Study guide
5.6 Deploying & Configuring the VCF Network Gateway
VMware Certified Professional - VMware Cloud Foundation Administrator VCP-VCF 2V0-17.25
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Private Cloud Vision & Architecture
1.1 Private Cloud Principles & The Modern Cloud Operating Model 1.2 VMware Cloud Foundation Architecture & Full-Stack Value Proposition 1.3 Private Cloud Use Cases, Service Models & Workload Strategy
2 Chapter 2: VMware Compute Fundamentals
2.1 ESXi Host & vCenter Architecture and Deployment 2.2 vSphere Cluster Design, High Availability (HA), and DRS 2.3 Virtual Machine Deployment, Advanced Hardware, & Management 2.4 Managing Virtual Machines Through vCenter: Day-2 Operations
3 Chapter 3: VMware Storage Fundamentals
3.1 vSphere Core Storage Architecture: VMFS, NFS, & vVols 3.2 vSAN Architecture: Express Storage Architecture (ESA) vs. Original Storage Architecture (OSA) 3.3 vSAN Cluster Deployment, Storage Pools, & Disk Configurations 3.4 Storage Policy-Based Management (SPBM), Fault Tolerance, & Space Efficiency 3.5 vSAN Resilience & Data Availability: FTT, Fault Domains, and Stretched Clusters 3.6 vSAN Space Efficiency: Compression, Deduplication, TRIM/UNMAP & Reclamation
4 Chapter 4: VMware Network Fundamentals
4.1 VCF Network Architecture & NSX Core Components 4.2 NSX Virtual Network Fabrics, Transport Nodes, & Geneve Overlays 4.3 Edge Clusters, Tier-0/Tier-1 Gateway Routing, & Uplink Connectivity 4.4 NSX Distributed Firewall (DFW) & Distributed Network Services 4.5 VCF 9.0 Virtual Private Clouds (VPCs) & Transit Gateway Connectivity
5 Chapter 5: VCF Deploy and Configure
5.1 VCF Deployment Models: Standard vs. Consolidated & Prerequisites 5.2 VCF Installer Bring-Up & Management Domain Deployment 5.3 VI Workload Domain Deployment, Commissioning Hosts, & Storage Attachment 5.4 vSphere Supervisor Configuration & vSphere Kubernetes Service (VKS) Integration 5.5 VCF Deployment Components & Additional Required Infrastructure 5.6 Deploying & Configuring the VCF Network Gateway 5.7 VCF Networking Deployment: NSX Instances, Transport Fabric & Edge Clusters 5.8 Workload Domain Storage: Principal vs. Supplemental Storage
6 Chapter 6: VCF Manage & Lifecycle Operations
6.1 VCF Fleet Management & Existing vCenter Import Workflows 6.2 Identity Federation, VCF Identity Broker, & RBAC 6.3 Certificate & Password Lifecycle Management in VCF Operations 6.4 Lifecycle Management (LCM), Upgrade Bundles, & Drift Remediation 6.5 License Management in VMware Cloud Foundation
7 Chapter 7: VCF Operations: Architecture, Metrics & Health Diagnostics
7.1 VCF Operations Architecture, Cluster Nodes, & Deployment Options 7.2 Metrics, Properties, Symptom Definitions, & Alerting Mechanics 7.3 Health Diagnostics, Troubleshooting Workflows, & Operational Policies
8 Chapter 8: VCF Operations: Monitoring, Logs & Compliance
8.1 Dashboards, Views, & Management Reporting in VCF Operations 8.2 Storage, Network, and Workload Application Monitoring 8.3 Log Analytics & Troubleshooting with VCF Operations for Logs 8.4 Security Compliance Benchmarks, Hardening, & Configuration Drift 8.5 VCF Operations for Networks: Flow Analytics, Path Troubleshooting & Micro-Segmentation Planning
9 Chapter 9: VCF Consume & Automate: Architecture, Tenancy & Networking
9.1 VCF Automation Architecture, Services, & Automation Use Cases 9.2 Regions, Cloud Zones, Projects, & Multi-Org Tenancy 9.3 Provider Networking, Org Networks, & Content Library Integration
10 Chapter 10: VCF Consume & Automate: Templates, Extensibility & Governance
10.1 Cloud Templates (Blueprints), Schema, & Infrastructure as Code 10.2 Extensibility: Action-Based Extensibility (ABX) & Orchestrator Workflows 10.3 Governance Policies: Approvals, Leases, Resource Quotas, & Day-2 Actions 10.4 Supervisor-Based Services, vSphere Kubernetes Service (VKS), & Modern App Consumption
5.6 Deploying & Configuring the VCF Network Gateway
Key Takeaways Explain This Topic AI
The gateway layer that joins a VCF private cloud to the physical network is built on the NSX Tier-0 gateway and its Tier-0 VRF instances, hosted on the services router component of Edge transport nodes.
A provider gateway in VCF Automation leverages a Tier-0 or Tier-0 VRF gateway and associates it with addresses drawn from IP spaces, which is how a provider hands external connectivity to an organization.
VCF 9.0 adds a simplified network connectivity workflow with guided Edge deployment, so establishing external connectivity no longer requires building Edge clusters and routing by hand first.
A Tier-0 VRF gives each tenant an isolated routing table on shared Edge hardware, which is the standard way to separate tenants without dedicating an Edge cluster to each.
A Distributed Transit Gateway removes the Edge requirement entirely for suitable VLAN-backed topologies, so gateway deployment is a design decision rather than an automatic prerequisite.
Last updated: September 2026
5.6 Deploying & Configuring the VCF Network Gateway
Exam Focus: The blueprint objective reads "describe the deployment of and configure a VMware Cloud Foundation (VCF) Network Gateway". In the product itself this gateway layer is delivered by NSX Tier-0 gateways and Tier-0 VRFs , surfaced to tenants as provider gateways in VCF Automation. This section teaches that layer under the names you will see in the products and in Broadcom documentation.
What the Gateway Layer Does
Everything inside the private cloud is overlay. At some point that overlay has to meet the physical network — to peer with datacenter routers, to translate addresses, and to enforce a controlled perimeter. The gateway layer is that meeting point.
It is built from three cooperating pieces:
Edge transport nodes — VM or bare-metal appliances running a DPDK-accelerated fast path. They are the only place the services router (SR) component can live, which is why any centralised stateful service requires them.
The Tier-0 gateway — the north-facing router that peers with the physical fabric, typically over BGP , and owns the uplinks.
Tier-0 VRFs — virtual routing and forwarding instances carved from a parent Tier-0, each with an isolated routing table.
Tier-0 VRFs: Tenant Separation Without Dedicated Hardware
A VRF is the mechanism that makes multi-tenancy affordable. Rather than deploying a separate Edge cluster per tenant, one physical Edge cluster hosts a parent Tier-0, and each tenant receives a Tier-0 VRF with:
Its own routing table , so overlapping or independent address plans do not collide.
Its own BGP peering and route advertisement policy .
Shared underlying Edge capacity , inherited from the parent Tier-0's uplinks.
- Dedicated Tier-0 per tenant Tier-0 VRF per tenant
- Routing isolation Full Full
- Edge cluster required One per tenant One shared
- Uplink configuration Independent Inherited from parent Tier-0
- Typical use Strict physical separation mandates Standard provider multi-tenancy
- Provider Gateways: Handing Connectivity to a Tenant
In VCF Automation, the provider administrator does not hand a tenant a raw Tier-0. They create a provider gateway , which leverages a VCF networking Tier-0 or Tier-0 VRF gateway and associates it with IP addresses from IP spaces that can be advertised from that gateway.
Two constructs matter here:
The provider gateway is the tenant-facing representation of external connectivity. Organizations attach to it to reach anything outside the private cloud.
IP spaces are the managed address pools the gateway advertises. Associating a space with a gateway is what makes those addresses externally reachable, and it is what allows the provider to enforce quotas so one organization cannot exhaust the pool.
This is the division of responsibility to remember: the provider owns the Tier-0, the VRFs, the Edge clusters, the IP spaces, and the provider gateways. The organization consumes them.
The VCF 9.0 Simplified Connectivity Workflow
In VCF 5.x, establishing external connectivity was a sequence of manual steps: build an Edge cluster, configure uplink profiles and transport zones, create the Tier-0, configure BGP, then attach Tier-1 gateways.
Starting with VCF 9.0 a simplified workflow sets up network connectivity and performs network configuration , improving operational efficiency in VPC environments by providing a straightforward way to establish external connectivity and install Edge nodes and Edge clusters as part of that guided flow . The administrator expresses the connectivity intent and the platform provisions the Edge infrastructure needed to deliver it, rather than requiring that infrastructure to exist first.
When a Gateway Deployment Is Not Required at All
The most important design nuance in VCF 9.0 is that Edge deployment is conditional .
A Centralized Transit Gateway (CTGW) routes through an NSX Edge cluster via the Tier-0 . Edge nodes are required, and the gateway layer described above is fully in play.
A Distributed Transit Gateway (DTGW) uses distributed routing in the vSphere hypervisor and requires no Edge nodes at all . Hosts connect directly to the fabric, which removes hops, raises throughput, and aligns the physical and virtual topologies for troubleshooting.
So the correct answer to "how do I give these workloads external connectivity" begins with a design question, not a deployment step.
Configuration Elements to Know
When a centralized gateway is deployed, these are the settings that carry exam weight:
Uplink interfaces and VLANs connecting Edge nodes to the top-of-rack switches.
BGP configuration — local and remote ASN, neighbour addresses, timers, and route redistribution.
ECMP across multiple uplinks and Edge nodes for active-active north-south throughput.
High availability mode — active-active for stateless forwarding throughput, or active-standby where stateful services such as NAT and the gateway firewall are required.
Route advertisement and filtering , controlling which internal prefixes are exposed.
Warning
Stateful services force active-standby. A common scenario offers active-active for maximum throughput while also requiring stateful NAT or gateway firewalling. Those requirements conflict, because stateful services need a single connection-tracking owner.
Exam Watch: Key Scenarios and Candidate Traps
Important
Provider versus organization. Creating a provider gateway, defining IP spaces, and deploying Edge clusters are provider administrator tasks. An organization administrator consumes the resulting connectivity and cannot create it.
Tip
VRF is the answer to "isolate tenants without more Edges". When a scenario demands separate routing tables and independent BGP policy per tenant while reusing one Edge cluster, the construct is a Tier-0 VRF.