Dynamic Address Groups in a Palo Alto Networks NGFW deployment on NSX utilize tags created on which system?

Dynamic Address Groups in a Palo Alto Networks Next-Generation Firewall (NGFW) deployment on NSX leverage tags that are created in the NSX Manager. This is because the NSX Manager acts as the central point for managing the network virtualization components of the NSX environment, including the configuration of network policies and the management of tags.

When addressing security policies in a dynamic and scalable manner, the use of tags allows the firewall to automatically include or exclude virtual machines (VMs) based on their assigned attributes. Tags defined in NSX can dynamically identify VMs or endpoints in the environment, ensuring that security policies are applied consistently and accurately as the infrastructure changes.

In contrast, while Panorama, Palo Alto Networks NGFW, and vCenter play important roles in other aspects of the security and virtualization architecture, they do not directly handle the creation of tags that facilitate Dynamic Address Groups in the context of an NSX environment. Hence, the integration between NSX and the Palo Alto Networks firewall relies significantly on the tagging capabilities provided by the NSX Manager.