NCP-NS-7.5 questions and answers

Existing Floating IPs still working means the external network path is not generally down. New Floating IP assignments failing for that external network points to the configured pool having no available IP addresses left for additional allocations.

VM categories define the secured and allowed entities independently of current IP addressing. Because the policy follows category membership, it remains valid when VMs move subnets or receive new addresses.

Service Insertion redirects traffic through a Network Function VM by using dedicated Network Function vNICs for each direction. Creating one specific vNIC for inbound traffic and another for outbound traffic provides the required traffic steering points.

Before upgrading Network Controller, the cluster foundation it manages must be compatible with the target release. In this deployment that means checking AHV on every managed cluster; Flow Network Security or Prism Element sequencing is not the stated prerequisite.

An Externally Routable Prefix tells the upstream routing domain that the tenant network prefix exists and can be advertised. Floating IPs and guest routes do not provide the same network-level advertisement for the overlay tenant prefix.

The missing dynamic ADGroup category points first to identity matching, not subnet or routing configuration. Verifying that the affected contractor matches the mapped AD group and identity data checks whether Prism Central can assign the category that the VDI policy uses for access.

Creating and enforcing security policies is separate from managing the categories used to group VMs. If category creation fails, the likely gap is missing category-management privilege, such as Flow Admin capability.

Flow Network Security Next-Gen is supported for overlay network environments in both deployment types named here: On-Premises Overlay Networks and NC2 Overlay Networks. The VLAN network options describe different network types and are not the supported pair.

Root-cause checks should start where the database flow is controlled: the security policy rule that allows port 3306 from Web to Database and the policy's Enforcement Mode. If that rule is inactive or not applied, MySQL traffic can fail even when other networking settings are normal.

A security hitlog is read from its flow tuple: source address and source port identify the sender side, while the destination field and service port identify what the packet is trying to reach. Here that supports 10.38.174.5 with TCP/123 and 10.38.174.57 as traffic destined to UDP 123.

Flow Virtual Networking depends on the Network Controller being active in the Prism Central environment. Overlay subnet conversion, firewall deployment, or static route planning comes after the controller prerequisite is in place.

Tiered application rules should follow workload identity and required services. Category values identify the web, app, and database tiers, and inter-tier rules then permit only the needed TCP 8443 and TCP 1521 communication.

A dual-homed VM needs policy scope narrow enough to select only the backup-facing interface. An entity group combining the VM category with the subnet category for that vNIC identifies that specific attachment, while a VM-only or VPC-wide scope would cover more interfaces than intended.

A Quarantine Policy is designed for rapid containment of a suspect VM. It can isolate the affected workload quickly without redesigning the broader application policy set or changing shared service definitions.

External Resource Policies control which external resources a VPC can reach. Since the problem affects VMs in Tenant-B-Prod after adding Tenant-B-VPC, updating the ERPs for Tenant-B-VPC addresses the missing allowed external access instead of changing Transit-VPC policy behavior.

Flow Policy Author lets the user create, monitor, and enforce security policies, but category management is a higher administrative function. Creating a new category requires Flow Admin privileges, so the UI hides that action when the user only has the policy author role.

IPsec adds tunnel headers, reducing the payload size that can pass without fragmentation. Lowering the guest VM MTU makes workloads send smaller packets that account for tunnel overhead, which addresses fragmentation before changing routes for a tunnel that is already up.

Before placing Flow Network Security bundle files on a local web server, the offline LCM content must be prepared: set up the local web server and download both the required software LCM bundle and the compatibility bundle.

A VPC can be created before external connectivity or overlay subnets are added. The minimum creation inputs are the VPC name and the cluster selection that places the VPC on the Nutanix environment. External VLANs and subnets can be configured later.

Adding an HA gateway introduces another device that must form its own BGP relationship with the upstream router. If only the original peer is configured, a peering session must be defined for the added gateway.

Network Controller auto-enablement is tied to the X-Large Prism Central deployment path. Installing or upgrading an X-Large deployment enables it automatically; scaling a Small deployment, manual configuration, or a Hyper-V-specific choice does not match that trigger.