When configuring a specific Distributed Firewall (DFW) Policy Section via the vDefend management plane, administrators have access to several foundational toggles:

Stateful (Option B): You can toggle whether the rules within this specific policy section should be processed statefully (maintaining a connection flow table to automatically allow return traffic) or statelessly.

Locked (Option C): You can toggle the lock icon to claim ownership of the policy section, preventing other administrators from making concurrent, conflicting edits to your rules.

TCP Strict is an advanced global setting/profile rather than a basic policy section configuration option, and Open is not a valid terminology state for a policy section in the vDefend UI.

=========================

While Malware Prevention is heavily utilized at the Distributed (vNIC) level, it can also be deployed as Gateway Malware Prevention to secure perimeter boundaries.

In the vDefend architecture, Gateway Malware Prevention is explicitly designed to be attached to the Tier-1 (T1) Gateways . By applying the enforcement profile to the T1 Uplinks (traffic leaving the tenant zone towards the main data center/internet) and the T1 Downlinks (traffic moving between the gateway and the internal application segments), you can successfully intercept and extract files crossing your tenant or application zone perimeters for deep sandbox analysis.

=========================