Two VMs on the same ESXi host are assigned to an isolated VLAN 2001 (primary VLAN 1001). The host connects to an HPE Aruba CX 10000 switch on an…

The HPE Aruba CX 10000 is a Distributed Services Switch that utilizes a Data Processing Unit (DPU) to extend policy enforcement to workloads within the server. Even though the two VMs are on the same ESXi host, the DPU intercepts the traffic between them.

Private VLAN (PVLAN) rules dictate forwarding behavior. An isolated VLAN prevents communication between any two member ports. When VM1 sends traffic to VM2, the DPU receives the traffic (ingress) and performs a forwarding lookup. The PVLAN policy, which is associated with the primary VLAN (1001), prevents the traffic from being forwarded to another isolated port. This action of controlling where traffic can be sent is an egress function. Therefore, the switch applies an egress policy on the primary VLAN 1001 to block the traffic.

B. No policies because the traffic remains local to the ESXi host:

Incorrect. The Aruba CX 10000's DPU architecture is specifically designed to inspect and apply policies to east-west traffic, even between VMs on the same host.

C. Ingress and egress policy on VLAN 1001:

Incorrect. While the packet is received on ingress, the PVLAN rule is a forwarding control that determines if the packet is allowed to leave towards its destination, making it an egress policy.

D. Ingress policy on VLAN 1001:

Incorrect. A pure ingress policy typically makes a decision based on source information. The PVLAN isolation rule is a forwarding decision based on both the source and destination port types.

1. ArubaOS-CX 10.10 Layer 2 Bridging Guide

Chapter: "Private VLANs"

Section: "PVLAN port modes". The guide specifies the forwarding logic: "Traffic received on an isolated port can only be forwarded to promiscuous ports." This describes a control on the forwarding (egress) path of the traffic based on its source and destination. The policy is applied within the context of the primary VLAN that defines the PVLAN domain.

2. HPE Aruba Networking CX 10000 Switch Series with Pensando - Solution Overview

Page 4

Section: "East-West Traffic Security". This document states

"...all traffic from the server is redirected to the Pensando DPU for policy enforcement

securing traffic between workloads within the same server..." This confirms that policies are applied to local host traffic

invalidating the premise of option B.

3. Aruba Fabric Composer 6.2.0 User Guide

Chapter: "Configuration > Network > Private VLANs". The documentation shows that PVLANs are configured by defining a primary VLAN and then associating secondary VLANs with it. Policies like isolation are enforced within this primary VLAN context

controlling traffic flow between the associated secondary VLAN members. This control of traffic flow to a destination is an egress function.