NCP-CI-Azure Questions and Answers

Flow Gateway VMs: Flow Gateway VMs are used to manage and route network traffic within an NC2 on Azure cluster, ensuring sufficient bandwidth for workloads.

Scalability: To ensure enough available bandwidth, multiple Flow Gateway VMs can be deployed.

Maximum Limit: The highest number of Flow Gateway VMs that can be deployed within an NC2 on Azure environment is 6, providing the necessary capacity to handle high traffic volumes and ensure optimal performance.

Conclusion: Deploying up to 6 Flow Gateway VMs ensures adequate bandwidth for NC2 workloads.

References:

Nutanix Clusters Networking Guide

Azure Network Performance Documentation

Node Termination Observation:When a node is terminated from the Azure portal, the NC2 cluster will detect that the node is no longer operational.

Marking as Degraded:NC2 will mark the node as degraded, indicating that the node is not functioning as expected. This status allows administrators to take necessary actions to resolve the issue, such as provisioning a new node or addressing the degradation cause.

References:

Nutanix NC2 Cluster Management Guide

Azure Instance Termination Documentation

NATed Path Configuration: When using the NATed Path, it is essential to ensure that traffic can flow out of the Flow gateway VM to external networks.

Default Route: Adding a default route on the Nutanix User VPC ensures that all outbound traffic is directed to the appropriate network gateway.

Configuration Steps:

Navigate to the routing settings of the Nutanix User VPC.

Add a default route with the destination of 0.0.0.0/0, pointing to the External Overlay network.

Security Group Settings:

Ensure that the External Flow Gateway Security Group on the External NIC allows outbound traffic.

Ensure that the Internal Flow Gateway Security Group on the internal NIC allows outbound traffic (if needed for internal network flows).

Conclusion: Properly configuring the default route on the Nutanix User VPC enables outbound traffic flow via the NATed Path through the External Overlay network.

References:

Nutanix Flow Gateway Configuration Guide

Azure VPC Routing Documentation

Instance Termination Detection:When an instance in Azure is reported as being in a terminated state but NC2 expects it to be running, the system will automatically take corrective actions.

Host Condemnation and Replacement:NC2 will condemn the host, marking it as unusable, and will then trigger the replacement process to ensure that the cluster maintains its required capacity and performance levels. This automatic handling ensures minimal disruption to the workloads running on the cluster.

References:

Nutanix NC2 Automated Management Features

Azure Instance State Documentation

BGP Gateway Deployment:The BGP gateway is deployed as Azure native VMs within the Prism Central VNet. This deployment ensures seamless integration with Azure's networking infrastructure.

Route Advertisement:The BGP gateway advertises the externally routable IP addresses to the Azure Route Server. This setup allows for dynamic routing and efficient traffic management.

Flow Gateways (FGW) as Next Hops:Each active Flow Gateway's external IP address is used as the next hop. This configuration ensures that southbound traffic is correctly routed to the appropriate Flow Gateway, providing efficient and reliable connectivity.

References:

Nutanix NC2 Networking Guide

Azure Route Server and BGP Documentation

ICMP Traffic:ICMP is essential for network diagnostics and troubleshooting, such as ping and traceroute, which help in monitoring the connectivity and health of the network.

Bi-Directional Traffic:Allowing bi-directional ICMP traffic ensures that all nodes (CVMs, Prism Element, and Prism Central) can both send and receive diagnostic messages, which is crucial for maintaining proper communication and network stability.

References:

Nutanix Networking and Connectivity Requirements

Corporate Firewall Configuration Guidelines

Default Route for Internet Traffic:By setting the default route of 0.0.0.0/0 for the Nutanix User VPC pointing to the external-NAT network, all internet-bound traffic from the desktops will be routed through the Azure NAT Gateway, conserving bandwidth on the ExpressRoute connection.

On-Premises Route:Setting a specific route to the on-premises subnet for the Nutanix User VPC pointing to the external-No-NAT network ensures that traffic destined for on-premises resources bypasses the NAT Gateway and utilizes the ExpressRoute connection, optimizing the use of network paths.

References:

Azure NAT Gateway Documentation

Nutanix NC2 Networking Configuration Guide

ERP Configuration: ERP (External Route Prefix) settings determine how traffic is routed between subnets and VPCs.

Objective: The goal is to isolate Darren-Tier3 while ensuring proper routing for Tier1 and Tier2.

Transit VPC ERP: Setting it to 10.0.0.0/16 ensures that it covers the entire VPC range, allowing traffic within Tier1 and Tier2.

Servers ERP: Setting it to 10.0.4.0/24 ensures isolation for Darren-Tier3 by limiting traffic to that specific subnet and preventing external traffic from reaching it.

Conclusion: This configuration achieves the isolation of Darren-Tier3 while allowing proper routing for Tier1 and Tier2.

References:

Nutanix Networking Documentation

Azure Virtual Network Documentation

NC2 Console:The NC2 console is specifically designed for deploying and managing Nutanix clusters on Azure. It provides the necessary tools and interface to configure, monitor, and manage the NC2 clusters effectively.

Cluster Deployment:Using the NC2 console ensures that all configurations and integrations with Azure are correctly handled, providing a seamless deployment experience.

References:

Nutanix NC2 Deployment Guide

Nutanix Console Documentation

Private Endpoint:Private Endpoints allow secure access to Azure services over a private network connection. They do not typically appear on delegated subnets, which are used for specific Azure services.

Prism Central Connectivity:Prism Central can be connected to a private endpoint to ensure secure communication without exposing it to the public internet. This setup ensures secure and private management of the Nutanix environment.

References:

Azure Private Endpoint Documentation

Nutanix NC2 Deployment and Security Guide

IP Forwarding in Azure:Enabling IP forwarding allows the VM to forward network traffic that is not specifically addressed to itself. This is necessary for network devices like the Flow Gateway VM to route traffic correctly.

Network Interface Configuration:Both the Azure portal settings and the VM's operating system must have IP forwarding enabled to ensure proper traffic handling and routing capabilities.

References:

Azure Virtual Machine Networking Documentation

Nutanix Flow Gateway Configuration Guide

Purpose of an Organization in NC2:In the NC2 console, an organization serves to manage and segregate clusters based on specific requirements such as departmental needs, project goals, or security policies.

Cluster Management:This segregation allows administrators to apply unique configurations, permissions, and policies to different clusters within the same environment, providing flexibility and control over resource allocation and management.

References:

Nutanix NC2 Console Documentation

Best Practices for Managing NC2 Clusters

Storage Capacity Requirement: The requirement specifies that the bare metal instance must support up to 20 TB of storage capacity.

Instance Selection: Among the provided options, the AN36P instance is designed to support higher storage capacities and performance needs.

AN36P Capabilities: The AN36P instance is optimized for storage-intensive applications and provides the necessary hardware specifications to handle up to 20 TB of storage.

Comparison with Other Instances:

ND96asr: Typically optimized for GPU workloads rather than storage.

AN36: May not meet the 20 TB storage requirement.

HB176rs: Geared towards high-performance computing rather than large storage capacities.

Conclusion: Based on the requirements and instance specifications, AN36P is the most suitable choice for supporting up to 20 TB of storage.

References:

Nutanix NC2 Instance Types

Azure Virtual Machine Sizes

Account Administrator Role:This role grants the necessary permissions for managing the Azure account, including the ability to open, close, or extend a support tunnel. These capabilities are crucial for the Nutanix Support team to perform diagnostics and troubleshooting efficiently.

Permissions Included:The Account Administrator role encompasses broader account management rights, ensuring that the user can interact with various support and operational aspects of the NC2 environment within Azure.

References:

Azure Role-Based Access Control (RBAC) Documentation

Nutanix NC2 Support Tunnel Requirements

NC2 on Azure Deployment: Deploying Nutanix clusters in Azure involves configuring various components, each needing appropriate network isolation and configuration.

Components and vNets:

Bare-metal instance: Requires its own vNet to ensure proper network isolation and performance.

Prism Central: Needs a dedicated vNet to manage and monitor the Nutanix environment, ensuring it has the required network access and isolation.

Azure Load Balancer: Does not require its own vNet but needs to be associated with the appropriate vNet where services are deployed.

Virtual Network Gateway: Is used for VPN connections but does not necessitate a separate vNet; it operates within an existing vNet.

Network Isolation: Providing separate vNets for Bare-metal instances and Prism Central ensures optimal performance and management capabilities.

Conclusion: Both Bare-metal instances and Prism Central require their own vNets in the NC2 on Azure deployment.

References:

Nutanix Clusters on Azure Deployment Guide

Azure Virtual Network Documentation

Azure AD App Registration: When setting up an application registration in Azure AD, specific permissions are required to delegate access.

User Access Administrator Role: This role has the necessary permissions to manage user access to Azure resources, including delegating permissions for app registrations.

Comparison of Roles:

Azure Reader Role: Grants read-only access, insufficient for managing app registrations.

Azure Contributor Role: Allows creation and management of resources but does not include permissions to manage access.

Azure Custom Role: While it can be defined to meet specific needs, the User Access Administrator role is predefined to handle access delegation.

Conclusion: The Azure User Access Administrator role is required to delegate minimum permissions for Azure AD App registration.

References:

Azure Role-Based Access Control Documentation

Azure AD App Registration Guide

Cloud Account Configuration:When setting up a cloud account for the NC2 organization, the administrator can specify which regions are available for deploying clusters.

Restricting Regions:This ensures that the Finance organization can only deploy clusters into the designated regions, complying with organizational policies and requirements.

References:

Nutanix NC2 Configuration Guide

Azure Subscription and Resource Management Documentation