Status in a VCF 9.1 deployment: Optional. An NSX Edge cluster is only required when a domain needs centralized north-south routing, NAT, or a Tier 0 gateway for VPC external connectivity.
What it does: Deploys a pair of NSX Edge virtual machines that host the Tier 0 gateway service router and the transit gateway service router, giving workloads a routed path to the physical network.
Depends on: A deployed management or VI workload domain with a registered NSX Manager, hosts prepared as transport nodes, a vSphere Distributed Switch with uplinks, an Edge TEP VLAN, and DNS records for each edge node.
TL;DR
- An NSX Edge cluster is optional. Deploy it only when a domain needs routing, NAT, or VPC external connectivity through a Tier 0 gateway.
- In VCF 9.1 you deploy edges from the vCenter UI under Networks, Network Connectivity, not from SDDC Manager.
- A cluster needs a minimum of two edge nodes and supports up to ten.
- Edge form factors are Small (2 vCPU, 4 GB), Medium (4 vCPU, 8 GB), Large (8 vCPU, 32 GB), and Extra Large (16 vCPU, 64 GB), each with a 200 GB disk.
- Prepare an Edge TEP VLAN, an IP pool or DHCP scope, DNS records, and a local ASN plus BGP peers if you want dynamic routing.
- Key steps: open Configure Network Connectivity, pick Centralized Connectivity, size the cluster, add and clone edge nodes, configure the Tier 0 gateway, set VPC IP blocks, and click Deploy.
This part shows you how to deploy an NSX Edge cluster in VCF 9.1 using the guided workflow in the vSphere Client. You will deploy two NSX Edge virtual machines, form them into an edge cluster, and configure a Tier 0 gateway so workloads can reach the physical network. An edge cluster is optional. If your workloads only need east-west connectivity inside a VPC or a distributed VLAN connection, you can skip edges entirely and add them later.
Before you start, confirm the target domain is built and healthy. Edges attach to a workload domain, so complete the VI workload domain build first, or deploy into the management domain if that is where external connectivity is needed. Have the VLAN, DNS, and NTP groundwork from the network, DNS and NTP setup in place, and keep the edge node FQDNs and BGP details on hand. If you want a refresher on where the Tier 0 gateway sits, review how NSX fits into VCF.
Prerequisites
VCF Installer and VCF Operations fulfil several of these by default when they build a domain. Confirm each item below before you open the wizard, because the deployment fails a validation check if any are missing.
| Requirement | What to confirm |
|---|---|
| NSX Manager | Deployed and healthy for the domain, with the vCenter registered as a compute manager. |
| Transport nodes | All hosts prepared as transport nodes with a Transport Node Profile attached to the vSphere cluster. |
| vSphere Distributed Switch | A VDS with uplinks configured on every host that will run an edge. |
| Edge TEP VLAN | A VLAN for edge tunnel endpoints. It can reuse the host TEP VLAN if the hosts have three or more pNICs, otherwise use a separate routable VLAN. |
| TEP addressing | An IP pool, a static list, or a DHCP scope for the edge TEP interfaces. |
| DNS records | Forward and reverse records for each edge node FQDN and management IP. |
| Routing | For BGP, a reserved local ASN and two BGP peers on the top of rack switch. For static routing, a plan for an HA VIP. |
| Capacity | Each edge reserves 100 percent of its CPU and memory, so size the cluster for at least two nodes of your chosen form factor. |
Pick an edge form factor from the table below. Use Small only for a lab. Medium, Large, or Extra Large suit production, and load balancing needs Large or larger.
| Form factor | vCPU | Memory | Disk | Use |
|---|---|---|---|---|
| Small | 2 | 4 GB | 200 GB | Lab and proof of concept only |
| Medium | 4 | 8 GB | 200 GB | Production, lighter workloads |
| Large | 8 | 32 GB | 200 GB | Production with load balancing |
| Extra Large | 16 | 64 GB | 200 GB | Production, high throughput and services |
Step 1 confirm the domain and NSX state
Check that the target domain is healthy and that NSX Manager sees the vCenter before you begin.
- Log in to the vSphere Client for the workload domain vCenter.
- Open the NSX Manager UI for that domain in a separate tab.
- Go to System, then Fabric, then Hosts, and confirm every host shows a green configuration state.
- Go to System, then Fabric, then Compute Managers, and confirm the vCenter is registered and its status is Registered.
- Confirm a Transport Node Profile is attached to the vSphere cluster that will host the edges.
Step 2 plan the Edge TEP VLAN, addressing and routing
Decide the tunnel endpoint VLAN, how TEP addresses are handed out, and how the Tier 0 gateway will reach the physical network.
- Reserve a VLAN ID for the Edge TEP network. Reuse the host TEP VLAN only when hosts carry three or more pNICs, otherwise use a separate VLAN that routes to the host TEP VLAN.
- Choose an addressing method for TEPs: an IP pool, a static IPv4 list, or a DHCP scope.
- Add forward and reverse DNS records for each edge node FQDN and its management IP.
- For dynamic routing, reserve a local ASN and configure two BGP peers on the top of rack switch, each with an interface IP and a BGP password.
- For static routing, plan an HA VIP for the active or standby Tier 0 gateway and set that VIP as the next hop on the top of rack switch.
Step 3 open the Configure Network Connectivity wizard
In VCF 9.1 you deploy edges from the vCenter UI, not from SDDC Manager. Start the guided workflow from the Networks view.
- In the vSphere Client, select the vCenter for the workload domain.
- Click the Networks tab.
- Select Network Connectivity.
- Click Configure Network Connectivity to open the wizard.
Step 4 select centralized connectivity and clear prerequisites
Centralized connectivity routes traffic through a Tier 0 gateway on the edge nodes. Distributed connectivity uses a VLAN and needs no edges, so pick Centralized when you want a routed or BGP uplink.
- On the Gateway Type page, select Centralized Connectivity.
- Click Next.
- Read the Networking Prerequisites page and confirm each item is met.
- Click Continue.
Step 5 name the edge cluster and set the TEP MTU
Give the cluster a name and confirm the tunnel endpoint MTU that the wizard reads from NSX global fabric settings.
- Enter a name for the edge cluster, for example edge cluster wld01.
- Confirm the Tunnel Endpoint MTU value. It is pre-selected from the global fabric settings and should be 9000 where the physical fabric supports jumbo frames.
- Select the Edge Form Factor, for example Large for a production cluster.
Step 6 add and configure the first edge node
Add the first edge node and enter its placement, management address, uplink mapping, and TEP settings. Reuse the host overlay configuration where you can, so the wizard fills in the TEP VLAN and pool for you.
- On the Edge Cluster page, click Add to add an edge node.
- In Edge Node Name, enter the FQDN that matches the DNS record, for example edge01.wld01.example.local.
- In vSphere Cluster, select the cluster that will host the edge.
- In Data Store, select the datastore for the edge virtual machine.
- Under Management IP, set IP Allocation to Static or DHCP.
- In Port Group, select the management port group where vCenter and NSX Manager reside.
- For static allocation, enter the Management IP CIDR and the Default Gateway. Each node needs a unique management IP.
- Under Uplinks, select Use the host overlay network configuration from the selected vSphere Cluster to auto fill the TEP VLAN and IP assignment.
- If you clear that checkbox, map the edge fp-eth0 and fp-eth1 interfaces to the host pNICs, set the TEP VLAN, and select an IP pool, static list, or DHCP for the TEP.
- Click Apply to save the first edge node.
Step 7 set passwords and clone the second node
A cluster needs at least two nodes. Clone the first node to add the second, then set the edge credentials. Cloning only fits when the second node sits on the same vSphere cluster with identical networks.
- Decide how passwords are handled. Leave Manage Edge Password with VCF on to let VCF generate them, or turn it off to set them by hand.
- If you set them by hand, enter the CLI username and password, and the system root password. Each password needs at least 12 characters, one lowercase, one uppercase, one digit, one special character, and five different characters.
- On the Edge Cluster page, click Clone to create the second node from the first.
- Enter a unique Edge Node Name FQDN for the cloned node, for example edge02.wld01.example.local.
- Click Apply.
Step 8 configure the Tier 0 gateway and routing
On the Workload Domain Connectivity page, define the Tier 0 gateway and its uplinks. You can also click Skip to deploy edges now and add routing later.
- Enter a Gateway Name for the Tier 0 gateway.
- Select the High Availability Mode. Choose Active Standby if VKS will run in this domain.
- Set Gateway Routing Type to BGP or Static.
- For BGP, enter the Local Autonomous System number you reserved.
- Under Gateway Uplinks, configure an uplink for each edge node to the top of rack router.
- For BGP, enter the BGP Peer IP, the MTU between 1500 and 9000, and the BGP Peer Password, then confirm the password.
- For Static routing, enter the Gateway Interface VLAN and the Gateway Interface CIDR for each uplink.
Step 9 set VPC IP blocks and deploy
Provision the IP blocks the transit gateway hands to VPCs, review the summary, and start the deployment.
- Under VPC configuration, enter External IP Blocks that the Tier 0 gateway advertises to the physical network. These must not overlap other ranges.
- Enter Private Transit Gateway IP Blocks for inter VPC traffic. These stay inside the project and are not advertised.
- Review the Edge Cluster Details and Workload Domain Connectivity summary.
- Click Deploy to start the build.
- Watch the deployment progress on the Network Connectivity page while the edge VMs are created.
During the build the wizard automatically creates two trunk port groups in vCenter, one for each of the fp-eth0 and fp-eth1 interfaces on the edges. A full run to two production edges usually completes in about 20 to 40 minutes depending on host speed and datastore performance.
Deployment flow at a glance
flowchart TD A[Confirm domain and NSX state] --> B[Plan Edge TEP VLAN addressing routing] B --> C[Open Configure Network Connectivity] C --> D[Select Centralized Connectivity] D --> E[Name cluster set TEP MTU] E --> F[Add first edge node] F --> G[Set passwords clone second node] G --> H[Configure Tier 0 and routing] H --> I[Set VPC IP blocks then Deploy] I --> J[Verify in NSX Manager and vCenter]
Verify the deployment
Confirm the edge nodes, the cluster, and the Tier 0 gateway from both NSX Manager and vCenter.
- In NSX Manager, go to System, then Fabric, then Nodes, then Edge Transport Nodes, and confirm both edges show a Success configuration state and Up node status.
- In NSX Manager, open the Edge Clusters view and confirm the cluster lists both members.
- In NSX Manager, go to Networking, then Tier 0 Gateways, and confirm the gateway exists.
- For BGP, open the Tier 0 gateway BGP view and confirm each neighbor state is Established.
- In the vSphere Client, go to Networks, then Network Connectivity, and confirm the edge cluster appears with a healthy status.
- In the vSphere Client host and cluster inventory, confirm the two auto created trunk port groups are present.
If BGP neighbors are Established and the Tier 0 gateway advertises the external IP blocks, a test workload on a VPC public subnet can reach the physical network.
Common errors and fixes
| Symptom | Cause and fix |
|---|---|
| Prerequisite check blocks the wizard | A Transport Node Profile is not attached or hosts are not prepared. Attach the TNP to the cluster on the NSX Fabric Hosts page, then reopen the wizard. |
| Edge deploy fails with a name resolution error | A forward or reverse DNS record for the edge FQDN is missing. Add both records, confirm they resolve, then retry. |
| Edges deploy but overlay tunnels stay down | The Edge TEP VLAN and host TEP VLAN cannot route to each other, common on two pNIC hosts. Put them on routable VLANs or use a single VLAN with NSX enabled on the DVPG. |
| BGP neighbor stays in Connect or Idle | A mismatched ASN, peer IP, or BGP password. Confirm the local ASN, the peer IP, and the password match the top of rack switch, then reset the session. |
| Not enough resources to place the edges | Each edge reserves 100 percent CPU and memory. Free capacity on the cluster or choose a smaller form factor, then retry. |
Common questions
Is an NSX Edge cluster mandatory in VCF 9.1. No. It is optional. Deploy it only when a domain needs routed north-south traffic, NAT, load balancing placement, or a Tier 0 gateway for VPC external connectivity.
How many edge nodes does a cluster need. A cluster needs a minimum of two nodes and supports up to ten.
Can I still deploy edges from NSX Manager. Yes. The vCenter wizard covers the common centralized case, and NSX Manager remains available for advanced designs.
Which form factor should I pick for production with load balancing. Use Large or Extra Large. Small is for lab use only.
Do I have to configure routing during deployment. No. Click Skip on the Workload Domain Connectivity page to deploy the edges first, then set the gateway and routing later from Networks, Network Connectivity.
References
- Broadcom TechDocs, Configure Centralized Network Connectivity with Edge Clusters
- Broadcom TechDocs, Centralized Connectivity Model, VCF 9.1 design library
- Broadcom TechDocs, Add an NSX Edge Node to an NSX Edge Cluster
- VMware Cloud Foundation Blog, VPC Centralized Network Connectivity with Guided Edge Deployment
« Previous: How to Create a VI Workload Domain in VCF 9.1 (Part 8)
Complete guide: VCF 9.1 Deployment Complete Guide
About The Author
