7.3 Virtual Networks: Managed vs. Unmanaged Networks and IPAM

Virtual Networks: Managed vs. Unmanaged Networks and IPAM

Quick Summary: Virtual networks in Nutanix AHV define the logical broadcast domains, VLAN boundaries, and IP addressing policies for guest virtual machines. Built on top of AHV virtual switches, virtual networks are categorized into two fundamental operational models: Unmanaged Networks (which provide standard Layer 2 bridging, passing all IP assignment and DHCP responsibilities to external network infrastructure) and Managed Networks (which leverage Nutanix native IP Address Management [IPAM] embedded directly inside the hypervisor to provide hypervisor-local DHCP, static IP reservations, and automated guest network provisioning). Mastering these virtual network types, IEEE 802.1Q tagging rules, and live vNIC lifecycle management is essential for architecting enterprise multicloud fabrics.

---

1. AHV Virtual Network Architecture and VLAN Segmentation

In Nutanix AHV, a Virtual Network represents an isolated logical network segment configured on an underlying virtual switch (such as vs0 / br0). When an administrator creates a virtual machine and attaches a virtual network interface card (vNIC), the vNIC is bound to a specific virtual network.

+-------------------------------------------------------------------------+
|                        AHV Virtual Network Topology                     |
|                                                                         |
|   +-------------------+  +-------------------+  +-------------------+   |
|   |     VM-Web-01     |  |     VM-App-01     |  |     VM-DB-01      |   |
|   |    [vNIC: NetA]   |  |    [vNIC: NetB]   |  |    [vNIC: NetC]   |   |
|   +---------+---------+  +---------+---------+  +---------+---------+   |
|             |                      |                      |             |
|             v                      v                      v             |
|       (VLAN 10 Tag)          (VLAN 20 Tag)          (VLAN 0 Untagged)   |
|   +-----------------------------------------------------------------+   |
|   |                 Virtual Switch: vs0 (Bridge br0)                |   |
|   |  - Open vSwitch manages 802.1Q tagging and untagging            |   |
|   |  - Strips VLAN headers on ingress to VM vNIC (Access Mode)      |   |
|   |  - Injects VLAN headers on egress to physical uplinks           |   |
|   +--------------------------------+--------------------------------+   |
|                                    |                                    |
|                                    v                                    |
|                       [ Bond Interface: br0-up ]                        |
|               Carries Tagged (802.1Q) and Native Frames                 |
+-------------------------------------------------------------------------+

IEEE 802.1Q VLAN Tagging Rules

Every virtual network in AHV is defined with a specific VLAN ID ranging from 0 to 4094:

1. VLAN 0 (Native / Untagged VLAN):

   • Setting the VLAN ID to 0 designates that traffic exiting the virtual machine must be forwarded across the physical network without an IEEE 802.1Q VLAN tag.
   • Physical switches receive these frames as native untagged Ethernet frames, typically assigning them to the native VLAN configured on the physical switch port (e.g., PVID 1).
   • VLAN 0 is commonly used for legacy flat networks, DMZ perimeter networks without 802.1Q trunking, or specific enterprise management segments.

2. VLAN 1 through 4094 (Tagged VLANs):

   • Assigning a VLAN ID between 1 and 4094 configures standard 802.1Q VLAN tagging.
   • Access Port Emulation (Default): The virtual machine operating system remains completely unaware of the VLAN tag. The guest OS transmits standard untagged Ethernet frames. When the frame enters the AHV virtual switch tap interface, OVS automatically tags the frame with the configured VLAN ID before sending it across br0-up. Conversely, incoming frames arriving from physical switches have their 802.1Q tags stripped by OVS before being handed to the guest vNIC.
   • VLAN Trunking to Guest VM: For specialized virtual appliances that require multi-VLAN visibility (such as virtual routers, firewalls, or container host nodes), AHV supports vNIC VLAN trunking. Using the Acropolis Command-Line Interface (acli), administrators can expose multiple tagged VLANs directly to a single guest vNIC:

# Expose multiple VLANs (e.g., 10, 20, 30) to a virtual appliance vNIC
acli vm.nic_create <vm-name> network=<network-name> trunked_networks=10,20,30

---

2. Unmanaged Networks: Traditional Layer 2 Bridging

An Unmanaged Network in Nutanix AHV functions as a pure Layer 2 virtual bridge.

+-------------------------------------------------------------------------+
|                         Unmanaged Network Model                         |
|                                                                         |
|   +-------------------+                         +-------------------+   |
|   |     AHV Host      |                         |  Physical Switch  |   |
|   |                   |                         |                   |   |
|   |  +-------------+  |   Broadcast / DHCP Req  |  +-------------+  |   |
|   |  | Guest VM    |==|========================>|  | External    |  |   |
|   |  | [vNIC: L2]  |<=|=========================|==| DHCP Server |  |   |
|   |  +-------------+  |   Unicast DHCP Ack      |  +-------------+  |   |
|   |                   |                         |  (e.g., Infoblox/ |   |
|   |  (No Nutanix IPAM)|                         |   Active Dir.)    |   |
|   +-------------------+                         +-------------------+   |
+-------------------------------------------------------------------------+

Operational Characteristics of Unmanaged Networks

• External IP Lifecycle: AHV does not participate in IP address assignment, subnet routing, or lease management. IP configuration is handled entirely by external datacenter infrastructure—such as an enterprise Windows DHCP server, Infoblox appliance, or manual static IP assignment inside the guest OS.
• Pass-Through Forwarding: OVS forwards all broadcast, multicast, and unicast traffic transparently between the guest VM vNIC and the physical ToR switches based purely on MAC address learning tables.
• Prism IP Address Discovery: Because AHV does not assign the IP address, Prism relies on secondary discovery mechanisms to report the VM's IP address in the Prism dashboard:
  1. Nutanix Guest Tools (NGT): The NGT guest agent queries the guest OS network stack directly and reports assigned IPv4/IPv6 addresses securely back to the CVM via TCP port 2074.
  2. Hypervisor ARP Snooping: If NGT is not installed, OVS snoops Address Resolution Protocol (ARP) reply frames emitted by the guest VM and populates Prism with the discovered IP address.

When to Select Unmanaged Networks

• Environments with strict, centralized external IPAM architectures (e.g., Infoblox, BlueCat, EfficientIP).
• Subnets where specialized DHCP options (such as custom VoIP phone boot scopes or dynamic DNS updates) are already managed by corporate infrastructure.
• Production clusters where guest VM IP addresses are statically assigned and audited through enterprise configuration management tools (Ansible, Puppet, Terraform).

---

3. Managed Networks: Nutanix Native IPAM

A Managed Network activates the built-in Nutanix IP Address Management (IPAM) engine embedded directly into the AHV hypervisor and Acropolis control plane.

+-------------------------------------------------------------------------+
|                          Managed Network Model                          |
|                                                                         |
|   +-----------------------------------------------------------------+   |
|   |                        AHV Physical Host                        |   |
|   |                                                                 |   |
|   |   +-------------+       DHCP Discover                           |   |
|   |   |  Guest VM   |---------------------------+                   |   |
|   |   |   [vNIC]    |<-----------------------+  |                   |   |
|   |   +-------------+       DHCP Offer / Ack |  |                   |   |
|   |                                          |  v                   |   |
|   |   +--------------------------------------+------------------+   |   |
|   |   |            Nutanix Hypervisor-Level IPAM                |   |   |
|   |   |  - OVS intercepts DHCP requests locally at vnet tap     |   |   |
|   |   |  - ZERO DHCP broadcast traffic sent to physical uplinks |   |   |
|   |   |  - Deterministic IP assignment from defined pool        |   |   |
|   |   +---------------------------------------------------------+   |   |
|   +-----------------------------------------------------------------+   |
|                                                                         |
|   Physical Datacenter Network (Completely isolated from DHCP chatter)   |
+-------------------------------------------------------------------------+

How Hypervisor-Level DHCP Interception Works

In standard networks, when a newly provisioned virtual machine powers on, its operating system broadcasts a DHCPDISCOVER packet across the Layer 2 network (255.255.255.255:67). In large virtualized environments with hundreds of VMs, simultaneous boot storms generate significant broadcast traffic.

In a Nutanix Managed Network:

1. Local Interception: The OVS flow table on the local AHV host detects the outgoing DHCP broadcast frame directly at the guest VM's virtual tap interface.
2. Hypervisor-Level DHCP Server: Rather than forwarding the broadcast frame out through physical uplinks, OVS diverts the packet to a localized hypervisor DHCP responder daemon managed by Acropolis.
3. Zero Broadcast Storms: The local hypervisor evaluates the managed subnet configuration, selects an available IP address from the designated pool, generates a standard DHCPOFFER / DHCPACK, and transmits it directly back to the guest vNIC.
4. Physical Network Isolation: Zero DHCP broadcast traffic escapes onto the physical ToR switches. IP assignment occurs in milliseconds, even if physical network uplinks are disconnected or undergoing spanning-tree convergence.

Managed Network Configuration Parameters

When creating a Managed Network in Prism Element or Prism Central, administrators define comprehensive network properties:

Static IP Reservations via Prism

Nutanix IPAM provides powerful governance through Static IP Reservations:

• Administrators can allocate specific, permanent IP addresses to critical workloads (such as Active Directory Domain Controllers, Oracle databases, or SAP application servers) directly within Prism.
• When the VM requests an IP via DHCP, Nutanix IPAM identifies the VM's virtual NIC MAC address and returns the statically reserved IP address every time.
• This achieves the operational stability of static IP addressing without requiring administrators to manually log into individual guest operating systems to configure static network properties.

---

4. Managed vs. Unmanaged Networks: Comprehensive Comparison

---

5. Virtual Network Interface (vNIC) Lifecycle and Live Operations

Nutanix AHV provides advanced flexibility when managing virtual network interfaces throughout a virtual machine's lifecycle.

+-------------------------------------------------------------------------+
|                        vNIC Lifecycle Operations                        |
+-------------------------------------------------------------------------+
| 1. Dynamic Network Migration: Change VLAN without rebooting guest OS    |
| 2. MAC Address Assignment: Deterministic Nutanix OUI (50:6b:8d)         |
| 3. Hot-Plug Virtual Adapters: Add/remove vNICs on live running VMs      |
| 4. Network Disconnection: Administrative link-state toggling            |
+-------------------------------------------------------------------------+

MAC Address Architecture

Every virtual network adapter created on AHV is automatically assigned a globally unique Layer 2 hardware address. Nutanix utilizes an IEEE-registered Organizationally Unique Identifier (OUI) prefix:

$\text{Nutanix MAC Address Format} = \mathbf{50:6b:8d}:XX:YY:ZZ$

Administrators can also specify a custom MAC address during VM creation if legacy software licensing or network access control (NAC) policies mandate specific hardware identifiers.

Live VLAN Re-assignment (Zero-Downtime Migration)

In legacy virtualization platforms, changing a virtual machine's port group or VLAN often required disconnecting the virtual NIC or restarting the guest operating system. In Nutanix AHV:

• An administrator can edit a running virtual machine in Prism and select a completely different virtual network (e.g., transitioning VM-App-01 from VLAN-10-Dev to VLAN-20-Prod).
• Acropolis immediately instructs the local AHV host's ovs-vswitchd daemon to update the OpenFlow VLAN action on the VM's active tap interface.
• The guest operating system maintains link state without dropping its virtual adapter. If operating on a managed network, the guest automatically renews its IP configuration or executes a smooth transition without requiring a VM reboot.

Hot-Plugging and Administrative Link States

• Hot-Add / Hot-Remove: AHV natively supports adding new vNICs to running virtual machines. Linux and Windows operating systems equipped with Nutanix VirtIO drivers detect newly attached adapters immediately without downtime.
• Administrative Disconnection: In Prism, administrators can toggle the Connected state of individual vNICs. Toggling a vNIC to disconnected simulates pulling a physical network patch cable, severing connectivity immediately at the hypervisor tap interface while leaving the virtual hardware attached to the VM.