A water-utility ESXi host shows Unknown realization for Distributed Firewall, and new SCADA-segment rules never appear on the host. What should the administrator check?
Select an answer to reveal the explanation.
Short Explanation
Policy has to be delivered by the host agents, like a work order that never left the truck. If nsx-proxy or fabric is sick, realization stays Unknown. Fix the agent, not a BGP neighbor.
Full Explanation
When a water-utility ESXi host shows Unknown realization for Distributed Firewall and new SCADA-segment rules never appear on the host, the administrator should check nsx-proxy and NSX fabric status on the host. Policy realization depends on healthy host agents delivering configuration from Manager; if nsx-proxy or fabric status is sick, rules stay Unknown and SCADA segmentation never lands on that host. Fix the delivery path before rewriting SCADA policy. Workspace ONE UEM profiles on the SCADA HMI fail by concept because UEM profiles manage endpoints, not NSX host DFW realization. Carbon Black Cloud reputation for the rule UUID fails by concept because CBC reputation does not realize NSX DFW rules on ESXi. A T0 BGP neighbor as the DFW realization engine fails by concept because BGP is routing adjacency, not the host-local DFW realization channel. Exam caveat: Unknown realization points to host fabric and nsx-proxy health first—not UEM, CBC reputation, or T0 BGP as the DFW delivery engine. Operational check: inspect nsx-proxy and fabric status on the affected host, remediate agent or connectivity faults, republish or wait for realization, confirm SCADA rules show Applied, and keep evidence in the water-utility OT security runbook for civic industrial governance.