A design requirement for a new VCF 9.0 deployment specifies that all tenant network traffic must be inspected by a centralized firewall appliance located in a "Security" VPC before reaching the internet. Which NSX VPC feature should be used to support this "Service Chaining" requirement?

The requirement is to steer all outbound traffic from tenant VPCs through a centralized firewall appliance in a dedicated "Security" VPC. This form of service chaining is achieved using routing. By configuring a static default route (0.0.0.0/0) within each tenant VPC, an administrator can specify the next-hop IP address. This next-hop address would be the IP of an interface on the virtual firewall appliance in the Security VPC. This configuration forces all traffic destined for the internet to be forwarded to the firewall for inspection before it is routed out from the Security VPC's own egress gateway.

A. Default Outbound NAT is used to translate private source IPs to a public IP for internet access. It does not redirect traffic flow to a different VPC for inspection.
C. A Distributed Firewall (DFW) Exclusion List is used to prevent traffic from being inspected by the DFW, which is the opposite of the stated requirement.
D. "VPC Ingress Profiles" is not a standard NSX feature for implementing this type of traffic steering or service chaining. Routing policies are the correct mechanism.

1. VMware, Inc. (2023). NSX-T Data Center Administration Guide. Section: "Add a Static Route on a Tier-0 or Tier-1 Gateway". This section describes the procedure for creating static routes to control traffic paths.

2. VMware, Inc. (2023). NSX-T Data Center Design Guide. Section: "Service Insertion and Chaining". The guide discusses various patterns for inserting services like firewalls into the traffic path, with static routing being a primary method for north-south service insertion.

3. VMware, Inc. (2023). VMware NSX-T Reference Design. This document provides examples of network topologies, including hub-and-spoke models where traffic from spoke VPCs is routed through a central hub (like a Security VPC) for inspection.