The preceding steps show that we can create a security policy rule that will permit or deny traffic based on a Active Directory group object using the security group. The source can be a virtual desktop virtual machine or a physical desktop.
For a virtual desktop, NSX will use the Guest Introspection VM to do the IP-to-user mapping, while for a physical desktop, NSX will query the Active Directory server and check the AD security logs to do the IP-to-user mapping. The NSX Manager stores the IP-to-user mapping result in the user cache database in NSX Manager and sends this information to the NSX DFW component in the ESXi Host for NSX DFW to apply to the appropriate destination VM's vNIC.
Being IP-based, this architecture cannot ...
