Views:

The Service Segment is required to deploy the Trend Micro Deep Security Service in NSX-T:

Overlay Transport Zone

  1. Click Action and then click ADD SERVICE SEGMENT.
  2. Under Name, enter a name e.g. service-segment.
  3. Under Transport Zone (Overlay), select "transport-zone-overlay" or whichever overlay transport zone you are using.
  4. Leave "Connected To" empty.
  5. Click SAVE and then CLOSE.

    A service segment should be created.

  6. From the Service Segments dropdown list, select the service segment you just created.

The service segment needs to have a transport zone.

Service Segment

Below is the LSW limitation:

image.png
 

Situation No Machine NIC Features of DSVA, which VDI or Virtual Machine use Auto isolation by DFW Type of LSW in ESXi Limitation about LSW
No. Purpose LSW LSW installed by NSX-T
vSS vDS N-VDS
AM WRS FW IPS IM LI AC - Overlay VLAN Overlay VLAN
1 DSVA eth0 Management. To connect DSM. - - - - - - - - Available Available Available Available Available Available It is OK if DSVA can connect DSM and DSR.
2 eth1 Can not set value by user. For GI service. - - - - - - - - Available - - - - - Automatically created and set vSS.
3 eth2 Can not set value by user. For NI service. - - - - - - - - - - Available - Available -

It is required to set a LSW that is Overlay-backend network. The LSW is created automatically when DSVA be deployed.

4 VDI or Virtual machine ethX Service for VDI or Virtual Machine ON - - - ON - - - Available Available Available Available Available Available -
5 ON - - - ON - - Using - - Available Available Available Available

If Customer wants to use auto isolation by NSX-T DFW, VDI or Virtual Machine need to belong LSW installed by NSX-T. However if do not use Network features at DSVA, the machine can use LSW which created by VLAN-backend and Overlay-backend.

6 - ON ON ON - - - - - - Available Available1 Available Available1

If Customer wants to use WRS, IPS or FW feature by DSVA, there are 2 limitations:

  1. VDI or Virtual Machine NIC connect to Overlay-backend or VLAN-backend LSW are supported.
  2. The overlay network is designed as service segment used for DSVA deployed .

1- Support NSX-T 3.1.5 above and 3.2.1 above build

7 - ON ON ON - - - Using - - Available Available1 Available Available1
8 ON ON ON ON ON - - - - - Available Available1 Available Available1
9 ON ON ON ON ON - - Using - - Available Available1 Available Available1
Comments (0)