County web and app VMs on the same cluster send east-west traffic to a hardware firewall in another building and back. Which traditional challenge is that, and how does virtual networking address it?
Select an answer to reveal the explanation.
Short Explanation
Hairpinning is the long detour out to another building just to inspect two VMs that already sit on the same cluster. A distributed firewall checks at the vNIC, like a guard at each apartment door. The county should not send neighbor-to-neighbor mail across town and back.
Full Explanation
Hairpinning occurs when east-west traffic between county web and app VMs on the same cluster trombones to a remote hardware firewall and back. Virtual networking addresses that with a distributed virtual firewall that inspects at the vNIC or hypervisor, keeping enforcement local instead of forcing every lateral packet across buildings. Requiring hairpinning in NSX-T so every packet visits the physical core reverses the benefit. Placing Carbon Black on the firewall while keeping the trombone does not fix the network path. Horizon BLAST is a display protocol and does not replace east-west firewalling for server tiers. Exam caveat: some north-south flows still use gateway or physical edge firewalls; the hairpinning critique targets unnecessary east-west trombones. Operational check: measure path and latency for a web-to-app civic flow before and after DFW local enforcement and confirm packets are not forced to the remote hardware firewall. Keep municipal naming and change tickets aligned with the software objects so civic audits can trace intent. Prefer verifying with a non-production agency workload before promoting the same pattern to life-safety systems. Record realization state and underlay health in the runbook used by on-call city operators.