The virtualized network: microsegmentation and distributed firewalling — the security that travels with the VM.
NSX moves the network into the hypervisor: distributed switches and routers, and above all the firewall in front of every single vNIC — the policies follow the VM wherever it travels (vMotion included). Microsegmentation, impossible to do with physical appliances, becomes a policy: ransomware's lateral movement stops there.
Intelligence on the real traffic before the rules: microsegmentation without breaking production.
First the critical apps (ERP, backup), then widening: the project by risk priority.
Default-deny between applications: the compromise of ONE machine stays one machine's.
Segments and policies via API: the network keeping pace with the provisioning.
NSX builds the network in overlay (Geneve) on top of any physical fabric: segments, T0/T1 gateways and load balancing defined in software; the Distributed Firewall applies stateful rules at every VM's vNIC (east-west microsegmented without appliances), the dynamic groups (by tag, name, OS) make the policies alive; the multi-site federation distributes the policies; the distributed IDS/IPS inspects where the traffic is born.
The lateral movement blocked: the damage confined.
PCI, OT and guests isolated by policy, with evidence.
Separate logical networks on the same fabric.