{"id":1447,"date":"2025-05-30T19:58:00","date_gmt":"2025-05-30T19:58:00","guid":{"rendered":"https:\/\/bogdanburuiana.com\/?p=1447"},"modified":"2025-12-29T16:05:45","modified_gmt":"2025-12-29T16:05:45","slug":"distributed-firewall-why-tagging-beats-ips-every-time","status":"publish","type":"post","link":"https:\/\/bogdanburuiana.com\/index.php\/2025\/05\/30\/distributed-firewall-why-tagging-beats-ips-every-time\/","title":{"rendered":"Distributed Firewall &#8211; Why Tagging Beats IPs Every Time"},"content":{"rendered":"\n<p>Distributed Firewall (DFW) is powerful, but it becomes truly scalable only when you stop thinking in IPs. IP-based rules still work, but they don&#8217;t age well in dynamic environments: VMs move, IPs change, autoscaling expands, and suddenly your policy becomes fragile.<\/p>\n\n\n\n<p>The NSX-T mindset is i<strong>ntent-based security<\/strong>:<\/p>\n\n\n\n<ul>\n<li>&#8220;Web talks to backend on 443&#8221;<br>instead of<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>&#8220;10.10.10.0\/24 talks to 10.10.20.0\/24 on 443&#8221;<\/li>\n<\/ul>\n\n\n\n<p>Example: You add a new backend VM. With IP rules, you update firewall policy. With tags, you simply apply <strong>app=backend<\/strong>. Policy follows automatically.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"618\" height=\"293\" src=\"\/wp-content\/uploads\/2025\/12\/image-1.png\" alt=\"\" class=\"wp-image-1448\" srcset=\"\/wp-content\/uploads\/2025\/12\/image-1.png 618w, \/wp-content\/uploads\/2025\/12\/image-1-300x142.png 300w\" sizes=\"(max-width: 618px) 100vw, 618px\" \/><\/figure>\n\n\n\n<p><strong>Pros<\/strong><\/p>\n\n\n\n<ul>\n<li>Policies scale naturally (no rule edits on scale-out)<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>Clearer security intent for audits and reviews<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>Works perfectly with IaC (Terraform\/Ansible\/GitOps)<\/li>\n<\/ul>\n\n\n\n<p><strong>Cons<\/strong><\/p>\n\n\n\n<ul>\n<li>Tag governance is mandatory (or you get outages)<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>Mistagging can open access or block production<\/li>\n<\/ul>\n\n\n\n<ul>\n<li>Requires naming standards and ownership rules<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p>DFW is only as good as your tagging discipline. If tags are treated like a first-class asset (enforced, audited, standardized), NSX-T security becomes clean and resilient. If tags are ad hoc, you end up debugging policy more than traffic.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Distributed Firewall (DFW) is powerful, but it becomes truly scalable only when you stop thinking in IPs. IP-based rules still work, but they don&#8217;t age well in dynamic environments: VMs move, IPs change, autoscaling expands, and suddenly your policy becomes fragile. The NSX-T mindset is intent-based security: Example: You add a new backend VM. With [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/posts\/1447"}],"collection":[{"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/comments?post=1447"}],"version-history":[{"count":1,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/posts\/1447\/revisions"}],"predecessor-version":[{"id":1449,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/posts\/1447\/revisions\/1449"}],"wp:attachment":[{"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/media?parent=1447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/categories?post=1447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bogdanburuiana.com\/index.php\/wp-json\/wp\/v2\/tags?post=1447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}