To implement micro-segmentation with host isolation, even for VMs on the same host, a Private VLAN (PVLAN) is the appropriate technology. For this to be effective, the PVLAN configuration must be consistent across the entire traffic path. This means configuring the primary and secondary VLANs on both the physical Aruba switch and the VMware vSphere Distributed Switch (vDS) that the VMs connect to.

Once the VMs are in an isolated PVLAN, they cannot communicate directly at Layer 2. To enable controlled communication via a Layer 3 gateway (where firewall policies are applied), the gateway's Switched Virtual Interface (SVI) must respond to ARP requests on behalf of the isolated hosts. The ip local-proxy-arp feature on the SVI serves this exact purpose.

B. A generic "local firewall" on the VMware host is ambiguous and does not provide the required network-level isolation between VMs on a virtual switch.

C. Configuring PVLANs only on the physical switch is insufficient, as it would not prevent VMs on the same host from communicating directly through the local vSwitch.

1. ArubaOS-CX 10.11 IP Routing Guide

"ARP

" page 11. The guide states

"A primary use case for local proxy ARP is for private VLANs (PVLANs). In a PVLAN

hosts in the same secondary VLAN are prevented from communicating with each other directly. Communication must go through the router. Local proxy ARP allows the router to respond to ARP requests from hosts in the secondary VLANs." This directly supports the need for local proxy ARP (Option A).

2. VMware vSphere 8.0 Documentation

"Networking

" section "Configuring Private VLANs on a Distributed Switch." The documentation states

"The PVLAN configuration on the distributed switch must match the PVLAN configuration on the physical switch." This confirms that the PVLAN must be configured on both the switch and the VMware hosts for the solution to work (Option D).

3. ArubaOS-CX 10.11 Security Guide

"Private VLAN

" page 10. This document explains the function of isolated PVLANs: "Hosts connected to isolated ports can communicate only with hosts connected to promiscuous ports." This establishes the isolation principle that underpins the question's requirements.