A school-district Distributed Firewall allow never hits because the student-information VM sits on a VLAN port group that is not prepared for NSX. What should the administrator do first?

When a school-district Distributed Firewall allow never hits because the student-information VM sits on a VLAN port group that is not prepared for NSX, prepare the host and move the VM to an NSX segment or prepared VLAN first. DFW inspects workloads on the NSX fabric; a plain VLAN port group is off that fabric, so the allow never sees the packet no matter how carefully it was written. Putting the SIS VM on prepared networking is the prerequisite for civic micro-segmentation. Duplicating the allow at the bottom of the Emergency section fails by concept because rule copies still cannot inspect traffic that never enters the NSX DFW path. Adding the VM to a Carbon Black Cloud isolation policy as a DFW substitute fails by concept because CBC isolation is endpoint containment, not NSX Distributed Firewall realization on unprepared networking. Creating a Workspace ONE Tunnel rule for the VM UUID fails by concept because Tunnel is managed VPN for devices, not DFW attachment for a datacenter VM on a non-NSX port group. Exam caveat: DFW requires prepared hosts and NSX segments or prepared VLANs—fix order and product substitutes cannot fix an unprepared attachment. Operational check: prepare the host, migrate the SIS VM to an NSX segment or prepared VLAN, republish the allow, confirm hit counts, and update the school-district network attachment standard for civic education workloads.