Beyond the Perimeter: Securing VCF Applications with VMware ANS

Most VMware Cloud Foundation (VCF) customers already own powerful tools to secure their applications. Far fewer use them to their full potential.

VMware Application Networking and Security (ANS) brings load balancing, distributed firewalling, threat protection, and microsegmentation into the same platform that runs your workloads. Used well, it closes the gap between a hardened perimeter and an exposed interior, where most modern attacks do their damage.

In this post, we break down the ANS challenges we see most often, how we solve them, and what that looks like in real ClearBridge engagements.

What ANS brings to VCF

ANS combines four capabilities inside VCF:

The distinction matters: the distributed firewall decides whether a connection is allowed, while ATP asks whether allowed traffic is actually malicious. Together they form the foundation of a Zero Trust private cloud. In VCF 9.1, that protection covers Kubernetes workloads running on vSphere Kubernetes Service (VKS) as well as VMs.

Common ANS challenges and how we solve them

1. Security stops at the perimeter

The challenge: Many environments still rely on perimeter firewalls and a mostly flat internal network. Once an attacker or ransomware gets inside, nothing stops it from moving server to server.

The solution: We design microsegmentation with a distributed firewall so each workload talks only to what it needs. Instead of guessing at rules, we start with observed traffic, group workloads by application, and roll out policy in stages so nothing breaks in production. ATP then adds detection for threats hiding inside allowed traffic.

2. Hardware load balancers can’t keep up

The challenge: Appliance-based load balancers are expensive to scale, configured by ticket, and slow to adapt. They become a bottleneck as teams deploy Kubernetes or self-service applications.

The solution: We deploy Avi as a software-defined, elastic load balancing layer inside VCF. Application teams get load balancing, WAF, and ingress on demand, and VCF Operations handles Avi’s day-0 through day-2 lifecycle. Where teams run NGINX ingress today, Broadcom’s Avi Conversion Tool helps automate the move.

3. ANS was licensed but never deployed

The challenge: We regularly meet customers who bought the ANS add-on with VCF but never put it into production. Teams are stretched, and without a clear plan, they never rise to the top of the list.

The solution: Our ANS Review gives you that plan in one to two weeks. A ClearBridge architect assesses your current VCF configuration and lays out exactly how to use ANS to secure the environment, following VMware best practices.

4. Rule sprawl and tool sprawl

The challenge: Firewall rules pile up over years, nobody is sure which ones still matter, and security teams bounce between separate consoles for firewalling, IDS, and traffic analysis.

The solution: With ANS, firewalling, IDS/IPS, and network detection share one VCF management plane. We clean up and consolidate policy, tie rules to application groups instead of IP addresses, and where it fits, manage policy as code so every change is versioned and auditable.

5. Kubernetes opens a new blind spot

The challenge: As teams adopt containers, security and networking often get handled with separate tools and rules, creating gaps between VM and container environments.

The solution: With Avi integrated into VCF, VKS clusters automatically get the Avi Kubernetes Operator for load balancing, WAF, and ingress. In VCF 9.1, distributed firewall and threat prevention policies extend to VKS workloads, so we design one consistent security model across VMs and containers.

6. Compliance and audit pressure

The challenge: Healthcare, federal, and financial organizations have to prove that sensitive systems are isolated, not just say so.

The solution: We capture your regulatory and audit controls up front and design segmentation to match. The result is documented, enforceable separation between environments and data tiers, built by engineers experienced in cleared and highly regulated settings.

7. Fear of a disruptive migration

The challenge: Teams worry that moving to a new firewall or load balancer means rewriting every policy and risking outages.

The solution: Broadcom now offers automated migration from legacy agent-based firewalls to the distributed firewall, and VCF Import brings existing policies intact. We plan the cutover, test in stages, and hand off documentation your team can run with.

ANS in action: ClearBridge case studies

Securing VCF for a global financial services leader

A global financial services organization needed its VCF environment validated and certified against strict Global Information Security standards, while preparing for future containerized workloads. A ClearBridge Security Architect assessed the environment and designed and validated controls using the distributed firewall, Security Services Platform, and Advanced Threat Prevention, then worked with infrastructure and security teams to close the gaps. The client met its compliance requirements, reduced implementation risk, and accelerated its VCF deployment. Read the case study

Moving VMware management from click-ops to GitOps

This client already ran GitOps in the public cloud, but its VMware environment still depended on manual, GUI-driven changes. A ClearBridge VMware GitOps Architect introduced infrastructure as code, Git-based version control, and automated deployment workflows. The client gained more consistent deployments, less configuration drift, and better auditability, the same foundation that makes security policy as code practical. Read the case study

How ClearBridge helps

The fastest way to start is our ANS Review. Over one to two weeks, delivered remotely, a ClearBridge architect:

1. Interviews your team and reviews your current VCF configuration
2. Builds a plan to use Avi, the distributed firewall, ATP, and microsegmentation according to VMware best practices, mapped to your regulatory and audit controls
3. Reviews findings with you and lays out a clear path to implementation

From there, we can scope the full design and deployment, including multi-site and highly regulated environments. Our work is backed by a team that includes Broadcom Knights and consultants with experience in cleared federal, healthcare, and financial services settings.

Ready to secure what’s inside your perimeter? Contact us to schedule an ANS Review.