In an NSX environment, a Punting Traffic Group for the NSX Edge uplinks must be configured before enabling stateful active-active Source NAT (SNAT). This configuration ensures that traffic is appropriately handled and forwarded between the NSX Edge nodes in an active-active setup, allowing stateful connections to be maintained across multiple Edge nodes.

Distributed Firewall on VDS is a feature of NSX-T Data Center that allows users to install Distributed Security for vSphere Distributed Switch (VDS) without the need to deploy an NSX Virtual Distributed Switch (N-VDS). This feature provides NSX security capabilities such as Distributed Firewall (DFW), Distributed IDS/IPS, Identity Firewall, L7 App ID, FQDN Filtering, NSX Intelligence, and NSX Malware Prevention. To enable this feature, the following requirements must be met in the environment:
The NSX version must be 3.2 and later1. This is the minimum version that supports Distributed Security for VDS.
The VDS version must be 6.6.0 and later1. This is the minimum version that supports the NSX host preparation operation that activates the DFW with the default rule set to allow.
Reference:
Overview of NSX IDS/IPS and NSX Malware Prevention

Auditor: Allows users to view settings and logs without making changes.
Full access: Provides complete control over all NSX settings and configurations.
None: No permissions are granted, restricting access completely.
Read: Allows users to view configurations and settings without editing capabilities.