Choosing a Nutanix subnet: Basic VLAN, VLAN Subnet or overlay

The subnet type fixes who manages it, where it can be edited and which features it can use, and several of those choices cannot be undone.

A VLAN Basic Subnet is the default product of the Prism Central Create Subnet workflow. Change that in Prism Central Settings > Flow Management > Flow VLAN Networking, or clear VLAN Basic Networking under Advanced Configuration for one subnet.

Common trap: Using one VLAN ID in both stacks - provision any single VLAN ID either in the AHV stack or in the Flow Virtual Networking stack. Configuring one VLAN as both a Flow external network and an AHV IPAM network can cause IP address conflicts.

IP address management

IPAM lets AHV assign addresses to VMs by DHCP. A network with IPAM is a managed network, and one without is unmanaged.

• IPAM can be set only at creation, and a network cannot be converted between managed and unmanaged.
• A VLAN can have at most one managed network.
• DHCP pools must not overlap and must sit entirely inside the managed subnet. With no pool, assign addresses manually.
• Addresses in a pool are not reserved, so one can be specified manually for an adapter.
• DHCP traffic goes to an internal server and does not reach the physical network, in either direction.
• The DHCP server address defaults to .254 of the network, or .253 if the gateway uses .254. Override DHCP Server sets another.
• The VLAN ID of either VLAN type cannot be updated. On an active Basic network only the name can change, not the virtual switch or VLAN ID.

Check that the physical switch allows the VLANs configured for virtual networks: the user is responsible for the switch ports, and for the virtual switch existing on all hosts.

IGMP snooping stops a host delivering multicast to every VM on a VLAN. It is enabled per virtual switch and needs a querier, either native Acropolis (sending IGMP v2 queries) or third party. A snooping timeout of 30 seconds means a query every 15 seconds.

Migrating Basic VLANs to VLAN Subnets

Migration is done in Prism Central, one subnet at a time, and is irreversible. The Basic VLAN is locked, a VLAN Subnet is created with the same UUID and properties, vNICs move with their MAC addresses preserved, and the Basic VLAN is then deleted. Prism Central VM vNICs must stay on a Basic VLAN, so on a shared subnet they move to a newly created Basic VLAN.

The precheck requires Super Admin or Prism Admin access and blocks migration in these cases:

• More than 100 Basic VLANs in one request, or a Basic VLAN with no virtual switch reference.
• kDirect vNICs or vNICs in Trunk mode.
• Protection Domain association.
• Files Storage VMs deployed by Prism Element.
• Managed Basic VLANs hosting Prism Central VM vNICs, or subnets used by Microservices Infrastructure.
• A VM with vNICs in other Basic VLANs that are not also migrating.

An attached Flow Network Security policy must be migrated to the Next-Gen version first, on the Security Policies page.

Get the whole book

This note is one section of Ultra Transcenders NCP-MCI-7.5: Nutanix Multicloud Infrastructure, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to the Nutanix Support Portal.

About the book · NCP-MCI-7.5 terms in the glossary · All NCP-MCI-7.5 study notes