Tigera: Your NSX DFW Covers Every VM Except the Ones on Kubernetes: Extending the Policy Model to Your Cluster with Tiered Microsegmentation

You have years of NSX distributed firewall policy in production. Tag-based security groups, rules that follow the workload, a tiered structure that keeps the security team’s rules above what app teams can touch and an auditor who has already signed off on all of it. Now some of those VMs are moving to Kubernetes, where the default posture is that every workload can reach every other workload.

The first question your security team will ask is whether this means starting over. It’s the right question. The answer is no, but “no” is only credible if you can show them the mapping.

NSX DFW and Calico were built on the same four ideas: enforcement at the workload interface, policy that travels with the workload, a tiered model that separates security rules from application rules, and identity derived from labels rather than addresses. Different vocabulary, same principles. What you’re doing is a translation, and you can stage it while both enforcement points run side by side.

In this workshop you’ll bring real NSX DFW rules to a live cluster and express them as Calico policy. You’ll validate each translated rule before it is enforced and monitor the traffic flow live.