Transit north-south traffic never hits the NSX-T gateway firewall after a core-switch change. East-west Distributed Firewall still works. The Edge uplink VLAN is missing from the physical trunk toward the Edge host. What should the administrator fix?

When transit north-south traffic never hits the NSX-T gateway firewall after a core-switch change, east-west Distributed Firewall still works, and the Edge uplink VLAN is missing from the physical trunk toward the Edge host, allow the Edge uplink VLAN on the physical switch trunk so north-south traffic reaches the gateway firewall. East-west can remain healthy while north-south never reaches the Edge if the uplink VLAN is absent from the trunk. Restoring that VLAN returns civic gateway inspection. Rewriting east-west Distributed Firewall any-any so gateway firewall is no longer required for north-south fails by concept because east-west any-any does not restore north-south gateway enforcement and weakens micro-segmentation. Installing a CB Defense sensor on the Edge VM so Carbon Black Cloud inspects north-south in software fails by concept because CBC on the Edge VM is not the NSX gateway firewall datapath. Enrolling the Edge in Workspace ONE UEM and use compliance to gate north-south routing fails by concept because UEM compliance does not forward north-south traffic into gateway firewall. Exam caveat: east-west OK but north-south misses gateway after core change often means missing Edge uplink VLAN on the trunk—fix physical path first. Operational check: allow the Edge uplink VLAN on the core trunk to the Edge host, confirm Edge uplink up, verify north-south hits gateway firewall, and document trunk VLAN requirements in the transit Edge networking checklist for municipal north-south security.