An architect needs to allow users to deploy multiple copies of a test lab with public access to the internet. The design requires the same machine…

The scenario requires providing outbound internet access to multiple isolated labs that use the same internal IP addresses. This is a classic use case for Source Network Address Translation (SNAT). SNAT translates the private, non-routable source IP addresses of the lab machines into a public, routable IP address. This translation must occur at the edge of the logical network before traffic is sent to the public internet. In an NSX architecture, the Tier-0 gateway serves as this edge, connecting the logical overlay network to the physical underlay and the external world. Therefore, configuring SNAT rules on the Tier-0 gateway is the correct solution.

A. Configure DNAT rules on the Tier-1 gateway.

DNAT (Destination NAT) is used for inbound traffic, translating a public destination IP to a private internal IP. The requirement is for outbound access.

B. Configure isolation on the NSX segment.

Segment isolation restricts traffic between VMs on the same segment. It does not provide a mechanism for external network connectivity or address translation.

C. Configure firewall rules to isolate the traffic going to the public internet.

Firewall rules permit or deny traffic based on policy. They do not perform the IP address translation necessary to solve the overlapping IP address problem for internet access.

1. VMware Docs

NSX-T Data Center Administration Guide

"NAT" section: "SNAT (Source NAT) is used to translate a private IP address to a public IP address. SNAT is for traffic that originates in the NSX-T Data Center domain and has a destination outside the NSX-T Data Center domain. A common use case for SNAT is to provide Internet access to VMs on a private network." This document confirms SNAT is the correct technology for the use case.

2. VMware Docs

NSX-T Data Center Administration Guide

"Add a Tier-0 Gateway" section: "A Tier-0 gateway provides a gateway service between the logical and physical network. It is required if you want to connect your VMs to the physical network." This establishes the Tier-0 as the correct location for North-South traffic services like public internet access.

3. VMware Press

NSX-T Reference Design Guide

Section 5.2.1 "Tier-0 Gateway": "The T0-GW is responsible for connecting the NSX logical space with the physical network... It is where stateful services such as NAT

Gateway Firewall

and VPN can be enabled." This reference explicitly places the NAT function on the Tier-0 gateway for connecting to external networks.