With NSX Federation, you can deploy a tier-0 gateway that is limited to a single location, or you can stretch it across multiple locations.

Tier-0 gateways can have one of the following configurations:
  • Non-stretched tier-0 gateway.
  • Stretched active-active with primary and secondary locations.
  • Stretched active-active with all primary locations.
  • Stretched active-standby with primary and secondary locations.

Non-Stretched Tier-0 Gateway

You can create a tier-0 gateway from Global Manager that spans only one location. This is similar to creating the tier-0 gateway on the Local Manager directly, but has the advantage that you can manage it from Global Manager.

This diagram shows a non-stretched tier-0 gateay that only spans one location.

Stretched Active-Active Tier-0 Gateway with Primary and Secondary Locations

In an active-active tier-0 gateway with primary and secondary locations, the following applies:
  • All Edge nodes are active at the same time, therefore the tier-0 cannot run stateful services.
  • All traffic enters and leaves through the Edge nodes in the primary location.

If both the tier-0 gateway and the linked tier-1 gateway have primary and secondary locations, configure the same location to be primary for both gateways to reduce cross-location traffic.

Important: In this topology, NSX ensures that all egress traffic leaves through the primary location.

If your environment has stateful services, such as external firewall, on the physical network, you must ensure that the return traffic enters through the primary location. For example, you can add AS path prepending on the BGP peers in your secondary locations.

If you do not have stateful services on your physical network, and you choose to have asymmetric routing, you must deactivate Unicast Reverse Path Forwarding (uRPF) on all externally tier-0 interfaces.

This diagram shows a Stretched Active-Active Tier-0 Gateway with Primary and Secondary Locations

Stretched Active-Active Tier-0 Gateway with All Primary Locations

In an active-active tier-0 gateway with all primary locations, the following applies:
  • All Edge nodes are active at the same time, therefore the tier-0 cannot run stateful services.
  • All traffic enters and leaves through Edge nodes in the same location as the workloads.
Important: This topology allows traffic to egress locally from each location. You must ensure that return traffic enters the same location to allow external stateful services (such as an external firewall). For example, you can configure an external location-specific NAT IP (such as on the external firewall) so that return traffic is always routed back to the same location that it left.
This diagram shows a South/North stretched Active-Active Tier-0 Gateway with All Primary Locations with VMs in location 1 exiting via Location 1 and VMs in Location 2 exiting in Location 2.

Stretched Active-Standby Tier-0 Gateway with Primary and Secondary Locations

In an active-standby tier-0 gateway with primary and secondary locations, the following applies:
  • Only one Edge node is active at a time, therefore the tier-0 can run stateful services.
  • All traffic enters and leaves through the active Edge node in the primary location.
This diagram shows a Stretched Active-Standby Tier-0 Gateway with Primary and Secondary Locations and services on the tier-0 gateway.
For active standby tier-0 gateways, the following services are supported:
  • Network Address Translation (NAT)
  • Gateway Firewall
  • DNS
  • DHCP
See Features and Configurations Supported in NSX Federation for more information.