Mid-size company alternative to NSX

We're a mid-sized company with 40 virtual machines. We have a traditional firewall for external traffic, but nothing protecting the data center vms from the internal networks.

At first glance NSX appeared to be exactly what we need, but after doing some reading the complexity of the product is over our heads. We considered outsourcing this project but feel like it will turn into a full time job to setup, manage, monitor, etc....

Is there an alternative product for smaller companies to protect their vms from threats from the internal networks?

in VMwareNSXby account-at-work

100%

1.4y

bc-squared

1.4y

I would still look at NSX, especially if your environment is fully virtualized in vSphere. You DO NOT have to use all of the complex networking features of NSX that require edges, gateways, etc.. You can use NSX for microsegmention using your traditional, VLAN backed segments (they look and feel just like a normal port group) and maintain a relatively simple deployment. In fact, I believe there are some license levels of NSX that only give you this functionality.

account-at-work

1.4y

Thank you for the quick reply. Microsegmention is exactly what we were looking to accomplish. I know just enough to be dangerous, so this might not be correct, but it seemed that the lower license levels didn't include vRealize, and we thought that without vRealize (or a similar tool) to help analyze the traffic, setting up the rules on the Microsegemanton would be extremely cumbersome. When we started looking at the higher license levels for NSX it got expensive fast, then adding in the labor, the project costs started spiraling and that is why this project stalled.

Is that incorrect?

bc-squared

1.4y

Yep, you nailed it. Knowing how your apps communicate and what policies are needed is arguably the most difficult part of a microsegmentation implementation. A good partner should be able to help you through this journey or tools such as Aria (formerly vRealize Network Insight) or NSX Intelligence (not my favorite) can help. But, as you mentioned, this will add to the cost and complexity.

If NSX is too costly and complex, maybe you can start with macrosegmentation and run E/W traffic between segments through a NGFW such as Palo or FortiGate?

[deleted]

1.4y

My company is running NSX on a 3 node cluster. We are only using vlan backed segments and as far as analyzing traffics NSX Intelligence is working just right for our needs. It’s really easy to get recommender firewall rules and publish them to the distributed firewall. There some great YT videos out there. Check out NRDY Tech on YT also, a great resource also Rob Rikers tech channel

vtotie

1.4y

NSX Security. I am also recently got interested in NSX Security with just DFW, IPS and IDS only. The new NSX 3.2 made some new interesting changes that makes it appealing to me.

https://www.cloud13.ch/2022/12/21/a-closer-look-at-vmware-nsx-security/

VMware NSX Distributed Firewall with Threat Prevention https://www.cdw.com/product/vmware-nsx-distributed-firewall-with-threat-prevention-term-license-1-ye/6903108

Ahindre

1.4y

Upping this reply. They have this SKU outside their normal tiers for those of us that just want the microsegmentation features.

notyourorginaryitguy

2mo

Zero Networks offers a significantly streamlined approach to microsegmentation, surpassing the complexities of alternative products, including those referenced here.

sjhwilkes

1.4y

What O/S are your virtual machines? The alternative is usually installing an endpoint agent on the VMs as you would with physical servers. As bc-squared points out you can use NSX for micro segmentation only, but it's still a costly and heavyweight solution for that if you're small.

account-at-work

1.4y

We have 40 vms on three hosts, each host has 2 cores. They're all Windows 2016.

As for pricing the reseller gave us three options for our 6 cores:

Professional = $13k a year

Advanced = $20k a year

Enterprise = $44k a year

Professional was well within in the project scope, advance was a stretch, and enterprise was way out of our budget range. The system admin thought he needed enterprise to figure out the traffic, but he wasn't sure. That's where the project stalled.

sjhwilkes

1.4y

You can figure out the traffic fine with just professional- just a matter of setting up a syslog server then adding a permit any any log for a VM, tail - f the log and gradually add rules for the traffic. A majority is easily identified/ rules for the top of the table anyhow, DNS/AD/NTP etc. it’s just a matter of figuring out what legit traffic specific apps generate.

Simrid

1.4y

To be honest there’s not much in the market which delivers what NSX can. The learning curve is steep but the right professional services engagement, with the right company should help you combat this.

No matter which step you take, knowing how to engage with your application owners will be crucial. This being said, there’s tools which can be used to discover application flows such as application platform (formerly NSX intelligence) or Aria.

Drop me a DM and I’ll fire over my LinkedIn where we can chat on all the above ☺️.

xzitony

1.4y

I don’t know about for smaller companies, and I’m a big fan of NSX so that’s my suggestion too.

That said, Prisma, Illumio, Guardicore, Cisco Secure Workload, ShieldX, vArmour— there’s a bunch of options (that I know little about)

notyourorginaryitguy

2mo

Zero Networks offers a significantly streamlined approach to microsegmentation, surpassing the complexities of alternative products, including those referenced here.

foxjon

1.4y

Either move your VLAN virtual interfaces onto the existing firewall or purchase a new one for east west traffic.

Then do segmentation by VLAN, will take a while to organise your rulebase but there's nothing wrong with using a traditional NG firewall for this.

xzitony

1.4y

Sort of. “Microseg” usually implies host-based or Intra-VLAN security, not just Inter-VLAN. I agree though that in smaller deployments where scale isn’t an issue this is effective for at least that latter use.

Over-Ad-6049

1.4y

OP, did you ever figure this out or get this resolved? Or still looking for help?

[deleted]

6mo

Take a look at Illumio for micro seg

1 missing reply