911 voice VMs were added to the Distributed Firewall exclusion list by mistake, so micro-segmentation never applies. Adding more gateway firewall rules does not fix east-west on the same segment. What should the administrator do?
Select an answer to reveal the explanation.
Short Explanation
The exclusion list is a VIP pass that walks voice VMs around Distributed Firewall. Take the pass back and policy applies again. Extra gateway rules and UEM enrollment do not un-exclude a vNIC.
Full Explanation
VMs on the NSX-T Distributed Firewall exclusion list skip DFW processing. Removing the 911 voice VMs from that list is required before micro-segmentation can apply. Gateway firewall does not inspect same-segment east-west, so adding Tier-0 rules does not replace DFW on excluded VMs. Workspace ONE UEM enrollment and Carbon Black sensor groups do not manage the DFW exclusion list.