WYRE-AI Nutanix Networking
Overview
Two namespaces cover networking. networking is AHV network
configuration: subnets, VPCs, virtual switches, BGP, and hybrid-cloud
(AWS VPC/subnet) visibility. microseg is Flow Network Security:
east-west security policies between VMs, defined over service groups
(port/protocol sets) and address groups (IP ranges).
Coverage warning: the networking namespace varies more than any
other with the artifact set the server loaded. The upstream default
artifact set carries as few as 3 GET-only operations (networking
capabilities, AWS VPCs, AWS subnets), while a PC-fetched artifact set
can expose the fuller subnet/VPC/vSwitch surface. Run
listOperations(namespace="networking") and report what is actually
there before promising subnet-level detail.
Key Concepts
| Concept | Namespace | Notes |
|---|---|---|
| Subnet | networking |
VLAN-backed or overlay; VM NICs attach to subnets |
| VPC | networking |
Overlay network container for Flow Virtual Networking |
| Security policy | microseg |
Allow/deny rules between VM groups, usually category-scoped |
| Service group | microseg |
Named set of ports/protocols referenced by policies |
| Address group | microseg |
Named set of IPs/ranges referenced by policies |
Common Workflows
Network inventory
listOperations(namespace="networking")to see the loaded surface.- If subnet/VPC operations are present:
networking_executeto list subnets and VPCs, joining VM NIC attachments from thevmmnamespace when mapping which workloads sit where. - If only the minimal slice is present, report capabilities and any AWS VPC/subnet visibility, and say plainly that subnet-level detail is not exposed by this deployment.
Flow policy review
- Discover list operations in
microseg. microseg_executeto list security policies, then service groups and address groups they reference.- Report policy mode (monitor vs enforce where the entity carries it), scope, and any policies referencing empty or overly-broad address groups.
Read-only boundary
Creating or modifying subnets, VPCs, or Flow policies is non-GET and blocked by read-only mode. A microsegmentation review therefore ends in recommendations, not applied policy changes.
Gotchas
- Do not diagnose an absent operation as an outage. A thin
networkingsurface is an artifact-set property, not a Prism Central failure. - Flow requires licensing. An absent
microseg_executetool usually means Flow Network Security is not enabled on the connected PC. - Policies reference categories. Category definitions live in the
prismnamespace; resolving a policy's scope may take aprismlookup.
Related Skills
- api-patterns — discovery workflow, OData, read-only mode
- vm-management — VM NIC attachments to subnets