VMware Certified Professional – Network Virtualization 2025 (VCP-NV 2025)

Moving production networking into VMware NSX means your team takes on transport nodes, edge clusters, tier-0 and tier-1 gateways, dynamic routing, and distributed security in one platform. Without a shared foundation, misconfigured overlays or firewall rules can quietly break east-west traffic and external connectivity.

Role fit: This intermediate course suits systems admins, virtualization engineers, and network-focused IT practitioners with three to five years of virtualization experience. Trainer Keith Barker notes that later topics such as Federation and stretched topologies assume NSX basics are already in place, so Team Leads should assign the course in order rather than cherry-picking advanced skills.

Time investment: Plan on roughly 34 hours across 31 skills per learner. Most skills run about an hour, which fits a weekly training block over a quarter.

Risk and security coverage: The course goes beyond deployment to cover:

• Distributed and gateway firewalls
• Segmentation policy design and verification
• IDS/IPS
• NSX Application Platform deployment considerations for advanced security services

This helps teams harden segmentation, not just build it.

Change management: Nearly every skill ends with a troubleshooting scenario, such as a load balancer pool marked down or a BGP peer that cannot reach an external gateway. These build the diagnostic habits teams need before touching production.

Platform support: A dedicated lab skill walks through an NSX 4.x lab environment that teams can use as an NSX playground for repeated practice instead of rebuilding from scratch. Training Managers can group skills into Playlists by role and track progress toward VCP-NV readiness with Team Reporting.

IT teams use this training to run NSX in production with fewer escalations and faster root-cause analysis. Every skill follows a plan, implement, and verify pattern, then closes with a troubleshooting scenario modeled on a customer request, so learners practice the diagnostic thinking their roles demand.

• Faster connectivity troubleshooting: Practitioners trace packet flow from a VM through Tier-1 and Tier-0 gateways to an external router. They also predict and resolve failures involving default gateways, transport network uplink profiles, and OSPF or BGP peering with upstream routers.
• Enforceable segmentation practice: Teams build and verify segmentation policy for real application scenarios, such as allowing required front-end traffic while protecting back-end services. They focus on implementation, validation, and troubleshooting so policy changes are tied to expected traffic behavior.
• Fewer NSX Application Platform deployment issues: Learners verify the network services the NSX Application Platform depends on, including DNS, Internet access, NAT/PAT, and internetwork routing. They also review how the supporting network and Kubernetes deployment steps fit together before introducing the platform.
• Safer change practice: The lab-build skill teaches a graceful shutdown and snapshot process. Team members can rehearse new configurations repeatedly and revert to a known-good state before touching production.

The result for IT Directors and Team Leads is a team that can deploy segments, routing, VPNs, VRF Lite, and NSX Application Platform security features with confidence, and with less reliance on outside contractors.

Knowledge

• How the core NSX components fit together on top of vSphere: NSX Manager, host transport nodes, edge nodes, TEPs, and Geneve-encapsulated overlay segments
• When an edge node is required (services router functions for external connectivity) and when distributed routing on host transport nodes is enough
• How Tier-1 and Tier-0 gateways split distributed router (DR) and services router (SR) roles, and how packets move between VMs and external networks
• The trade-offs between OSPF and BGP for dynamic route exchange with external routers, plus how DHCP configuration fits into NSX environments
• How the Distributed Firewall, context profiles (FQDN and App ID filtering), Gateway Firewall, Identity Firewall with Active Directory, and IDS/IPS layer together for segmentation and threat detection
• Where VRF Lite, Federation and stretched topologies, IPsec and L2 VPNs, the NSX Advanced Load Balancer, and the NSX Application Platform (NAPP) fit in multi-site and security designs

Ability

• Deploy an NSX Manager cluster, prepare host and edge transport nodes, and build overlay segments
• Configure Tier-1 and Tier-0 gateways, NAT, and OSPF or BGP peering to connect workloads to the outside world
• Write DFW rules that limit client access to web tiers (for example, HTTPS only) and apply identity-based rules tied to AD logons
• Troubleshoot connectivity step by step, from transport network uplinks and default gateways to load balancer pools marked down
• Prepare the network for NAPP by verifying DNS, internet access, NAT/PAT, routing, FQDN and IP address requirements, and required firewall ports and protocols
• Build a resettable NSX 4.x lab using graceful shutdown and snapshots for repeatable practice