Utility-billing VMs need source NAT so they can reach a partner network using a public civic address. Where in the NSX GUI should the operator configure that NAT?
Select an answer to reveal the explanation.
Short Explanation
NAT is a change of street address at the civic gateway, not a firewall tick-box. Open Networking, then NAT, on the T0 or T1 that fronts the partner network. DFW, Horizon, and Forged Transmits do not write that translation.
Full Explanation
NSX NAT rules are configured in the Policy Networking UI on a Tier-0 or Tier-1 that hosts Edge services—Networking, then NAT—for utility-billing VMs that need source NAT to a partner network using a public civic address. NAT is a change of street address at the civic gateway, not a firewall tick-box. Distributed Firewall Application rules filter east-west traffic; they are not NAT. Horizon Cloud NAT is an EUC setting. vSphere Forged Transmits is a switch security policy, not source NAT for utility-billing. Exam caveat: the gateway chosen for NAT must have Edge services capacity; DFW cannot substitute for translation. Operational check: open Networking NAT on the relevant Tier-0 or Tier-1, add source NAT for utility-billing, test partner reachability with the public address, and reject DFW Application, Horizon Cloud, and Forged Transmits as the NAT path. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish.