Parks Endpoint Protection via Guest Introspection shows partner service VMs unhealthy. Transport nodes are prepared and Distributed Firewall Application policy is unchanged, but the service insertion network cannot ping the partner SVM. What should the administrator fix first?

When parks Endpoint Protection via Guest Introspection shows partner service VMs unhealthy, transport nodes are prepared, and Distributed Firewall Application policy is unchanged, but the service insertion network cannot ping the partner SVM, restore IP connectivity on the service insertion network to the Guest Introspection partner SVM first. GI partner health requires a reachable service insertion network path to the SVM; prepared hosts and unchanged DFW do not help if that network is broken. Restoring SVM reachability returns civic partner EPP. Broadening the Distributed Firewall Application policy to any-any so Guest Introspection no longer needs a partner SVM fails by concept because any-any abandons micro-segmentation and does not heal SVM connectivity. Replacing Guest Introspection with a Carbon Black Cloud sensor group on the same VMs and ignore the SVM fails by concept when the designed control is GI partner EPP; swapping products ignores the broken insertion network. Binding the partner SVM to a Workspace ONE Access network range so Hub can health-check the GI agent fails by concept because Access network ranges do not health-check GI SVMs. Exam caveat: unhealthy GI partner with prepared hosts usually means service insertion network connectivity to the SVM—fix ping path before rewriting DFW or swapping to CBC. Operational check: restore routing/firewall on the service insertion network, ping the partner SVM, confirm GI service healthy, retest partner EPP on a parks workload, and document the insertion network in the parks NSX partner runbook for municipal endpoint offload.