A library Distributed Firewall rule uses an L7 context profile for HTTP, but the catalog flow is TLS-encrypted and application-id never matches. What should the administrator understand?
Select an answer to reveal the explanation.
Short Explanation
An L7 profile is reading labels on the box, and TLS wraps the box in opaque tape. If the protocol is not visible, app-id fails. Use a port-based allow or a design that can see TLS, not wishful decryption.
Full Explanation
When a library Distributed Firewall rule uses an L7 context profile for HTTP but the catalog flow is TLS-encrypted and application-id never matches, understand that context profiles need a visible protocol; encrypted TLS may require a port-based allow or a TLS inspection design. An L7 profile reads identifiable application markers; TLS wraps those markers so app-id fails even when the civic catalog service is healthy. Choose a control that can see the traffic or fall back to ports intentionally. Context profiles decrypt all TLS automatically on every segment fails by concept because DFW context profiles do not magically decrypt all TLS everywhere without an inspection design. Carbon Black Cloud will classify the TLS flow for DFW fails by concept because CBC classification is endpoint telemetry and does not supply NSX DFW L7 app-id for encrypted sessions. Identity Firewall supplies L7 app-id for encrypted sessions fails by concept because IDFW maps directory users to IPs for rules; it does not decrypt TLS for context profiles. Exam caveat: encrypted traffic defeats naive L7 context matching—plan port-based allows or TLS inspection rather than assuming automatic decrypt. Operational check: confirm the catalog flow is TLS, replace or augment the HTTP context rule with an appropriate port-based allow or inspection path, retest matching, and document the encryption assumption in the library DFW design for civic catalog protection.