VMware NSX Distributed Firewall

NSX Distributed Firewall enforces security policies directly at each individual virtual machine's virtual network interface rather than routing all traffic through a centralized appliance at the network edge. This enables east-west micro-segmentation inside the data center, so you can control traffic between two VMs on the same ESXi host without it ever leaving the hypervisor.

The NSX Distributed Firewall can enforce rules from Layer 2 through Layer 7, meaning it can filter based on MAC addresses, IP addresses, ports, and application-level attributes. At Layer 7, it can use context such as Active Directory group membership and computer identity to create identity-based rules that go beyond simple IP matching.

Yes, the Distributed Firewall feature requires at minimum the NSX Data Center Advanced edition license, which includes micro-segmentation capabilities. The Enterprise edition adds additional features such as IDS/IPS and network detection, but core distributed firewalling is available starting at the Advanced tier.

Full distributed firewall enforcement is applied through the ESXi hypervisor's virtual switch, so it only inspects traffic to and from protected VMs running on NSX-prepared hosts. Physical servers or workloads on non-VMware hypervisors cannot leverage the distributed firewall directly, though VMware does offer guest-introspection-based alternatives for some workloads.