Impact of Replacing Existing Firewall Licenses with a vDefend Bundle License

Products

• VMware vDefend Firewall

Issue/Introduction

Customers planning to transition from existing Distributed Firewall (DFW) and Gateway Firewall (GFW) licenses to the vDefend Bundle license often want to understand whether this change could impact their production environment.

This article outlines the recommended approach for replacing firewall licenses and explains the expected impact on firewall functionality and traffic flow.

Environment

VMware vDefend Firewall

VMware NSX-T

Resolution

To avoid any impact on production traffic, the following approach is recommended:

Add the vDefend Bundle (Firewall) license to the NSX environment while the existing DFW and GFW licenses are still active.
Allow the system to complete the license synchronization process.
Verify that all existing DFW and GFW rules remain intact and that traffic is flowing as expected.

Once verification is complete, the older DFW and GFW licenses can be manually removed.

 

Following this sequence ensures uninterrupted firewall enforcement and avoids disruption to the data plane.

Expected Impact :

No impact on existing DFW or GFW rules
No interruption to firewall enforcement on ESXi hosts (data plane)
No downtime or traffic disruption when licenses are replaced in the recommended order.

Additional Information

Conclusion:

Replacing existing DFW and GFW licenses with a vDefend Bundle license does not cause any significant impact on firewall functionality when performed correctly. Customers are advised to add the new vDefend license first, verify system behavior, and then remove the older licenses afterward. This approach ensures a smooth transition with no effect on production workloads.