What it is
NSX virtualizes the network: switching, routing and firewalling run as software in the hypervisor rather than on dedicated hardware. The firewall sits at each VM’s virtual port rather than at the edge of the network.
That is the difference that matters. Traffic between two VMs on the same host is filtered without ever leaving the host.
What it is for
Segmentation. The classic approach separates with VLANs and physical firewalls, and it scales exactly as long as the number of zones stays manageable. With a distributed firewall, which zone a VM belongs to becomes a property of the VM rather than of where it sits in the rack.
The second use case is automation: networks that come up with an application and disappear with it.
What to watch
NSX is part of VMware Cloud Foundation, and it is the component that holds migrations up. Not because the technology is hard, but because nobody knows a rule set that grew over a decade in full. Segmentation needs an honest answer to which systems talk to each other today, and that answer is rarely written down.
