{"id":415,"date":"2026-08-31T01:17:31","date_gmt":"2026-08-30T23:17:31","guid":{"rendered":"https:\/\/nutanix.ma\/index.php\/2026\/08\/31\/enabling-the-flow-controller-a-field-walkthrough\/"},"modified":"2026-08-31T01:35:40","modified_gmt":"2026-08-30T23:35:40","slug":"enabling-the-flow-controller-a-field-walkthrough","status":"publish","type":"post","link":"https:\/\/nutanix.ma\/index.php\/2026\/08\/31\/enabling-the-flow-controller-a-field-walkthrough\/","title":{"rendered":"Enabling the Nutanix Flow Controller step by step"},"content":{"rendered":"

Nutanix Flow is the microsegmentation and network security layer built into AHV \u2014 it lets you write intent-based security policies between VMs and application tiers instead of relying on VLAN-level firewalling. Before any of that is usable, though, two things have to be switched on in Prism Central: the Network Controller, and Microsegmentation itself. On a recent engagement we walked a cluster through exactly that sequence, from a Security Policies page that refused to do anything to a working policy list backed by Flow’s default quarantine policies. This post covers the steps involved, with screenshots from the actual project (customer identifiers and IP addresses have been redacted throughout).<\/p>\n

Starting point: Security Policies with nothing to secure<\/h2>\n

Prism Central’s Security Policies page under Network & Security is where Flow policies live, but visiting it on a cluster that hasn’t been set up yet just shows a single message: “To create a Security Policy, please enable Flow.” A banner above the page spells out the actual prerequisite \u2014 Network Controller has to be enabled first, and needs to be on ANC 3.0.0 or later.<\/p>\n

\"Prism
Security Policies with nothing enabled yet \u2014 the page points straight at the real prerequisite, Network Controller.<\/figcaption><\/figure>\n

Enabling Network Controller<\/h2>\n

Network Controller (recently renamed from “Advanced Networking”) is Prism Central’s centralized networking service \u2014 it’s what backs VLAN management, Flow Virtual Networking, and, relevant here, Flow Network Security Next-Gen. It has its own resource footprint: 2 extra vCPUs and 3GB of RAM for small Prism Central VMs, or 3 vCPUs and 4GB for large ones, resized automatically the moment it’s enabled. Nutanix’s recommendation is to also have Prism Central Scale Out and Prism Central Backup configured for resiliency, though neither is a hard requirement to get started.<\/p>\n

\"Prism
The Network Controller settings page \u2014 resource requirements and recommendations before enabling.<\/figcaption><\/figure>\n

Clicking Enable kicks off a background deployment while Prism Central resizes its own VM and stands up the controller. It’s a short wait, tracked as a percentage right on the same settings page.<\/p>\n

\"Network
Network Controller deploying \u2014 a few minutes from finished.<\/figcaption><\/figure>\n

Once it completes, the same page flips to a live status view: Service Status Enabled, a version number, a Health check, and sections for VLAN Management and VPC Management. A Clusters and Compatibility table lists every registered Prism Element cluster next to its AOS and AHV versions and whether it’s compatible with Network Controller \u2014 ours came back Supported straight away.<\/p>\n

\"Network
Network Controller is up \u2014 the registered cluster shows as Supported in the compatibility table.<\/figcaption><\/figure>\n

Enabling Microsegmentation<\/h2>\n

With Network Controller running, the Microsegmentation page (still under Settings) becomes the next stop. This is the specific toggle behind “Flow Network Security Next-Gen” and it carries its own resource cost too \u2014 an additional 2GB of memory per Prism Central VM, applied automatically when enabled. The page also nudges toward migrating any VLAN Basic subnets to Network Controller\u2013managed VLAN subnets, since that’s a prerequisite for those subnets to actually be covered by Flow policies later.<\/p>\n

Checking the compatibility table here confirms the registered cluster is capable of running microsegmentation before flipping the checkbox and saving.<\/p>\n

\"Microsegmentation
Enabling Microsegmentation \u2014 the cluster shows as capable in the compatibility check.<\/figcaption><\/figure>\n

Flow is live: policies and defaults<\/h2>\n

Back on the Security Policies page, the “please enable Flow” message is gone, replaced by the full policy management UI: a Create Security Policy button, bulk Actions, grouping and filtering, and \u2014 notably \u2014 two policies already sitting there without anyone having created them. These are Nutanix’s system-defined quarantine policies (Quarantine Forensic Policy and Quarantine Strict Policy), shipped enforced by default so that a compromised VM can be isolated for forensics or cut off entirely the moment it’s flagged, without waiting on a custom policy to be written first.<\/p>\n

\"Security
Flow is enabled \u2014 the two built-in quarantine policies are already enforced, and custom policies can now be created.<\/figcaption><\/figure>\n

A side note: Intelligent Operations<\/h2>\n

While in Prism Central’s Admin Center settings for this work, we also came across the Intelligent Operations page \u2014 a separate, unrelated feature that layers AI-driven operational insights on top of Prism Central, requiring its own additional vCPU and memory allocation and, critically, its own license. In this environment the license had expired, so enabling it wasn’t in scope for this engagement, but it’s worth knowing it lives in the same Settings area as Network Controller and is easy to stumble across while enabling Flow.<\/p>\n

\"Intelligent
Intelligent Operations \u2014 a separate licensed feature noticed along the way, not part of enabling Flow itself.<\/figcaption><\/figure>\n

Two toggles \u2014 Network Controller, then Microsegmentation \u2014 took the cluster from a Security Policies page that couldn’t do anything to a fully functional Flow deployment with its default quarantine policies already enforced and ready for custom rules on top.<\/p>\n","protected":false},"excerpt":{"rendered":"

Nutanix Flow is the microsegmentation and network security layer built into AHV \u2014 it lets you write intent-based security policies between VMs and application tiers instead of relying on VLAN-level firewalling. Before any of that is usable, though, two things have to be switched on in Prism Central: the Network Controller, and Microsegmentation itself. On […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-415","post","type-post","status-publish","format-standard","hentry","category-nutanix"],"_links":{"self":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/comments?post=415"}],"version-history":[{"count":1,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/415\/revisions"}],"predecessor-version":[{"id":428,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/posts\/415\/revisions\/428"}],"wp:attachment":[{"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/media?parent=415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/categories?post=415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nutanix.ma\/index.php\/wp-json\/wp\/v2\/tags?post=415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}