What is the NSX Advanced Firewall Add-On?
Advanced Distributed Security for VMware Cloud on AWS workloads
Ensure workloads are secure and compliance goals are met. NSX Advanced Firewall for VMware Cloud on AWS customers provides layer 7 distributed security that scales linearly with VMs, with no blind spots during network traffic inspections.
Distributed IDS/ IPS
Distributed traffic inspection that scales seamlessly, with context based threat prevention.
Distributed Firewall with Active Directory based User ID
Per user and session application access control with an Identity Firewall.
Distributed Firewall with Layer 7 Application ID
Deep Packet Inspection built into the hypervisor with built in profiles for common enterprise applications.
Distributed Firewall with FQDN Filtering
Permit or deny communication to specific destinations in the Internet.
Pricing - NSX Advanced Firewall
Pricing starting October 1, 2021
NSX Advanced Firewall for VMware Cloud on AWS |
i3.metal |
i3en.metal |
i4i.metal |
List Price / host |
List Price / host |
List Price / host |
|
| On-Demand (hourly) | $0.83/hour | $1.10/hour | $1.47/hour |
| 1-year subscription | $4,995/Year | $6,660/Year | $8,880.00/Year |
| 3-year subscription | $10,704/3 Years | $14,272/3 Years | $19,029.33/3 Years |
Prices in USD
Priced on a per-host basis. Applies to all hosts in the SDDC.
Frequently Asked Questions
The Advanced Firewall Add-On is a new set of capabilities enhancing the security offerings for VMware Cloud on AWS. It features Layer 7 Distributed firewalling, Fully Qualified Domain Name (FQDN) Filter List, Distributed Intrusion Detection/Prevention Services (D-IDS/IPS), and Active Directory Based Identity Firewalling.
What are the requirements to run the Advanced Firewall Add-On?
The Advanced Firewall Add-On requires an SDDC with VMC release M15 or higher.
Is the Advanced Firewall Add-On part of the base VMware Cloud on AWS offering?
The Advanced Firewall Add-On is an additional service that needs to be enabled per SDDC to begin using the additional features. Pricing and billing information can be found on the VMware Cloud on AWS pricing page here: https://cloud.vmware.com/vmc-aws/pricing OR the product page here: https://www.vmware.com/products/nsx-advanced-firewall-for-vmc.html
Does the Advanced Firewall Add-On apply to all VMs in the SDDC?
Yes, the Advanced Firewall Add-On is enabled at the hypervisor level on all hosts in the SDDC. It applies to all VMs.
Does the Advanced Firewall Add-On protect East-West and North-South traffic?
Yes, the Advanced Firewall Add-On protects both East-West and North-South traffic based on the user configured policy.
Does the Advanced Firewall Add-On protect against Malware?
Yes, the Distributed IDS/IPS feature can protect against Malware that matches the curated signatures configured.
What AWS Regions are the Advanced Firewall Add-On available?
The Advanced Firewall Add-On is available in all AWS commercial regions where VMC is available.
What are the scale attributes for the Advanced Firewall Add-On features?
Please refer to VMC ConfigMax for current scale attributes here. https://configmax.vmware.com/home
What level of feature enablement is available for the Distributed IDS/IPS?
The Distributed IDS/IPS is enabled or disabled on a per vCenter cluster basis.
Where do I download signatures for Distributed IDS/IPS?
Updated signatures for the Distributed IDS/IPS are obtained from the NSX Threat Intelligence Cloud (NTIC) service. This can be configured for automatic updates to streamline administration and ensure the most current signatures are in place.
What is NSX Threat Intelligence Cloud services?
NSX Threat Intelligence Cloud service is a VMware managed repository of IDS/IPS signatures. It is a cloud based offering hosted in multiple regions across the globe.
Where are Distributed IDS/IPS signatures stored?
The signatures for Distributed IDS/IPS are downloaded initially to NSX Manager inside the SDDC then automatically placed on each host in a cluster that is configured to use Distributed IDS/IPS.
Can I run the Distributed IDS/IPS in detect only mode?
Yes, when a policy is configured for the Distributed IDS/IPS it can be configured for detect only (IDS) or detect and prevent (IPS) actions.
What is the use case for Identity Firewall (IDFW)?
The primary use case for IDFW is for granular, per user session based firewall policy in Virtual Desktop Infrastructure (VDI) environments.
Does Identity Firewall (IDFW) support Remote Desktop Session Host (RDSH)?
The IDFW supports both VDI and RDSH methods for remote access.
What level of feature enablement is available for the Identity Firewall (IDFW)?
The IDFW is enabled or disabled on a per vCenter cluster basis.
Is Guest Introspection required to use the Identity Firewall (IDFW) feature?
Guest Introspection is used by the IDFW feature.
Does Guest Introspection require a dedicated VM to operate?
VMware Cloud on AWS uses a kernel based Guest Introspection engine that does not require a dedicated VM to operation.
Is VMTools required for Identity Firewall (IDFW)?
The IDFW feature requires VMTools 11.x or higher to be installed on the guest VMs.
What are the use cases for Layer 7 Firewalling?
The common use case for Layer 7 Firewalling is to allow granular inspection of traffic inside a given port or protocol. This is frequently used to detect and prevent unauthorized traffic to use commonly allowed ports and protocols. It is also used to ensure specific encryption protocols are used for secure traffic.
Does the Layer 7 Firewalling feature have pre-configured application definitions?
The Layer 7 Firewalling feature has more than 70 pre-configured application definitions based on commonly used Enterprise applications to enable a fast deployment of the feature.
Is it possible to define a custom application in the Layer 7 Firewall?
The Layer 7 Firewall uses Context Profiles to define applications and the ability to add custom profiles is available.
What are the use cases for Fully Qualified Domain Name (FQDN)Filtering?
The common use cases for FQDN filtering include restricting access to unauthorized URLs or conversely restricting access to specific authorized URLs.
Does the Fully Qualified Domain Name (FQDN) Filtering feature require DNS Snooping?
The FQDN Filtering feature uses DNS Snooping on the Distributed Firewall (DFW) to observe and track the DNS requests from guests.
Is it possible to deactivate the Advanced Firewall Add-On?
The Advanced Firewall Add-On can be enabled or disabled by the user at any time.
What happens if I disable the Advanced Firewall Add-On?
If the Advanced Firewall Add-On is disabled additional policy for Distributed IDS/IPS, FQDN Filtering, IDFW or Layer 7 firewalling cannot be added, and existing policy cannot be edited. Previously configured policy will still be enforced and is retained until deleted by the administrator.
What happens if I re-enable the Advanced Firewall Add-On?
If the Advanced Firewall Add-On is re-enabled, existing policy will become configurable.
Where can I find the latest pricing for the NSX Advanced Firewall Add-on?
Pricing and billing information can be found on the VMware Cloud on AWS pricing page here: https://cloud.vmware.com/vmc-aws/pricing OR the product page here: https://www.vmware.com/products/nsx-advanced-firewall-for-vmc.html
