According to the VMware NSX Documentation, these are two of the requirements for FQDN Analysis, which is a feature that allows you to monitor and control the traffic based on the fully qualified domain names (FQDNs) of the websites that your workloads access:
The NSX Manager requires access to the Internet to download category and reputation definitions: The NSX Manager periodically downloads the latest category and reputation definitions from a cloud service provider and distributes them to the NSX Edge nodes. These definitions are used to classify and score the FQDNs based on their content and risk level.
A layer 7 gateway firewall rule must be configured on the Tier-0 gateway uplink: You need to configure a layer 7 gateway firewall rule on the tier-0 gateway uplink interface that matches the traffic that you want to analyze based on FQDNs. You also need to enable FQDN Analysis on the firewall rule and select the categories and reputations that you want to allow or deny.