Most networks are protected like a building with a strong front door and no inside doors. Once an attacker gets in, often through one weak server or a stolen password, they can move from server to server freely. Micro-segmentation adds the inside doors.
What Micro-Segmentation Does
With VMware NSX, the distributed firewall runs inside the hypervisor, right at each VM's network connection. Every VM gets its own firewall, and traffic between two VMs is checked even when they sit on the same host and the same network.
This traffic between servers inside the data centre is called east-west traffic. It is usually the largest part of the traffic and the part that traditional firewalls never see.
Rules by Role, Not by Address
Instead of writing rules for IP addresses, you group VMs by what they are: web servers, application servers, databases, or one application's tiers. A rule might say that only the web group may talk to the application group on one port.
Because the rules follow the groups, they keep working when a VM moves to another host or gets a new IP address. New VMs that join a group get the right rules automatically.
How to Roll It Out Without Breaking Things
The safest approach is gradual:
- Watch first. Use Security Intelligence, part of vDefend Firewall, to see which servers really talk to each other.
- Group your VMs by application and role.
- Write allow rules for the traffic each application needs.
- Run the rules with logging on and check the logs for anything you missed.
- Only then switch the default for that application to block everything else.
- Repeat one application at a time.
This way nothing breaks by surprise, and each step is easy to roll back.
Licensing Note
With VMware Cloud Foundation, the distributed firewall is licensed through the separate vDefend Firewall add-on, which also includes the gateway firewall and Security Intelligence for traffic analysis. Check what your licence includes before you plan the project.
A Simple Example
Picture a three-tier application: web servers, application servers and a database. With micro-segmentation, users reach only the web servers on HTTPS, the web servers reach only the application servers on their port, and only the application servers reach the database. If a web server is compromised, the attacker cannot reach the database directly, and cannot jump sideways to other applications at all.
Common Questions
Do We Still Need Our Perimeter Firewall?
Yes. The perimeter firewall still controls traffic in and out of the data centre. Micro-segmentation adds control inside it. The two work together.
Does It Slow Down the VMs?
The distributed firewall runs inside the hypervisor on every host, so the work is spread across the cluster instead of going through one central box. In normal designs the effect on performance is small, but we still measure it during testing.
A Quick Checklist
- Traffic between applications mapped before any rule is written
- VMs grouped by application and role, not by IP address
- Rules tested with logging before blocking is switched on
- Rollout planned one application at a time
- Licensing for the distributed firewall confirmed
How We Help
We plan and roll out NSX micro-segmentation step by step: traffic discovery, grouping, rule design, testing and handover with clear documentation, so your team can keep the rules up to date.
