Networking and Virtualization
AHV networking model
This domain tests AHV virtual networking, uplink bonds, VLANs, and Flow security. AHV uses Open vSwitch on each host. The default bridge, br0, carries management and VM traffic; VLANs can be configured on the bridge and on individual VM NICs. Uplink bond modes include active-backup, balance-slb, and LACP. LACP requires a matching LAG on the physical switch; balance-slb does not. Flow is a distributed firewall that enforces policy at the virtual NIC level using categories, so rules follow VMs even when they migrate.
Design rules
Keep management, CVM storage traffic, VM traffic, and backup traffic segmented where possible. Do not mix the CVM network with untrusted VM networks. Use VLANs and Flow policies rather than relying only on physical firewall choke points. AHV is a type-1 hypervisor; VMs use virtio drivers, and Prism manages images, networks, and VMs.
Worked example
A host has two 10 GbE uplinks. If the switch ports are independent, use balance-slb for transmit load balancing without switch configuration. If the switch has a LAG, LACP can aggregate both links and provide failover. Configuring LACP in AHV while the switch ports remain independent can break connectivity, so validate the switch configuration before production.
Traps
Do not assume LACP is always better; it depends on switch support. Do not place CVM traffic on an untrusted VLAN. Do not describe Flow as a physical firewall. Do not treat VLAN 0 as no network; it is the untagged VLAN.