By Matt Cozzolino | Trace3 Senior Solutions Architect
Private cloud security is no longer a question of whether to segment, inspect, and prove compliance. The question is whether your platform can do all three at scale without becoming an operational burden. With the most recent release of VMware Cloud Foundation (VCF), Broadcom has delivered a maintenance update that matters more to security and networking leaders than its name suggests.
The marketing headlines focus on AI and Kubernetes operations, including multi-tenant model sharing, a GitOps service, and an AI assistant for diagnostics. Those are fine additions. But I still spend most of my time helping clients solve their core business needs: disaster recovery and security compliance.
vDefend: Where the Release Gets Exciting
vDefend is the part of VCF I’m most excited about right now, especially for clients with serious security and compliance obligations. These are the organizations that can’t take a “good enough” approach, where an auditor will ask not only whether you segment your workloads, but how you prove it. vDefend can provide the audit trail and the protection of workloads without complicated span ports or only relying on a gateway firewall. NSX coupled with vDefend solves so many compliance and security requirements it’s a shame it gets left out in the cold by the network and compute teams. NSX doesn’t displace the network team or what they do; it enhances their tool set. Virtualization is here to stay. I say embrace it and explore how much more you can accomplish.
The latest release centers on three themes: air-gapped deployment, TLS inspection with performance scaling, and clearer licensing behavior. Air-gapped support is the headline for me. GeoIP filtering, malicious IP detection, and URL filtering are now fully supported in isolated environments, and the advanced threat prevention stack, including IDS/IPS, Malware Prevention, and Network Detection and Response, is available there through the Security Services Platform. Defense, government, healthcare, and financial organizations have long been forced to choose between strong threat detection and strict network isolation. That tradeoff is shrinking.
Encrypted traffic gets a major upgrade as well. TLS inspection now extends to Tier-0 gateways, not just Tier-1, so deep packet inspection, URL filtering, Layer 7 controls, and advanced threat prevention can apply to HTTPS traffic at the edge of your network. Gateway Firewall also supports full TLS 1.3 decryption and inspection, including hybrid post-quantum key exchange. For anyone worried about “harvest now, decrypt later,” that is a practical step toward cryptographic modernization, not a roadmap slide.
Most compelling is this security lives in the platform rather than in a bolt-on appliance. Policy follows the workload. That makes segmentation easier to defend, easier to audit, and far less likely to drift. And because inspection takes real horsepower, the release also adds a security-focused NSX Edge profile that shifts capacity toward the engines doing the heaviest work, so you can size for inspection rather than forwarding alone.
NSX and Portable Networks: DR Without the Pain
While this capability is quieter, it solves one of the most painful problems in disaster recovery. Anyone who has run a DR test knows replicating virtual machines is the easy part. The hard part is the network. Re-IPing applications, rebuilding routes and firewall rules at the recovery site, and chasing down the dependencies nobody documented are where recovery plans fall apart.
NSX addresses this by decoupling workloads from the physical network. Overlay networks and a consistent policy framework mean you can move workloads between data centers without changing the network underneath them. With NSX Federation, segments can be stretched between VCF instances, giving you IP mobility, so a recovered application keeps its addressing. Federation also centralizes policy across locations, which means your security posture follows the workload to the recovery site rather than being rebuilt there. Pair that with VMware Live Recovery for replication and orchestrated failover, and the network stops being the long pole in your recovery plan.
Of course, this still takes design. You need a second location, you must meet the latency and bandwidth requirements between sites, and you should decide whether a separate VCF fleet or just separate workload domains are a better fit. But the network portability story is one of the strongest arguments for NSX in a resilience conversation. Hyperscalers pioneered the idea of regions and availability zones, and concepts such as VPC and software-defined applications. Clients that embraced those concepts in their own private cloud journey have seen a simplification in services delivery and availability.
EVPN Integration: Connecting NSX to Your Cisco Fabric
The other significant networking story is how NSX connects to the physical fabric. VCF introduced EVPN-VXLAN interoperability earlier this year, with support for fabrics from Cisco, Arista, and SONiC, and the most recent release builds on it. Direct VXLAN tunnels between transit gateways and leaf switches optimize east-west traffic, and services that matter in multi-tenant environments, including NAT, NSX load balancing, Avi load balancing, and DHCP relay, are now available in the EVPN VXLAN distributed connectivity mode.
For Cisco shops, the model is worth a close look. As Cisco describes the Nexus One integration, the VCF Networking Route Controller peers directly with a Nexus One EVPN Border Gateway using MP-BGP EVPN. Each VCF Transit Gateway maps to a corresponding Layer 3 VNI in the fabric, so tenant isolation carries through one-to-one. EVPN Type 5 routes exchange workload and external prefixes dynamically, and VXLAN provides direct Layer 3 reachability from the ESX transport endpoint to the fabric Border Gateway. In practice, that takes dedicated edge nodes out of the distributed data path. A consistent overlay from host to physical switch also reduces the finger-pointing between virtualization and network teams when something breaks.
It isn’t plug and play. The fabric team needs to deliver EVPN/VXLAN on the leaf layer, the BGP EVPN address family, and a disciplined VNI and route-target plan, and you should confirm your specific Cisco hardware and software versions are supported. This is a project where virtualization, network, and security teams need to plan together. If you are struggling with getting the network team onboard, this may be the solution for you. The network team can leverage the tools in place while embracing virtualization into the compute layer.
ACC: The Compliance Backbone
Advanced Cyber Compliance (ACC) is the layer that keeps all of this honest. It’s a VCF add-on that combines continuous compliance enforcement powered by VMware Salt, automated disaster recovery, and cyber recovery in an isolated, on-premises clean room. It monitors the VCF stack against baselines such as the VCF Security Configuration Guide and PCI DSS, detects configuration drift, and can remediate it automatically. The goal is compliance that is always on rather than merely audit-ready. To be clear, the materials we reviewed for this release don’t announce new ACC features. Its value here is verifying your vDefend and NSX investments stay configured the way you intended. Licensing deserves attention too, since full compliance management in VCF Operations moved into the ACC add-on earlier this year.
Where Trace3 Comes In
Trace3 helps organizations turn platform capabilities into working outcomes. Our teams bring together cloud, data center, and security expertise, which matters for VCF because the platform sits at the intersection of all three. Whether you’re building a segmentation and threat prevention strategy with vDefend, designing network portability for disaster recovery, integrating NSX with your Cisco fabric, or deciding where ACC fits in your compliance program, we approach VCF as a broader infrastructure and security transformation rather than a simple version bump.
That starts with visibility and design. Before changing anything, our engineers examine your current environment, identify dependencies across compute, network, and security, and map your goals to the right VCF capabilities. From there, we help you build the architecture, plan upgrades to minimize risk, and validate the result, including DR testing. The release notes list known issues, such as temporary DFW rule behavior when upgrading from earlier releases, so careful planning matters. For teams that want to stay focused on the business, Trace3 Managed Services and Lifecycle Management can handle day-to-day operations and keep your environment current. And Trace3 Supply Chain & Integration Services can enable the procurement, staging, and deployment of the hardware your VCF and fabric designs depend on.
Organizations that start planning now will be far better positioned to take advantage of what the latest VCF release offers. If you’re unsure where your environment stands, we can help. Reach out to your Trace3 representative or find us at Trace3.com.
Matt Cozzolino is a Trace3 Senior Solutions Architect who expertly bridges the data center, network, and cloud. Owning myriad certifications, including the designation Broadcom Knight, he designs and implements secure, automated hybrid environments, from VMware Cloud Foundation and NSX to firewalls and zero trust segmentation. Matt brings a disciplined approach to change management, migrations, and upgrades, taking pride in risk reduction, security compliance, and minimal business disruption.