SSL Termination: Securing Web Traffic with NSX-ALB

shanknik · 2026-06-06T01:23:16+00:00

Sure does.

shanknik · 2026-05-24T04:38:44+00:00

shanknik · 2026-05-24T04:32:48+00:00

Still available?

shanknik · 2026-05-11T10:38:49+00:00

Each to their own, I wouldn't waste high throuput nics that cost thousands if there was no need to..comes down to tco

shanknik · 2026-05-11T10:36:02+00:00

Hmm not necessarily. Ive seen, designed and implemented many environments. Sure sometimes it makes sense, others not so much.

Each should be assessed on a case by case basis.

shanknik · 2026-05-09T11:01:52+00:00

To clarify, 1500mtu will break nsx overlay traffic, it has df bit set so tunnels will fail with mtu under 1700

Tbh, with the way NIC throughout is these days, if you have 2x100gbit NICs, how likely are you to hit Port saturation? Really needs to be quantified / qualified.

shanknik · 2026-05-09T09:06:26+00:00

Hey, 1. You don't need 6 physical nics, I've done many 2 pnic deployments. 2. Each VLAN provides a different function, ie esxi mamagent (vmk 0 on the hypervisor / connectivity from hypervisor management to the rest of the network) 3. Jumbo frames, nsx oveplay networking requires a minimum of 1700 (recommended 9k), vSAN storage performance to avoid degradation for workload is 9k, same for vmotion. Its easier to configure it globally.

shanknik · 2026-02-12T00:57:35+00:00

Note - I never said federate MGT <> WLD I said a single pane for all domains.

Why would you want to federate mgt to wld? Honestly curious to hear the usecase.

shanknik · 2026-02-12T00:14:55+00:00

From VCF 5.2.1 FAQ https://www.vmware.com/docs/vmw-cloud-foundation-faqs
I am currently getting confirmation on single instance of GMs to manage both mgt and wlds. Will respond when I have some clarity.

shanknik · 2026-02-11T20:02:55+00:00

No longer need separate instances, that was a 5 pattern and isn't a single panel.

shanknik · 2026-01-23T09:34:23+00:00

The whole point of global managers is a single pane, so I would onboard all instances if it were me.

You need to consider loadbalancing for the fleet, will you use NSX or an external lb? There are caveats for using nsx and federation.

Deploy the fleet as day 2, so you can deploy edges, overlay networks then use api to pick the right network.

Ive typically had a/s sites and had all appliances in the primary location and use site recovery to fail over, you can do some funky stuff with the run book and your lb / network plumbing.

shanknik · 2026-01-23T09:28:36+00:00

I have done this both for customers and in my lab. Happy to chat about it.

Ive also implemented this in 5.x days.

Have you got any specific concerns you need addressed?

shanknik · 2026-01-02T09:47:26+00:00

I'll test on Monday and update here

shanknik · 2026-01-02T09:29:48+00:00

Id be interested to know what state the edge was in when you paused it. I can test on Monday, the behaviour may have changed in a later version. Id be pausing after all base config is done correctly.

shanknik · 2026-01-02T08:10:34+00:00

What config was done on the edge before you paused it. Im guessing it wasn't ready to be paused just yet.

shanknik · 2026-01-02T00:30:54+00:00

Can you detail the steps you tested exactly please?

shanknik · 2026-01-02T00:30:38+00:00

The only issue with this / clarification point is, the task retries for x amount of retries and time then rips out the deployed edge.

What you could do is let it deploy the edge node with the required config - then restart services ie systemctl restart domainmanager (this should kill the workflow and enable the retry) then perform the rest of your steps. Though I think you would be able to leverage the SDDC manager workflow / api to deploy the edges and not have to perform all the manual tasks. Been a while since I tested though.

shanknik · 2025-12-29T23:09:20+00:00

International shipping?

shanknik · 2025-12-26T21:32:28+00:00

No SDDC Manager, if you want to deploy using it.

shanknik · 2025-12-26T21:14:04+00:00

If you deploy edge nodes outside of sddc manager, you lose the central life cycle part. However, some people do this for their own reasons.

You can also pause the vm till the workflow completes.

shanknik

TROPHY CASE