Parks backup VMs stream to a physical backup grid that is not an NSX-T overlay workload. Why must the administrator identify that flow?

Parks backup VMs streaming to a physical backup grid that is not an NSX-T overlay workload must be identified because that flow leaves the hypervisor toward physical endpoints, so IP-set or Gateway Firewall policy must include it. When backup data walks off the overlay onto iron, overlay-only VM groups are incomplete. Treating the flow as guest-only Distributed Firewall east-west that never needs an IP set fails by concept because the destination is physical infrastructure outside NSX-T workload inventory; without an IP set or appropriate gateway policy, the virtual-to-physical hop is ungoverned or incorrectly assumed covered. Calling it Workspace ONE UEM compliance traffic fails because backup data-plane streams are not device-enrollment or compliance check-ins and UEM does not classify NSX backup paths. Calling it vSAN kernel traffic that belongs only in Guest Introspection fails because vSAN is storage VMkernel fabric and Guest Introspection is identity/agent insertion—neither replaces identifying virtual-to-physical backup conversations for firewall policy. Exam caveat: virtual-to-physical backup flows need explicit identification with IP sets and/or Gateway Firewall; overlay VM groups alone, UEM compliance, and Guest Introspection are the wrong classifications. Operational check: inventory backup appliance IPs into an IP set, write Distributed Firewall or Gateway Firewall allows only for required backup ports from backup VMs, Traceflow or capture to prove the path leaves the overlay toward the grid, deny citizen or unrelated sources, and document the virtual-to-physical hop in the parks backup security design.