Moving around the data plane, we need to think about how, exactly, we’re going to get packets off of one logical switch and onto another. Or out to the physical infrastructure, even.
Logical routing in NSX-T is so very similar to what we have in NSX-V, but it’s entirely new at the same time.
We still have the concept of a distributed router, embedded in the kernel to make routing decisions. Pretty similar so far.
Logical routers have interfaces, called Downlinks, connected to the logical switches to enable routing between L2 domains. Still pretty much the same as we’re used to.
Logical routers no longer have a DLR Control VM. Well, there’s a bit of a departure from NSX-V.
Let’s reel things back into similarities. We can still maintain two tiers of routing to keep tenants separated. But we don’t refer to the tiers as the Distributed Logical Router and Edge Services Gateway any longer. Now, it’s Tier-1 and Tier-0 routing, respectively. This is where we have to start unlearning NSX-V things and relearning NSX-T things.
The NSX-T routers are all distributed, meaning the Tier-0 and Tier-1 routers are programmed on all the transport nodes throughout the transport zone.
So think about this logical topology:
Everything in the diagram, save for the physical router, is distributed across the transport zone.
Except when they’re not. Without diving too deep here, each of these routers, Tier 0, Tenant A Tier 1, and Tenant B Tier 1, are actually comprised of two objects: the distributed router (DR), and the services router (SR).
So let’s talk about these for a minute. The distributed router component is the part that lives on each transport node. This is the part that makes the routing decisions. If I had two workloads: tenantA-Web and tenantB-Web, and those workloads were instantiated on the same hypervisor, traffic between them would not have to leave the host. If tenantA-Web sent a ping to tenantB-Web, the traffic would go VM -> Tenant A Tier 1 -> Tier 0 -> Tenant B Tier 1 -> VM.
Perhaps breaking the environment up into tenants was a poor choice, as I likely wouldn’t allow traffic between them like that. But that’s where other capabilities come in – the distributed firewall, for example. We’ll talk about more of that kind of stuff as we continue through this series.
Anyway, we have our DR, but what’s this services router thing? Simply put, it’s the component that we use for centralized or non-distributed services, such as dynamic routing, NAT, Firewalling, Load Balancing, L2 Bridging, etc.
I know, you’re wondering, at this point, just what we’re thinking with a whole new routing structure when it sounds a lot like we’ve taken the model from NSX-V, and just distributed the ESG routing. Which is sort of true. But it’s not. Because the Tier 1 routers can run services just as well as the Tier 0 routers, which means everyone gets a services router component, assuming you’ve turned up one of these services.
That’s right, I can do NAT at Tier 0 or Tier 1, I can firewall at either tier, and on and on and on.
But we’re not getting into the specifics of all of that yet.
So where do these services routers live? Since they’re centralized, we need someplace to put them. How about on the Edge? We still have Edges in NSX-T, though they’re definitely no longer “Edge Services Gateways” – just Edges. We’ll talk more about the specifics of them in the next installment. For right now, just remember that all of the stateful or centralized services will live on an Edge node.
Another thing of note, is that I don’t need to deploy a two-tier routing topology. I can attach a Tier 0 logical router to a logical switch. If I don’t need a complex topology, you don’t have to build a complex topology. Just cut Tier 1 completely out of the picture, and you’ll be fine.
This is a lot of information. It may not seem like it, but it really is. We’ll dive into the Edge next in an effort to complete the picture here.
~$ history
Introduction: From NSX-V to NSX-T. An Adventure
NSX-T: The Manager of All Things NSX
The Hall of the Mountain King. or “What Loot do We Find in nsxcli?”
Three Controllers to Rule Them All (that just doesn’t have the same ring to it, does it?)
Beyond Centralization: The Local Control Plane
Transport Zones, Logical Switchies, and Overlays! Oh, My!
VirtualKrueger 