Flow Virtual Networking and Security
What this domain tests
Flow questions test microsegmentation with categories, policy types, enforcement, and Flow Virtual Networking concepts.
Core rules and concepts
- Flow Network Security is managed in Prism Central and enforces policy at the VM vNIC, so traffic is filtered before it reaches the guest.
- Policies use categories, not IP addresses. VMs must be categorized; uncategorized VMs are a common gap.
- Policy types include isolation (deny all except explicitly allowed), application (allow defined flows), and quarantine (deny all). Precedence matters; quarantine is the most restrictive.
- Flow Virtual Networking adds overlay VPCs, routing, NAT, and gateways for tenant isolation.
- Flow is distributed. No separate firewall appliance is needed for east-west enforcement.
- Policy changes apply dynamically as VMs move.
Worked example
A three-tier app has web, app, and db categories. Create an application policy allowing web to app on 443 and app to db on 5432, with default deny. Put each VM in the correct category. Test web to db; it should be blocked. If a VM is missing its category, the policy will not match and the VM may be unexpectedly open or isolated depending on policy scope.
Traps
Do not describe Flow as only a perimeter firewall. Do not say policies are IP-based. Do not forget that Prism Central is required. Do not assume categories are assigned automatically. Do not confuse Flow Network Security with Flow Virtual Networking.