VMware Cloud Foundation 9.1 Networking Updates

VMware Cloud Foundation (VCF) 9.1 introduces substantial advancements in its software-defined networking capabilities, building on the established NSX technology. These updates enhance transit gateway flexibility, refine workload placement, and provide native support for EVPN VXLAN, delivering a more adaptable and efficient virtual networking environment. Broadcom highlighted these new features at VMware Explore 2026, alongside discussions on artificial intelligence’s impact on networking.

The core of VCF’s networking, NSX, forms the bedrock for these innovations. VCF 9.0 initially offered a public-cloud-inspired virtual private cloud (VPC) model, streamlining consumption over NSX’s foundational tier-0 and tier-1 gateways. These gateways are essential for routing traffic both within the virtual environment and to the external physical network. The latest iteration, VCF 9.1, expands on this, focusing on empowering users with greater control and simplifying complex network operations.

Broadcom’s announcements for VCF 9.1 concentrate on several key areas. They include the introduction of multiple transit gateways per tenant, which are now decoupled from tier-0 gateways and feature independent availability modes. A new virtual network appliance is available for centralized Network Address Translation (NAT) and load balancing, removing the dependency on NSX Edge for these services. Workload placement gains finer control through transit gateway span and VLAN-backed subnets. Additionally, VCF 9.1 provides native EVPN VXLAN support for distributed external connections, facilitated by a route controller virtual machine. The update also enhances Direct Path and AI agent isolation, with a preview of an agentic platform for network operations. These innovations aim to make virtual networking as intuitive as public cloud services, according to Francois Tallet, a product marketing engineer at Broadcom.

Advanced Transit Gateway Capabilities and New Service Appliances

VCF 9.1 significantly upgrades transit gateway functionality, offering greater flexibility and efficiency in interconnecting VPCs and routing traffic to external networks. Previous versions restricted each tenant to a single transit gateway, limiting topological choices. The new release addresses this limitation with three primary enhancements.

Tenants now have the ability to configure multiple transit gateways. This allows for a blend of centralized and distributed external connections within a single tenant, eliminating the need to choose one approach for the entire environment. This flexibility supports diverse network architectures and specific workload requirements, as articulated by Tallet. Each tenant can now deploy an arbitrary number of external connections and transit gateways, optimizing their network topology.

A critical improvement is the independent availability modes for transit gateways. VCF 9.1 separates the transit gateway from the tier-0 gateway, unlike earlier versions where they shared a Virtual Routing and Forwarding (VRF) gateway and an availability mode. This decoupling provides more granular control over availability settings for different network segments. Enterprises can tailor resilience to specific application needs without affecting other parts of the network.

VCF 9.1 introduces a virtual network appliance (VNA) to provide centralized services without requiring an edge node. In VCF 9.0, distributed transit gateways could not support stateful centralized services due to the absence of a single node for session state management. The VNA cluster simplifies deployment, needing only a management interface and no VLAN uplinks or Border Gateway Protocol (BGP). It provides services such as NAT, Dynamic Host Configuration Protocol (DHCP), and load balancing via Avi. Traffic needing these services is selectively redirected to the VNA, optimizing resource utilization and network performance.

Enhanced Workload Placement, Segmentation, and Physical Fabric Integration

VCF 9.1 extends control over workload placement, inter-VPC connectivity, and integration with physical network infrastructure. These new controls empower administrators to finely tune their virtual environments for security, performance, and operational efficiency.

VLAN-backed subnets are a key addition, allowing VPC subnets to directly attach to physical VLANs. This provides workloads with the same Layer 2 connectivity as a distributed port group. A workload within a VLAN-backed subnet can only communicate with other public subnets, even if it resides in the same VPC. A variant of this feature, available with a distributed external connection, also connects the subnet to the VPC gateway, enabling the default gateway to exist in both virtual and physical realms simultaneously. This creates a bridge for seamless communication between the two environments while maintaining isolation.

VPC connectivity policies, inspired by Cisco’s private VLAN concept, offer sophisticated control over inter-VPC communication within a tenant. By default, VPCs in VCF 9.1 communicate openly. However, administrators can now group VPCs into communities, designate specific VPCs as “promiscuous” to allow communication with every VPC in the tenant, or mark them as “isolated” to restrict communication to only promiscuous VPCs. This capability offers a robust mechanism for enforcing segmentation and security policies across the virtual network.

Native EVPN VXLAN support significantly enhances VCF’s ability to connect to physical infrastructure. VCF 9.0’s distributed external connection allowed ESXi hosts to send north-south traffic directly to physical infrastructure over VLANs, bypassing the NSX edge. However, this required a single Layer 2 VLAN across all participating hosts. VCF 9.1 extends this model to VXLAN fabrics through EVPN, using a lightweight route controller virtual machine to manage the BGP EVPN control plane. This route controller functions solely for BGP, without handling data paths, streamlining external connections and improving scalability.

AI Integration: Networking for AI and AI for Networking Operations

VCF 9.1 also addresses the evolving landscape of artificial intelligence by optimizing networking for AI workloads and introducing AI capabilities for network operations. Jerome Catrouillet, Senior Manager of Product Management at Broadcom, presented these developments at VMware Explore, segmenting the work into two distinct areas.

The first area, “Networking for AI,” focuses on tailoring VCF’s capabilities to meet the demanding requirements of AI applications. A primary enhancement is the increase in throughput. Enhanced Direct Path, a new feature in VCF 9.1, delivers near bare-metal network speeds. Crucially, it achieves this without compromising vMotion or Distributed Resource Scheduler (DRS), the live-migration and load-balancing features typically sacrificed when using SR-IOV for high performance. This addresses AI’s need for significant data throughput, which is essential for rapid model training and inference.

Isolation is the second critical enhancement for AI workloads. VCF 9.1 allows for the creation of isolated VPCs that have no gateway and connect only through point-to-point private links. These isolated subnets lack external connectivity. They rely on per-workload VDefend rules for security. This strict isolation ensures sensitive AI workloads operate in a secure and controlled environment, minimizing potential data breaches or unauthorized access.

The second area, “AI for networking operations,” involves developing an agentic platform for VCF network operations. This platform is currently in development and Broadcom plans to offer it as an optional technical preview, released outside the regular VCF cycle. The platform leverages Multi-Cloud Provider (MCP) servers, which expose the APIs of VCF components such as NSX Manager, vCenter, and VCF Operations, to an AI agent. It integrates a retrieval pipeline over VMware’s internal knowledge base articles, providing context and data to the AI agent. Access to this platform is through a built-in chatbot user interface and a command line interface. Broadcom aims for this agentic platform to evolve alongside user experience with AI, progressively automating and optimizing network operations within VCF environments. This strategic move aims to simplify management and problem-solving, allowing network administrators to focus on higher-level tasks.