diff --git a/src/cli/onevm b/src/cli/onevm
index a29e3e53f1..c3161ffe72 100755
--- a/src/cli/onevm
+++ b/src/cli/onevm
@@ -1460,7 +1460,7 @@ CommandParser::CmdParser.new(ARGV) do
         RAW       = ["DATA", "TYPE", "VALIDATE"]
         CPU_MODEL = ["MODEL", "FEATURES"]
         BACKUP_CONFIG = ["FS_FREEZE", "KEEP_LAST", "BACKUP_VOLATILE", "MODE", "INCREMENT_MODE", "INTERACTIVE"]
-        CONTEXT (any value, ETH* if CONTEXT_ALLOW_ETH_UPDATES set in oned.conf, **variable substitution will be made**)
+        CONTEXT (any value, ETH* if NETWORK is not YES or CONTEXT_ALLOW_ETH_UPDATES set in oned.conf, **variable substitution will be made**)
     EOT
 
     command :updateconf, updateconf_desc, :vmid, [:file, nil],
diff --git a/src/vm/VirtualMachine.cc b/src/vm/VirtualMachine.cc
index 642c4792c4..9b2c5c4a80 100644
--- a/src/vm/VirtualMachine.cc
+++ b/src/vm/VirtualMachine.cc
@@ -3281,6 +3281,21 @@ int VirtualMachine::updateconf(VirtualMachineTemplate* tmpl, string &err,
     }
     else if ( context_bck != 0 && context_new != 0 )
     {
+        bool network_context;
+
+        // In append mode an omitted NETWORK retains its current value.
+        if (append && context_new->value().count("NETWORK") == 0)
+        {
+            context_bck->vector_value("NETWORK", network_context);
+        }
+        else
+        {
+            context_new->vector_value("NETWORK", network_context);
+        }
+
+        // ETH* values are user-managed when network context is disabled.
+        allow_eth_updates = allow_eth_updates || !network_context;
+
         context_new = context_new->clone();
 
         // Remove equal values from the new context
diff --git a/src/vm/VirtualMachineContext.cc b/src/vm/VirtualMachineContext.cc
index 4f3e67f2fe..c5aed4ffbd 100644
--- a/src/vm/VirtualMachineContext.cc
+++ b/src/vm/VirtualMachineContext.cc
@@ -888,11 +888,24 @@ static void clear_context_network(const std::vector<ContextVariable>& cvars,
 
 /* -------------------------------------------------------------------------- */
 
+// The ETHx_* variables are only generated (and so only owned) by OpenNebula when
+// NETWORK=YES. Otherwise they are defined by the user and must not be removed.
+static bool network_context_enabled(const VectorAttribute * context)
+{
+    bool net_context;
+
+    context->vector_value("NETWORK", net_context);
+
+    return net_context;
+}
+
+/* -------------------------------------------------------------------------- */
+
 void VirtualMachine::clear_nic_context(int nicid)
 {
     VectorAttribute * context = obj_template->get("CONTEXT");
 
-    if (context == 0)
+    if (context == 0 || !network_context_enabled(context))
     {
         return;
     }
@@ -926,7 +939,7 @@ void VirtualMachine::clear_nic_alias_context(int nicid, int aliasidx)
 {
     VectorAttribute * context = obj_template->get("CONTEXT");
 
-    if (context == 0)
+    if (context == 0 || !network_context_enabled(context))
     {
         return;
     }