Extend Security Policy from NSX-V to NSX-T

Table of Contents

Migrate from VM-Series on NSX-T Operation to Security Centric Deployment

Use In-Place Migration to Move Your VM-Series from NSX-V to NSX-T

Extend Security Policy from NSX-V to NSX-T

By leveraging your existing device groups and sharing them between the NSX-V and NSX-T service definitions. After migrating your policy to NSX-T, you can continue using the VM-Series for NSX-V or remove your NSX-V deployment.

If you're moving from an NSX-V deployment to an NSX-T deployment or combining an NSX-T deployment with an NSX-V deployment, you can extend your existing security policy from NSX-V to NSX-T without having to recreate the policy rules. This is achieved by leveraging your existing device groups and sharing them between the NSX-V and NSX-T service definitions. After migrating your policy to NSX-T, you can continue using the VM-Series for NSX-V or remove your NSX-V deployment.

Install the Panorama Plugin for VMware NSX 3.2.0 or later. See the Panorama Plugin for VMware NSX 3.2.0 Release Notes before upgrading.
Configure an NSX-T service definition for each NSX-V service definition in your deployment. Do not create new device groups; instead use your existing NSX-V device groups. Using the existing device groups allows you to apply the same security policy rules used on NSX-V to the VM-Series firewalls deployed on NSX-T. If you have policy that references a particular zone, add the same template stack from your NSX-V service definition to your NSX-T service definition. Additionally, if your device group references a particular template, ensure that you select the template stack that includes the template referenced in the device group.
Configure an NSX-T service manager and associate the NSX-T service definitions to the service manager.
Prepare your NSX-T environment and deploy the VM-Series firewall. Create your security groups, service chains, and traffic redirection policy before launching the VM-Series firewall.
- VM-Series Firewall on VMware NSX-T (North-South)
- Deploy the VM-Series Using the Operations-Centric Workflow
Add the NSX-T tags to you existing Dynamic Address Groups.
1. Select PanoramaObjectsAddress Groups.
2. Click on the name of an existing NSX-V Dynamic Address Group.
3. Click Add Match Criteria to display the tags from NSX-V and NSX-T.
4. Add the NSX-T tag to the Dynamic Address Groups. Be sure to use the OR operator between the tags.
5. When you have added all the necessary tags, click OK.
6. Commit your changes.
After your VM workloads have successfully migrated from NSX-V to NSX-T, you remove the NSX-V tags from your Dynamic Address Groups if you plan to discontinue use of NSX-V. All NSX-V tags and corresponding IP addresses are unregistered after all NSX-V related configuration is removed from the Panorama plugin for NSX and VM-Series firewall configuration is removed from the NSX-V manager.