Management Domain Edge Placement and Rack HA
A customer runs VCF 5.0 with a four-host management domain. Each host has two 25 GbE NICs, 768 GB RAM, and 15 TB vSAN capacity. They need a new workload domain for a latency-sensitive trading application: six hosts, NSX overlay segments, and a hard requirement that no single rack failure takes down north-south traffic. The data center has two racks, Rack A and Rack B, with 10 GbE inter-switch links. The customer proposes placing the NSX Edge cluster in the management domain to avoid dedicating workload-domain hosts to edge, and using one Tier-0 gateway with both edge nodes in Rack A. Security requires management and tenant traffic to be isolated at layer 2.
1. Is placing the new workload domain's NSX Edge cluster in the management domain valid in VCF? What host count would you recommend for the new domain?
Read the worked answer
Not valid as proposed. In standard VCF, an NSX Edge cluster is deployed into and owned by a workload domain. The management domain's edge cluster serves the management domain, not a separate workload domain's tenant north-south traffic. The new domain needs its own edge cluster.
Sizing judgement: With six hosts total and a two-node edge cluster, only four hosts remain for compute if edge nodes are anti-affine to each other and to compute. If the application sizing assumed six compute hosts, the domain needs eight hosts: two edge nodes plus six compute. If four compute hosts meet the N+1 requirement after checking per-host CPU, memory, and storage, six hosts is acceptable. Confirm whether "six hosts" means total domain hosts or compute-only before deploying.
2. Evaluate the single Tier-0 gateway with both edge nodes in Rack A. What placement and HA rules would you require?
Read the worked answer
A single Tier-0 can be highly available with two edge nodes, but both edge nodes in Rack A makes north-south traffic a rack-level single point of failure. Losing Rack A, its top-of-rack switch, or its power feed takes down both edge nodes.
Require the edge nodes to be placed on separate hosts and in separate racks: one edge node in Rack A and one in Rack B. Add vSphere anti-affinity rules so a single host failure cannot take both edge nodes. Each edge node should have redundant uplinks to separate top-of-rack switches, and the inter-rack link must carry the edge uplink VLANs with sufficient MTU. If only one rack is available, document the accepted risk or redesign to a stretched or multi-rack topology before go-live.
3. How should management and tenant traffic be isolated at layer 2, and which VLANs must be kept separate?
Read the worked answer
Keep separate VLANs for management, vMotion, vSAN, NSX TEP, edge uplinks, and any storage or backup traffic. Do not collapse TEP and management into one VLAN, even if both are reachable.
Tenant isolation should use NSX overlay segments (Geneve) rather than stretching a single VLAN across tenants. The edge uplink VLAN carries tenant north-south traffic and must be dedicated, trunked only on the required switch ports, and not shared with management. Verify that the physical trunk allows only the required VLANs, that MTU 9000 is configured on TEP and edge uplinks, and that the edge uplink VLAN is present on both racks so rack failure does not isolate the surviving edge node.