Site icon Digital Thought Disruption

NSX-T Federation: Multi-Site Architecture, Failover, and Consistency

Paul Bryant

Table of Contents

  1. Introduction
  2. What is NSX-T Federation?
  3. Federation Architecture Overview
    • Global Manager and Local Manager
    • Federation Components
  4. Detailed Multi-Site Topology
    • Diagram
    • Cross-site Federation
  5. Control and Data Plane Consistency
  6. Failover and DR Scenarios
    • Runbook Examples
    • PowerShell & Ansible Monitoring
  7. Real-World Lessons Learned
  8. Troubleshooting Federation Deployments
  9. YAML and PowerShell Templates
    • Federation Object Deployment
    • Site Health Monitoring
  10. Conclusion

1. Introduction

VMware NSX-T Federation enables robust multi-site networking and security for enterprise data centers. NSX-T 4.x offers centralized management, disaster recovery orchestration, and configuration consistency across geographically dispersed sites. This guide provides a deep technical dive into NSX-T Federation, complete with practical diagrams, code snippets, YAML templates, and runbooks proven in real deployments.

2. What is NSX-T Federation?

NSX-T Federation extends networking, security, and policy management across multiple sites. Using a Global Manager (GM) and multiple Local Managers (LM), organizations gain centralized control and seamless failover capabilities. This ensures uniform policy enforcement and workload mobility while maintaining site autonomy.

Key Benefits:

3. Federation Architecture Overview

3.1 Global Manager (GM)

3.2 Local Manager (LM)

3.3 Federation Components

4. Detailed Multi-Site Topology

4.1 Diagram

4.2 Cross-site Federation

5. Control and Data Plane Consistency

NSX-T Federation keeps your multi-site network consistent by ensuring all universal objects (segments, gateways, groups, firewall rules) are created and managed from the Global Manager. Local Managers receive these objects and enforce them within their site’s data plane. If a Local Manager loses contact with the Global Manager, it continues to enforce the last synchronized policies until connectivity is restored.

Consistency Verification:

6. Failover and DR Scenarios

6.1 Failover Types

6.2 Sample DR Runbook

Federation DR: Local Manager Down at Site-B

  1. Detect Site-B Local Manager outage using monitoring scripts
  2. Trigger notification and disaster recovery runbook
  3. Identify affected universal objects (segments, gateways)
  4. Initiate workload failover or mobility to Site-A via global segments
  5. Verify edge/gateway and segment health post-failover
  6. Re-sync policies upon Site-B restoration

7. Real-World Lessons Learned

8. Troubleshooting Federation Deployments

Common Issues:

Sample PowerShell for Health Checking:

# Check status of Global and Local Managers
Get-NsxGlobalManagerStatus
Get-NsxLocalManagerStatus -Site "Site-B"

# Validate object sync
Get-NsxFederationObjectSync -ObjectType Segment

9. YAML and PowerShell Templates

9.1 Ansible YAML: Create Universal Segment

---
- name: Create universal segment with NSX-T API
  hosts: localhost
  tasks:
    - name: POST segment to Global Manager
      uri:
        url: "https://gm.example.com/policy/api/v1/infra/segments"
        method: POST
        headers:
          Content-Type: "application/json"
          Authorization: "Bearer {{ nsx_gm_token }}"
        body: |
          {
            "display_name": "global-segment-prod",
            "type": "DISCONNECTED",
            "replication_mode": "MTEP"
          }
        status_code: 201

9.2 PowerCLI: Federation Monitoring Script

# Connect to NSX Global Manager
Connect-NsxServer -Server gm.example.com -User admin -Password 'YourPassword'

# Get all sites
$sites = Get-NsxSite

foreach ($site in $sites) {
    # Get Local Manager health
    $lmHealth = Get-NsxLocalManagerStatus -Site $site.Name
    Write-Output "$($site.Name): $($lmHealth.Status)"
    
    # Get universal segments
    $segments = Get-NsxSegment -Site $site.Name -Universal
    foreach ($seg in $segments) {
        Write-Output "Segment $($seg.DisplayName) is $($seg.Status)"
    }
}

9.3 API Call: Consistency Check

curl -k -X GET "https://gm.example.com/policy/api/v1/global-infra/sites" \
     -H "Authorization: Bearer $NSX_TOKEN"

10. Conclusion

NSX-T Federation in version 4.x delivers robust, policy-driven multi-site capabilities for demanding data centers. Proper architecture, monitoring, and automation deliver seamless failover and airtight consistency. Use the templates, diagrams, and scripts above to streamline your deployments or tighten your operational controls.

Disclaimer

Disclaimer: The views expressed in this article are those of the author and do not represent the opinions of VMware, my employer or any affiliated organization. Always refer to the official VMware documentation before production deployment.

Exit mobile version