48
VM-Series
Deployment
Guide
VM-Series NSX Edition Firewall Overview
The VM-Series NSX Edition Firewall
then enforces security policy by matching on source or destination IP address—the use of Dynamic Address
Groups allows the firewall to populate the members of the groups in real time—and forwards the traffic to
the filters on the NSX Firewall.
To understand how the NSX Manager and Panorama stay synchronized with the changes in the SDDC and
ensure that the VM-Series firewall consistently enforces policy, see
Policy Enforcement using Dynamic
Address Groups
.
Policy Enforcement using Dynamic Address Groups
Unlike the other versions of the VM-Series firewall, the NSX edition does not use security zones as the primary
traffic segmentation mechanism because both virtual wire interfaces belong to the same zone. Instead, the NSX
edition uses Dynamic Address Groups to segment traffic.
A Dynamic Address Group is used as a source or destination object in security policy. Because IP addresses are
constantly changing in a datacenter environment, Dynamic Address Groups offer a way to automate the process
of referencing source and/or destination addresses within security policies. Unlike static address objects that
must be manually updated in configuration and committed whenever there is an address change (addition,
deletion, or move), Dynamic Address Groups automatically adapt to changes.
All security groups defined on the NSX Manager are automatically provided as updates to Panorama using the
NetX API managment plane integration and can be used as filter criteria to create Dynamic Address Groups;
the firewall filters for the name of the security group, which is a tag, to find all the members that belong to a
security group.
If, for example, you have a multi-tier architecture for web applications, on the NSX Manager you create three
security groups for the WebFrontEnd servers, Application servers and the Database servers. The NSX Manager
updates Panorama with the name of the security groups and the IP address of the guests that are included in
each security group.
