Networking

---
name: "Nutanix Networking"
description: >
  The Nutanix networking read surface: `networking_execute` for AHV
  network configuration (subnets, VPCs, vSwitch, BGP — coverage varies
  by artifact set, down to a minimal capabilities/AWS-VPC slice) and
  `microseg_execute` for Flow Network Security policies, service groups,
  and address groups.
when_to_use: >-
  When inspecting Nutanix network configuration or Flow security
  policies. Use when: nutanix network, nutanix subnet, nutanix vpc,
  ahv networking, flow network security, microsegmentation nutanix,
  microseg, service group nutanix, or address group nutanix.
---

# Nutanix Networking

## Overview

Two namespaces cover networking. `networking` is AHV network
configuration: subnets, VPCs, virtual switches, BGP, and hybrid-cloud
(AWS VPC/subnet) visibility. `microseg` is Flow Network Security:
east-west security policies between VMs, defined over service groups
(port/protocol sets) and address groups (IP ranges).

**Coverage warning:** the `networking` namespace varies more than any
other with the artifact set the server loaded. The upstream default
artifact set carries as few as 3 GET-only operations (networking
capabilities, AWS VPCs, AWS subnets), while a PC-fetched artifact set
can expose the fuller subnet/VPC/vSwitch surface. Run
`listOperations(namespace="networking")` and report what is actually
there before promising subnet-level detail.

## Key Concepts

| Concept | Namespace | Notes |
|---------|-----------|-------|
| Subnet | `networking` | VLAN-backed or overlay; VM NICs attach to subnets |
| VPC | `networking` | Overlay network container for Flow Virtual Networking |
| Security policy | `microseg` | Allow/deny rules between VM groups, usually category-scoped |
| Service group | `microseg` | Named set of ports/protocols referenced by policies |
| Address group | `microseg` | Named set of IPs/ranges referenced by policies |

## Common Workflows

### Network inventory

1. `listOperations(namespace="networking")` to see the loaded surface.
2. If subnet/VPC operations are present: `networking_execute` to list
   subnets and VPCs, joining VM NIC attachments from the `vmm`
   namespace when mapping which workloads sit where.
3. If only the minimal slice is present, report capabilities and any
   AWS VPC/subnet visibility, and say plainly that subnet-level detail
   is not exposed by this deployment.

### Flow policy review

1. Discover list operations in `microseg`.
2. `microseg_execute` to list security policies, then service groups
   and address groups they reference.
3. Report policy mode (monitor vs enforce where the entity carries it),
   scope, and any policies referencing empty or overly-broad address
   groups.

## Read-only boundary

Creating or modifying subnets, VPCs, or Flow policies is non-GET and
blocked by read-only mode. A microsegmentation review therefore ends in
recommendations, not applied policy changes.

## Gotchas

- **Do not diagnose an absent operation as an outage.** A thin
  `networking` surface is an artifact-set property, not a Prism
  Central failure.
- **Flow requires licensing.** An absent `microseg_execute` tool
  usually means Flow Network Security is not enabled on the connected
  PC.
- **Policies reference categories.** Category definitions live in the
  `prism` namespace; resolving a policy's scope may take a `prism`
  lookup.

## Related Skills

- [api-patterns](../api-patterns/SKILL.md) — discovery workflow, OData, read-only mode
- [vm-management](../vm-management/SKILL.md) — VM NIC attachments to subnets