County compute clusters must enforce NSX distributed firewall. What prepares the ESXi hosts for that?
Select an answer to reveal the explanation.
Short Explanation
DFW lives in the NSX bits on the host, not in a vCenter checkbox. Slap a transport-node profile on the cluster so ESXi becomes a transport node—Carbon Black sensors and a plain port group will not grow that filter.
Full Explanation
Distributed firewall realizes on NSX-prepared transport nodes after a transport-node profile installs the NSX components on ESXi in the target cluster. vCenter has no standalone DFW switch that replaces that preparation, and a vSphere standard-switch port group with no NSX backing is not a DFW attachment point. Carbon Black sensors protect endpoints; they do not install the NSX DFW datapath.