Lateral Movement Protection conditions

It was my understanding that the device in red would be separated from the rest by means of-

The device in question set to isolate Endpoint 2 would essentially isolate all traffic within

End Points 1, 3 & the server isolating themselves from Endpoint 2 or denying all traffic from endpoint 2

The firewall isolating Endpoint 2 from the internet and other segments and devices as well.

Or am I not understanding this correctly?

I asked for a clarification in a recent webinar about this, in fact.
- Endpoints in the same network (or rather, broadcast domain) deny traffic from the Red endpoint by filtering its MAC address (the XG informs the rest of the endpoints of the 'bad' MAC address). This is why Endpoint 3 denied ALL traffic.
- I imagine that the Server did not deny all traffic (ICMP was allowed) because the Server Client does not have the Isolation feature.
- I am still not sure why UDP/TCP traffic was blocked to the Server.
- As you said, traffic to Endpoint 1 and the Internet would be blocked by the Heartbeat feature on the XG. However this was not enabled during my tests, and UDP/TCP traffic was still blocked for the Internet.

So what happens if you change the mac address on that RED endpoint? 

https://docs.microsoft.com/en-us/powershell/module/netadapter/set-netadapter?view=win10-ps

Would it then be allowed to talk to End Point 3?  I am curious now....

The description from Sophos
https://news.sophos.com/en-us/2019/01/22/xg-firewall-and-lateral-movement-protection/

Although, does not give the 'higher level detail of how. But as you say above, done by MAC address

Yes that is what I would be interested in, knowing if this is done on the Mac Address, IP Address or FQDN or a combination of all three or even a Unique Identifier tied directly to Sophos as well.