NCP-CI-Azure Nutanix Certified Professional - Cloud Integration - Azure (NCP-CI-Azure v6.7) Questions and Answers

In the scenario presented, the NC2 cluster was initially deployed with two Flow Gateways (FGW1 and FGW2) in HA. After adding four bare-metal nodes and additional workloads, two more Flow Gateways (FGW3 and FGW4) were added to handle the increased bandwidth for north/south traffic. Given the configuration, the existing workloads can utilize all available Flow Gateways (FGW1, FGW2, FGW3, and FGW4) for No-NAT (routed) traffic paths. This setup allows for Equal Cost Multipath (ECMP) routing, distributing traffic load across all Flow Gateways.

References

Nutanix Flow Networking

Default Route for Internet Traffic:By setting the default route of 0.0.0.0/0 for the Nutanix User VPC pointing to the external-NAT network, all internet-bound traffic from the desktops will be routed through the Azure NAT Gateway, conserving bandwidth on the ExpressRoute connection.

On-Premises Route:Setting a specific route to the on-premises subnet for the Nutanix User VPC pointing to the external-No-NAT network ensures that traffic destined for on-premises resources bypasses the NAT Gateway and utilizes the ExpressRoute connection, optimizing the use of network paths.

References:

Azure NAT Gateway Documentation

Nutanix NC2 Networking Configuration Guide

my.nutanix.com Portal:This portal provides access to various Nutanix services and features, including the NC2 deployment interface.

NC2 Tile:The NC2 tile within the portal is specifically designed for deploying and managing Nutanix Cloud Clusters. It provides the necessary tools and settings to initiate and configure NC2 clusters on Azure or other cloud environments.

References:

Nutanix NC2 Deployment Guide

my.nutanix.com Portal Documentation

NC2 Cluster Node Limit: NC2 on Azure has specific limitations regarding the maximum number of nodes supported in a single cluster.

Maximum Nodes: According to the current NC2 on Azure guidelines, a single cluster can support up to 18 nodes.

Workload Support: This limitation ensures optimal performance and management of resources within the Azure environment.

Comparison of Options:

14 nodes: Less than the maximum supported.

24 nodes and 28 nodes: Exceed the maximum supported, potentially leading to performance and management issues.

Conclusion: For supporting new workloads, the maximum number of nodes in an NC2 on Azure environment is 18.

References:

Nutanix Clusters on Azure Technical Specifications

Azure Virtual Machine Scale Sets Documentation

When selecting the NC2 subscription plan from the Nutanix billing portal, the available options are:

Pay-as-you-Go (PayG):Allows you to pay for the services as you use them, providing flexibility and avoiding upfront costs.

Bring your own License (BYOL):Enables you to use your existing Nutanix licenses within the cloud environment, offering cost savings if you already have licenses.

These options provide flexibility in how you can manage and pay for your Nutanix cloud clusters.References

Nutanix Cloud Clusters Pricing and Plans

To verify that the NC2 specialist has access to the necessary organizations for troubleshooting the issue, the administrator should:

Confirm that theSupport Authorizationon the organization is set toFull Access. This ensures that the NC2 specialist has the required permissions to access the necessary resources and perform the necessary actions to resolve the issue.

Providing login credentials or adding the specialist as an admin user is not recommended due to security and privacy concerns. Ensuring the specialist is assigned the correct RBAC role is another valid approach but confirming the support authorization directly ensures they have the needed access.

References

Nutanix Support and Services

No-NAT Path Requirement:For a No-NAT path to function, the external networks must be able to route traffic directly to the Nutanix User VPC without translation.

Externally Routable IP Address:The externally routable IP address ensures that traffic from outside networks can reach the Nutanix User VPC.

Address Space Compatibility:Sharing the same address space as the Nutanix User VPC allows for seamless integration and communication between the external network and the User VPC.

References:

Azure Virtual Network Documentation on IP Addressing

Nutanix NC2 Configuration Guide on No-NAT Networking

Azure Subscription Validation: When deploying an NC2 cluster, the Azure subscription must be validated and allowlisted by Microsoft. This is a crucial step to ensure that the necessary permissions and configurations are set up for the deployment.

Booting State Issue: If the nodes are stuck in the Booting state, it often indicates that the subscription has not been properly validated and allowlisted. This prevents the deployment from progressing as required resources and permissions are not fully accessible.

Checking Allowlisting Status: Administrators should verify that their subscription has been allowlisted by contacting Azure support or checking the status through the Azure portal.

Resolution: Once the subscription is validated and allowlisted by Microsoft, the deployment should proceed without the nodes getting stuck in the Booting state.

References:

Nutanix NC2 on Azure Documentation

Azure Subscription Management

Initial Access: To gain access to the NC2 console, users need to create an account on the Nutanix platform.

My Nutanix Account: Creating a My Nutanix account provides access to the Nutanix console, support, and other resources.

Free Trial and Billing Portal: Starting a free trial or accessing the billing portal can be subsequent steps but require an initial account.

Support Case: Opening a support case is not necessary for initial access but might be needed for specific issues later.

Conclusion: Creating a My Nutanix account is the first step to accessing the NC2 console and other Nutanix services.

References:

Nutanix Account Creation Guide

Getting Started with Nutanix NC2

IP Forwarding in Azure:Enabling IP forwarding allows the VM to forward network traffic that is not specifically addressed to itself. This is necessary for network devices like the Flow Gateway VM to route traffic correctly.

Network Interface Configuration:Both the Azure portal settings and the VM's operating system must have IP forwarding enabled to ensure proper traffic handling and routing capabilities.

References:

Azure Virtual Machine Networking Documentation

Nutanix Flow Gateway Configuration Guide

Requirement Analysis: The NC2 VMs need to access Azure and on-premises resources without traversing the internet, ensuring secure and direct connectivity.

Solution Options:

SSH Connection: Suitable for individual remote access, not for full VM connectivity to Azure and on-premises resources.

Interface Endpoint: Facilitates private connectivity to specific Azure services, but not comprehensive for all resources.

ExpressRoute: Provides private, dedicated connectivity between Azure and on-premises environments. This ensures that traffic does not traverse the public internet, meeting the security and performance requirements.

Site-to-Site VPN: Provides secure connectivity but can involve traversing the internet, which is against the requirements.

Conclusion: ExpressRoute is the optimal solution as it offers a private connection that does not involve internet traversal, ensuring secure and efficient access to both Azure and on-premises resources.

References:

Azure ExpressRoute Documentation

Nutanix Clusters on Azure Networking Guide

Minimum Node Requirement:For production deployments, Nutanix typically requires a minimum of three nodes to ensure high availability and fault tolerance within the cluster.

Azure Ready Nodes:Deploying at least three Azure Ready Nodes allows the cluster to provide redundancy, ensuring that the failure of a single node does not affect the overall availability and performance of the cluster.

References:

Nutanix NC2 on Azure Deployment Guide

High Availability and Redundancy Best Practices

NC2 on Azure Deployment: Deploying Nutanix clusters in Azure involves configuring various components, each needing appropriate network isolation and configuration.

Components and vNets:

Bare-metal instance: Requires its own vNet to ensure proper network isolation and performance.

Prism Central: Needs a dedicated vNet to manage and monitor the Nutanix environment, ensuring it has the required network access and isolation.

Azure Load Balancer: Does not require its own vNet but needs to be associated with the appropriate vNet where services are deployed.

Virtual Network Gateway: Is used for VPN connections but does not necessitate a separate vNet; it operates within an existing vNet.

Network Isolation: Providing separate vNets for Bare-metal instances and Prism Central ensures optimal performance and management capabilities.

Conclusion: Both Bare-metal instances and Prism Central require their own vNets in the NC2 on Azure deployment.

References:

Nutanix Clusters on Azure Deployment Guide

Azure Virtual Network Documentation

To troubleshoot the error shown in the exhibit where Azure credentials are not valid and the creation of the resource group failed, the administrator should:

Verify that the Azure AD App registration has been correctly configured, especially the Client Secret.

Ensure that the Client Secret is valid, has not expired, and matches what has been entered in the configuration.

This step is crucial because an invalid or expired Client Secret would prevent the validation of Azure credentials and the creation of necessary resources.

References

Azure AD App Registration and Secrets Management

Nutanix Cluster Configuration Documentation

NAT Based Network:A NAT-based network is designed to provide inbound and outbound internet access while obscuring the internal private addresses. This setup uses Network Address Translation (NAT) to map internal IP addresses to a public IP address, ensuring that internal addresses are not exposed to the public internet.

Security and Connectivity:NAT provides a layer of security by hiding internal IP addresses and allowing controlled access to external resources. This configuration is well-suited for VMs that need to communicate with servers on the public internet while maintaining the privacy of their internal network addresses.

References:

Azure Virtual Network NAT Documentation

Nutanix Networking and Security Configuration Guide

Jump Host VM in External VNet with VNet Peering:

Deploy Jump Host VM:Deploy a VM in an external VNet that is not within the same network as Prism Central.

VNet Peering:Establish VNet peering between the external VNet and the Prism Central VNet. This allows the Jump Host to communicate with Prism Central securely.

Jump Host VM in Prism Central VNet Inside a Delegated Subnet:

Deploy Jump Host VM:Deploy the Jump Host VM directly in the Prism Central VNet within a delegated subnet. This places the Jump Host in the same network environment as Prism Central, allowing direct access.

References:

Azure VNet Peering Documentation

Nutanix NC2 Networking and Access Configuration Guide

Local Key Manager (LKM):The native local key manager in Nutanix requires a minimum number of nodes to function correctly and provide key management services.

Minimum Node Requirement for LKM:To support the Nutanix native LKM, at least three nodes are needed. This configuration ensures that the key management service can achieve the necessary quorum and redundancy for secure operations.

References:

Nutanix Data Encryption Documentation

Nutanix Cluster Configuration Guide

Flow Virtual Networking: Nutanix Flow Virtual Networking allows for the creation of overlay networks to segment and manage network traffic.

Network Types:

Underlay: Refers to the physical network infrastructure.

Overlay: Logical network built on top of the physical infrastructure, providing flexibility for creating isolated subnets and accommodating different workloads.

VPC: Virtual Private Cloud, a network within a public cloud provider.

VNET: Azure-specific virtual network.

Requirement: Creating a subnet for new workloads within Flow Virtual Networking suggests using an overlay network for logical separation and management.

Conclusion: An overlay network within Flow Virtual Networking will satisfy the task of accommodating a new type of workload in the NC2 Azure instance.

References:

Nutanix Flow Networking Guide

Azure Virtual Network Documentation

In this scenario, the issue arises from overlapping IP address ranges between the Transit VPC and the User VPC. Here’s a detailed breakdown:

Understanding ERPs (Elastic Routing Prefixes):

The ERP for the Transit VPC is 10.1.1.0/25, which covers IP addresses from 10.1.1.0 to 10.1.1.127.

The ERP for the User VPC is 10.1.1.0/24, which covers IP addresses from 10.1.1.0 to 10.1.1.255.

IP Address Overlap:

Since 10.1.1.0/25 is a subset of 10.1.1.0/24, there is a significant overlap in the IP address ranges of these two ERPs.

This overlap can cause routing issues because the same IP address range is being used in both VPCs, leading to ambiguity in routing and communication.

Communication Issue:

When a VM in the User VPC tries to communicate with other resources, the network cannot accurately determine the correct route due to the overlapping IP address ranges.

This overlap prevents proper routing and results in the VM being unable to communicate with other resources as intended.

Resolution:

To resolve this issue, the ERPs must be in different CIDR ranges. This means the IP address ranges for the Transit VPC and the User VPC should not overlap.

For example, if the Transit VPC uses 10.1.1.0/25, the User VPC could use a different range such as 10.1.2.0/24 or any other range that does not overlap with 10.1.1.0/25.

By ensuring that the ERPs are in different CIDR ranges, the network can properly route traffic between the VPCs without any conflicts or ambiguities, thereby enabling the VM in the User VPC to communicate with other resources effectively.