:

https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-69DF70C2-1769-4858-97E7B757CAED08F0.html#:~:text=On%20the%20north%2Dsouth%20traffic,Guest%20Introspection%20(G

I)%20platform.

The main components on the edge node for north-south malware prevention perform the following

functions:

• IDS/IPS engine: Extracts files and relays events and data to the security hub

North-south malware prevention uses the file extraction features of the IDS/IPS engine that runs on

NSX Edge for north-south traffic.

• Security hub: Collects file events, obtains verdicts for known files, sends files for local and cloud-

based analysis, and sends information to the security analyzer

• RAPID: Provides local analysis of the file

• ASDS Cache: Caches reputation and verdicts of known files

The Tier-0 gateway is the valid insertion point for North-South network introspection in an NSX

environment. North-South traffic refers to traffic entering or leaving the data center, and the Tier-0

gateway is responsible for routing this traffic between the NSX environment and external networks.

Placing network introspection at the Tier-0 gateway allows for inspection and security policies to be

applied to traffic as it moves in and out of the data center.

In an NSX environment, a Punting Traffic Group for the NSX Edge uplinks must be configured before

enabling stateful active-active Source NAT (SNAT). This configuration ensures that traffic is

appropriately handled and forwarded between the NSX Edge nodes in an active-active setup,

allowing stateful connections to be maintained across multiple Edge nodes.

Using a Transport Node Profile allows the administrator to apply configuration changes, such as

specifying an NTP server, across multiple Edge Transport Nodes efficiently. This method is scalable

and avoids the need for manual configuration on each individual node. Once the Transport Node

Profile is updated, the configuration can be pushed to all associated nodes.

https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-69604E49-BC8B-4777-BFD8B98F8D1FF064.html

BGP Neighbors: This parameter is essential for establishing BGP sessions with other routers.

Configuring BGP neighbors allows VRF Lite gateways to exchange routing information with adjacent

BGP-enabled devices.

Local AS: The Local Autonomous System (AS) number can be set for the VRF Lite gateway, which is

necessary for BGP operations within a specific routing domain.

The NSX Application Platform Deployment features are divided into three form factors: Evaluation,

Standard, and Advanced. Each form factor determines which NSX features can be activated or

installed on the platform1. The Evaluation form factor supports only NSX Intelligence, which provides

network visibility and analytics for NSX-T environments2. The Standard form factor supports both

NSX Intelligence and NSX Network Detection and Response, which provides network threat

detection and response capabilities for NSX-T environments3. The Advanced form factor supports all

four features: NSX Intelligence, NSX Network Detection and Response, NSX Malware Prevention, and

NSX Metrics1.

https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/nsx-application-platform/GUID85CD2728-8081-45CE-9A4A-D72F49779D6A.html

The show log manager follow command is used on the NSX Manager to view the syslog in real-time.

This command displays ongoing log entries, allowing administrators to monitor syslog messages as

they are generated, which is helpful for troubleshooting and real-time analysis.

Security policy recommendations: Are East-West distributed firewall (DFW) security policies in the application category12. Security group recommendations: Are VMs or physical servers whose traffic flows were analyzed for the time period and the boundary you had specified12. Service recommendations: Are service objects that were used by applications in the VMs or physical servers that you had specified, but the services are not yet defined in the NSX inventory12. https://docs.vmware.com/en/VMware-NSX-Intelligence/4.1/user-guide/GUID-BA3B0D67-4AA8439E-A845-4598DAD6B9D0.html