VCP-NV flashcards
VCP-NV · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- NSX Manager cluster size
- Production high availability requires three NSX Manager nodes forming a cluster behind a single VIP; a single node is supported only for lab and evaluation deployments.
- GENEVE encapsulation port
- NSX overlay traffic is encapsulated in GENEVE, which uses UDP destination port 6081. The physical underlay must permit this between all transport nodes.
- Overlay transport zone
- Defines the span of GENEVE-backed segments. Hosts and edges in the same overlay transport zone can participate in the same logical switches.
- Host transport node
- An ESXi host prepared with NSX kernel modules and a hostswitch, providing the distributed data plane for segments and the distributed firewall.
- Edge transport node
- A VM or bare-metal appliance in an edge cluster that provides centralized services such as Tier-0 routing, NAT, load balancing, and VPN.
- Uplink profile
- A reusable object specifying teaming policy, active and standby uplinks, transport VLAN, and MTU applied to hostswitch uplinks on transport nodes.
- Tier-1 distributed router
- The downlink of a Tier-1 gateway is realized as a distributed router on every host, so routing between segments on one host stays local.
- Transport node profile
- Applied to a vSphere cluster to configure the same hostswitch (N-VDS or VDS 7.0) and uplink settings on all member ESXi hosts.
- Edge node sizes
- Small, Medium, Large, and X-Large, selected by throughput and feature needs; the size is fixed at deployment and changing it requires redeployment.
- Compute manager registration
- vCenter is registered to NSX Manager with credentials so NSX can inventory hosts and VMs and deploy Edge appliances into the compute environment.
- TEP IP pool
- A range of IP addresses assigned to tunnel endpoints on host and Edge transport nodes, used as the source for GENEVE overlay traffic.
- NSX Manager backup
- Configuration backups are sent to an FTP or SFTP server; restore requires an NSX Manager of the same or a compatible software version.
- Upgrade start point
- Upgrades begin with the NSX Manager cluster, which must be fully upgraded before host transport nodes or Edge nodes are upgraded.
- Segment definition
- A logical switch backed by GENEVE that VMs attach to; it lives in an overlay transport zone and is independent of physical VLANs.
- Tier-0 gateway role
- Provides north-south connectivity between the NSX domain and the physical network through the service routers of an attached edge cluster.
- Tier-1 service router
- Instantiated on the Edge only when a Tier-1 gateway has centralized services configured, such as NAT, load balancing, or gateway firewall.
- Route advertisement
- A Tier-1 advertises connected segments, static routes, NAT IPs, and load balancer VIPs up to its Tier-0 unless selectively disabled.
- ECMP requirement
- Equal-cost multipath on a Tier-0 gateway requires multiple Edge nodes in the edge cluster with equal-cost paths to upstream physical routers.
- VLAN-backed segment
- Maps a segment to a specific VLAN on the transport VLAN, used to connect workloads to physical networks without GENEVE encapsulation.
- ARP suppression
- The transport node answers ARP requests for known IP-to-MAC bindings on an overlay segment, reducing broadcast flooding across the network.
- Distributed firewall point
- DFW rules are enforced at the VM vNIC in the hypervisor kernel, so east-west traffic is filtered without leaving the host.
- DFW rule categories
- Evaluation order is Ethernet, Emergency, Infrastructure, Environment, Application; rules within a category are evaluated top-down with first match winning.
- Gateway firewall
- Enforced on the Edge service router, it filters north-south traffic and supports L7 features such as URL filtering and TLS inspection.
- Security group membership
- Groups can be static or dynamic, based on NSX tags, VM names, segments, or IP addresses, and their membership determines which firewall rules apply.
- Spoof Guard
- Blocks a VM from sending traffic with a source IP or MAC address different from the binding learned by IP discovery for that vNIC.
- Identity firewall
- Uses Active Directory user and group identity so distributed firewall rules can be enforced based on who is logged in to the workload.
- Traceflow
- Injects a synthetic packet with specified headers to trace its path across hosts and edges and show where a rule drops it.
- Port connection tool
- Shows the segment or switch port a VM vNIC is attached to and whether that attachment is currently up or down.
- nsxcli on ESXi
- The command-line interface available on a prepared ESXi host, used for commands such as get logical-switches and get tunnel-ports.
- Edge BFD
- Bidirectional forwarding detection between Edge nodes and Tier-0 peers detects peer failure quickly and triggers failover of centralized services.
- MTU verification
- Use ping with the DF bit and a 1572-byte payload to verify a 1600-byte path; fragmentation errors indicate an underlay MTU mismatch.
- Support bundle
- Collected from the NSX Manager UI or CLI for all nodes, it packages logs and configuration for analysis by VMware support.