In reply to Sakshi Saxena.

Hello Sakshi, thanks for reading and thanks for the question. We don't need any magic at the VDS dvPortgroup level. When you configure a regular EPG and map it to the VDS-based VMM domain you can now click on "allow micro segmentation". When we do this, we program the dvPortGroup as an isolated PVLAN. This disables VM to to VM communication locally, and all traffic has to flow through the leaf. At the leaf there are various ways we can identify each endpoint of course, so that when you configure a uEPG, we can place the endpoint's MAC traffic under the right uEPG and apply the right policy. A VM in the base EPG and/or on a uEPG may still need to talk to another VM on the same EPG/uEPG on the same hosts, so that means we need to proxy-arp as well. All of this together requires working with EX-based hardware. There are no hardware requirements though if you use the AVS. In the case of the AVS the implementation is clearly very different. I hope this clarifies! :-)