NCP-CI-AWS Questions and Answers

When deploying Nutanix Cloud Clusters (NC2) on AWS, administrators have two primary workflows: allowing the NC2 portal to automate resource creation or using existing resources. The " Bring Your Own " (BYO) model is characterized by the requirement that the administrator manually prepares the underlying AWS infrastructure before initiating the Nutanix cluster deployment. Specifically, the actions ofcreating an AWS VPCandcreating the required subnets(such as management and User VM subnets) are exclusive to the BYO workflow. In the automated " Nutanix-managed " workflow, the NC2 portal uses CloudFormation to provision these network resources automatically. While setting up IAM users and permissions is necessary for both models to allow the NC2 console to interact with the AWS API, the pre-existence of the VPC and subnet architecture is the defining prerequisite for a BYO deployment.

In an NC2 environment using Flow Virtual Networking (FVN), routing traffic between the AWS cloud and on-premises environments requires specific configuration of the Transit VPC and User VPCs.

To ensure that traffic reaching the on-premises environment is not subjected to Network Address Translation (NAT)—which would obscure the original IP addresses and potentially break connectivity for certain applications—the routing tables must point to the correct internal gateway interface. Theoverlay-external-subnet-nonatacts as the designated gateway for traffic that should be routed without address translation. Verifying that the " Next Hop " for on-premises prefixes is set to this specific subnet ensures that internal communication remains transparent and complies with standard corporate networking and security policies.

For a VM to be accessible over the internet through a load balancer, the VM itself must have a public IP address.

In this case, the health check for the VM target is failing and the DNS returns a " NOT Found " message because web-1 does not have a public IP assigned.

Without a public IP, the load balancer cannot route traffic to web-1 from the internet.

Assigning a public IP to web-1 ensures that the VM can be accessed via the load balancer, resolving the connectivity issue.

Refer to the AWS documentation on network load balancers and public IP assignments, and Nutanix documentation on VM network configurations.

Synchronous replication in Nutanix Cloud Clusters (NC2) on AWS requires extremely low latency, typically less than 5ms round-trip time (RTT). To achieve this, clusters must be located within the same AWS region, often within different Availability Zones or the same VPC.

Supported networking configurations for this high-speed data exchange include using standard native AWS networking on both clusters to ensure direct, low-latency communication. Additionally, a hybrid setup where one cluster utilizes native networking and the remote cluster uses Flow Virtual Networking (FVN) is supported, provided the underlying network infrastructure satisfies the latency requirements for synchronous operations. This ensures that data is written to both clusters simultaneously before an acknowledgment is sent to the application, providing zero recovery point objective (RPO).

After the NC2 free trial expires, to continue using all features of NC2 on existing clusters, the administrator needs to switch to a paid subscription plan.

A paid subscription ensures uninterrupted access to the full range of features and support for NC2 clusters.

Without switching to a paid plan, the features might be limited, and support may not be available, impacting the cluster ' s operations and management.

Refer to the Nutanix billing and subscription documentation for details on switching from a trial to a paid plan and the benefits associated with paid subscriptions.

To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:

Option A: Create a custom Security Group with the following rules:

Key = tag:nutanix:clusters

Key = tag:nutanix:clusters:external

and value = the clusters ' UUID

Key = tag:nutanix:clusters:external

and value = 10.78.1.0/24

Option D: Create a custom Security Group with the following:

Key = nutanix:clusters

Key = nutanix:clusters:external

and value = the clusters ' UUID

Key = nutanix:clusters:external

and value = 10.79.1.0/24

These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.

Nutanix Cloud Clusters on AWS Administration

AWS Security Groups Documentation

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

The Nutanix NC2 portal uses a hierarchical structure consisting of Customers, Organizations, andWorkspacesto manage resources. A common point of confusion for administrators is that clusters are localized to specific Workspaces. If an administrator logs into the portal and finds their cluster " missing, " the most likely cause is that they are currently viewing a differentworkspacethan the one where the cluster was provisioned. The NC2 console requires users to select the correct context to view their resources. Checking the workspace selector in the portal interface usually resolves this visibility issue, as the account and overall portal permissions are already verified by the successful login.

When planning to leverage NC2 on AWS for an elastic DR scenario where the initial cluster is using 13en.metal, the following additional node types are supported for cluster expansion:

I3.metal: These instances provide high IOPS and low latency with NVMe SSDs, making them suitable for storage-intensive applications.

i4i.metal: These instances offer higher performance with AWS Nitro SSDs, improved network bandwidth, and better compute performance compared to the I3.metal instances.

Nutanix Cloud Clusters on AWS Documentation

Amazon EC2 I4i Instances – AWS

Amazon EC2 I3 Instances – AWS

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix ' s update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines

For issues related to cloud hardware support such as EC2 instances, VPC, etc., the public cloud vendor (AWS in this case) should be contacted. AWS provides support and documentation for their infrastructure and services, ensuring that users can get assistance for any hardware or cloud-specific queries.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS requires bare-metal EC2 instances to run the Nutanix AHV hypervisor and the Controller VMs (CVMs).

Nutanix supports specific " metal " instance types that provide the necessary hardware access for the hypervisor to manage resources efficiently. The primary supported instance types include thei3.metal, which is optimized for high I/O workloads; thei3en.metal, which offers more storage capacity and higher network bandwidth; and thei4i.metal, which utilizes the latest Intel Ice Lake processors for superior compute and storage performance. Other instance types listed, such as virtualized " xlarge " or " micro " instances, do not provide the bare-metal access required to run the Nutanix software stack in an NC2 environment.

To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).

Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.

Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.

Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.

Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.

Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.

AWS Direct Connect allows companies to create private, dedicated connections between their data centers and AWS. This bypasses the internet and provides a more reliable and faster network connection directly to AWS services, including S3.

AWS Direct Connect Documentation

AWS S3 Access over Direct Connect

To ensure that alert emails are sent properly from Prism Central within an NC2 environment, configuring an SMTP server in the Prism Central settings is required. The SMTP server facilitates the sending of email notifications for alerts and other communications.

SMTP Configuration:

Prism Central requires an SMTP server to send email alerts. This involves specifying the SMTP server address, port, and authentication details if needed.

The configuration must include the email address from which the alerts will be sent and the recipient addresses.

Steps to Configure SMTP Server in Prism Central:

Log in to Prism Central.

Navigate to the " Settings " menu.

Select " Email Server " under the " Alerts " section.

Enter the SMTP server details, including the server address, port, and authentication credentials.

Test the configuration to ensure emails are sent correctly.

Nutanix Prism Central Administration Guide

Nutanix Support Documentation on Email Alert Configuration

Best Practices for Configuring SMTP Servers in Cloud Environments

Post-deployment, Nutanix provides flexibility in managing the software capabilities and licensing models of an NC2 cluster to adapt to changing workload requirements. Administrators canswitch the software tier from Pro to Ultimateto unlock advanced features such as synchronous replication, Nutanix Flow, and advanced security. Additionally, users can transition between different licensing portfolios, such asswitching from the NCI (Nutanix Cloud Infrastructure) portfolio to the legacy AOS portfolio, depending on their contract terms and desired consumption model. These changes are typically managed through the Nutanix portal and applied to the cluster without requiring a full redeployment of the bare-metal instances. However, it is important to note that switching tiers may result in changes to the billing rate or require additional license reservations to cover the upgraded feature set.

In an NC2 environment using Flow Virtual Networking (FVN), the External Routable Prefix (ERP) is used to identify the address space that can reach external networks. If the ERP is correctly configured in both the Transit and User VPCs but outbound communication still fails, the issue typically lies within the virtual routing table. A static route (such as 0.0.0.0/0) must be manually added to the User VPC routing table with the next hop set to the overlay-external-subnet. Without this explicit static route, the virtual router within the User VPC does not know how to direct traffic toward the Transit VPC for outbound delivery, even if the address ranges are theoretically compatible. Verifying this routing path is a standard step in ensuring overlay workloads can reach on-premises or internet resources.

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

To protect workloads on an NC2 cluster on AWS, deploying strategies that ensure high availability and disaster recovery are essential. The two valid options are:

Create a Second NC2 Cluster in a Different Availability Zone:

High Availability: Deploying a second NC2 cluster in a different availability zone ensures that workloads can be quickly recovered in case of an availability zone failure.

Disaster Recovery: This setup enables asynchronous replication between clusters, providing a robust disaster recovery solution.

Use an Existing On-Prem Nutanix Cluster as a Disaster Recovery Target:

Hybrid DR: Leveraging an existing on-premises Nutanix cluster for disaster recovery provides a cost-effective and efficient DR solution.

Replication: Set up replication policies to ensure data is consistently copied from the NC2 cluster on AWS to the on-premises cluster.

Why Not Other Options:

One-node cluster in another availability zone: Not a valid DR solution as a single-node cluster cannot provide the required resilience and high availability.

Deploy a cluster across two availability zones: While this can enhance availability, it is not a typical approach for Nutanix clusters which are designed to operate within a single availability zone for simplicity and performance reasons.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices

AWS Availability Zones and Disaster Recovery Documentation

The Nutanix disaster recovery capabilities include recovery plans that define how entities are recovered in the event of a failure. There is a limit to the number of entities that can be managed within a single recovery plan.

Entity Limit:

According to Nutanix documentation, the maximum number of entities that can be recovered using a single recovery plan is 300. Exceeding this limit will cause issues during the execution of the recovery plan.

Impact of Exceeding the Limit:

If the number of entities in a recovery plan exceeds the supported limit, the recovery process may fail or not execute correctly, as observed in the scenario.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices Documentation

To ensure that the newly created NC2 organization named Finance can only deploy clusters into certain cloud regions, the administrator should specify the allowed regions during the cloud account configuration.

This action restricts the regions available for cluster deployment, ensuring compliance with organizational policies or regulatory requirements.

The allowed regions can be set in the cloud account settings associated with the Finance NC2 organization, defining the geographical scope of operations.

Refer to the Nutanix documentation on NC2 cloud account configuration and region restrictions.

Multi-Cloud Snapshot Technology (MST) allows Nutanix clusters to protect data by taking snapshots directly to cloud object storage, such as Amazon S3.

When an administrator initiates a recovery from these snapshots, the process is managed throughPrism Central (PC), which serves as the orchestration layer for disaster recovery. Specifically, the execution and progress of the recovery are tracked under theRecovery Planssection within the Data Protection menu. Recovery Plans define the order of VM power-ons, IP address changes, and script executions. By monitoring this section, administrators can verify the status of each step, ensure that the RTO (Recovery Time Objective) is being met, and troubleshoot any failures during the restoration of workloads from the cloud snapshots.

The error message in the image indicates that the cluster creation failed due to reaching the maximum retries for provisioning cluster nodes. Here are two possible scenarios that could lead to this issue:

Insufficient Permissions (Answer B):

If the AWS user or role used to create the cluster does not have sufficient permissions, it can result in failures during the provisioning process. Proper IAM policies must be attached to ensure that the necessary actions can be performed, such as launching instances, creating VPCs, or managing networking components.

AWS Quota Exceeded/Instance Limit Exceeded (Answer D):

AWS imposes quotas and limits on the number of instances and other resources that can be created within an account. If these quotas are exceeded, new instances cannot be provisioned, causing the cluster creation to fail. This can be resolved by requesting a quota increase from AWS.

Nutanix Knowledge Base Article 9774

AWS Service Quotas

Nutanix NC2 on AWS Documentation

For AOS software support related to NC2, the appropriate entity to contact is Nutanix. Nutanix provides comprehensive support for their software, including the Acropolis Operating System (AOS) used in NC2 deployments.

Support Scope:

Nutanix offers support for the deployment, configuration, and management of NC2 clusters, including any issues related to AOS software.

This includes troubleshooting, updates, and technical assistance.

Why Not Other Options:

Internal IT Operations team: Typically handles internal issues but does not have the specialized knowledge or resources for AOS software support.

Partner: May provide support but would ultimately escalate issues to Nutanix for software-specific concerns.

Public Cloud Vendor: Manages infrastructure-related issues but does not provide support for Nutanix AOS software.

Nutanix Support Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for AOS Support

To deploy NC2 in AWS using an existing VPC, the following AWS resources should be configured beforehand:

NAT Gateway: This allows instances in the private subnet to connect to the internet or other AWS services, while preventing the internet from initiating connections with those instances.

Public and Private Subnets: These are necessary to segregate the network traffic. Public subnets provide a direct route to the internet gateway, while private subnets are used for internal resources that do not need direct access to the internet.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

When deploying Windows Server workloads on NC2 on AWS without existing licenses, administrators must carefully choose the tenancy and licensing model to remain compliant with Microsoft ' s cloud mobility rules. For a new deployment where " Bring Your Own License " (BYOL) is not an option due to the lack of existing licenses with Software Assurance, the administrator should select Shared Tenancy with License-included instances. This configuration ensures that the cost of the Windows OS is included in the hourly rate of the bare-metal instances provisioned by AWS. Although the question ' s source Answer (A) lists " BYOL, " standard Nutanix/AWS best practices for unlicensed environments dictate using License-included options on Shared Tenancy to provide the most cost-effective and compliant path for Windows-based virtual machines in the cloud.

For the NC2 cluster deployed in the North Virginia region (us-east-id), consuming IPs from the 10.78.2.0/24 range, the subnets configured within the same CIDR range of 10.78.0.0/16 will be recognized.

The subnetDR01 (10.78.2.0/24)is directly within the range of the deployed cluster.

The subnetL2stretch (10.19.101.0/24)is also configured in the NC2 AWS VPC, although not in the immediate range of the cluster, it may show up due to broader network configurations for stretched L2 operations.

SubnetsVDI (10.78.130.0/22)andDR02 (10.79.120.0/24), although part of the same VPC, are not directly within the immediate CIDR range or may not be recognized in this specific configuration scenario.

Refer to the Nutanix documentation on NC2 AWS VPC subnet configurations and Prism Element settings for detailed guidelines on network visibility and configuration.

In an NC2 on AWS environment, licensing Microsoft Windows Server workloads can be complex due to cloud mobility rights.

If an organization does not have existing licenses with Software Assurance to support " Bring Your Own License " (BYOL) on cloud hardware, they must acquire licenses through the cloud provider. The most integrated and efficient way to achieve this for Nutanix clusters is to select theLicense Includedoption during the host provisioning process in the NC2 console. By purchasing nodes with licenses included, the cost of the Windows Server OS is bundled with the instance hourly rate provided by AWS. This ensures full compliance with Microsoft licensing terms without requiring a separate purchase through external marketplaces or resellers for the cloud-resident VMs.

To manually hibernate an NC2 on AWS cluster, the administrator can use the following methods:

Select the cluster under NC2 console and Select Hibernate/Resume on the cluster sur page: Navigate to the specific cluster in the NC2 console and use the provided Hibernate/Resume option.

Log into NC2 console, find the cluster name and select Hibernate/Resume from the ellipses: Access the NC2 console, locate the cluster name, and select the Hibernate/Resume option from the ellipses (three dots) menu.

These options allow for the manual control of the cluster ' s hibernation state directly within the NC2 console interface.

Nutanix Cloud Clusters on AWS Administration

Nutanix Support and Insights

In Nutanix Cloud Integration with AWS, specifically version 6.7, the role that allows full access to clusters created within an organization is the Organization Administrator.

The Organization Administrator role has the highest level of privileges within an organization, enabling the user to manage all aspects of the clusters, including creation, modification, and deletion.

This role is designed to oversee and control the entire organization ' s resources, ensuring comprehensive management capabilities over all clusters and associated resources.

Refer to the Nutanix documentation on roles and permissions for NC2 on AWS for further details.

To provide VMs with outbound internet connectivity in AWS using a private subnet, the administrator needs to create the following components in the VPC:

Private Subnet: A private subnet is required to house the VMs that need outbound internet access but do not require direct inbound access from the internet.

NAT Gateway: A NAT (Network Address Translation) Gateway is necessary to allow instances in the private subnet to connect to the internet or other AWS services while preventing the internet from initiating a connection with those instances.

Public EIP (Elastic IP Address): An EIP is associated with the NAT Gateway to provide a persistent public IP address that allows outbound internet traffic from the private subnet to be routed correctly.

Route Table: A route table is configured to route traffic from the private subnet to the NAT Gateway for outbound internet access.

AWS NAT Gateway Documentation

AWS VPC Subnet Basics

When a node is marked as " Condemned, " it indicates that the system has determined that the node is no longer reliable for operations. As part of the automated recovery and protection process, the following action is typically taken:

The node has a power reset sent to it (Answer A):

In most cases, a condemned node undergoes a power reset as an initial recovery attempt. This action attempts to reboot the node to bring it back to a healthy state. If the reset fails, further manual or automated steps may be required to address the hardware or software issue.

Nutanix Cluster Management Documentation

Nutanix Support Knowledge Base

Integrating Flow Virtual Networking (FVN) into an NC2 cluster necessitates the creation of specific management and transit subnets to coordinate the overlay traffic. The administrator must ensure that aPrism Central subnet is configured on the Prism Elementside to facilitate the management link between the cluster nodes and the centralized management instance. Additionally, aTransit subnet must be configured on Prism Central. This transit subnet is critical because it houses the virtual routing components and gateways that manage traffic flow between different VPCs and the external network. By establishing these two subnets, the administrator provides the necessary control plane and data plane paths for the FVN overlay to communicate effectively with the underlying AWS infrastructure and the broader Nutanix management ecosystem.

When reserving licenses for Nutanix Cloud Clusters (NC2), administrators must understand the inclusion of add-ons within different tiers. For organizations requiring multi-protocol storage, the Nutanix Unified Storage (NUS) add-on is flexible and can be associated with either the NCI Pro or NCI Ultimate licensing tiers. Furthermore, the NCI Ultimate tier is designed to be comprehensive; it automatically includes high-value features such as Advanced Replication and Security (Microsegmentation) by default. This simplifies the licensing process because these features do not require separate manual applications once the Ultimate tier is selected. While NCI Ultimate is feature-rich, it does not include the NUS add-on by default, which remains a capacity-based selection that must be specifically managed alongside the base license tier.

Given the company ' s large spend commitments as part of an AWS Enterprise Discount Program (EDP) totaling $15 million, purchasing Nutanix licenses through the AWS Marketplace ensures that the costs contribute to the EDP commitment.

This approach integrates the Nutanix license costs into the overall AWS spend, thereby maximizing the benefits of the EDP.

Purchasing directly from Nutanix or leveraging existing licenses might not count towards the AWS EDP commitment, and trial licenses are typically for evaluation purposes and do not contribute to the committed spend.

Refer to the Nutanix and AWS documentation on licensing and marketplace purchases, and EDP program details.

Migrating an existing NC2 cluster from native AWS networking to an overlay network (Flow Virtual Networking) requires careful coordination between the Nutanix software and the AWS environment. A primary prerequisite is ensuring thatExternal IPAMis correctly configured for the cloud subnets to manage the IP address lifecycle within the new overlay. Additionally, the administrator must ensure thatcorresponding cloud subnets are added in the Prism Element UI and mapped to the existing AWS subnets. This mapping is essential for the Nutanix Controller VMs (CVMs) and AHV hosts to properly encapsulate and route traffic between the virtual overlay and the physical AWS VPC infrastructure. Validating these configurations prevents IP conflicts and connectivity loss during the transition from standard VPC routing to the software-defined Geneve-encapsulated overlay.