At a logical port for a court VM, NSX uses specific direction terms. Which official identification is correct?
Select an answer to reveal the explanation.
Short Explanation
NSX reads direction from the VM's front door: ingress is traffic walking into the guest from the data center, egress is traffic walking out toward the data center. It is not a NAT-versus-BGP nickname and not Horizon or Carbon Black slang.
Full Explanation
At a logical port for a court VM, official NSX direction terms are taken from the virtual machine’s point of view: ingress is traffic entering the VM from the data center, and egress is traffic leaving the VM toward the data center. Those definitions apply at the port—including Distributed Firewall orientation—and form the vocabulary municipal security teams must use when writing micro-segmentation policy. Ingress is not defined as only north-south NAT on the Edge, and egress is not only BGP to the ISP; those are specific service paths, not the logical-port direction model. Ingress is not Horizon client traffic and egress is not BLAST display protocol. Ingress is not Carbon Black quarantine and egress is not sensor check-in; endpoint products do not redefine NSX port directions. Exam caveat: because direction is VM-centric, an allow-egress rule on a client VM is not automatically “toward the internet” in every diagram. Always read rule direction relative to the protected logical or segment port. Operational check: create a test Distributed Firewall rule using ingress and egress relative to a court VM port, generate traffic both toward and from the guest, and confirm hit counters match the VM-centric definitions rather than Edge-NAT or Horizon/Carbon Black slang.