Introduction In VMware Cloud Foundation (VCF) 9.1, ingress North-South traffic targeting private VPC workload subnets traverses a Destination Network Address Translation (DNAT) boundary managed by the Virtual Network Appliance (VNA) Tier-1 Service Router (SR) context.When external clients access published applications via public IP addresses, the VNA gateway firewall engine intercepts the ingress traffic, evaluates compiled…