VCP-NV key terms

The centralized management-plane appliance for NSX, deployed as an OVA and integrated with vCenter. It hosts the web UI and REST API, stores configuration in its internal database, and pushes desired state out to controllers and hosts.

A set of three NSX Controller nodes that form the control plane. They learn the location of VMs and hosts, compute VTEP and MAC tables, and distribute that information so hosts can forward overlay traffic without flooding.

A configuration object that defines the scope of a VXLAN network: which hosts and clusters may participate in logical switches, and which replication mode is used for broadcast, unknown unicast, and multicast traffic.

Virtual Tunnel Endpoint. A per-hypervisor tunnel interface, configured on a VMkernel adapter, that encapsulates and decapsulates VXLAN frames on behalf of the virtual machines running on that host.

A Layer 2 overlay technology that encapsulates original Ethernet frames inside UDP/IP packets, letting a virtual network segment span hosts and subnets across an existing Layer 3 network.

A virtual appliance that provides north-south services at the perimeter of a logical network, including routing, NAT, firewall, load balancing, and VPN termination.

The method used to replicate broadcast, unknown unicast, and multicast (BUM) traffic across a transport zone - multicast, unicast, or hybrid - which determines how VTEPs learn about and forward those frames.

The process of installing NSX kernel modules (VIBs) on the ESXi hosts in a cluster and configuring VXLAN networking, which makes the cluster capable of running logical switches and the distributed firewall.

A deployment where a primary NSX Manager, one or more secondary managers, and standalone managers share universal objects, enabling stretched logical networks and consistent security policy across multiple vCenter Server instances.

Configuration items - such as universal logical switches, universal logical routers, and universal distributed firewall rules - created on the primary NSX Manager and replicated to secondary NSX Managers in a cross-vCenter deployment.

A feature that assigns roles - such as enterprise administrator, NSX administrator, security administrator, and auditor - to users and groups, limiting what each account can view or change in the environment.

A scheduled or on-demand backup of NSX Manager configuration and controller cluster data, written to an FTP or SFTP server, used to restore the management plane after failure or corruption.

The supported sequence for upgrading an NSX-V environment: NSX Manager first, then the controller cluster, then host clusters, and finally Edge and Guest Introspection components.

A virtual Layer 2 segment, backed by VXLAN, that virtual machines connect to through distributed port groups and that behaves like a physical switch without VLAN scale constraints.

A 24-bit identifier carried in the VXLAN header that distinguishes one logical switch from another, allowing roughly 16 million isolated overlay segments on the same transport network.

A logical router whose routing and firewall functions run in the ESXi kernel on every host, providing optimized east-west routing, plus a control VM that handles routing protocols and ARP.

The virtual appliance paired with a distributed logical router that runs dynamic routing protocols such as OSPF and BGP, answers ARP for router interfaces, and programs routes into the hosts' distributed routing tables.

A logical switch that connects a distributed logical router's uplink to an Edge Services Gateway, carrying traffic that must leave the logical network for physical or north-south routing.

Equal-cost multipath. An Edge or logical router feature that spreads traffic across multiple equal-cost uplinks or next hops, increasing throughput and redundancy for north-south traffic.

An interior gateway routing protocol supported on NSX Edge and the DLR control VM that exchanges link-state information with physical routers so logical networks can be advertised dynamically.

A control-plane optimization in which NSX Controllers answer ARP requests on behalf of virtual machines, reducing broadcast flooding and ARP traffic across VXLAN segments.

An NSX feature, configured on a distributed logical router, that connects a VXLAN-backed logical switch to a VLAN-backed network so devices on both segments appear to sit in the same Layer 2 domain.

A stateful firewall enforced in the ESXi kernel at each virtual machine's NIC, filtering east-west traffic between VMs on the same host or across hosts without hairpinning through an appliance.

A dynamic collection of virtual machines, defined by membership criteria such as VM name, tags, or security tags, that lets firewall rules and policies be written independently of individual VM identities.

A label assigned to a virtual machine, often through the vSphere interface or automation, used as membership criteria for security groups and as a match condition in distributed firewall rules.

An NSX feature for grouping security groups, firewall rules, and partner services into security policies, which can then be applied to VMs, clusters, or logical switches from a single canvas.

A distributed firewall capability that identifies users through Active Directory logon events gathered by Guest Introspection, allowing rules to be written based on user or group identity rather than only IP or VM.

A framework using a thin agent in the guest OS and a per-host introspection module that reports VM context, such as processes and file events, to third-party security virtual machines for filtering.

A security feature that inspects the source MAC and IP addresses in packets leaving a virtual machine's NIC and blocks traffic that does not match the addresses approved for that VM.

A site-to-site VPN feature of the Edge Services Gateway that encrypts traffic between an NSX environment and a remote site or another Edge over the internet or other untrusted networks.

A client-based remote-access VPN on the Edge Services Gateway that lets remote users connect through a browser or VPN client and reach internal networks over an encrypted TLS tunnel.

A feature of Edge Services Gateways that extends a logical switch or VLAN between two sites over an encrypted tunnel, letting stretched Layer 2 subnets span data centers.

An NSX feature that collects and reports per-VM traffic flows - source, destination, port, protocol, and whether traffic was allowed or blocked - from the distributed firewall for auditing and analysis.

A diagnostic feature that copies traffic from a virtual machine's NIC, a logical switch, or a distributed port group to a destination port where a packet analyzer can capture and inspect it.

A command-line facility provided by NSX Manager that lets administrators query the status of controllers, edges, logical switches, and clusters with show commands from one central location.

A standard logging protocol that NSX components - Manager, controllers, edges, and hosts - use to forward events and audit records to a remote log server for retention and analysis.