Network Native

  Network address translation, or more commonly NAT, is most often used to do source NAT or destination NAT. In rare instances, SNAT or DNAT isn't enough to get ip packets to their destination. Enter twice nat. While twice NAT isn't a function I've needed often, it was a function drilled into me while studying for various Cisco exams. I used to watch Christian Matei explain it over at INE and it really helped me to understand what twice NAT is and how to configure it on Cisco devices. Previous to my time working with NSX-T, I'd only utilized twice NAT once. A few years back, a customer wanted to build and IPsec tunnel from the organization HQ to a branch office. The private ip space used by HQ and the branch used overlapping ip space. We used twice NAT to NAT the source and destination ip address in a single NAT rule ( similar to this guy ) before shoving it all into an IPsec tunnel. Previous to working with NSX, circumstances requiring twice NAT were uncommon.  While w...

  NSX-V Load Balancer: Inline vs One-arm In this post I am going to talk about the NSX-V load balancer. In particular, I wanted to talk about the difference between inline and one-arm architecture versus inline and one-arm configuration. I chose to blog about this because it seems to confuse many of my customers. I also found it quite confusing at first since the documentation doesn't provide enough detail to build an intuition on how the architecture and configuration work together to make a functioning load balancer. However, the NSX documentation is a good starting point. NSX-V's Administration Guide on page 315 explains the basics about the load balancer: https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/nsx_64_admin.pdf This time around I decided to demonstrate how one-arm load balancer configuration and one-arm architecture differ, as well as inline configuration and inline architecture differ. Click this link below for my youtube video. Loadbalancer...

 "MTU refers to the maximum size of an  IP packet  that can be transmitted without fragmentation over a given medium." - https://en.wikipedia.org/wiki/Maximum_transmission_unit   Over the years, working with customers to resolve MTU issues with NSX overlay networks called attention to my weakness in understanding MTU and its implications. My experiences troubleshooting and experimenting with MTU are the inspiration for this blog post. I’ve needed to strengthen my knowledge on MTU because VXLAN network traffic requires a network to transport data frames with 1600 byte MTU at a minimum. The standard MTU in TCP/IP networking devices is 1500 bytes. This has been the standard since the birth of the Internet, which I'm going to define here as the decade TCP/IP protocol was invented, the mid 1970s . MTU is a well documented network attribute. However, reading documentation about MTU didn’t prepare me to understand the implications of changing MTU and how to troubles...

This lab / tutorial will show you the path of an IP packet that is routed through an NSX distributed logical router (DLR). This is often one of the most difficult components to conceptualize, particularly for network engineers who have experience with traditional routing using physical routers. My hope is that by going through this lab, it will help clarify the ways in which a DLR is the same as traditional routing, and the ways in which it is different from traditional routing in physical routing devices. Let's get started! Step 1: Head over to http://labs.hol.vmware.com/ and type nsx in the search bar. Click to enroll in the lab below. Use this HOL: Step 2: Run powershell script 3 & 4. This removes some Distributed Firewall (DFW) configuration that exists to show users how to manage the DFW. Here we are not concerned about the DFW: Step 3: Open the browser. It should load the vSphere web client to the login screen. login with the following credentials: administrat...