Thanks once again for the kind comments.

@Matt, if you use micro EPGs with DVS having EX series, we program the dvPortGroup to only allow traffic sent to the leaf. At the leaf we classify per vNIC into the right uEPG. So yes, the policy is enforced at the leaf indeed, not the VDS. If you have levels of affinity this is sub-optimal, but even then the actual impact on application performance is usually marginal, and the advantage is that you do not have to install any additional bits on the hypervisor, thus keeping it simpler for all purposes. That said, AVS gives extra advantages so I tend to recommend it.