VMware NSX is the market-leading software-defined networking and microsegmentation platform — and under Broadcom's ownership, its licensing model has been restructured alongside vSphere into per-core subscription pricing. This guide explains the new NSX licensing model, when NSX is included in VCF versus purchased separately, and how to reduce NSX costs without compromising network security.
VMware NSX was already one of the more complex VMware licensing areas before the Broadcom acquisition — with multiple editions (NSX Data Centre Standard, Professional, Advanced, Enterprise Plus), add-on modules for specific capabilities, and different pricing for on-premises versus cloud deployments. Broadcom has simplified this complexity in one sense — there are now fewer standalone NSX purchase options — while significantly increasing the effective cost through the transition to subscription-based, per-core pricing and the bundling of NSX into VCF.
Under the pre-acquisition model, organisations could purchase NSX Data Centre licences on a perpetual basis, with annual SnS providing ongoing support and updates. NSX was priced per processor (similar to vSphere), with different per-processor prices for each edition. Organisations could also purchase NSX add-on capabilities — such as NSX Advanced Load Balancer (Avi Networks) and NSX Advanced Threat Prevention — as separate licence items on top of the base NSX Data Centre edition.
Under Broadcom's new model, NSX is no longer sold as a standalone perpetual product for new purchases. NSX is included within VCF subscriptions (all editions of VCF include NSX Data Centre Enterprise Plus capabilities), and can be purchased as a standalone subscription through Broadcom's commercial team — but on a per-core, subscription basis that mirrors the VCF pricing structure. For the full context on how NSX sits within the VCF bundle, see our VMware Cloud Foundation licensing guide.
Organisations that previously deployed NSX Standard or Professional edition — paying a lower per-processor price for basic overlay networking without advanced security features — can no longer purchase a standalone lower-tier NSX subscription at a meaningful price reduction. The bundling of NSX Enterprise Plus into VCF effectively forces an upgrade to the highest NSX edition for all VCF customers, regardless of whether they use the advanced features.
While the market availability of standalone NSX editions has narrowed under Broadcom, the technical differentiation between NSX capability levels remains relevant — primarily to determine whether VCF (which includes NSX Enterprise Plus) represents genuine value for your environment, or whether the NSX capabilities bundled in VCF are excessive relative to your actual use case.
| NSX Edition / Tier | Key Capabilities | Core Use Case | Availability (2026) |
|---|---|---|---|
| NSX Standard | Overlay networking, L3 routing, basic firewall | Network virtualisation without security advanced features | Standalone subscription only |
| NSX Professional | Standard + gateway firewall, L7 inspection | Perimeter-focused security in virtualised environments | Standalone subscription only |
| NSX Advanced | Professional + distributed firewall, microsegmentation | Zero-trust network security within the DC | Standalone or via VCF |
| NSX Enterprise Plus | Advanced + Federation, Identity Firewall, ATP integration | Large-scale, multi-site, security-focused deployments | Included in all VCF |
| NSX Advanced Load Balancer | L7 load balancing, WAF, analytics | Application delivery, replaces hardware LBs | Separate add-on subscription |
| NSX Advanced Threat Prevention | IDS/IPS, sandboxing, IDPS, network detection | Advanced threat detection in network traffic | Separate add-on subscription |
The most important commercial decision for organisations deploying NSX is whether to licence it as part of VCF or as a standalone NSX subscription. This decision has cascading implications for cost, management, and strategic flexibility:
NSX within VCF means you pay a single per-core subscription that covers vSphere, vSAN, NSX Enterprise Plus, and Aria management tools. The effective per-core cost for NSX when embedded in VCF is approximately 25–35% of the total VCF per-core price — meaning organisations that deploy all four VCF components genuinely gain cost efficiency from the bundle versus purchasing each component separately. However, if you do not use vSAN (using SAN or NAS storage instead), the VCF bundle forces you to pay for an unwanted component to access the NSX Enterprise Plus capabilities.
Standalone NSX subscription allows organisations to licence NSX separately from vSphere, which is relevant for environments that want NSX capabilities without the full VCF bundle — either because they use VVF for compute virtualisation (which does not include NSX) or because they want to apply NSX to non-VMware environments. Standalone NSX subscription pricing is per core, but the per-core cost for NSX standalone is generally higher than the NSX component cost within VCF — Broadcom has commercially incentivised the VCF bundle by making standalone purchases comparatively expensive.
The practical implication: if you use vSAN and NSX together, VCF is likely the right commercial structure. If you use NSX but not vSAN, VVF plus standalone NSX may be cheaper than VCF. If you use vSAN but not NSX in any meaningful way, VCF forces you to pay for NSX capabilities you do not use. Each scenario requires a different commercial approach — and each is an opportunity for negotiation with Broadcom's commercial team.
Like vSphere, NSX has transitioned from per-processor to per-core subscription pricing. The per-core counting rules for NSX follow the same logic as vSphere — all physical cores on in-scope hosts are counted, with a minimum of 16 cores per CPU. However, there is an important nuance in NSX licence scope that differs from vSphere:
NSX is licenced based on the number of transport nodes — the hosts on which NSX is deployed and managed. A transport node is any host running NSX data plane components (ESXi hosts with NSX kernel modules installed, KVM hosts with NSX agents, bare metal servers). Not all hosts in a vSphere environment need to be NSX transport nodes — only those where NSX networking policies are applied to the workloads running on them. This creates scope management opportunities: hosts that do not run workloads requiring NSX overlay networking or distributed firewall policies do not need to be NSX transport nodes, and their cores are therefore not in the NSX licence scope.
In practice, many organisations have inadvertently deployed NSX as a transport node on all hosts in their vCenter inventory, even where workloads on those hosts do not require NSX capabilities. Auditing NSX transport node scope and removing hosts where NSX provides no value can reduce the NSX licence base by 10–30% in some environments.
| Licence Unit | Old Model (pre-2024) | New Model (Broadcom) |
|---|---|---|
| Basis | Per processor socket (2 sockets/licence) | Per physical core |
| Minimum per CPU | None | 16 cores per CPU |
| Scope | NSX transport nodes | NSX transport nodes (same scope rule) |
| Licence type | Perpetual + SnS | Annual subscription only |
| Available editions | Standard, Professional, Advanced, Enterprise Plus | Enterprise Plus (in VCF), limited standalone tiers |
NSX's distributed firewall (DFW) capability — which enables microsegmentation of virtual machine traffic at the hypervisor kernel level — is one of the most strategically important security capabilities in a modern data centre. It allows east-west network traffic between VMs to be inspected and filtered without routing traffic through a physical or virtual network appliance, dramatically reducing the attack surface for lateral movement by threat actors. For many security teams, NSX microsegmentation is the primary justification for the NSX investment.
Under Broadcom's new licensing model, NSX microsegmentation (distributed firewall) requires at minimum NSX Advanced edition. It is included in NSX Enterprise Plus (which is bundled in VCF) and is available in standalone NSX Advanced subscriptions. NSX Standard and Professional do not include the distributed firewall capability, meaning organisations licenced at lower NSX tiers under the old model may need to assess whether their microsegmentation requirements are adequately covered under the new structure.
The financial implication is significant: organisations that deployed NSX primarily for microsegmentation are now paying VCF pricing (which bundles NSX Enterprise Plus with vSphere, vSAN, and Aria) rather than being able to purchase a targeted NSX Advanced licence for microsegmentation alone. If your organisation uses NSX DFW for microsegmentation but does not use vSAN or most of the other VCF components, explore whether standalone NSX Advanced subscription pricing represents better value than VCF.
For organisations where NSX microsegmentation is the primary security use case and the VCF bundle premium is not commercially justified, evaluate Illumio Core, Guardicore (now Akamai Guardicore Segmentation), or Cisco Secure Workload as alternatives. These platforms provide microsegmentation capabilities independent of the underlying hypervisor — including for non-VMware environments — at per-workload pricing models that may be more cost-effective for segmentation-focused deployments.
NSX Federation is the Enterprise Plus capability that allows a single management plane to govern NSX networking and security policies across multiple on-premises sites and cloud environments. For organisations with multi-datacentre infrastructure or hybrid cloud deployments, NSX Federation provides operational efficiency through centralised policy management. However, it requires NSX Enterprise Plus at all sites — a licensing requirement that significantly increases the per-site NSX cost for organisations that would otherwise only need Standard or Advanced capabilities at secondary sites.
The commercial implications of NSX Federation licensing are particularly acute for organisations with disaster recovery or passive secondary sites where NSX Enterprise Plus features beyond policy mirroring are not used. In these scenarios, the cost of licensing NSX Enterprise Plus at a DR site (for Federation compatibility) may not be justified by the operational benefits. Evaluate whether Federation's centralised management benefit outweighs the cost premium of Enterprise Plus at secondary sites, versus managing secondary-site NSX policies independently at a lower edition tier.
NSX's position as the dominant enterprise SDN and microsegmentation platform has been somewhat disrupted by Broadcom's pricing changes, opening commercial conversations with alternatives that were previously difficult to justify against NSX's installed base and functionality advantages. The main alternatives in 2026 are:
Nutanix Flows: Nutanix's software-defined networking capability, integrated with Nutanix AHV, provides overlay networking and microsegmentation in a Nutanix-native model. For organisations migrating VMware to Nutanix AHV, Flows is the natural NSX alternative — it is included in the Nutanix subscription pricing rather than charged separately. The maturity gap versus NSX-T is real (particularly for advanced security capabilities and multi-site scenarios), but for many workload profiles Flows provides adequate coverage. See our VMware alternatives comparison for the full Nutanix analysis.
Cisco ACI / Cisco SD-WAN: For organisations already heavily invested in Cisco networking, Cisco ACI (Application Centric Infrastructure) provides data centre SDN capabilities competitive with NSX. Cisco ACI has different architectural assumptions from NSX (controller-based overlay versus NSX's kernel-distributed model) and requires ACI-capable hardware, but for Cisco-dominant environments the integrated operations story is compelling.
Open-source alternatives (OVN, Calico): OVN (Open Virtual Network) — embedded in Proxmox and available for KVM environments — provides overlay networking and basic security policies. Calico provides Kubernetes-native network policy enforcement. These are compelling for organisations with strong DevOps teams but lack the enterprise operational tooling and support ecosystem of NSX.
Microsoft Azure Virtual Network / Azure Stack HCI SDN: For organisations migrating to Azure or Azure Stack HCI, Azure's networking capabilities replace NSX's role. Azure Virtual Network provides network isolation, and Azure Firewall / Network Security Groups provide policy enforcement. The model is different from NSX (cloud-native versus hypervisor-embedded SDN) but provides equivalent functional coverage for most workload requirements in Azure environments.
Facing an NSX renewal under Broadcom?
Our advisors provide NSX transport node audits, VCF bundle challenge methodology, and Broadcom commercial negotiation support for enterprise NSX deployments.