When setting up a Network Function VM for Service Insertion, an administrator needs to configure the vNICs that will be used for redirecting traffic. What is the correct configuration for the vNICs on the Network Function VM?

Nutanix Flow's service insertion feature redirects traffic to an NFVM to act as a transparent, in-line service. This "bump-in-the-wire" model requires two interfaces for traffic processing: one for ingress (receiving traffic from the source) and one for egress (sending processed traffic toward the destination). For the redirection to be transparent at Layer 2, both of these vNICs must be connected to the same network/VLAN. This allows the NFVM to inspect or modify traffic without altering the IP-level path, as the source and destination VMs remain unaware of the redirection.

One vNIC: A single vNIC is insufficient for an in-line service, as it lacks separate ingress and egress paths, which would cause traffic to loop or be dropped. Two vNICs on different VLANs: This configuration would require the NFVM to act as a router (Layer 3 device), which contradicts the transparent Layer 2 insertion model used by Flow service chaining. Three or more vNICs for traffic redirection: While an NFVM can have additional vNICs (e.g., for management), the service chain function itself only requires and uses two specific vNICs for the redirected traffic path.

1. Nutanix Flow Network Security Guide v6.8: In the "Service Chaining" section, under "Network Function VM," the guide states, "The network function VM must have at least two vNICs connected to the same network. One vNIC receives traffic from the source (the left vNIC) and the other vNIC sends the traffic to the destination (the right vNIC)." (Section: Service Chaining > Network Function VM)

2. Prism Central Infrastructure Guide v6.8: The procedure for creating a service chain details the configuration of the NFVM. It requires the administrator to specify a "Left vNIC" and a "Right vNIC" for the VM, reinforcing the two-interface requirement for the data path. (Section: Security Management > Flow Network Security > Creating a Service Chain)