County fails over permitting VMs to a disaster-recovery NSX-T fabric. Recovered VMs match no security groups and hit default-deny. What should have been replicated to the DR site?
Select an answer to reveal the explanation.
Short Explanation
Recovered permitting VMs are strangers in a new courthouse unless their name tags come with them. Copy the tag taxonomy, groups, and Distributed Firewall policy to DR or default-deny will black-hole them.
Full Explanation
NSX-T Distributed Firewall membership is driven by tags and groups. If the DR fabric lacks the same taxonomy and policy, recovered VMs miss allows and hit default-deny. HA restart priority, a standing any-any, and GRC wording without NSX objects do not give recovered workloads a security policy at DR.