Network Segmentation and Flow Network Security Policy Design
How Flow works
Flow Network Security is a distributed firewall enforced inside the AHV virtual switch and managed from Prism Central. Policies are written against categories, not IP addresses, and are distributed to every host - so VM-to-VM traffic is filtered whether the two VMs sit on the same host or different hosts. Categories must be applied before a policy can take effect; a VM with a missing or misspelled category silently escapes the intended policy. This is the number-one reason a rule "doesn't work."
Policy types
Isolation (whitelist) policies deny everything between VMs in their scope except explicitly allowed flows. Application policies define allow lists for a tier or application across sources and destinations. Quarantine policies lock down a suspected-compromised VM, permitting only specific remediation traffic. Every policy runs in Monitor (log only) or Enforce (block); exam questions love the gap between "policy created" and "policy enforcing."
Semantics that trip people up
Isolation policies are additive: a VM in two isolation policies receives the union of both allow lists, not the intersection. There are no explicit deny rules inside an isolation policy - exclusion from the allow list is how you deny. VMs outside a policy's scope are unaffected unless a rule names them as source or destination. Use "external" with IP ranges to govern traffic leaving the AHV estate.
Rule of thumb
Run in Monitor first, read the hit counters and flow visualization, confirm category coverage, then switch to Enforce.