A customer in a non-NSX VMware environment wants to add a VM-Series firewall and to partition an existing group of VMs in the same subnet into two groups. One group needs no additional security, but…

Question

Options

• ACreate a new virtual switch and use the VM-Series firewall to separate virtual switches using
• BEdit the IP address of all of the affected VMs
• CSend the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in
• DCreate a Layer 3 interface in the same subnet as the VMs and configure proxy ARP

• A
  3% (1)
• B
  14% (4)
• C
  10% (3)
• D
  72% (21)

Explanation

Option D works because proxy ARP lets the VM-Series firewall "impersonate" the protected VMs at the ARP layer - when other hosts try to reach those VMs, the firewall answers the ARP request with its own MAC address, silently redirecting traffic through itself for inspection. Since the firewall shares the same subnet via its Layer 3 interface, no IP address or default gateway changes are needed on any guest VM.

Why the distractors fail:

• A - Moving VMs to a new virtual switch would require network reconfiguration and doesn't inherently route traffic through the firewall transparently; it also doesn't partition the existing subnet.
• B - Directly contradicts the constraint: the question explicitly forbids editing IP addresses.
• C - Hairpinning traffic to external hardware increases latency and complexity, and still requires some switching/routing change to redirect only the high-security group without touching their configs.

Memory tip: Think of proxy ARP as the firewall "raising its hand" when someone asks "Who has 10.0.0.5?" - it intercepts traffic for the protected group by volunteering its own MAC, making itself an invisible checkpoint. No VM knows the firewall is there, so no VM config changes are needed.

No community discussion yet for this question.