Which Network Security Policy action is valid?

A Network Security Policy rule can take the action DENY, which immediately drops the matching packets; this and ALLOW are the only documented valid actions.

A (RATELIMIT): Not a rule action; rate limiting is configured via Service-Policy.

B (ALLOWSSL): No such action keyword exists in the Network-Security-Policy schema.

C (MIRROR): Packet mirroring is configured elsewhere, not as a rule action.

1. VMware NSX ALB 22.1 Security Guide, “Network Security Policy Object”, Table 3-1 ‘action { ALLOW | DENY }’, (PDF p. 63).

2. VMware NSX ALB API Guide 22.1, Schema networksecuritypolicy > rules > action, (JSON schema ref 127).