On the APP VM Cluster, think there is no need for GI-SVM for both VDI and Physical Desktop Scenarios. Have not tested in detail, but if understood correctly the mechanism should work like this:
1. User "JoeSmith" logs into the Physical desktop --> Since the physical desktop is a member of AD Domain, this will trigger a Security Event Log on the Domain Controller. This log includes the IP Address of the desktop. Since it is integrated wth NSX Manager, NSX Manager learns this IP Address from the DC. (It is not very clear if it is pushed by the DC to the NSX Manager at the login time, or NSX Manager periodically pulls this information from the DC like every 5 minutes, but from documentation it seems this occurs simultanously at the login time, i.e. NSX Manager don't need to wait for a couple of minutes.
1.1 Since JoeSmith user is a member of AD Group that a Security Group configured on the dFW includes, this should trigger an update on the Rule Set belonging to the VNIC of the APP VM (which is included on the Applied to Field of this Rule). Every Rule, whether it is IP Based, or Vsphere Object like Logical Switch, VM Name Cluster, or AD Group will eventually be converted to an IP Based Rule Set.
This update is possible to observe from the vsipioctl command as follows:
vsipioctl getaddrsets -f <filter-name> (Here filtername is the dFW construct applied to the VNIC of the APP VM, this can be learned with summarize-dvfilter <Name_of_APP_VM> command as below article:
http://www.virtually-limitless.com/vcix-nv-study-guide/manage-and-report-on-a-distributed-firewall-u...
From the vsipioctl getaddrsets command output, the IP Address of the Physical Desktop Should exist.
# vsipioctl getaddrsets -f nic-11164389-eth0-vmware-sfw.2
addrset ip-vm-64 {
ip 1.1.1.11, --> This IP addresses should include Physical Desktop IP Address
ip 2.2.2.123,
ip fe80::a82d:11b2:a8ab:a098,
ip fe80::e903:8cfc:1163:79a3,
}
2. He tries to access a web application on an Application VM --> Since the dFW has the Desktop IP address on the Address Set of the Rule, this session will be allowed.(If it is a permit rule). NSX Manager has already pushed this IP to the VNIC of the VM.
3. DFW (running on the Application VM) sees the request coming in from the IP address of the physical desktop. Will DFW now query the NSX Manager to get the username of the user which in turn will do the Security Event Log scrapping? Also, wouldn't DFW just drop the request coming in from the Physical desktop (without even querying NSX Mgr) since there is no rule currently that is allowing that specific IP address? In other words, what I am asking is how does DFW decide that for that specific request coming in from the physical desktop, I need to query the NSX Manager. --> As in 1.1 the IP Address should exist ont the dFW of the APP VM. If the same desktop is logged in with another user that is not a member of the AD Group that Security Group includes, then this IP should disappear from the VNIC dFW IP Address Sets, this time blocking APP. Very similar scenario is explained below links:
https://www.youtube.com/watch?v=r5B8AWeopKs
https://www.youtube.com/watch?v=ub9Rqdty4T8
