In this part you turn on vDefend, the security services that run inside NSX. The Distributed Firewall segments east to west traffic between workloads, and Distributed IDS and IPS inspects that traffic for threats. Neither is a separate appliance. You enable and configure both on the NSX that your management domain or a workload domain already runs, so this part is configuration rather than a bring-up.

Confirm NSX and licensing, plan your segmentation, build the firewall policy, then optionally add intrusion detection and prevention. Enable the Distributed Firewall before you touch IDS and IPS, because the inspection engine rides on the firewall data path.

Prerequisites

Step 1 confirm NSX and licensing

Start from a healthy NSX with the right entitlement.

1. Log in to NSX Manager for the domain you want to protect.
2. Open System, then Licenses, and confirm a vDefend firewall license is applied.
3. Add the threat prevention entitlement if you plan to use IDS and IPS.

Step 2 plan segmentation and groups

Group workloads before you write rules.

1. Open Inventory, then Groups.
2. Create security groups using dynamic membership such as tags, names or segments.
3. Map each application tier to a group so rules follow the workload.

Step 3 create Distributed Firewall policies

Build the east to west policy from the groups.

1. Open Security, then Distributed Firewall.
2. Click Add Policy and name the policy for the application.
3. Click Add Rule and set source, destination and service using your groups.
4. Set the rule Action to Allow or Drop as your design requires.
5. Click Publish.

Step 4 set the default rule

Decide what happens to traffic no rule matches.

1. Locate the Default Layer3 rule at the bottom of the Distributed Firewall.
2. Keep it at Allow while you build and test policy.
3. Change it to Drop only after your allow rules are proven, to move to a deny by default posture.
4. Click Publish.

Step 5 enable Distributed IDS and IPS

Add intrusion detection and prevention on top of the firewall.

1. Open Security, then Distributed IDS IPS and Malware Prevention.
2. Open Settings and configure the NSX proxy for signature updates, or plan a manual update.
3. Click Download to pull the latest signature set.
4. Under Enable, select the hosts or clusters where inspection should run.

Step 6 create IDS and IPS rules

Point inspection at the traffic you care about.

1. Click Add Policy in the IDS and IPS section.
2. Click Add Rule and scope it to your security groups.
3. Set the Mode to Detect only, or Detect and Prevent to block matches.
4. Click Publish.

Step 7 verify enforcement

Confirm rules apply and events appear.

1. Generate test traffic between two workloads in different groups.
2. Confirm the Distributed Firewall rule hit counters increment.
3. Confirm IDS and IPS events appear for a test signature.

flowchart TD
A[Confirm NSX and license] --> B[Plan groups and segmentation]
B --> C[Create Distributed Firewall policies]
C --> D[Set the default rule]
D --> E[Enable IDS and IPS and signatures]
E --> F[Create IDS and IPS rules]
F --> G[Verify hits and events]

Verify enforcement

Send test traffic between two groups and confirm the Distributed Firewall rule counters move. For IDS and IPS, trigger a benign test signature and confirm the event shows in the security dashboard. If rules do not apply, the NSX DFW troubleshooting guide covers applied-to scope and the default-rule trap.

Plan your segmentation model

The firewall is only as good as the groups behind it, so decide on a model before you write rules. A common approach segments by application and by environment, so production and test cannot reach each other and each application tier only talks to the tiers it must. Use dynamic groups based on tags or names so membership follows the workload as it moves or scales, rather than static lists you have to maintain. Build and test the allow rules with the default rule at Allow, then switch the default to Drop for a deny by default posture once the allow set is proven. VCF Operations for Networks helps here, because it shows the real east to west traffic before you commit rules.

Turbo Mode and performance

VCF 9.1 runs Distributed IDS and IPS in Turbo Mode by default on every ESX host, which raises inspection throughput so you can inspect more traffic without the penalty older releases carried. Even so, inspection is not free. Scope IDS and IPS rules to the traffic that matters rather than inspecting everything, keep the signature set current so you are not spending cycles on stale rules, and start in detect only mode to learn what fires before you switch to prevent. That order avoids blocking good traffic while you tune.

Notes and best practices

Start every firewall project with groups, not rules, because dynamic groups based on tags let policy follow a workload as it moves or scales, while static lists rot the day someone builds a new VM. Keep the default rule at Allow while you write and test the allow set, then switch it to Drop for a deny by default posture only once the allow rules are proven, since flipping it early blocks good traffic and erodes trust in the project. Scope IDS and IPS to the segments that carry sensitive traffic rather than inspecting everything, and start in detect only mode so you learn what fires before you let it block. Keep the signature set current through the NSX proxy, because stale signatures spend host cycles without catching modern threats. Review rule hit counters regularly and retire rules that never match, so the policy stays readable.

Common errors and fixes

IDS and IPS will not enable.
The Distributed Firewall must be enabled first, because inspection rides on the firewall data path. Enable and publish firewall policy, then enable IDS and IPS.

Signatures are stale.
Without internet the signature set does not refresh. Configure the NSX proxy for updates, or import signatures manually on a schedule.

Traffic dropped after the default rule change.
Moving the default rule to Drop before your allow rules are complete blocks good traffic. Return it to Allow, finish and test the allow rules, then switch to Drop.

No license for prevention.
IDS and IPS needs the threat prevention entitlement. Apply it in NSX Licenses, then retry.

Common questions

Is vDefend a separate appliance
No. It is the NSX security layer, configured on your existing NSX rather than deployed as its own appliance.

Does IDS and IPS need the firewall
Yes. Distributed IDS and IPS requires the Distributed Firewall to be enabled first.

What is Turbo Mode
A higher throughput inspection mode that is the default on all VCF 9.1 ESX hosts.

Do I need extra licensing
Yes. A vDefend firewall license is required, and threat prevention is a further entitlement for IDS and IPS.

References

• Broadcom TechDocs: VMware vDefend 9.1 Release Notes
• Broadcom TechDocs: What is new in NSX (VCF 9.1)
• Broadcom TechDocs: Workflow for Distributed IDS and IPS

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts