What Changed for NSX Under Broadcom
NSX was one of VMware's most strategically important products — a software-defined networking platform that abstracted network functions (routing, switching, load balancing, firewalling, microsegmentation) from physical hardware and delivered them as software services in the hypervisor layer. VMware sold NSX in multiple standalone editions — NSX Standard, Professional, Advanced, and Enterprise Plus — with per-processor perpetual pricing and annual support renewals.
Broadcom's post-acquisition consolidation eliminated all NSX standalone SKUs. NSX is now exclusively available as a component of VMware Cloud Foundation (VCF). There is no mechanism to purchase NSX without also purchasing VCF — meaning NSX capability now requires commitment to the full VCF per-core subscription, which also includes vSAN, vCenter, Tanzu, and Aria Suite components.
For enterprises that previously purchased NSX standalone — particularly those who deployed NSX on existing vSphere infrastructure without vSAN — this change has two significant implications: they are now required to purchase VCF at a higher per-core rate to maintain NSX functionality; and they are paying for vSAN and other VCF components they do not use or need, with no mechanism to pay for NSX alone.
"An enterprise that purchased NSX Advanced on 20 processors for $200K per year is now being asked to commit to VCF on 800 cores — the same underlying infrastructure — at $720,000 per year at list. NSX bundling is one of the most commercially impactful Broadcom changes for customers who had NSX without the full stack."
NSX in VCF: What You Get and What You Pay
VCF includes the full NSX feature set — what was previously equivalent to NSX Advanced edition (overlay networking, distributed firewall, gateway firewall, load balancing, VPN). The advanced NSX capabilities that were previously in Enterprise Plus edition (intelligence, network detection and response, identity-based firewall, malware prevention) are available in VCF+ (the premium VCF tier) or as paid add-ons.
NSX in VCF Standard (~$90/core/yr)
- Overlay networking (VXLAN/Geneve)
- Distributed logical router
- Distributed firewall (microsegmentation)
- Gateway firewall (Tier-0/Tier-1)
- Load balancing (basic)
- Site-to-site VPN
- NSX Manager (centralised management)
NSX in VCF+ Premium (add-on pricing)
- NSX Intelligence (traffic analytics)
- Network Detection and Response
- Identity-based firewall
- Advanced load balancing (Global DSR)
- Malware detection and prevention
- NSX+ (cloud-managed NSX-as-a-service)
- Advanced SaaS connectivity
For most enterprise NSX deployments — which use NSX primarily for microsegmentation, overlay networking, and distributed firewall — the standard VCF NSX feature set is adequate. The NSX Intelligence and advanced security capabilities that were previously in NSX Enterprise Plus are now add-on charges on top of VCF, which is important to understand if your existing NSX deployment used those advanced features.
Cost Impact for Existing NSX Customers
The cost impact of NSX bundling within VCF depends heavily on how NSX was previously deployed. Three deployment patterns produce different cost impact profiles.
Pattern 1: NSX on Non-HCI vSphere
The most impacted group are enterprises that deployed NSX-T on standard vSphere infrastructure without vSAN. Their previous cost was vSphere Enterprise Plus (per-socket) plus NSX (per-processor). Their new cost under VCF is the full VCF per-core rate on all cluster cores — including the vSAN component they are not using. This group sees cost increases of 200–400% in most cases, because the full VCF bundle cost is applied to an infrastructure where only compute (vSphere) and networking (NSX) were previously licenced.
Pattern 2: NSX on Full HCI (vSphere + vSAN)
Enterprises that deployed NSX, vSphere, and vSAN as a complete HCI stack see cost increases, but the proportional increase is lower because they were already paying for all three components. Their previous cost was three separate perpetual licence amortisations plus support. VCF consolidates these into a single per-core subscription. The increase is real — typically 100–200% — but the baseline was higher, so the proportional impact is less severe than for NSX-only deployers.
Pattern 3: NSX for Limited Use Cases
Some enterprises deployed NSX for a specific use case — microsegmentation in a small cluster, or NSX for a specific application zone — while running the broader infrastructure on vSphere without NSX. For these environments, moving to VCF requires licencing all cluster cores at the VCF rate (including NSX), even though NSX was previously used on only a fraction of the infrastructure. This can represent the most disproportionate cost increase — paying for NSX across all VCF cores when it was only deployed on 20% of infrastructure.
NSX End of Support Timelines
Understanding NSX End of General Support (EOGS) dates is essential for migration planning. NSX-T 3.x reached EOGS in January 2025. NSX 4.0 and 4.1 have EOGS in April 2026. NSX 4.2 has EOGS in October 2027. After EOGS, Broadcom provides no patches — not even critical security fixes.
For enterprises running NSX-T 3.x on perpetual licences, the EOGS date has already passed, meaning they are currently running without security patch access. This is a critical compliance issue for any organisation subject to security frameworks that require supported infrastructure. The urgency of the NSX situation varies by version but is acute for the large installed base of NSX-T 3.x customers.
NSX Negotiation Tips: 6 Specific Tactics
NSX customers negotiating VCF have specific leverage points that differ from pure vSphere-to-VCF migrations. The following tactics are derived from our experience advising NSX-deploying enterprises through Broadcom negotiations.
Challenge NSX Core Scope
NSX deployment scope rarely equals total vSphere deployment scope. If NSX is deployed on a subset of your clusters, argue that VCF (which includes NSX) should be scoped to NSX-enabled clusters only — with VVF (no NSX) applied to clusters that never had NSX. Broadcom typically resists this but it is a legitimate argument when NSX was genuinely not deployed across the full estate.
Quantify the vSAN Credit
If you are moving from NSX + vSphere (no vSAN) to VCF, you are paying for vSAN capability that you do not use. Negotiate an explicit credit or discount that reflects the vSAN component value embedded in the VCF price. This is structurally equivalent to the "no vSAN" discount that VVF represents — but with NSX included, which VVF does not provide. Some enterprises have negotiated a custom VCF-NSX tier at a price point between VVF and VCF.
Use NSX Advanced Feature History as Leverage
If your NSX deployment used Enterprise Plus features (Intelligence, NDR, identity-based firewall) that are now add-ons in VCF+, negotiate the inclusion of those features at the standard VCF price as part of your migration. Your previous perpetual licence entitled you to those features — their removal from standard VCF and reclassification as add-ons is a value reduction that justifies price concession.
Evaluate Cisco ACI as Alternatives Leverage
Cisco ACI is the most credible alternative to NSX for large data centre networking deployments. Even if you have no intention of migrating to Cisco ACI, commissioning a formal ACI evaluation — with Cisco engagement, reference customer visits, and a migration cost model — creates demonstrable alternatives leverage in Broadcom negotiations. Broadcom's NSX team knows Cisco ACI is a viable alternative; your evaluation activity makes the threat credible.
Negotiate Multi-Year Flat Rate with NSX Expansion Rights
If your NSX deployment is expected to grow — new workloads, new clusters — negotiate a flat per-core rate for the entire term with expansion rights priced at the same rate. Broadcom's default VCF expansion pricing for new cores added during a term is often at list price. Securing your discounted rate for planned expansion can save significantly over a 3-year term as your estate grows.
Time Your Negotiation to Broadcom's Fiscal Quarter-End
Broadcom's fiscal year ends in October. Quarter-ends in January, April, and July are pressure points where Broadcom sales teams have quota commitments that drive them toward commercial concessions. NSX renewals timed to conclude in the final 3 weeks of a fiscal quarter — with a credible alternatives track and a committed deal size — consistently achieve better pricing than negotiations with no fiscal pressure.
NSX Alternatives Assessment
For enterprises evaluating a genuine migration away from NSX, the alternatives landscape is narrower and more complex than for vSphere compute. NSX's software-defined networking architecture — particularly its distributed firewall and overlay networking — has no direct drop-in replacement. Alternatives require re-architecting the networking model, not just swapping a licence.
Nutanix Flow is the most accessible NSX alternative for enterprises migrating to Nutanix AHV. Flow provides microsegmentation and distributed firewall capability comparable to NSX Standard, but does not replicate NSX's overlay networking depth or gateway routing capability. For environments where NSX is used primarily for microsegmentation, Flow is a viable replacement. For environments with complex NSX overlay routing, Flow requires additional external networking components.
Cisco ACI offers an alternative data centre fabric architecture that provides microsegmentation, policy-based networking, and multi-site connectivity. ACI is a mature enterprise platform with strong credentials for large-scale deployments. However, ACI uses a different architectural model from NSX — hardware-anchored policy enforcement via APIC rather than software-only hypervisor-resident enforcement — and migrating from NSX to ACI requires significant re-architecture of network policies, not just a product swap.
For most enterprises with deep NSX deployments, the most commercially prudent path is VCF with maximally negotiated pricing rather than NSX migration to an alternative — at least in the near term. The NSX alternatives assessment should focus on creating negotiating leverage rather than on planning an imminent migration, unless there is a specific strategic reason to exit the VMware platform entirely.
For the full negotiation playbook and NSX-specific deal structures, see our VMware Broadcom Survival Guide or contact our VMware advisory team for a personalised review of your NSX position.