Transit needs north-south gateway firewall at the civic perimeter, not only east-west host filtering. What must be deployed?
Select an answer to reveal the explanation.
Short Explanation
East-west DFW is a lock on every apartment door; north-south gateway firewall is the lobby door on the street. You still need Edge nodes in an Edge cluster for that lobby—host DFW alone will not inspect traffic leaving toward the ISP.
Full Explanation
NSX gateway firewall runs on NSX Edge nodes that belong to an Edge cluster and front the north-south gateways. Distributed firewall on compute hosts filters east-west traffic at the vNIC and does not replace that perimeter function. Workspace ONE Access policies and Carbon Black prevention are not NSX gateway firewall.