---
# source: src/content/solutions/en/vmware/vmware-cloud-foundation/nsx.md
# route:  /en/solutions/vmware/vmware-cloud-foundation/nsx/
title: VCF Networking
tags: [network, security, virtualization]
vendors: [vmware]
summary: Networking and firewalling in software, at the virtual port. Segmentation is set per VM.
photoNeed: "A vSphere or VCF console on a real screen at soulTec: a cluster view, a running task, an inventory tree, so the reader should recognise the UI"
stub: false
draft: false
kind: product
formerly: NSX
editions: [vcf]
addon: false
sourceNote: "Broadcom, VMware Cloud Foundation 9.1 and VMware vSphere Foundation 9.1: Feature Comparison & Upgrade Paths, read 2026-08-28"
vendorName: VMware VCF Networking
status: current
practice: >
  Draft, not yet reviewed. The distributed firewall can be turned on in an afternoon, and writing the rule set takes months. We start in monitor mode and only enforce once the flows are documented.
practiceReview: true
---

## What it is

NSX virtualizes the network: switching, routing and firewalling run as software in the
hypervisor rather than on dedicated hardware. The firewall sits at each VM's virtual port.

Traffic between two VMs on the same host is filtered without ever leaving the host.

## What it is for

Segmentation. The classic approach separates with VLANs and physical firewalls, and that
works while the number of zones stays manageable. With a distributed firewall, which zone
a VM belongs to becomes a property of the VM itself.

The second use case is automation: networks that come up with an application and
disappear with it.

## What to watch

NSX is part of VMware Cloud Foundation, and it is the component that holds migrations up.
The reason is that nobody fully knows a rule set that has grown over time. Segmentation
needs an honest answer to which systems talk to each other today.