Network

VMware Cloud Director

Yandex Cloud

This layer contains both distributed components, such as the NSX router, and centralized components (running on dedicated nodes), such as NSX Edge. The latter are virtual machines or bare-metal servers that provide high-performance interface between the NSX overlay network and the physical data center network.

Yandex Cloud implements a similar SDN design approach: each hypervisor contains vRouter components that handle network packet routing and processing, as well as cloud gateway components that interface SDN clouds with the outside world.

The main differences lie in the overlay encapsulation technologies and the methods used to ensure connectivity between the solution system components.

While NSX-T uses the Geneve encapsulation, Yandex Cloud is based on MPLSoverUDP.

Both approaches enable granular load balancing of network traffic at the transport layer, as well as expanding the header to transfer additional service data at the transport layer (telemetry and tracing), if required.

VMware Cloud Director

Yandex Cloud

In NSX-T, control plane and management plane are hosted on the NSX-T Manager cluster nodes (three nodes in total). Each node runs control plane and management plane processes, with all system state variables being stored in CorfuDB.

In Yandex Cloud, control plane and management plane are deployed on different nodes (unlike in NSX-T). The controller cluster can include more than three nodes.

VMware Cloud Director

Yandex Cloud

NSX transport zones (TZs) define the boundaries for network segments, such as VLANs and software overlays.

A transport zone can contain multiple types of vSphere clusters.

In NSX-T, transport zones can be either overlay or VLAN-based.

In Yandex Cloud, an availability zone (AZ) may serve as an SDN equivalent to an NSX-T overlay transport zone. L2 within each availability zone is unique and does not extend across other zones.

Yandex Cloud has no transport zones of the VLAN type. Since all hosts, including dedicated ones, are virtualized, you can use overlay segments to connect cloud workloads.

A logical switch created in a transport zone (TZ) will run on all virtualized infrastructure nodes that have been added as transport nodes to that TZ. Similarly, a distributed logical router (LR) linked to logical switches in that TZ will create an LR instance on each virtualization node attached to the transport zone.

VMware Cloud Director

Yandex Cloud

In NSX-T, it specifically refers to a virtual switch that operates within the kernel of each hypervisor. It provides virtual ports for connecting a virtual machine to the network infrastructure using uplinks, i.e., physical host interfaces. It implements Geneve overlay encapsulation.

The NSX-T infrastructure supports multicast (L2/L3) and VRRP/HSRP.

Yandex Cloud uses vRouter as the equivalent. It is a virtual router that similarly operates within the kernel of each host hypervisor and performs similar functions with the MPLSoverUDP encapsulation: high entropy for outgoing flows, granular traffic flow balancing, and potential use of extended headers for packet tracing and telemetry collection.

Unlike N-VDS, vRouter features integrated routing across all virtual ports, including those that are technically within a single subnet. In N-VDS, traffic through the ports within a single subnet is not routed.

Therefore, Yandex Cloud does not support such protocols as VRRP/HSRP and multicast (L2/L3).

VMware Cloud Director

Yandex Cloud

All NSX-T fabric hosts are initially set up as transport nodes. For their further configuration and monitoring with NSX-T Manager, you need to install the required software components.

For distributed traffic routing, the NSX-T infrastructure uses a logical router (LR), which has a complex internal architecture:

• Tier1-GW: Tenant component.

• Tier0-GW: Inter-tenant (provider) component.

Both Tier1-GW and Tier0-GW have a distributed router (DR) and a service router (SR). The DR is deployed across all transport nodes within the selected transport zone, while the SR is limited to Edge nodes (which are interface nodes, virtual or bare-metal) within the selected transport zone.

In Yandex Cloud, the vRouter routing module running on all cloud hosts serves as the equivalent of the DR in Tier0-GW and Tier1-GW.

Edge gateways are implemented as dedicated virtual machines without a distributed router component inside. In this sense, the Yandex Cloud SDN architecture is more similar to the NSX-v for vSphere architecture.

VMware Cloud Director

Yandex Cloud

In NSX-T, you can use dedicated clusters for a specific class of workload.

For high-performance interfacing with external networks, NSX-T supports the use of Bare Metal Edge clusters.

To reduce the NSX-T network traffic processing load on guest VMs, you can offload overlay encapsulation using SR-IOV, DPU, or SmartNIC.

In Yandex Cloud, you can use dedicated virtualized hosts.

You can also set up a software-accelerated network for load balancing.

VMware Cloud Director

Yandex Cloud

In NSX-T, you can use either the built-in L7 load balancer or the VMware NSX Advanced Load Balancer (AVI).

Both options enable traffic balancing at L4 and L7.

In Yandex Cloud, you can use the L4 load balancer, Network Load Balancer (NLB), and the L7 load balancer (Application Load Balancer, or ALB), separately.

The application traffic balancer (ALB) can also serve as an ingress in Managed K8s, similar to the NSX-T Basic/Advanced Load Balancer.

VMware Cloud Director

Yandex Cloud

NSX-T has no native DDoS protection. You have to integrate the relevant services separately.

To address microsegmentation and internal threat protection issues, NSX-T offers a tool package known as NSX-T Security, which includes NSX-T Distributed FW (Application-Layer Gateway + L7 filtering), Distributed IDS, and Malware Prevention.

For perimeter protection, NSX-T features integrated Gateway Firewall which you can configure on NSX-T Edge. Although it is not a next-generation firewall, it supports FQDN analysis and URL filtering.

Yandex Cloud features DDoS Protection and Smart Web Security for DDoS protection.

You can also integrate Security Groups for network access management. This will provide L4 stateful traffic filtering at the hypervisor level. Each network interface of VMs in the cloud can have its own L4 Firewall configured.

Currently, Yandex Cloud has no equivalents to Distributed IDS and Distributed Malware Protection. As an alternative, you can use specialized custom VMs from Marketplace, although, in this case, you will need network segmentation.