@Juan: Your description of "real world" is a good start for a discussion but in my opinion there are some inaccuracies.

1. You mentioned that a firewall that only looks at L4 headers and keeps L4 connection state does not really “inspect” traffic. Actualy Cisco taught about ”Layer 3/Layer 4 inspection” in IOS and ASA firewalls many times. Examples:

a)
http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=30338

"Effective exploit prevention can also be provided by the Cisco ASA 5500 Series Adaptive Security Appliance, … using the following methods:
• Layer 3/Layer 4 inspection”

b)
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_protocol_cbac_fw/configuration/15-mt/sec-prot-cbac-fw-15-mt-book/sec-prot-email-insp.html

"TCP L4 inspection continues until the connection is closed."

I agree that since Sourcefire acquisition the L7 inspection became reality but L4 inspection still aplies.

2. L4 FW is not NGFW but the L4 firewall with ALGs is better than ACLs. NSX firewall can at least offload a SYN flood denial of service attack. Do you agree?

3. You are right by saying that micro segmentation is not all-in-one security solution which meets all security needs. NSX firewall is not replacing the North-South security perimeter or NGFW. On the other hand NSX FW is not only about micro-segmentation. It combines identity based firewall, ALG support for Oracle, MS Windows etc., IP source guard, ARP spoofing, enhanced rules tracking, bandwidth stats for each rule and many other features. Flow monitoring capabilities totally surprised me comparing to ACI. Thus micro segmentation is one of features offered by NSX FW.