An administrator has two user VPCs connected via a Transit VPC. Routing works for most subnets, but one overlay subnet cannot reach external…

In a Nutanix Flow Networking hub-and-spoke topology, each subnet within a user (spoke) VPC is associated with a route table. For traffic from a subnet to reach an external network via the transit (hub) VPC, its route table must contain a route (typically a default route 0.0.0.0/0) that directs traffic to the transit VPC connection. Since other subnets are working correctly, the overall VPC peering and external connectivity are functional. The issue is isolated to one subnet, making a misconfiguration in that specific subnet's route table the most probable cause.

A. The VPC peering connection to the Transit VPC is down.

This would disrupt connectivity for all subnets within the user VPC, not just a single one.

C. The external network route is not advertised from the Transit VPC.

This would prevent all subnets in the user VPC from learning the path to the external network.

D. A Flow Network Security policy is blocking all outbound traffic from the VPC.

This policy would affect the entire VPC. While a policy could target a single subnet, a missing route is a more fundamental and direct cause for a reachability failure.

References:

1. Nutanix Flow Networking Guide v4.0, Chapter: VPC Configuration, Section: VPC Route Tables

"Each subnet in a VPC must be associated with a route table. A subnet can be associated with only one route table at a time, but a route table can be associated with multiple subnets." This establishes the per-subnet granularity of routing policy.

"To enable spoke VPCs to communicate with the external network through the hub (transit) VPC, you must add a default route (0.0.0.0/0) in the spoke VPC route tables with the next hop as the hub VPC." This directly states the requirement that is missing in the scenario described by the correct answer.

2. Nutanix University, Nutanix Hybrid Cloud Fundamentals Course, Module: Flow Virtual Networking

The courseware explains that for spoke VPCs to access networks outside the Nutanix environment (like the internet or a corporate WAN), a default route must be configured in the spoke VPC's route table, pointing to the transit VPC as the next hop. The absence of this route for a specific subnet's route table isolates the failure to that subnet.

1. Nutanix® Flow Virtual Networking Guide v.2023.1, “Create or Edit Subnet – Advertise Prefix Externally”, p. 72–73.

2. Same guide, “Transit VPC Routing and Prefix Export”, p. 116–118 – notes that only advertised prefixes are installed in the Transit VPC route-table.

3. Nutanix AOS 6.5 Prism Central Admin Guide, Section “Prefix Advertisement and Route Propagation”, p. 302–304 – explains effect of disabling advertisement on reachability beyond local VPC.