Compatibility Guide to find network cards that support GENEVE encapsulation.

Choose 'N-VDS Enhanced Data Path' under 'Features' to find network cards supporting enhanced data path for faster performance.

The minimum size of the NSX Manager appliance, offering 8GB of RAM, 2 vCPUs, 300 GB disk space, and requires VM Hardware Version 10 or later. Suitable for smaller deployments.

The small NSX Manager size offers 16GB RAM, 4 vCPUs, 300 GB disk space, and needs VM Hardware Version 10 or later, suitable for medium deployments.

The medium NSX Manager size offers 24GB RAM, 6 vCPUs, 300 GB disk space, and needs VM Hardware Version 10 or later, suitable for larger deployments.

The largest NSX Manager size with 48GB RAM, 12 vCPUs, 300 GB disk space, and requires VM Hardware Version 10 or later. Ideal for large-scale deployments.

NSX Manager now combines various roles previously requiring separate appliances, simplifying management.

The NSX Manager appliance requires a minimum VM Hardware Version of 10.

A password's strength based on its length, character variety (letters, numbers, symbols), and avoidance of simple patterns.

Guidelines for valid hostnames; avoid underscores and certain special characters like periods (.).

Software installed on NSX Manager VM running on ESXi; do not remove or upgrade.

Minimum conditions your system must meet before installing NSX Manager.

Specify the open ports and protocols required for NSX Manager to function.

Using media adapters or cables not specifically supported by the vendor can lead to unpredictable issues like failure to boot.

Consult the documentation provided by the Network Interface Card (NIC) manufacturer for a list of supported media adapters and cables.

Before configuring a bare metal server for NSX-T Data Center, ensure it meets the specified system requirements.

NSX-T Data Center supports specific versions of CentOS, RHEL, Oracle Linux, SUSE Linux Enterprise Server, Ubuntu and Windows Server.

For NSX-T Data Center installation, the minimum CPU core count is 4 for all supported operating systems.

The minimum RAM requirement for NSX-T Data Center installation is 16 GB for all supported operating systems.

Make sure the MTU (Maximum Transmission Unit) is set to 1600 to enable Jumbo frame support by the NIC or OS drivers.

For Ubuntu 18.04.2 LTS, you need to either upgrade from 16.04 or perform a fresh installation.

The user performing the NSX-T Data Center installation may require sudo command permissions for certain tasks.

For physical servers running Linux, there are no restrictions on the physical NIC, except it must be supported by the operating system.

For physical servers running Windows on Segment-VLAN with MTU of 1500, there are no restrictions on the physical NIC, except it must be supported by the operating system.

For physical servers running Windows on Segment-Overlay or Segment-VLAN with large MTU (> 1500), the NIC must support jumbo packet functionality.

To verify jumbo packet support on a physical NIC, use the Windows PowerShell command: $ (Get-NetAdapterAdvancedProperty -Name "<NIC Name>").DisplayName -Contains "Jumbo Packet"

The e1000e NIC is an Intel(R) 82574L Gigabit Network adapter.

The vmxnet3 NIC is a virtual NIC specific to VMware products, designed for high performance.

Node-to-node communication in NSX-T Data Center relies on ports and protocols for secure and authenticated connections.

NSX-T Data Center uses secured and authenticated communication paths for node-to-node interactions.

Configure required ports and protocols on both physical and host hypervisor firewalls for NSX-T Data Center functionality.

By default, NSX-T Data Center uses self-signed certificates. These can be replaced with CA signed certificates.

Network Address Translation (NAT) enables devices within a private network to communicate with the external internet using a single public IP address.

Routing determines the path data packets take to reach their destination, facilitating communication between different networks.

A Layer 4 firewall inspects traffic at the Transport layer (TCP/UDP), controlling connections based on port numbers and protocols.

A Layer 4 load balancer distributes traffic across multiple servers based on port numbers and protocols, ensuring even workload distribution.

TLS inspection examines the content of encrypted traffic (TLS/SSL) to identify potential threats, providing enhanced security.

A Layer 7 load balancer can inspect the content of application traffic (like HTTP requests), enabling advanced load balancing and security features.

A load balancer distributes traffic across multiple servers to ensure even workload distribution, improve performance, and increase availability.

SSL offload refers to the process of handling SSL/TLS encryption and decryption on a separate device, reducing CPU load on the application servers.

Refer to the VMware configmax website (https://configmax.vmware.com) for detailed information on NSX Edge form factors and their capabilities.

The hostname is used to identify your NSX Manager appliance on the network. It must be valid and unique, and does not contain special characters like underscores or periods.

VMware Tools is software installed on the NSX Manager virtual machine (VM) running on ESXi. It enhances performance and integration with the host environment.

These are the minimum specifications your system must meet before installing NSX Manager. This includes things like CPU, RAM, disk space, and supported operating systems.

NSX Manager needs to communicate with other components and services. Making sure the required ports and protocols are open enables the necessary communication.

The maximum network latency allowed between NSX Managers in a cluster is 10ms. This ensures efficient communication and smooth operation of the cluster.

The maximum network latency permitted between an NSX Manager and its Transport Nodes is 150ms. This latency ensures reliable communication and control of the virtual network.

The maximum disk access latency for NSX Managers should be under 10ms. This is crucial for fast and responsive operation of the NSX Manager to handle network management tasks.

NSX Managers are recommended to be placed on shared storage that is highly available. This prevents a storage outage from causing all NSX Manager file systems to become read-only, ensuring uninterrupted operation.

NSX Edge VMs are only supported on ESXi hosts with Intel or AMD chipsets. If vSphere EVC mode is enabled, the CPU must be Haswell generation or newer.

Only VMXNET3 vNICs are supported for NSX Edge VMs. This virtual network interface is designed for high performance in VMware environments.

There are various NSX Edge VM sizes, each with different resource requirements. The 'Small' size is recommended for proof-of-concept deployments.

NSX-T Data Center supports specific versions of CentOS, RHEL, Oracle Linux, SUSE Linux Enterprise Server, Ubuntu, and Windows Server for bare metal deployments.

For NSX-T Data Center installation on a bare metal server, all supported operating systems require at least 4 CPU cores.

The minimum RAM requirement for installing NSX-T Data Center on bare metal is 16 GB for all supported operating systems.

To verify jumbo packet support on a physical NIC, use the Windows PowerShell command: $ (Get-NetAdapterAdvancedProperty -Name "<NIC Name>").DisplayName -Contains "Jumbo Packet"

The password for your NSX-T Data Center appliance must meet several complexity criteria, including a minimum length of 12 characters, at least one lowercase letter, one uppercase letter, one digit, one special character, and at least five different characters. These rules help secure your environment and protect against unauthorized access.

The password complexity rules ensure that passwords are strong and secure. These rules are enforced by the Linux PAM module and include requirements for length, character variety, and uniqueness.

The password must have at least 12 characters, one lowercase letter, one uppercase letter, one digit, one special character, and at least five different characters.

The 'retry' argument limits the number of times a user can attempt to enter a new password before being locked out. This helps protect against brute force attacks.

The 'minlen' argument defines the minimum acceptable length for a new password. The password length is further increased by credit given for different types of characters like lowercase, uppercase, digits, and special characters.

The 'difok' argument specifies the minimum difference required between the old and new passwords. A value of '0' allows the new password to be identical to the old password, which can be risky.

These arguments represent the credit given for using lowercase letters, uppercase letters, and digits respectively in a password. Additional credit is given for each unique lowercase, uppercase, and digit character, making passwords stronger.

The 'minlen' value, representing the minimum password length, is influenced by the number of different character types used in the password. Each unique lowercase letter, uppercase letter, digit, and special character contributes to a longer minimum password length.

Strong passwords are essential for protecting your NSX-T Data Center environment from unauthorized access. They help prevent sensitive data from being compromised and maintain the integrity and security of your network infrastructure.

The 'retry' argument limits the number of times a user can attempt to enter a new password. This limitation discourages brute-force attacks, where hackers try to guess passwords by systematically attempting combinations.

Used for managing NSX-T Data Center resources in a declarative way, focusing on high-level configurations like network policies and security groups. It's the recommended mode for new deployments and NSX Federation.

Offers fine-grained, low-level control over NSX-T Data Center objects, including advanced networking and security configurations. It's useful for specific features not available in Policy Mode or for managing legacy environments.

Policy Mode is generally the preferred choice for new deployments, NSX Federation, and everyday management. It simplifies configuration and provides a consistent approach. Some features aren't available in Policy Mode, requiring Manager Mode for specific tasks.

Use Manager Mode when you require features not available in Policy Mode, when managing legacy environments from earlier NSX-T versions, or when transitioning to Policy Mode from Manager Mode.

You can easily switch between Policy and Manager Mode using dedicated buttons in the NSX Manager interface. The available menu options change depending on the selected mode.

It's crucial to be consistent with the chosen mode for managing your NSX-T Data Center environment. Creating objects in one mode and then attempting to manage them in another can lead to conflicts and issues.

Changes made in Manager Mode on objects like Edge nodes, Edge clusters, and transport zones may take up to 5 minutes to reflect in Policy Mode. You can force an immediate synchronization using a specific API command.

A network object in Policy mode that represents a logical switch.

In Policy mode, it is a virtual router that connects different Segments and provides routing capabilities.

In Policy mode, it provides outbound connectivity to the external world and acts as a firewall.

In Policy mode, it defines security rules for network traffic, similar to firewall sections in traditional firewalls.

In Policy mode, it acts as a firewall for communication between NSX-T and the external world.

The API that allows you to manage NSX-T objects and configurations in Policy mode.

The API used to manage NSX-T objects and configurations in Manager mode.

A larger NSX Edge form factor designed for demanding workloads, offering 64GB of RAM and 200GB of storage. It's suitable for features like L7 load balancing, VPN, TLS inspection, L7 access profiles, and IDS/IPS.

To use DPDK (Data Plane Development Kit) for accelerated network processing, the underlying platform needs to meet specific requirements. These include support for AESNI (Advanced Encryption Standard New Instructions) and 1GB Huge Pages on the CPU.

NSX Edge VMs must run on ESXi hosts with Intel or AMD chipsets. If vSphere EVC mode is enabled, the CPU must be Haswell generation or newer.

An NSX Edge virtual machine with 8 GB of RAM, 4 vCPUs, and 200 GB of disk space. It's suitable for L2 through L4 features with a throughput of less than 2 Gbps.

An NSX Edge virtual machine with 16 GB of RAM, 4 vCPUs, and 200 GB of disk space. Offers L2 through L4 features with a throughput of up to 10 Gbps.

An NSX Edge virtual machine with 32 GB of RAM, 8 vCPUs, and 200 GB of disk space. Designed for handling high throughput (2 to 10 Gbps) for demanding L2 through L4 workloads.

NSX Edge provides features like Network Address Translation (NAT), Routing, Layer 4 (L4) firewall, and L4 load balancer. These enable advanced network control and security.

L4 load balancing distributes traffic based on port numbers and protocols (like TCP/UDP), while L7 considers application-specific information like HTTP headers for more granular control.

TLS inspection examines the content of encrypted traffic (TLS/SSL) to identify potential threats. It increases security by looking 'inside' encrypted connections.

The 'retry' argument in the Linux PAM module limits the number of times a user can attempt to enter a new password before being locked out. This helps prevent brute-force attacks.

The 'minlen' argument sets the minimum password length, while 'difok' determines the minimum difference required between the old and new password. Both contribute to password strength.

These arguments give credit for using lowercase letters, uppercase letters, and digits respectively, in a password. The more unique characters of each type, the stronger the password.

The 'minlen' value, representing the minimum password length, is influenced by the number of different character types used in the password. More unique lowercase letters, uppercase letters, digits, and special characters result in a longer minimum password length.

A physical or virtual server that connects to the NSX-T Data Center control plane and hosts virtual machines. It allows you to manage and secure network traffic for VMs running on that host.

Configuring a network interface on the bare metal server that allows workloads to access the NSX-T Data Center network.

A group of interconnected NSX-T Managers providing high availability and load balancing for efficient network management.

The central component of NSX-T Data Center that manages and orchestrates the network, including routing, security, and traffic flow.

Responsible for managing and configuring NSX-T Data Center components, including the control plane and hosts.

Digital certificates used to authenticate and secure communication between NSX Edges and other network elements. They ensure that only authorized devices can access the network.

A logical grouping of hypervisors and logical switches in NSX-T Data Center, providing connectivity for virtual machines (VMs) on those hypervisors. It's registered with the NSX-T management plane.

A physical or virtual host in NSX-T Data Center that participates in the overlay network, providing connectivity for VMs. It can be a KVM host, ESXi host, or NSX Edge.

Defines policies for connections between transport nodes and NSX-T Data Center segments or NSX Edge nodes and physical switches. It controls traffic flow between layers.

A software component on each transport node responsible for encapsulating overlay VM traffic within a VLAN header for routing to other destinations. It's the address used for communication among hosts.

The centralized management and control center for NSX-T Data Center. It provides a web-based user interface for managing your NSX-T environment and hosts the API server.

Policy Mode offers high-level, declarative management for simplifying configurations, while Manager Mode provides fine-grained, low-level control over NSX-T objects, useful for managing legacy environments or specific features.

There are Tier-0 and Tier-1 gateways. Tier-0 provides external connectivity, while Tier-1 connects different Segments within the NSX-T Data Center.

A comprehensive software-defined networking (SDN) and security platform from VMware that allows you to virtualize and automate your network infrastructure. It provides features for network segmentation, micro-segmentation, load balancing, firewalling, and more.

A fundamental concept in NSX-T that groups together physical and virtual network infrastructure into a logical unit for management. You can define different networking policies and settings within a Transport Zone.

Virtual appliances that provide advanced networking and security features like firewalling, routing, load balancing, and VPN. They act as gateways and security enforcement points for your virtual network.

A physical or virtual host that connects to the NSX-T management plane and becomes part of the virtualized network. Transport Nodes can include ESXi hosts, KVM hosts, bare metal servers, and more.

Configuration templates that automate the provisioning and configuration of ESXi hosts. Host Profiles can ensure consistent network settings, security policies, and other configurations across your environment.

Two different ways to manage NSX-T Data Center. Policy Mode focuses on high-level configuration via policies, while Manager Mode offers fine-grained control over individual objects.

Allows you to create a hierarchical network management structure with a global manager and local managers. This enables centralized control of multiple NSX-T deployments across different sites.

The size of the NSX Manager virtual machine determines its resource allocation, affecting performance and scalability. Options include Extra Small, Small, Medium, and Large. Smallest size suitable for small deployments.

The size of the NSX Manager appliance determines its resource configuration, affecting performance and scalability. Options include Extra Small, Small, Medium, and Large, each with specific resource requirements.

A tool that helps identify compatible network cards and devices for NSX-T Data Center deployments. Users filter by I/O Device Type, Features, and driver versions.

Network cards, also known as NICs are essential for network connectivity. They must be compatible with NSX-T Data Center and meet specific criteria for features and drivers.

A network encapsulation technology that allows different network protocols to communicate across a single network. Used for flexibility and security.

An optimized network path on NSX-T Data Center that improves performance and reduces latency. Network cards supporting this feature accelerate network traffic.

The maximum permissible network latency between various NSX Manager components, including the Manager cluster, Transport Nodes, and storage. Ensures efficient communication and smooth operation.

NSX Manager requires storage for its configuration and data files. Shared, highly available storage is recommended for uninterrupted operation.

For NSX Edge versions 3.2 to 3.2.3, check the Ubuntu server certification website for compatible hardware models. Starting with NSX-T 3.2, both UEFI and legacy BIOS modes are supported. Earlier versions only supported legacy BIOS.

The password for your NSX-T Data Center appliance needs to meet several complexity criteria including a minimum length of 12 characters, at least one lowercase letter, one uppercase letter, one digit, and one special character. These rules are enforced by the Linux PAM module.

Policy mode provides high-level management for NSX-T Data Center, focusing on declarative configurations - like network policies and security groups. It's the recommended choice for new deployments and NSX Federation.

Manager mode offers fine-grained, low-level control over NSX-T Data Center configurations, including advanced networking and security settings. It's useful for transitioning from older versions, handling legacy environments, or using features unavailable in Policy Mode.

In Policy mode, a Segment represents a logical switch. It's a virtual network that connects virtual machines and provides network services.

In Policy mode, a Tier-0 Gateway provides outbound connectivity to the external world and acts as a firewall for your entire NSX-T deployment.

NSX Edge VMs are available in various sizes: Small (8GB RAM, 200GB storage), Medium (16GB, 200GB), Large (32GB, 200GB), and Extra Large (64GB, 200GB). Choose based on your workload demands.