What is VMware NSX?

VMware NSX is a network virtualization and security platform that lets IT teams build, run, and secure networks in software instead of wiring them together with physical switches, routers, and firewalls. 

It grew out of VMware’s vCloud Networking and Security product and Nicira’s Network Virtualization Platform, and now it functions as the networking layer inside VMware Cloud Foundation (VCF).

In this article, you’ll learn what NSX is made of, how it works, how it differs from wiring a network by hand, and where it fits in VMware’s current product lineup.

What Is Network Virtualization?

Network virtualization is the process of combining physical hardware and software network resources into a one software-based virtual network. It separates networking functions, such as switching, routing, and firewalling, from the physical hardware that traditionally performed them, so those functions run as software instead. 

Just as a hypervisor lets multiple virtual machines share one physical server, network virtualization lets multiple isolated virtual networks share the same physical switches and routers underneath. The physical network still exists and still carries traffic, but it becomes a simple transport layer. 

For example, a hospital might run patient records, billing, and guest Wi-Fi on the same physical switches. With network virtualization, each of these can get its own separate virtual network, with its own routing and firewall rules, without adding new cables or new switches. If a new department needs its own separate network next quarter, an administrator can set it up through software, not by ordering new hardware.

How Does VMware NSX Work?

VMware NSX works by wrapping network traffic inside a protocol that physical network hardware already understands, most commonly VXLAN (Virtual Extensible LAN), and then using software to manage how that traffic is switched, routed, and filtered. The physical network sees standard IP packets moving between hosts. NSX is the virtualization platform that decides, in software, what those packets represent and where they are allowed to go.

NSX splits this work across three planes, a structure that is also common in traditional networking hardware, implemented differently here:

• Management plane: NSX Manager is where administrators and automation tools define policy: which logical networks exist, which firewall rules apply, and which workloads belong where.
• Control plane: The NSX Controller Cluster distributes that policy information to the hosts that need it and keeps the state of the virtual network consistent as workloads move or scale.
• Data plane: The NSX Virtual Switch and NSX Edge actually forward, route, and filter traffic based on the policy the control plane has pushed down to them.

Because that logic  is enforced through software-defined networking (SDN) rather than in fixed hardware configurations, NSX exposes its functionality through APIs. That matters for two reasons: 

• automation tools and infrastructure-as-code pipelines can provision or change a network the same way they provision a virtual machine
• NSX can be driven directly by orchestration and CI/CD tooling instead of requiring a person to log into a device console.

Example: When a DevOps team spins up a new three-tier application, a network administrator does not need to manually configure a VLAN, a router, and a firewall rule set for it. Instead, an automation script calls the NSX API to create a logical switch for each tier, a distributed router between them, and a firewall policy that only allows the web tier to talk to the application tier. The entire network is provisioned in the time it takes the virtual machines to boot.

Where Did VMware NSX Come From?

VMware NSX traces back to Nicira, a network virtualization startup founded in 2007 that built one of the first software-based platforms for decoupling network services from physical hardware. VMware acquired Nicira in 2012 for approximately $1.26 billion, combining Nicira’s Network Virtualization Platform with VMware’s own vCloud Networking and Security product. That combination became VMware NSX, which launched in 2013.

Over the following years, VMware maintained two NSX product lines before consolidating around NSX-T (the “transport” architecture), which was built to support multiple hypervisors, containers, and cloud-native workloads rather than being tied exclusively to vSphere. Today, “NSX” typically refers to that NSX-T lineage, now simply branded VMware NSX.

What Are the Core Components of VMware NSX?

VMware NSX is made up of four core components, each responsible for a different function within the platform: management, control, or data forwarding.

How Does VMware NSX Compare to Traditional Networking?

The core difference is where configuration is managed: traditional networking configures individual physical devices one at a time, while NSX configures policy centrally and pushes it out to software running on every host.

For example, moving a VM to a new rack in a traditional network can mean new firewall rules and routing changes. In NSX, the VM’s network and firewall policy travel with it, so nothing changes.

What Are the Key Features of VMware NSX?

VMware NSX provides the networking and security services that a physical network would otherwise deliver through dedicated hardware, instead implemented as software services running across the hypervisor layer.

• Logical switching and distributed routing: NSX creates Layer 2 logical networks that isolate workloads across the environment, and a distributed logical router (DLR) handles Layer 3 routing between them. The virtual distributed switch uses VXLAN to tunnel traffic between ESXi hosts across the underlying Layer 3 physical fabric, so logical networks are not constrained by physical subnet boundaries.
• Load balancing: NSX distributes incoming traffic across backend servers so that no single server absorbs a disproportionate share of requests during traffic spikes.
• VPN, distributed firewall, and gateway firewall: NSX supports Layer 2 and Layer 3 VPN tunnels between NSX Edge devices across data centers. The distributed firewall filters traffic between workloads at the host level, while the gateway firewall filters traffic at the network boundary, giving teams both microsegmentation and perimeter protection from the same platform.
• Network function virtualization (NFV): NSX replaces purpose-built network appliances with virtual machines that run the same functions on standard servers, which is generally less expensive than purchasing dedicated hardware for each function.
• Container and Kubernetes networking: NSX extends logical switching, routing, and firewall policy to Kubernetes pods and namespaces, so containerized workloads get the same network segmentation and security controls as virtual machines, managed from the same policy layer.

What Is VMware NSX’s Relationship to VMware Cloud Foundation and vDefend?

VMware NSX is included as the built-in networking component of VMware Cloud Foundation (VCF); it is no longer sold as a fully separate product line the way it was before Broadcom acquired VMware. Teams that want NSX outside of VCF can still buy it as a standalone subscription, now licensed on a per-core basis.

Security capabilities that used to be bundled directly into NSX, such as distributed firewalling, gateway firewalling, and advanced threat prevention, are now licensed separately under VMware vDefend. NSX Manager still handles vDefend’s license activation and policy configuration, so day-to-day operations stay unified even though the products are sold separately.

This matters for anyone comparing quotes or reading older documentation: an NSX quote that does not mention vDefend may not include the firewall and threat-prevention capabilities that used to be included with NSX by default.

What Are the Benefits of VMware NSX for Enterprises?

VMware NSX provides enterprises with advanced network virtualization, security, and automation capabilities. Its key advantages include enforcing zero-trust security through micro-segmentation, automating network provisioning so deployments take minutes instead of weeks, and applying consistent networking and security policies across on-premises infrastructure and multiple public clouds.

Moreover, VMware NSX integrates with third-party networking vendors, including Arista Networks, Dell EMC Open Networking, and Juniper Networks, which lets organizations adopt it without replacing their existing physical network hardware. Beyond these compatibilities, the benefits break down into four areas.

Enhanced Network Security

NSX supports microsegmentation, which divides a data center into small, isolated segments so that a compromised workload cannot move laterally to reach other systems. Combined with vDefend’s distributed and gateway firewalling, IDS/IPS, and network detection and response capabilities, this limits how far ransomware or other intrusions can spread before they are contained. 

NSX also synchronizes configuration and operational state across sites, so security policy stays consistent whether a workload is running in a primary data center or a secondary one.

A common enterprise use case is environment isolation: a single physical infrastructure can host development, test, and production environments as fully isolated virtual networks, each with its own firewall policy, preventing a misconfigured test workload from ever reaching production systems.

Scalability, Multi-Tenancy, and Business Continuity

NSX’s virtual private cloud (VPC) capabilities let organizations scale network capacity and enforce isolation as new workloads or business units come online, without redesigning the physical network each time. 

This supports multi-tenant infrastructure, where a managed service provider or a large enterprise IT team needs to keep multiple business units or customers logically separated on shared hardware. It also supports rapid provisioning, such as onboarding a newly acquired business unit onto existing infrastructure without a lengthy network redesign. 

Because logical networks and policies are not tied to specific physical hardware, NSX also supports business continuity: if a primary site experiences an outage, workloads and their associated network and security policy can be brought up at a secondary site without manually rebuilding firewall rules and routing tables from scratch.

Streamlined, Multi-Cloud Data Center Design

NSX removes the dependency on physical equipment for network changes, which lets teams design and modify data center networks based on business requirements rather than hardware lead times. 

NSX also supports common multi-cloud use cases such as data center extension and multi-data-center pooling, and its consistent policy model means the same firewall rules and network segments can be enforced whether a workload runs in a private data center, a hosted private cloud, or across multiple clouds. 

That consistency is what lets a hybrid or multi-cloud environment behave like one governed network instead of several disconnected ones.

Improved Speed and Agility

NSX automates the deployment of network resources, which reduces the time it takes to stand up networking infrastructure for a new virtual environment from days to minutes. 

Because NSX can deploy across public clouds, private clouds, physical servers, and container platforms, and because its functionality is exposed through APIs, it fits directly into infrastructure-as-code pipelines: a Terraform or Ansible playbook that provisions a new application stack can create its network and firewall policy as part of the same automated deployment, instead of waiting on a separate networking ticket.

How Do Organizations Use VMware NSX?

Organizations use VMware NSX to virtualize networking and security services, allowing them to automate network deployment, enforce microsegmentation, and support workload mobility across private and multi-cloud environments. By decoupling network services from the underlying hardware, NSX delivers routing, switching, and firewall functionality entirely in software.

Different industries rely on NSX for different combinations of the capabilities described above, but a few patterns show up consistently across enterprise deployments.

• Media and Entertainment: Streaming and content delivery platforms use NSX to maintain performance and security as viewership spikes during live events. Because NSX’s load balancing and network scaling are handled in software, capacity can expand for a traffic spike without a hardware procurement cycle.
• Financial Services: Financial institutions, including Deutsche Bank, use NSX to build infrastructure that supports rapid scaling and integration while maintaining the compliance posture regulators require. Microsegmentation is particularly relevant here, since it lets a bank isolate systems handling different types of financial data on the same physical infrastructure.
• Healthcare: Electronic medical record (EMR) providers such as Epic rely on NSX to handle sensitive patient data securely. Environment isolation supports separating patient-facing systems from internal administrative systems without duplicating hardware.

Is VMware NSX Worth Investing In?

VMware NSX is worth investing in depending on your organization’s scale, budget, and need for advanced automation, micro-segmentation, and multi-cloud management. 

VMware NSX is worth looking at if your network has grown too big or too complex to manage device by device, especially if you already use VMware or plan to use VMware Cloud Foundation. Its switching, routing, load balancing, and virtualization features cut down the manual work of running a growing network, and since it works through APIs, it fits well into automated setups.

The main thing to look for is cost. NSX networking and vDefend security are now billed separately, so you need to check both, not just the base NSX price. If you already use VCF, NSX networking is included, which can lower the total cost compared to buying NSX on its own.

See NSX Performance in the Context of Your Full Environment

Virtualizing your network with NSX changes how the network is configured, but it does not remove the need to monitor it. LogicMonitor gives IT teams visibility into NSX-virtualized environments alongside the rest of their infrastructure, cloud, and application stack, so a routing or firewall policy change in NSX can be correlated with the application and infrastructure signals it affects, in the same platform.

Explore LogicMonitor’s resources on hybrid infrastructure monitoring, or see how the 2024 G2 Network Monitoring Grid Report ranks the current network monitoring landscape.