A Distributed Firewall rule must match every city VM tagged Finance…

Question

A Distributed Firewall rule must match every city VM tagged Finance without typing a static IP list. How should the operator build that match in the NSX GUI?

Accepted Answer

Create a Group under Inventory whose membership is based on the Finance tag, then use that Group as the rule source or destination. — Finance VMs should wear a name badge, not a scribbled subnet on a sticky note. Build an Inventory Group from the Finance tag and drop that Group on the DFW rule. Carbon Black sensors and Horizon pools are not that badge.

Answer

Type a random civic /16 into the rule and skip grouping.

Answer

Create a Carbon Black sensor group and attach it as an NSX Distributed Firewall destination.

Answer

Entitle a Horizon desktop pool named Finance and use the pool as the Distributed Firewall source.

A Distributed Firewall rule must match every city VM tagged Finance without typing a static IP list. How should the operator build that match in the NSX GUI?

Short Explanation

Full Explanation