NSX-T 3.2 Introduces Migration Coordinator’s User Defined Topology Mode
VMware NSX-T 3.2 is one of our largest releases — and it’s packed full of innovative features that address multi-cloud security, scale-out networking, and simplified operations. Check out the release blog for an overview of the new features introduced with this release.
Among those new features, let’s look at one of the highlights. With this release, Migration Coordinator now supports a groundbreaking feature addressing user-defined topology and enabling flexibility around supported topologies. In this blog post, we’ll look at the workflow for this new feature — starting with a high-level overview and then digging into the details of User Defined Topology. For more information on Migration Coordinator, check out the resource links at the end of this blog.
Migration Coordinator
Migration Coordinator is a tool that was introduced about 3 years ago with NSX-T 2.4. It enabled customers to migrate from NSX for vSphere to NSX-T Data Center. It’s a free and fully supported tool built into NSX-T Data Center. Migration Coordinator is flexible, with multiple options enabling multiple ways to migrate based on customer requirements.
Prior to NSX-T 3.2, Migration Coordinator offered two primary options:
- Migrate Everything: Migrate from edges to compute, to workloads in an automated fashion and with a workflow that resembles an in-place upgrade on existing Continue reading
Introducing New NSX Upgrade Capabilities for NSX-T 3.2
We’re introducing new capabilities to help our customers prepare for upgrading to the latest releases — now available with NSX-T Data Center 3.2.0.1.
To ensure that existing NSX deployments can be successfully upgraded to NSX-T Data Center 3.2.x, we have provided an NSX Upgrade Evaluation Tool that operates non-intrusively as a separate downloadable tool to check the health and readiness of your NSX Managers prior to upgrade. Using NSX Upgrade Evaluation Tool can help avoid potential upgrade failures and save time by avoiding a rollback from a failed upgrade.
Customers upgrading to NSX-T 3.2.x are strongly encouraged to review the Upgrade Checklist and run the NSX Upgrade Evaluation Tool before starting the upgrade process.
In what follows, we’ll go over the details of the NSX Upgrade Evaluation Tool:
- How the tool works
- When to use the tool
- What the tool can and cannot do
- How to use the tool
How the NSX Upgrade Evaluation Tool Works
The main component of the NSX Upgrade Evaluation Tool is the database where a copy of NSX objects will be stored. The tool starts by making a secure copy of the database from an existing NSX Manager Continue reading
Emotet Is Not Dead (Yet)
The state of cyber security is a typical example of a cat-and-mouse game between hackers and defenders. Sometimes, a threat that appears to be under control, if not completely mitigated, comes back with a vengeance. This is exactly what happened to Emotet.
It has been just about a year since the Emotet botnet was taken down, thanks to the international efforts of multiple law enforcement agencies. But the silence from Emotet attackers did not last long. Late last year, we saw a report on the resurface of Emotet distributed by Trickbot. Recently VMware’s Threat Analysis Unit saw another Emotet campaign—where the attacks leveraged the increasingly abused Excel 4.0 (XL4) macros to spread Emotet payloads.
In this blog post, we investigate the first stage of the recent Emotet attacks by analyzing one of the samples from the recent campaign and reveal novel tactics, techniques, and procedures (TTPs) that were not used by Emotet in the past.
The Recent Emotet Campaign
Figure 1 shows the detection timeline of a recent Emotet campaign that affected some of our customers—mostly in the EMEA region. The campaign started on January 11 and peaked the next day before fading Continue reading
VMware Network Automation with NSX-T 3.2 and vRealize Automation
VMware Network Automation combines the modern microservices architecture of vRealize with VMware NSX network virtualization to enable rapid application rollout. The solution automates VMware NSX via VMware vRealize Automation to deliver complete workload lifecycle automation through networking, compute, and security services that make it simple to template, provision, and update complete environments. That, in turn, enables businesses to accelerate application delivery and drive overall agility.
The latest iterations of vRealize Automation native integration with NSX-T features include multiple new capabilities, such as support for NSX-T Federation, distributed firewall configurations from NSX-T, a shared gateway across on-demand networks, and many others.
In this post, we will provide an overview of the feature-set available with this native integration. The post doesn’t aim to be exhaustive, so don’t hesitate to look at the vRealize Automation documentation for more details.
Setting up the Environment
The native integration allows for consumption of NSX-T constructs from vRealize Automation after a simple configuration.
The goal is for the cloud admin to be able to offer users a self-service catalog, through Service Broker that enables the deployment of complex topologies with consistent governance policies across the cloud — all while abstracting the underlying infrastructure and its complexity from Continue reading
6 East-West Security Myths Busted
With the world at our fingertips via a simple Google search, it can sometimes be tough to figure out what’s fact and what’s fiction. Whether you’re an expert, novice, or beginner in the tech world, time should be spent putting capabilities and terms into action – rather than trying to piece them together and understand them like a Sudoku puzzle. That’s why we’re going to debunk six major East-West security myths for you – so you can get back to the good stuff.
1. East-West security is the monitoring and inspection of traffic moving medially within the network perimeter, working to identify and block threats and enable access rights.
Busted. East-West security does all of the fancy stuff mentioned, with one very important difference: it moves laterally through the network perimeter. This is a key understanding, since East-West security operates on the premise that threat factors will eventually find a way through next-generation firewalls – which means all internal network traffic is vulnerable.
2. A traditional firewall that manages North-South traffic can handle a modern network breach by itself.
Busted. While it’s important to have North-South security in place (filtering the traffic that is exiting and entering the network), it cannot protect the network on its own Continue reading
How VMware Protects Organizations with Simply Stronger Security [INFOGRAPHIC]
Every 11 seconds, a new organization falls victim to ransomware. That means by the time you’re done reading these two sentences, your organization could very well become another statistic. In the war against ransomware, there are two cohorts: those who are armed for war and those who will suffer digital casualties. With threats becoming increasingly more agile, it’s up to you to protect your organization’s past, present, and future.
The Numbers Don’t Lie
Cybercrime has become a bigger entity than any of us could’ve ever imagined. With over 4,000 attacks every day and $20 billion in damages in 2021 alone, ransomware has become the big business we’ve all feared. Imposing numbers like these make it seem nearly impossible to protect against ransomware – but there is a solution that will strengthen your armor.
Protection Served with Simplicity
We know that shopping for new digital armor can be daunting. But the threat is real, and VMware is not in the business of smoke and mirror solutions. We are, however, in the business of helping enterprises scale out – simply, securely, swiftly. To that end, the VMware Distributed Firewall is a foundational step for many customers strengthening their multi-cloud environments. Enforcing east-west advanced threat protection at each workload, our distributed firewall solution can scale to 20TB+ while coming in at one-third of the cost of other solutions in the industry. Providing support to over 30,000 customers, VMware Security Solutions have consistently been able to stop attackers in Continue reading
How to Achieve TAP-less Network Traffic Analysis
We’re all becoming extremely aware of the importance of east-west protection. Recent security breaches have highlighted the role of Zero Trust as an essential strategy to protect valuable information. As a result, organizations are explicitly considering the security of east-west traffic flows to prevent adversaries from gaining a foothold in the data center and moving laterally across the network to access high-value data.
The biggest problem with protecting against advanced threats is the need to inspect all network traffic to prevent unwanted access by hackers, malicious insiders, or users with compromised accounts.
The traditional approach involves setting up a series of network Test Access Points (TAPs) to see traffic going over the network. Tapped traffic is then sent to a centralized Network Traffic Analyzer (NTA) appliance for monitoring. All of this – designing the infrastructure, acquiring the devices and appliances, configuring, implementing, and managing them—can present serious issues.
Let’s look at the challenges of the traditional approach, and then show how a distributed implementation can not only respond to the challenges but also provide operational simplicity.
TAP Network Challenges
TAP Challenge 1: Where to put the TAPs
A network architect must determine which network assets are most critical, which locations Continue reading
Introducing DARTH: Distributed Analysis for Research and Threat Hunting
As targeting data centers, which mainly run workloads on Linux, has proven to be a very lucrative target for cyber criminals, Linux malware has become increasingly prevalent. Although still an emerging threat that’s somewhat less complex than its Windows counterpart, analysis of Linux malware remains challenging due to lack of analysis tools in the Linux world.
Luckily, both the Linux kernel and the Linux ecosystem provide a set of capabilities and tools that, when combined, potentially allow for the creation of malware analysis frameworks as powerful as those available on Windows.
This blog details what can be achieved by leveraging tools and an analysis pipeline specifically tailored for Linux, and introduces our Distributed Analysis for Research and Threat Hunting
(DARTH) framework. We provide a high-level overview of the framework, including core components and modules, as well as the design requirements that have led our research efforts in this area. We then discuss Tracer, a dynamic analysis module used in DARTH to collect various behaviors during malware execution in a controlled environment.
High Level Overview: Where DARTH Began
As part of our research, we often find ourselves running new types of analysis on large collections of malicious samples; building a scalable Continue reading
Simplify NSX Security for Brownfield vSphere Deployments with NSX-T 3.2
Perimeter-only security controls are just not sufficient to address sophisticated attacks on mission-critical infrastructure. VMware NSX pioneered the “micro-segmentation” approach, in which granular security controls enable Zero-Trust Security. With micro-segmentation, each individual workload inside the network receives unprecedented protection from attacks originating from both external as well as internal threat actors. One of the primary reasons for NSX’s instant success in the industry was the fact that deploying Zero-Trust security across the infrastructure is quite easy and effectively mitigates malicious lateral movement with L4 and L7 Application controls. With the NSX 3.2 release, we are further simplifying the NSX Security deployment experience.
This blog captures why deploying NSX for micro-segmentation is already a simple experience, and how NSX 3.2 further simplifies that experience. Specifically, the following two key capabilities will be covered:
- NSX Distributed Security support for vSphere Distributed Switch-based workloads, and
- Embedded vCenter-based NSX Distributed Firewall workflows
Achieving Zero-Trust for Applications with NSX today
From the initial days of VMware NSX, we strongly believed that achieving micro-segmentation should not come at the cost of complexity.
If you ask our customers, this is why they love NSX:
- Ease of deployment: NSX does not require any custom firewall Continue reading
Announcing VMware HCX 4.3
VMware HCX, an application mobility platform, is a crucial part of an organization’s digital transformation journey. HCX simplifies application migration, workload rebalancing, and business continuity across data centers and clouds. This becomes increasingly important as organizations consolidate data centers, extend data centers to the cloud, or replace on-premises infrastructure.
Let’s dig into some of the new and exciting features of HCX 4.3.0:
Transition to PostgreSQL
One of the key improvements HCX 4.3.0 introduces is the use of PostgreSQL. The goal is to replace the older databases and leverage some inherent advantages of PostgreSQL. From an end-user perspective, this transition will have no impact. Once the upgrade process is triggered, the system will automatically transition to the newer database in the backend, and all the data is seamlessly transferred to the new database.
Building Resiliency in HCX Network Extension
The second significant enhancement is the high availability of Network Extension appliances. Network Extension service is a critical part of HCX, and any disruption during normal migration activities can have a high impact on business operations. HCX 4.3.0 aims to minimize the impact of such disruptions by introducing a high availability (HA) feature for Network Extension Continue reading
NSX Year in Review: 2021
With 2022 just around the corner, we can’t help but look back at the past year. 2021 was one for the books, as the world continued to navigate the ups and downs of the pandemic and the new way of working. It was also a big year for NSX, with many firsts, releases, awards and events. Before we head into the new year, take a quick trip down memory lane with us for an NSX year in review and reminisce on all the news we shared this year:
January
Shared on YouTube
January, besides marking the start of the new year, was the month of the -tion’s on YouTube. Our top-viewed videos this month were the classic NSX Introduction, Micro-segmentation, Network Evolution, NSX-T Migration, and NSX-T Federation. Check out the videos and let us know in the comments if any of the information in these creations got your attention.
February
Introduced HCX 4.0
Roses are red, violets are blue. Have you heard? HCX 4.0 is new! This major release focused on providing enhanced visibility, reducing service downtime during upgrades, and simplifying the reconfiguration of NSX security policies post-migration. Since February, Continue reading
How to Get the Most Out of VMware NSX with Advanced Load Balancing
Switzerland never takes sides. Safeguarding its independence is one of the principal objectives of Swiss foreign policy. And Swiss neutrality, one of the main principles of this policy, dictates that Switzerland remain agnostic.
Hailed as the Switzerland of load balancers, VMware NSX Advanced Load Balancer (Avi) doesn’t take sides either. It is environment-agnostic. Designed to save you from costly re-platforming, retooling, and retraining, Avi offers the same great user experience regardless of the number or types of underlying infrastructure that support your apps. So you get a consistent experience, across any cloud, every time. The Avi platform enables a fast, scalable, and secure application delivery experience.
Network Automation and Advanced Load Balancing: Better Together
Customers invest in VMware NSX to achieve network automation and deploy a software-defined data center (SDDC) or private cloud that is programmable. However, they have historically used either the native NSX load balancer or legacy load balancers such as F5 or Citrix. Neither solution is adequate for the level of automation — and the enterprise-grade load balancing functions — that customers hope to enjoy with NSX.
Customers deploying VMware NSX-T need an integrated, automation-driven, multi-cloud application services solution. Avi integrates with NSX-T, simplifies Day 0 deployments, Continue reading
When Supply-Chain Attacks Meet CI/CD Infrastructures
Supply-chain attacks can be so destructive that they are often considered black-swan events. Often, the most upsetting aspect of the attack is that it manages to compromise what is normally deemed to be safe by definition — whether that’s a software component or an MSP (managed service provider). The result is that our understanding of perimeters, security boundaries, and/or best practices is often flipped upside down.
Consider, for example, the SolarWinds attack back in December 2020: disguised as a normal software update, attackers managed to implant a pre-crafted backdoor on thousands of customers, which led many frantic security teams to discover that their network perimeter had already been breached several months before. Another (and even more destructive) attack took place in July 2021: by exploiting a vulnerability in Kaseya VSA servers, attackers managed to infect hundreds of MSPs, which in turn deployed the REvil ransomware to thousands of customers, breaking the assumption of a safe boundary between different IT infrastructures.
Fast forward to October 2021. An innocent bug report alerted the entire NPM developer community that a core open-source library had been hacked. Fortunately, the community quickly handled and fixed the issue. But, had it not been detected, the potential Continue reading
How to Secure the Software Supply Chain with Container Network Security
The way enterprises design, build and run applications has changed significantly over the past several years with the evolution of microservices and containers. No longer are applications built using a monolithic architecture—evenly stacked and centrally organized in a way that made it easy to manage and secure. Today’s modern applications are spread out in thousands of microservices across data centers and the cloud—able to be spun up and down wherever users log in.
While microservices provide reusable elements to accelerate software development, the software supply chain itself could become an attack vector. In an effort to enable business agility without putting the enterprise at risk, organizations need to infuse security directly into DevOps processes and throughout the software supply chain at large. This makes security everyone’s responsibility—whether they are a user, a developer or a platform owner—to protect the applications that are consumed for work and for life.
The Rise (and Risk) of Kubernetes
Microservices applications need Kubernetes as an orchestrator to handle scheduling of containers in a cluster of servers, load balancing those containers, managing permissions and access control and many other Day 2 concerns. Kubernetes wasn’t the first orchestrator, but its rapid adoption makes it a defecto standard today for running scalable and resilient containerized applications. According Continue reading
What’s New in vRealize Network Insight Cloud and vRealize Network Insight 6.4 for NSX-T 3.2
We’re pleased to announce another close collaboration between NSX-T 3.2, vRealize Network Insight Cloud, and vRealize Network Insight 6.4 in this latest release. As enterprises strive for the latest in cloud networking, the network management piece combines the end-user experience, applications, and technology to provide the visibility needed to ensure applications are consistently performing and secure. As we know, broad network observability is a critical step in securing the infrastructure.
vRealize Network Insight Cloud is available as a SaaS or on-premises solution for end-to-end network visibility, troubleshooting, and analytics. It works closely with NSX-T 3.2. vRealize Network Insight Cloud also helps optimize multi-cloud network performance with troubleshooting capabilities for applications, virtual machines, physical servers, or Kubernetes.
NSX Federation
Customers use NSX Federation to scale across different locations globally, making it easier to create hierarchies and dramatically simplifying management. vRealize Network Insight Cloud now supports network visibility for NSX Federation. This new feature will enable customers to leverage views across multiple NSX-T data centers at the global, regional, and local site levels. Several new cross-site VM to VM paths will be available, including inter-site VM-VM paths, intra-site VM-VM paths, VM-VM across sites with NAT, VM-VM paths across Continue reading
VMware NSX 3.2 Delivers New, Advanced Security Capabilities
It’s an impactful release focused on significant NSX Security enhancements
Putting a hard shell around a soft core is not a recipe for success in security, but somehow legacy security architectures for application protection have often looked exactly like that: a hard perimeter firewall layer for an application infrastructure that was fundamentally not built with security as a primary concern. VMware NSX Distributed Firewall pioneered the micro-segmentation concept for granular access controls for cloud applications with the initial launch of the product in 2013. The promise of Zero Trust security for applications, the simplicity of deployment of the solution, and the ease of achieving internal security objectives made NSX an instant success for security-sensitive customers.
Our newest release — NSX-T 3.2 — establishes a new marker for securing application infrastructure by introducing significant new features to identify and respond to malware and ransomware attacks in the network, to enhance user identification and L7 application identification capabilities, and, at the same time, to simplify deployment of the product for our customers.
“Modern day security teams need to secure mission-critical infrastructure from both external and internal attacks. By providing unprecedented threat visibility leveraging IDS, NTA, and Network Detection and Response (NDR) capabilities along with granular controls leveraging L4-L7 Firewall, IPS, and Malware Prevention capabilities, NSX 3.2 delivers an incredible security solution for our customers“
– Umesh Mahajan, SVP, GM (Networking and Security Business Unit)
This blog captures critical enhancements NSX-T 3.2 delivers from a security perspective. And stay tuned —we’ll follow up with more detailed blogs on Continue reading
Announcing NSX-T 3.2: Innovations in Multi-Cloud Security, Networking, and Operations
We’re excited to announce VMware NSX-T 3.2, one of the largest NSX releases so far. NSX-T 3.2 includes key innovations across multi-cloud security, scale-out networking for containers, VMs, and physical workloads. It also delivers simplified operations that help enterprises achieve a one-click, public cloud experience wherever their workloads are deployed.
Strong Multi-Cloud Security
NSX-T 3.2 provides strong, multi-cloud, easy-to-operationalize network defenses that secure application traffic within and across clouds. NSX-T 3.2 goes a step further in making it easy to enable Zero Trust application access across multi-cloud environments — enabling customers to secure traffic across applications and individual workloads with security controls that are consistent, automated, attached to the workload, and elastic in scale.
Tapless Network Traffic Analysis (NTA)
Network traffic analysis (NTA) and sandboxing solutions are integrated directly into the NSX Distributed Firewall (DFW). NSX eliminates traffic hairpins by distributing NTA as a service within the hypervisor. Combined with distributed IDS/IPS capabilities, security teams can now virtualize the entire security stack and eliminate blind spots while allowing security policies and controls to follow workflows throughout their lifecycle, regardless of the underlying infrastructure.
Gateway Firewall
The enhanced gateway firewall serves as a software-based gateway with L2-L7 controls — including URL filtering and advanced threat prevention with malware analysis and sandboxing. This extends centralized security controls to physical workloads, the data center perimeter, and the public cloud edge — ensuring consistent security controls across both east-west and north-south application traffic Continue reading
Getting Started with VMware Transit Connect Intra-Region Peering for VMware Cloud on AWS
VMware Transit Connect has proven itself as a valuable tool to enable high bandwidth and speed connectivity for VMware Cloud on AWS customers and their Software Defined Data Centers (SDDCs). There are hundreds of customers using this feature across the fleet in a myriad of combinations. Since the initial offering in 2020 we have worked with our partner, AWS, to expand the service’s capabilities to include SDDC Grouping across multiple regions in addition to support for Transit/Security VPC models. These capabilities combine to provide a comprehensive networking solution to address some of the most challenging networking requirements. However, there has been one gap in the connectivity – the ability to peer the VMware Managed Transit Gateway (VTGW) with a native AWS Transit Gateway (TGW).
At AWS re:Invent 2021, the ability to peer VTGWs to AWS TGWs in the same region, also referred to as intra-region peering was announced. VMware and AWS have been working on this solution diligently and we are excited to announce VMware Cloud on AWS support for this new capability in this announcement blog. Equally exciting is that this feature will be available to VMware Cloud on AWS customers with SDDCs that are on any version. To Continue reading
The Hard Facts: Hardware vs. Software Load Balancers
Flexible infrastructure choices and application architectures are changing the way that modern enterprises run their distributed environments (see Figure 1). Enterprises have become application-centric, investing significant effort and resources in continuous delivery goals and DevOps practices in order to automate routine IT and operations tasks.
Hardware-based application delivery controllers (ADCs) have been the staple of application delivery in data centers for the last two decades. However, these legacy load balancing solutions aren’t keeping up with the changes in modern, dynamic capacity and automation needs. Legacy hardware-based ADCs have become inflexible in the face of changing requirements, delaying application rollouts and causing overspending and overprovisioning in many cases. Most enterprises experience the “do more with less but faster” challenges shown in Figure 2 when it comes to rolling out new applications or updates, which can often take weeks.
With aggressive continuous delivery goals and ever-greater customer expectations, businesses are pushing back against delays due to hardware provisioning and manual configurations of ADCs that slow time to market for application deployments and updates.
Figure 1: Computing today: Evolving app architectures and infrastructure heterogeneity.
Figure 2: Legacy hardware-based load balancing solutions are not keeping up with the modern pace of business.
Virtualized Continue reading