MENU
An architect is working on a VMware Cloud Foundation (VCF) architecture design and identified the following requirements:
* The organization is using a third-party virtual appliance that does not support overlay networks.
* The virtual appliance must reside on the same L2 domain as an external physical firewall.
* The virtual appliance also needs access to workloads that are currently hosted on overlay segments provided by NSX.
Which design decision should the architect make to meet these requirements?
According to the VMware Cloud Foundation 9.0.2 Design Guide (NSX Bridging and Layer 2 Connectivity), when workloads or appliances require Layer 2 adjacency with physical network devices and do not support overlay encapsulation (Geneve), NSX Edge bridging is the validated solution.
The documentation states:
''The bridge functionality extends an overlay segment into a VLAN identified by a VLAN ID on an uplink of the NSX Edge. This enables Layer 2 connectivity between virtual machines on NSX overlay segments and physical workloads on VLAN-backed networks.''
By connecting the third-party appliance to a VLAN-backed segment and configuring NSX bridging, the appliance gains direct L2 connectivity to the firewall, while the workloads on overlay segments can still communicate seamlessly through the bridge.
This approach maintains the logical separation of NSX networks while satisfying L2 adjacency requirements, a common design pattern for integrating non-overlay-capable systems.
Reference (VMware Cloud Foundation documents):
VMware Cloud Foundation 9.0.2 Architecture and Design Guide --- ''Edge Bridging: Extending Overlay Segments to VLAN.''
VMware Cloud Foundation 9.0.2 NSX Design Recommendations --- ''Bridge Profiles and VLAN Uplink Configuration.''