---
# source: src/content/solutions/en/vmware/vmware-cloud-foundation/nsx.md
# route:  /en/solutions/vmware/vmware-cloud-foundation/nsx/
title: VCF Networking
tags: [network, security, virtualization]
vendors: [vmware]
summary: Networking and firewalling in software, at the virtual port. The route to segmentation that does not depend on rack topology.
photoNeed: "A vSphere or VCF console on a real screen at soulTec: a cluster view, a running task, an inventory tree, so the reader should recognise the UI"
stub: false
draft: false
kind: product
formerly: NSX
editions: [vcf]
addon: false
sourceNote: "Broadcom, VMware Cloud Foundation 9.1 and VMware vSphere Foundation 9.1: Feature Comparison & Upgrade Paths, read 2026-08-28"
vendorName: VMware VCF Networking
status: current
practice: >
  Draft, not yet reviewed. Turning the distributed firewall on takes an afternoon. Writing a rule set someone can still understand in three years takes months. We start in monitor mode and only enforce once the flows are documented.
practiceReview: true
---

## What it is

NSX virtualizes the network: switching, routing and firewalling run as software in the
hypervisor rather than on dedicated hardware. The firewall sits at each VM's virtual port
rather than at the edge of the network.

That is the difference that matters. Traffic between two VMs on the same host is filtered
without ever leaving the host.

## What it is for

Segmentation. The classic approach separates with VLANs and physical firewalls, and it
scales exactly as long as the number of zones stays manageable. With a distributed
firewall, which zone a VM belongs to becomes a property of the VM rather than of where it
sits in the rack.

The second use case is automation: networks that come up with an application and
disappear with it.

## What to watch

NSX is part of VMware Cloud Foundation, and it is the component that holds migrations up.
Not because the technology is hard, but because nobody knows a rule set that grew over a
decade in full. Segmentation needs an honest answer to which systems talk to each other
today, and that answer is rarely written down.