In reply to Piotr_Jablonski.

Thank you again for commenting on our blog. And thanks for the links you bring up too, because they are actually quite explicit. See, the literature you point out from Cisco speaks very explicitly about "TCP L4 inspection". I also hope you noticed that the links you talk about also speak of Cisco products that can inspect e-mail protocols for instance, something which, again, the NSX DFW currently does not do. I also want to clarify that Cisco has not been talking about app-level threat management and the need for app-level inspection (beyond L2-4 security) since the SourceFire acquisition, but way before that. And certainly we are not the only security vendor recognising the need for inspecting at the application layer. To your points: personally, I do not see how the NSX DFW can off load a SYN flood DoS, a firewall that can do that needs to proxy the TCP sessions, which is not the same thing as tracking them. Also, I am well aware of the ALG capabilities that are built into L4 firewalls. Then again, let's not exaggerate by saying that it "supports Oracle and Microsoft Windows" … it's not like it has ALG support for all MSFT or Oracle apps: only for MS-RCP and Oracle TNS, just like Linux netfilter.  And this is good, it can open ephemeral ports also for FTP, like we do on the Cisco AVS, but let's not confuse (1) inspecting the communication channel that an application uses with (2) inspecting the application traffic. In any case, to be very clear: our intention is not to criticise VMware NSX or its Distributed Firewall. We have a similar implementation with the Cisco AVS after all. The two issues that we have are the following: (1)  on the VMware blog that we refer-to above, it is portrayed that ACI can not do micro segmentation without using expensive NGFW: that is simply NOT true. (2) another reading of the above mentioned  VMware blog would be that the NSX DFW has "traffic inspection capabilities" that are comparable to a NGFW (since that is what is considered that would be used with ACI). This is an exaggeration. This leads customers into thinking that if they use NSX, they don't need a firewall anymore which is not true.  When a customer reads literature from Checkpoint, Cisco, Fortinet, Palo Alto and other security vendors, they read about how the firewall inspects application traffic. When they read the same terminology referred to NSX firewalls, many customers are misled into thinking that they are equivalent, and they are not. In summary: ACI can be used to do micro segmentation without requiring a NGFW. A NGFW may as well be advisable in order to provide app-level threat management in any case. ACI can dynamically insert a NGFW in the path between any two endpoints. Finally, our intention is not to de-merit NSX at all, but we do think when it comes to security, exaggeration has no place.