VMware by Broadcom Presents at Networking Field Day 41

VMware NSX Today – VCF Networking for a Modern Private Cloud

Watch on YouTube
Watch on Vimeo

Andrew Voltmer of VMware by Broadcom explained how NSX has evolved within VCF Networking to bring a public cloud operating model to the private cloud. The session covered self-service VPCs, consistent networking across sites and regions, Enhanced Data Path performance and NIC offloads, integrated deployment within VMware Cloud Foundation, and EVPN integration with physical switching fabrics. Voltmer, Director of Product Management for VCF Networking, opened the VMware by Broadcom presentation at Networking Field Day 41.

Voltmer said the VPC construct, modeled on AWS VPCs and Azure VNets, replaces the older tier-0 and tier-1 model that once required specialist training. A single UI and API provisions isolated networks for workloads such as PCI or HIPAA zones, using routing isolation similar to VRFs alongside vDefend Layer 7 firewall rules with IDS/IPS and malware prevention. VPCs are now available directly in vCenter and VCF Automation, with Terraform, PowerCLI, and Antrea supporting automated and Kubernetes workflows. He highlighted long-standing use cases, including workload mobility over the Geneve overlay, disaster recovery that preserves IP addresses and security policy, and federation across global regions. Enhanced Data Path mode delivers line-rate switching on high-speed NICs up to 400G, with hardware offloads and a low-latency pass-through for AI workloads on NVIDIA ConnectX-7 NICs. EDP is opt-in today but is expected to become the default.

Voltmer described two complementary goals: making networking simple for virtualization admins and enabling sophisticated designs for network experts. NSX now installs as part of VCF fleet lifecycle, supports singleton managers and edgeless deployments, and renames the NSX Edge as the Virtual Network Appliance. For network teams, VMware is improving integration with Cisco, Arista, and Juniper fabrics so VPC constructs can be layered onto existing networks. The most significant change is EVPN support, in which NSX dynamically selects encapsulation, using Geneve between hosts and VXLAN when talking directly to a switch VTEP. Delegates raised concerns about losing underlay visibility, but Voltmer argued overlays are now universal. By removing the need for a centralized edge gateway, this approach offers a substantial performance benefit and positions NSX as a peer to the physical fabric rather than a layer hidden on top of it.

Personnel: Andrew Voltmer

VMware VPCs with Distributed Transit Gateway

Watch on YouTube
Watch on Vimeo

Francois Tallet of VMware by Broadcom detailed how VCF Networking handles north-south traffic for VPCs using the distributed transit gateway introduced in VCF 9. The session covered VPC subnet types and tenant roles, centralized versus distributed external connectivity, EVPN-based connections, the Virtual Network Appliance, and a live vCenter demo of VPC connectivity policies. Tallet, a technical marketing engineer in the VCF networking division, presented at Networking Field Day 41.

Tallet explained that VPCs offer private subnets scoped to a single VPC, public subnets reachable from the physical network, and transit gateway private subnets scoped to a tenant. A VPC gateway routes within each VPC, a transit gateway connects VPCs within a tenant, and a provider role handles BGP and the physical handoff. He described the external connection as a contract that hides networking details from tenant admins, who consume pre-provisioned IP blocks under quotas without involving the network team. In the traditional centralized model, an edge VM hosts the transit gateway and tier-0, advertising public subnets via BGP. VCF 9 adds a distributed VLAN external connection that runs the transit gateway on every ESX host and sends traffic directly out the host uplink, though it requires one VLAN spanning all hosts. An EVPN option instead uses a route server advertising /32 type 5 routes and VXLAN to EVPN gateways. Stateful services such as SNAT, load balancing, and DHCP relay run on the Virtual Network Appliance.

Tallet argued that removing the edge VM also removes a political problem, since its ownership often divided compute and network teams, and that the distributed model largely matches centralized capabilities. His demo created a VPC, a public subnet with a default /26 and DHCP, and a private subnet entirely in vCenter, then used a Gemini-generated PowerCLI script to deploy more VPCs. He applied connectivity policies borrowing private VLAN terminology: isolated VPCs reach only the outside world, while a promiscuous shared services VPC remains reachable by all. These policies rely on routing reachability rather than access lists, which Tallet presented as proof that a virtualization admin can build segmented, externally connected networks without understanding default gateways or coordinating with the physical network team.

Personnel: Francois Tallet

Open, Unified Datacenter Networking with VMware and Cisco

Watch on YouTube
Watch on Vimeo

Sabina Anja of VMware by Broadcom and Lukas Krattiger of Cisco presented a joint architecture integrating VCF Networking with Cisco Nexus fabrics. The session covered VMM integration support with ACI, VXLAN EVPN interoperability between the VCF distributed transit gateway and Cisco ACI and NX-OS, the VCF route controller, tunnel stitching at the fabric, and plans for fully distributed tunnel termination. The session at Networking Field Day 41 was billed as the first joint Cisco and VMware presentation in roughly ten years.

Anja and Krattiger confirmed that both companies support ACI VMM integration, though Krattiger stressed it was never mandatory and urged a routed EVPN approach over VLAN coordination. Cisco opened ACI’s edge with a border gateway that speaks VXLAN EVPN, bringing ACI and NX-OS under the Cisco Nexus One umbrella. On the VCF side, a route controller acts as a directory of every VM and its IP address, comparable to a route reflector but not one, and runs active-standby to avoid a single point of failure. The distributed transit gateway runs an EVPN engine in the ESX kernel and advertises each VM as a /32 type 5 route with the hosting ESX server’s VTEP as next hop, giving the fabric exact location rather than a summary. A vMotion triggers an updated advertisement. Today, VXLAN tunnels terminate at a centralized point such as a spine, where Cisco’s border gateway function re-encapsulates traffic. Krattiger said he got the integration working within hours because the required EVPN functions already existed.

The presenters argued that native stitching ends the decapsulate-and-reencapsulate handoff between overlays and gives network engineers clear visibility and a policy point at the interconnect. Anja framed the benefit operationally: instead of tracing MAC addresses hop by hop and waiting on virtualization teams, engineers can run show ip route to find exactly where a workload lives, which matters as AI workloads make traffic heavier and fabrics larger. Francois Tallet added that modes are chosen per transit gateway, so centralized BGP, distributed VLAN, and EVPN gateways can coexist for one tenant. The next step, roughly a year out, terminates tunnels directly at the leaf switch, eliminating centralized gateways entirely.

Personnel: Lukas Krattiger, Sabina Anja