A library validated Distributed Firewall policy in test and must apply the same intent in production. What is the preferred promotion method?

When a library validated Distributed Firewall policy in test and must apply the same intent in production, the preferred promotion method is to keep the same policy and retarget production by changing group membership, not pasted IPs. Treat the policy as the library rulebook and groups as which carts sit under each rule: move production carts into the groups rather than rewriting every shelf label with raw addresses. Copying raw IP addresses from the test segment into production rules fails by concept because pasted IPs drift from inventory, skip the group model, and force duplicate policy maintenance. Recreating the policy as Ethernet MAC allows in production only fails because MAC-level Ethernet rules are a different category and intent than the validated Application or Environment policy and do not preserve the same group-based design. Exporting iptables from the test guest and importing on production guests fails because guest iptables are not NSX-T Distributed Firewall realization and break the centralized policy model. Exam caveat: promote DFW intent via group membership retargeting; IP paste, Ethernet-only recreation, and guest iptables are not preferred promotion methods. Operational check: keep the validated policy object, point production security groups at production VMs, verify Traceflow and hit counts in production, and document group-based promotion in the library change procedure.