In this part you add VCF Operations for Networks, the fleet component that maps flows, shows topology, and helps you diagnose network problems. It is optional. Unlike log management, which runs on the Management Services cluster, VON deploys as its own platform and collector appliances, then plugs into VCF Operations through the vCenter integration.

Confirm the fleet is healthy, reserve two addresses for the nodes, run the add component wizard, then enable Network Operations so VCF Operations pulls network data. This registration step is easy to forget, so it has its own step below.

Prerequisites

Step 1 confirm the fleet is healthy

Start from a healthy, reachable fleet with NSX up.

1. Log in to the VCF Operations UI as an administrator.
2. Open Fleet Management and confirm no critical alerts.
3. Confirm the NSX Managers for the domains you want to see are reachable.

Step 2 reserve node addresses

Reserve one address for each node before you start.

1. Reserve 1 IP for the platform node.
2. Reserve 1 IP for the collector node.
3. Decide whether they sit on the management network or a non-management portgroup, and record the netmask, gateway, DNS and NTP.

Step 3 download the binaries

Fleet lifecycle installs VON from binaries you stage first.

1. In VCF Operations, open Fleet Management, then Lifecycle, then Binary Management.
2. Select the checkbox for operations-networks and click Download.
3. Wait for the package to appear on the Install Binaries tab before you continue.

Step 4 add the component

Launch the wizard from the components list.

1. Open Fleet Management, then Lifecycle, then Components, and click Add Component.
2. Select operations-networks.
3. Choose New Install, pick the version you downloaded, set the deployment type, and click Next.

Step 5 create the certificate

VON needs a certificate that covers both nodes.

1. Add the platform node FQDN and IP.
2. Add the collector node FQDN and IP.
3. Click Generate, select the new certificate from the dropdown, and click Next.

Step 6 choose infrastructure and network

Tell the wizard where the appliances land.

1. Select the vCenter, cluster, network, datastore and disk mode, then click Next.
2. Fill in the network settings with netmask, gateway, DNS and NTP, then click Next.
3. For a non management network, point the deployment at a vSphere portgroup and supply its own netmask, gateway, DNS and NTP.

Step 7 define the platform and collector nodes

Give each node an identity, an address and a size.

1. Enter the platform node name, IP and size.
2. Enter the collector node name, IP and size. VON needs both.
3. Set the admin password for the appliances, then click Next.

Step 8 precheck and submit

Validate first, then build.

1. Click Run Precheck and confirm every check passes.
2. Click Next, review the deployment, and click Submit.
3. Follow progress under Lifecycle, then Tasks, until the appliances finish building.

Step 9 enable Network Operations

Connect VON to VCF Operations so it pulls network data.

1. In VCF Operations, open Administration, then Integrations.
2. Open your vCenter integration.
3. Configure and enable Network Operations, pointing it at the VON platform node.
4. Click Save.

Step 10 verify network visibility

Confirm data is flowing before you rely on it.

1. Browse to the platform node URL and log in as admin@local with the password you set.
2. In VCF Operations, open Infrastructure Operations, then Analyze, then Flows, and confirm flows appear.
3. Confirm topology, flows and NSX objects populate for your domains.

flowchart TD
A[Confirm fleet and NSX health] --> B[Reserve platform and collector IPs]
B --> C[Download binaries and add operations-networks]
C --> D[Enter node names IPs and sizes]
D --> E[Run precheck and submit]
E --> F[Enable Network Operations]
F --> G[Verify topology and flows]

Verify network visibility

Confirm the component finished building under Lifecycle Tasks and that Network Operations is enabled on the vCenter integration under Integrations. Open the platform node and check that topology, flows and NSX objects populate for your domains. If flows are missing, the Network Operations setting in Step 9 is the first thing to recheck.

How platform and collector nodes divide the work

VON splits into two roles for a reason. The platform node does the heavy lifting. It indexes flows, searches traffic, maps application dependencies and generates micro segmentation recommendations. In a small environment one platform node is enough. For a large estate, or for high availability, you deploy a cluster of platform nodes, and clustering needs nodes of at least the large size, so a medium deployment has to scale up to large before it can cluster. The collector node has a narrower job. It polls vCenter and NSX, receives IPFIX flow records and forwards everything to the platform. Because collection is where load lands first, you scale by adding collectors well before you resize the platform. Keep each collector close to the sources it reads so it is not fighting latency across a slow link, and give each one an address on a network that reaches both vCenter and the NSX managers it serves.

What happens after you submit

After you click Submit, fleet lifecycle builds both appliances for you. It clones the platform and collector from the binaries you staged, applies the network settings and the certificate, and powers the nodes on. You can watch the virtual machines appear in vCenter while the task runs, and you follow the same task under Lifecycle Tasks in VCF Operations. A first build usually takes about an hour, so start it when you have time to let it finish rather than squeezing it into a change window that closes too soon. If a node fails to come up, the task stops on the step that failed and names it, and the cause is usually a network setting or an address that was not actually free. Fix the value, then rerun the deployment from where it stopped.

Size collectors for your fleet

A single Small deployment, one platform node and one collector, suits a small three node environment. Collectors do the gathering, so a large estate needs more of them. Add collector nodes as you add workload domains, and step up the deployment size when flow volume climbs. Each collector takes an address, so include them in your management plan. Place collectors close to the NSX and vCenter they read, and avoid pointing one collector at every domain in a large fleet, because that is where flow data starts to show gaps.

What VCF Operations for Networks shows you

VON maps the network the way it actually runs. It shows flows between workloads, the path a packet takes across segments and gateways, and the topology of your NSX objects. That makes it the tool you open when a connection fails and the firewall rules look correct, because it shows whether traffic is even reaching the segment. It also underpins planning for micro segmentation, since it reveals the real east to west traffic before you write vDefend rules. It also keeps a history, so you can compare how traffic between two workloads changed over days or weeks instead of seeing only the present moment. That history is what turns a one time investigation into a baseline you can plan against.

Data sources the collector reads

The collector is what talks to your infrastructure, so the sources you attach decide what VON can show. Add your vCenter servers and VON sees virtual machines, hosts and the virtual switches that carry their traffic. Add your NSX managers and VON reads segments, gateways, distributed firewall rules and the routing between them. Turn on IPFIX flow export on the distributed switches you care about so VON charts real east to west traffic instead of guessing it from configuration. Each source is polled by the collector, so a collector that cannot reach a source shows a gap for that one source while the rest keep reporting. When a domain looks empty, check the collector to source path before you suspect the platform.

Notes and best practices

Enable Network Operations the moment the appliances finish building, because until you do the platform shows no flows and it looks like the deployment failed when it did not. In a large fleet, run more than one collector and keep each one close to the NSX and vCenter it reads, since a single distant collector is where flow gaps appear. Use VON to baseline real east to west traffic before you design micro segmentation, so your firewall groups match how the applications actually talk rather than how you think they do. Scale the deployment size up before flow volume saturates a Small footprint, not after, because a saturated collector drops data silently. Keep the platform and collector on networks that reach both the NSX managers and the workloads, and confirm name resolution both ways so the adapter stays connected.

Common errors and fixes

No flow or topology data.
Network Operations is not enabled. Open Administration, Integrations, open the vCenter integration and enable Network Operations.

Deployment fails on the address.
The platform or collector IP is in use or on the wrong network. Confirm both addresses are free and reachable on the portgroup you chose.

Wrong portgroup on a non-management deployment.
The vSphere portgroup name must match exactly and carry the netmask, gateway, DNS and NTP you entered. Correct the value and redeploy.

Collector overloaded on a large fleet.
A single small collector cannot cover a big estate. Add collector nodes and scale the deployment size.

Common questions

Is VCF Operations for Networks mandatory
No. It is an optional Day-N component for teams that want flow analysis, topology and network diagnostics.

Where does it run
As its own platform and collector appliances, unlike log management which runs on the Management Services cluster.

How many addresses does it need
One for the platform node and one for the collector node, with more collectors for larger fleets.

Can it sit on a non-management network
Yes. Provide a vSphere portgroup with its netmask, gateway, DNS and NTP during the wizard.

What deployment sizes can I choose
VON offers small, medium and large sizes, with larger options for big estates. Small covers a lab or a small fleet, and you size the platform and collector nodes independently.

Can I cluster the platform node
Yes, for scale or high availability, but a platform cluster needs nodes of at least the large size, so a medium deployment must scale up to large first.

How do I log in to VON itself
VCF Operations reaches VON through the vCenter integration, but the platform also has its own console at its own URL. Log in there as admin@local with the password you set during the wizard.

References

• William Lam: Deploying VCF Operations for Networks to a non-management network
• Broadcom TechDocs: What is new in VCF Operations (9.1)
• VCF 9.1.x Ultimate Deployment Guide

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts