Network Sensor for Nutanix AHV Deployment Guide
Nutanix AHV provides a native, officially supported Traffic Mirroring feature (acli net.create_traffic_mirror) for copying traffic from a physical uplink or a VM’s vNIC to the vNIC of a destination VM. This is the recommended method for delivering traffic to the network sensor’s capture NIC, and is used throughout this guide as the primary configuration method.
An older, unsupported method — manipulating Open vSwitch (OVS) mirror rules directly with ovs-vsctl — is also documented as a fallback for clusters on AOS versions that predate the native feature, or where the native feature cannot be used.
This guide covers the AHV-specific steps needed to deliver a copy of network traffic to the capture NIC of the VM running the network sensor. Start with Prepare the Network Sensor VM, then follow the configuration that matches the traffic you want to monitor:
| Step | Content |
|---|---|
| Prepare the Network Sensor VM on Nutanix AHV | Create the Traffic Mirroring destination vNIC on the sensor VM and pin the VM to its host. Complete these steps once, regardless of which configurations you use. |
| Configuration A: North-South Traffic Monitoring | Monitor traffic between VMs and the external network by mirroring the AHV host’s physical uplink bond port. |
| Configuration B: East-West Traffic Monitoring | Monitor traffic between VMs on the same AHV host by mirroring the vNIC of each monitored VM. |
| Configuration C: External SPAN Monitoring | Deliver traffic from an external mirror source, such as a core switch SPAN port or a TAP device, to a dedicated NIC on the AHV host. |
Clusters registered to Prism Central
Traffic Mirroring cannot be configured with aCLI if the cluster is registered to Prism Central. Nutanix requires this to be configured through the Prism Central UI or v4 API instead in that case. This guide does not cover the Prism Central procedure, so refer to the Nutanix documentation. Check your cluster’s registration status before proceeding with the aCLI steps in this guide.
Session persistence and host placement
Native Traffic Mirroring sessions are managed by Acropolis and persist across AHV host reboots. However, the source and destination of a session generally must reside on the same AHV host. See each configuration article for version-specific exceptions and the recommended way to keep the network sensor VM pinned to the correct host.