NSX Security
Policy and enforcement
NSX security centers on the distributed firewall (DFW), which enforces rules at the VM vNIC on the host, close to the workload. Policies contain rules with sources, destinations, services, and profiles; groups can be static, dynamic by tag or membership criteria, or identity-based. Applied-to determines where enforcement occurs, while source and destination determine what matches. This distinction is a common trap: a rule applied to a Tier-1 gateway is not the same as a rule applied to VM vNICs. DFW is stateful and supports L2-L4 and context profiles; advanced services include IDS/IPS, malware prevention, and gateway firewall. Default rules and policy ordering matter: first match wins in a section, and catch-all rules can silently allow or drop.
Traps: assuming DFW protects traffic before it reaches the vNIC; forgetting that traffic within a host still crosses vNICs; expecting DFW to inspect encrypted traffic without TLS inspection; misusing groups as applied-to scope.
Rule of thumb: scope where, match what. Worked example: to block web servers from database servers, create dynamic groups for each tier, put both as source and destination, set applied-to to the database group, and add a drop rule above the default allow.