VMware NSX: Physical (VLAN) TO Virtual (VXLAN) Bridging Configuration

I came across a scenario which require the connectivity between traditional workloads with legacy VLANs to virtualized networks using VXLAN, and thought of writing a quick blog post on the subject.

VMware NSX provides in-kernel software L2 Bridging capabilities that allow you to connect VLAN backed VMs to VMs connected to NSX based logical network (virtual wires).

Prior to NSX version 6.2, it was not possible to bridge a Logical Switch that was connected to a Distributed Logical Router: for that scenario it was required to connect the Logical Switch directly to an Edge Services Gateway.1

With NSX 6.2 on a given NSX Logical Switch, Distributed logical routing can co-exist with L2 bridging.


In my scenario, I have a database VM “AMS” which is connected to VLAN backed port group “VxRACK MGMT” with a VLAN ID 36


You can see Database VM “AMS” is connected to VxRACK MGMT port group:


And an Application VM “App-Windows” connected to “App-Tier” VxLAN backed logical switch (DLR).



To verify that “AMS” is isolated and cannot ping the application VM, let me try to ping the default gateway of application VM.



It’s been verified that the VM is isolated and the L2 Bridging is not configured yet.

Now let’s configure NSX L2 bridging:

We will enable NSX L2 Bridging between VLAN 36 and the “App-Tier” Logical Switch, so that VM “AMS” will be able to communicate with the rest of the network. With NSX-V 6.2 is now possible to have a L2 Bridge and a Distributed Logical Router connected to the same Logical Switch. This represents an important enhancement as it simplifies the integration of NSX in brownfield environments, as well as the migration from legacy to virtual networking.


Select the “App-Tier” logical switch and click ok:


Click on Distributed port group and select “VxRACK-MGMT” port group:

13To enable the L2 Bridging, click on the Publish Changes button, and wait until the page refreshes.


Verify the published configuration. You will notice the “Routing Enabled” message: it means that this L2 Bridge is also connected to a Distributed Logical Router, which is an enhancement in NSX-V 6.2.15.png

Let’s verify L2 connectivity between the “AMS” VM, attached on VLAN 36, and the machines connected “App-Tier” Logical Switch (App-Windows). First let me ping the default gateway of “App-Tier” logical switch:


Boom…….ping successful: we have verified connectivity between a VM attached on VLAN 36 and the Distributed Logical Router that is the default gateway of the network, through a L2 Bridge provided by NSX!

Now let’s ping the Application VM “App-Windows” from Database VM “AMS” which is on VLAN 36:



NSX L2 Bridging has been verified successfully. I hope you enjoyed the blog, if you think it’s worth sharing, please do.  Keep learning and sharing knowledge.