Where security groups are leveraged, VMware Tools must be installed on the virtual machines to obtain full management functionality. VMware NSX distributed firewall requires up-to-date IP information from the VM to be reported in vCenter.

When you have many security groups to which you need to attach the same security policy, create an umbrella security group that includes all these child security groups, and apply the common security policy to the umbrella security group so that the VMware NSX distributed firewall uses ESXi host memory efficiently.