VMware

Three signs your VCF renewal quote is being padded with NSX advanced services you do not use.

NSX advanced services are bundled into the VCF subscription line on the renewal quote whether the buyer's environment activates them or not. Three patterns tell you the padding is present.

By The Negotiation Desk · VMware · Archetype: The Tell

Published 3 Oct 2024

The VCF subscription line on a renewal quote rolls NSX into the bundle, and inside the NSX entry the quote rolls in a set of advanced networking and security services that most buyers do not have active in their estate. The advanced services include distributed firewall, advanced load balancing, federation, intrusion detection and prevention, and the federated identity layer that ties NSX to the buyer's identity provider. Each of these has a real list price. Each is included in the VCF bundle as a default. The buyer who is consuming the NSX core for routing and switching is paying for the advanced services on every host in the estate whether the host is running them or not. The Desk reviews around 40 VCF renewal quotes per quarter and the NSX advanced services padding shows up in roughly three quarters of them. The padding is not a billing error. It is a bundle construction choice that produces the same outcome on the buyer's invoice. The three signs below tell you whether the padding is on your quote and at what scale.

The signs are not subtle once the buyer knows what to look for. The quote document itself surfaces all three signals on the page, but the signals are buried inside line items and footnotes that read as routine subscription mechanics. The buyer who reads the quote as a top line subscription number will miss the signals. The buyer who reads the quote against the buyer's actual NSX configuration in the estate will see them.

Sign one. The NSX line shows a per host price that exceeds the published list for the core SKU

The first sign sits in the NSX subscription line on the quote. The per host price the quote applies is the bundled price, which includes the advanced services. The published list price for the NSX core SKU, used standalone, sits materially below the bundled per host figure. The buyer who divides the NSX subscription line by the host count is looking at the bundled per host. If that figure exceeds the standalone list by more than 35 percent, the advanced services are inside the line. The published list moves quarterly, but the relationship between the bundled and standalone figures is stable enough to use as a quick test. The cohort shows bundled to standalone deltas running between 38 percent and 71 percent depending on the buyer's region and the buyer's renewal scale.

Sign two. The quote's bundle inclusion footnote names the advanced services

The second sign sits in the footnote on the quote that enumerates the bundle's inclusions. On a current VCF subscription quote the footnote will name distributed firewall, advanced load balancing, intrusion detection and prevention, federation, and the identity layer as included items. The footnote is the quote's contractual record that the buyer is paying for these services. The footnote does not say whether the buyer is consuming them. The buyer's review move on the footnote is to mark each enumerated service against the buyer's actual NSX configuration in the estate. Each unmatched service is a line item the buyer is paying for and not consuming.

"The bundle is the seller's preferred shape for the renewal. The buyer's preferred shape for the renewal is whatever the buyer is actually consuming. The padding sits in the gap between the two shapes."VCF Practice Lead, The Desk

Sign three. The host count on the NSX line matches the host count on the VCF line

The third sign sits in the host counts across the quote's line items. On a standard VCF bundle the NSX line carries the same host count as the VCF subscription line. The buyer who is running NSX only on a subset of the VCF estate, which is common in estates that have phased the NSX rollout or that run NSX only on the production tier, is paying for NSX on every VCF host. The per host price is the bundled price, which includes the advanced services. The host count is the full VCF estate. The two together produce a line item that overstates the buyer's actual NSX consumption by the ratio of the buyer's non NSX VCF hosts to the buyer's NSX hosts. On the cohort the overstatement ratio sits between 1.2 and 2.6, with the higher end concentrated in buyers who run NSX only on production.

What the three signs tell you together

The three signs are individually significant. Together they produce a working estimate of the NSX advanced services padding on the quote. The buyer computes the standalone NSX price the buyer would pay against the buyer's actual NSX host count, compares the result to the NSX line on the quote, and the delta is the padding. The cohort's median padding figure runs at approximately 18 percent of the total VCF renewal quote. The high end of the cohort runs to 31 percent. The padding is not the whole renewal negotiation. It is the most consistent line item adjustment available to the buyer who is willing to disaggregate the bundle.

VCF renewal quotes reviewed per quarter40

Quotes with NSX advanced services padding present~75%

Bundled to standalone per host delta on NSX line38% to 71%

Host count overstatement ratio, NSX line1.2x to 2.6x

Median NSX padding as share of total VCF renewal18%

High end of cohort31%

What we have seen on live deals this quarter

A Fortune 500 retailer received a VCF renewal quote at $24M annual. The NSX line ran at $4.1M on a per host basis that matched the VCF estate's full host count. The retailer's actual NSX consumption was core routing and switching on the production tier only, no distributed firewall, no advanced load balancing, no federation. The disaggregation work surfaced approximately $3.0M of NSX advanced services padding. The renewal closed at $19.6M annual.

A regional bank received a VCF quote at $11M annual. The NSX line ran at $2.0M. The bank's NSX configuration used distributed firewall on the production tier only. The advanced services padding figure was smaller in absolute terms, approximately $0.9M, but the bank's renewal scale made the percentage roughly 8 percent of the renewal. The renewal closed at $10.1M annual.

A global manufacturer received a VCF quote at $38M annual. The NSX line ran at $6.4M. The manufacturer's NSX configuration was the most extensive of the three: distributed firewall, advanced load balancing, and federation across the production and development tiers, with the identity layer integrated. The advanced services padding figure was approximately $1.1M, the smallest in absolute terms because the manufacturer was actually consuming most of what the bundle contained. The renewal closed at $36.9M annual. The padding figure was smaller, but the disaggregation work confirmed the line item, which mattered for the buyer's audit defence going forward.

The takeaway

The VCF subscription bundle includes a set of NSX advanced services that most buyers do not have active across the full estate. The bundle prices the services on every host whether the host activates them or not.
The three signs on the quote are a per host price exceeding standalone list by more than 35 percent, a footnote enumerating the advanced services, and an NSX line host count matching the full VCF host count.
The padding figure runs at a median of 18 percent of the total VCF renewal quote on the Desk's cohort. The disaggregation work that surfaces it is line item review, not a renegotiation of the bundle's structure.