VCP-NV cheat sheet

NSX Manager is the management plane: it hosts the UI and REST API and, since NSX-T 2.5, also the control plane (controller functions are embedded, with no separate controller VMs).

A production NSX Manager cluster uses three appliance nodes behind a single VIP; one node is supported only for lab or evaluation use.

Host transport nodes are ESXi hosts prepared with NSX kernel modules and a hostswitch (N-VDS or VDS 7.0); they carry the distributed data plane for segments and the distributed firewall.

Edge transport nodes are VMs or bare-metal appliances grouped in an edge cluster and provide centralized services: Tier-0 routing, NAT, DHCP, load balancing, VPN, and gateway firewall.

An overlay transport zone defines the span of GENEVE-backed segments; a VLAN transport zone carries VLAN-backed segments. A hostswitch can belong to only one overlay transport zone.

GENEVE encapsulation uses UDP destination port 6081; the outer headers add roughly 50 bytes for IPv4, so the underlay MTU should be at least 1600 (or jumbo frames).

Uplink profiles define teaming policy, active/standby uplinks, transport VLAN, and MTU for hostswitch uplinks; segment profiles bundle switching (MAC, MTU), IP discovery, spoof guard, and QoS settings.

Tier-0 is the north-south gateway whose service router runs on the Edge; Tier-1 is a tenant gateway whose downlink router is distributed on every host.

Deploy NSX Manager from the OVA, set management IP, DNS (A and PTR records), and NTP on each node, then form the three-node cluster behind the VIP.

Register the compute manager (vCenter) with NSX Manager using vCenter credentials; a given compute manager can be registered to only one NSX Manager cluster.

Host preparation installs the NSX VIBs on ESXi and requires a reboot; hostswitch and uplink configuration is then applied by a transport node profile at the vSphere cluster level.

Edge node sizes are Small, Medium, Large, and X-Large; sizing is fixed at deployment, and an edge cluster holds multiple Edge nodes for HA and ECMP.

IP pools supply tunnel endpoint (TEP) addresses to host and Edge transport nodes; overlay and VLAN traffic can use separate TEP pools.

NSX Manager backups are sent to an FTP/SFTP server and can be restored only onto an NSX Manager of the same or a compatible version.

Upgrades start with the NSX Manager cluster, which must be fully upgraded before host transport nodes and Edge nodes are upgraded.

Every NSX node needs forward and reverse DNS resolution and synchronized time, and the cluster VIP must resolve for API and UI access.

A segment is a logical switch backed by GENEVE; overlay segments require an overlay transport zone attached to the hostswitch of every participating host.

Tier-0 gateway attaches to an edge cluster, owns the north-south service router, and supports BGP, OSPF, static routes, and ECMP toward the physical network.

Tier-1 gateway attaches to a Tier-0; its downlink is a distributed router present on each host, keeping east-west routing local to the hypervisor.

A Tier-1 service router is instantiated on the Edge only when centralized services (NAT, load balancing, gateway firewall, VPN) are configured on that Tier-1.

Tier-1 route advertisement toward Tier-0 covers connected segments and service ports, static routes, NAT IPs, LB VIPs, and IPSec local endpoints.

ECMP on a Tier-0 requires multiple Edge nodes in the edge cluster with equal-cost paths to the upstream physical routers.

VLAN-backed segments map a segment to a VLAN ID on the transport VLAN and are used to reach physical networks or to bridge overlay and VLAN domains.

ARP suppression and IP discovery limit broadcast flooding on overlay segments by answering ARP for known IP-to-MAC bindings.

GENEVE adds about 50 bytes of IPv4 overhead; an underlay MTU below 1600 drops large frames unless the MTU is raised on the physical path.

The distributed firewall enforces rules at the VM vNIC inside the hypervisor kernel, so east-west traffic is filtered without leaving the host.

The gateway firewall is enforced on the Edge service router and controls north-south traffic; L7 features such as URL filtering and TLS inspection require it.

DFW rule categories evaluate in a fixed order: Ethernet, Emergency, Infrastructure, Environment, Application, followed by the default rule.

Firewall rules are stateful and evaluated top-down; the first match wins, and the default rule can be set to allow or drop.

Groups can be static or dynamic; dynamic membership is driven by NSX tags, VM names, segments, or IP addresses, and groups are the match criteria in rules.

Spoof Guard and IP/MAC discovery prevent a VM from sending traffic with a source address different from the one learned for its vNIC.

Identity firewall uses Active Directory user and group identity so DFW rules can be based on who is logged in to the workload.

Distributed IDS/IPS and malware prevention run at the host level, and NSX Intelligence provides flow-based analysis of east-west traffic.

Traceflow injects a synthetic packet with chosen headers and reports each hop across hosts and edges, showing where a firewall or routing rule drops it.

The port connection tool shows which segment or switch port a VM vNIC is attached to and whether the attachment is up.

Packet capture can target a segment, a VM vNIC, or an Edge interface to confirm whether traffic arrives and leaves a node.

NSX Manager uses a get/set/del CLI syntax; a prepared ESXi host uses nsxcli for commands such as get logical-switches and get tunnel-ports.

Tunnel health is checked with tunnel-port and hostswitch status output; BFD between Edge nodes and Tier-0 peers detects failure and triggers failover.

Alarms appear in NSX Manager per node and per entity; syslog servers are configured per node to export logs centrally.

Support bundles for all nodes can be generated from the NSX Manager UI or CLI for log and configuration collection.

A 1600-byte path is verified with ping using the DF bit and a 1572-byte payload; fragmentation errors indicate an underlay MTU mismatch.