Traditional firewalls only inspect traffic crossing the network perimeter — once inside, workloads can talk to each other freely, which is exactly how attackers move laterally. The distributed firewall enforces policy at every VM’s virtual interface, on every node, so east-west traffic between VMs is filtered with the same rigor as north-south traffic.

Security Groups (Baseline)

Security groups are stateful allow-lists attached to VM interfaces. Only the listed traffic is admitted; return traffic for allowed sessions is permitted automatically.

# A typical three-tier policy expressed as security groups
web-sg:  allow tcp/443 from 0.0.0.0/0
         allow tcp/22  from 41.210.10.0/28   (admin range)
app-sg:  allow tcp/8080 from web-sg
data-sg: allow tcp/5432 from app-sg

Note that rules can reference other security groups, not just CIDRs — "app tier accepts 8080 only from the web tier" stays correct no matter which IPs the web VMs get.

Micro-Segmentation Policies

Beyond security groups, the distributed firewall supports centrally managed policies matched on VM tags. Tag VMs by role (web, app, db) and environment (prod, staging), then write rules once:

• Block all traffic between environment=prod and environment=staging
• Allow tag:app → tag:db on tcp/5432 only; deny all other traffic into tag:db
• Quarantine: an isolation policy that cuts a compromised VM off from everything except the SOC jump host — applied with one click during incident response

Visibility

The firewall logs allowed and denied flows per rule. The traffic view in the console shows who is actually talking to whom — run it in monitor mode first to discover real flows before enforcing a strict policy.