A design requirement for a new VCF 9.0 deployment specifies that all tenant network traffic must be inspected by a centralized firewall appliance…

The requirement is to steer all outbound traffic from tenant VPCs through a centralized firewall appliance in a dedicated "Security" VPC. This form of service chaining is achieved using routing. By configuring a static default route (0.0.0.0/0) within each tenant VPC, an administrator can specify the next-hop IP address. This next-hop address would be the IP of an interface on the virtual firewall appliance in the Security VPC. This configuration forces all traffic destined for the internet to be forwarded to the firewall for inspection before it is routed out from the Security VPC's own egress gateway.

A. Default Outbound NAT is used to translate private source IPs to a public IP for internet access. It does not redirect traffic flow to a different VPC for inspection.

C. A Distributed Firewall (DFW) Exclusion List is used to prevent traffic from being inspected by the DFW, which is the opposite of the stated requirement.

D. "VPC Ingress Profiles" is not a standard NSX feature for implementing this type of traffic steering or service chaining. Routing policies are the correct mechanism.

1. VMware

Inc. (2023). NSX-T Data Center Administration Guide. Section: "Add a Static Route on a Tier-0 or Tier-1 Gateway". This section describes the procedure for creating static routes to control traffic paths.

2. VMware

Inc. (2023). NSX-T Data Center Design Guide. Section: "Service Insertion and Chaining". The guide discusses various patterns for inserting services like firewalls into the traffic path

with static routing being a primary method for north-south service insertion.

3. VMware

Inc. (2023). VMware NSX-T Reference Design. This document provides examples of network topologies

including hub-and-spoke models where traffic from spoke VPCs is routed through a central hub (like a Security VPC) for inspection.