How to Configure L2 Bridging in NSX-T 3.0

[@jonleichty3550]

Really appreciate your video -- the details of the DPG and the security settings just saved me a huge amount of frustration. Thank you!

[@NRDYTech]

Thanks Jon! Really glad it was helpful!

[@kenmurphy4259]

Nice video Mike, this feature like many others is much cleaner than previous versions, where you had to deploy a DLR to do the same thing

[@NRDYTech]

Thanks Ken! I am not an NSX-V expert (I've dabbled in it a bit), but I do think NSX-T is a huge improvement once you get the hang of some of the new terminology/concepts.

[@SumeethKumar]

Very Nic explained Videos, Sharing knowledge is the best thing one can do!

[@andrewferguson9039]

Really good thank you, thanks again for doing this. I'd created a dedicated "Bridge-TZ" transport Zone, and then created an additional switch within my edges as per some older documents I'd found. Your way looks simpler and cleaner. So I'll unpick mine and see if yours works. NSX-T 3.0 seems to cut out a lot of unnecessary steps. Loving it so far.

[@andrewferguson9039]

I'm thinking it depends how the original port groups were setup on vSphere.

[@NRDYTech]

Agreed! In slightly older versions of NSX-T, it was more complicated in my opinion..now it's almost trivial. Obviously there's other considerations (sizing of edges, physical NICs, etc) for production, but the basic config is really pretty simple!

[@andrewferguson9039]

@@NRDYTech You are awesome, I've just stripped out 50% of the config I had and just changed the edge's main port group to ALL-VLANs... And Bingo!

[@paoloruzic3941]

Good job man! Super easy and understandable.

[@NRDYTech]

Thank you Paolo!

[@rvassan32]

Really good thank you, thanks again for doing this.

[@MrCrrispy]

I'm subscribed :-)

[@aeroSheldonL]

Hey Mike, been watching the series, great video, love it! Just couple questions regarding the overlay traffic. So I understand overlay runs on tunnels, but how is the underlay network like between two VTEPs? is there still vlan involved in the underlay physical network? Do I have to set GWs if I have two VTEPS with different subnet? While I try to ping one vm from another(different host), how do they know where to go from a underlay perspective? Really appreciate it!

[@NRDYTech]

Thanks for the kind words! To answer your first question, all of the "overlay" traffic rides on an underlay VLAN, which I often call the "TEP VLAN" - the whole purpose of this VLAN is to transfer the GENEVE encapsulated (aka: overlay) traffic across the network. You hit the nail on the head - if you do have TEPs in different networks (which is fine, and actually preferable in some situations), you just need to make sure you have routing between those TEPs (and Jumbo MTU). You set the default GW for the TEPs when you configure the N-VDS/VDS in NSX-T.

[@NRDYTech]

To answer the second part of your question, when you ping from one VM to another VM, the host has a couple of tables. They have a routing table, and they also have an ARP and Mac-> TEP table. So say you ping 192.168.2.20, which is on another host, your current host would do a lookup, and see that 192.168.2.20 is on TEP 172.16.5.5...so it will then encapsulate that original traffic with GENEVE, and set the outer IP header to a destination of the 172.16.5.5 TEP IP. By doing this, the underlay only really needs to know about all of the TEP IP/Macs, and not the VMs. Hopefully this makes sense!

[@aeroSheldonL]

@@NRDYTechtHANK YOU!! Makes much more sense! Is there a Facebook or IG or anything I can follow? I know its a bit rude but just really need some help on my project so messaging would be much more efficient lol...its okay if you dont want to... Anyway great explaination!

[@NRDYTech]

@@aeroSheldonL I don't have anything like that setup, but maybe I should start a group or something! To be honest time is VERY valuable for me right now, so I try hard to answer questions here but it would be tough to get involved more than that

[@SumeethKumar]

promiscuous mode and forg mode is enabled on which port. edge has mgmt nic, (left and right vlan back nic connecting phy router) & TEP nic. Am guessing left/right NIC , however in your video its just one?

[@NRDYTech]

Hi Sumeeth, you would be enabling promiscuous mode at the port group level - not at the vNIC of the edge VM. So this would be whatever port group is trunking to your edge VMs (in my case, it's usually something like "ALLTRUNK-PG"

[@Faithhh071]

What's the point of doing it with bridging when you can use VLAN backed segments as well? If it's just for migration reasons, it's still feasible migrating from a legacy VDS port group to VLAN backed segments. Essentially, you're translating a VLAN backed segment to an overlay segment - but what's the benefit to it?

[@NRDYTech]

The reason you'd want to bridge instead of only VLAN-backed segments, is what if you plan on transitioning those particular segments into NSX? Specifically, what if I have the 172.16.0.0/16 network on my physical network. I want to eventually have that exist ONLY in NSX (meaning NSX handles route advertisement and such). I could, in theory, just delete the SVI from my physical network and re-create it in NSX. That would incur an outage though. With bridging, I could create the bridge/network in NSX, and slowly transition VMs into NSX - and most importantly - have them still be L2 adjacent to their buddies still on the old VLAN. Essentially, my "migrated" VMs in NSX are still talking on 172.16.0.0/16, and the VMs I haven't migrated yet are still also on 172.16.0.0/16. Now, you could definitely use VLAN-backed segments if the end goal is to keep the SVI/default gateway on the physical network. That's actually a smart idea. But if the end goal is that NSX owns those segments completely (and the physical network doesn't know about them EXCEPT through route advertisements) - then bridging is probably a better fit. Either way, just a temporary implementation. Sorry for the novel :)

[@Faithhh071]

@@NRDYTech Thank you for the 'novel', that clarified a lot! I find the use case for some things in NSX difficult to tell because I've never used NSX in a real production environment.

[@dhruvsharma3359]

How can we test this in lab ? Does vmware HOL offers something ? Also how to verify bridge is stable edge> get bridge ?

[@cristhiansaid]

hii.. one question: if i want to the defautl gateway be a NSX- Edge Tier 1 and not the physical router??

[@rahimhaleem]

I want to extend a segment in NSX-V to NSX-T, how can we do that?

[@virtualex81]

@NRDY Tech - great videos, really enjoy your content. For whatever reason I cannot get this to work even after following your tutorial step-by-step. I've pinged some internal VMware colleagues as well and it appears to all be set up correctly and "should" be working yet I cannot hit my test VM. Hoping you can give me a quick hand. Not sure if you're an internal VMware employee, if you are, ping me internally and I can provide my contact info. let me know, and keep up the great content!