The 311 VIP needs centralized NAT, while east-west isolation between 311 VMs uses the Distributed Firewall. How do Edge and host data planes interact for those services?
Select an answer to reveal the explanation.
Short Explanation
East-west inspection lives on the hosts; NAT for a VIP is a centralized Edge job. Do not flip those planes. vCenter HA is not the NAT box.
Full Explanation
NSX runs distributed services such as overlay switching and Distributed Firewall on hypervisor transport nodes, while centralized services such as NAT for a 311 VIP run on Edge nodes. East-west inspection lives on the hosts; NAT for a VIP is a centralized Edge job, and those planes must not be flipped when operators design the civic path. Hosts do not perform all centralized NAT while Edge nodes perform all Distributed Firewall—that reverses the product model. vCenter HA protects vCenter availability and does not terminate NAT or DFW in the same process on behalf of tenant traffic. Both NAT and DFW need not run only on the physical core routers; NSX places DFW at the vNIC and NAT on Edges so the city can keep policy close to the workload or at the centralized services edge. Exam caveat: associate questions expect this placement model—distributed on hypervisors versus centralized on Edges—even though advanced designs can add nuance later. Operational check: confirm DFW rules realize on hosts that run 311 VMs, confirm the VIP NAT is configured on the Edge-backed gateway path, generate test east-west and north-south flows, and ensure vCenter HA events are not mistaken for those data-plane roles.