Field notes on designing, securing and running VMware Cloud Foundation 9. Design decisions, firewall flows, NSX, operations and the lessons from real engagements.
VCF 9.1 gives VPCs multiple transit gateways, stateful services without NSX Edges, VLAN-backed subnets and firewall-free isolation between VPCs. Here is how the model fits together and where it changes what your physical firewall sees.
Same products, same features, same answers. Only the network model changed, and the final rule count moved from 176 to 228. Here is why, and why you should compare models before committing to a design.
Traffic between two components on the same VLAN never crosses a firewall, yet the ports catalogue lists it like any other flow. Removing it took 408 rules out of one customer's rule set.
The Broadcom ports catalogue lists every port for every product. It is not a firewall design. Here is how a 12-step assessment cut one customer's candidate rules by 79%, with a reason recorded for every exclusion.
No articles on this topic yet.
Turn the full Broadcom port catalogue into the consolidated rule set your design actually needs.