NCP-CI-AWS Sample Questions Answers

When a " boot timeout " alert occurs during a cluster expansion, it often indicates that the NC2 console requested a new instance from AWS, but the instance failed to reach a " healthy " state within the allotted time. While networking can be a factor, common " hard " stops at the AWS API level includeService QuotasandInstance Limits. AWS accounts have default limits on the number of bare-metal instances (like i3.metal or i4i.metal) that can be active in a single region. If the expansion request exceeds thevCPU quotaor the specificinstance type limit, AWS will deny the request or fail to provision the hardware. Administrators must verify these quotas in the AWS Service Quotas console and request an increase to support the additional nodes required for the Nutanix cluster.

For the NC2 cluster deployed in the North Virginia region (us-east-id), consuming IPs from the 10.78.2.0/24 range, the subnets configured within the same CIDR range of 10.78.0.0/16 will be recognized.

The subnetDR01 (10.78.2.0/24)is directly within the range of the deployed cluster.

The subnetL2stretch (10.19.101.0/24)is also configured in the NC2 AWS VPC, although not in the immediate range of the cluster, it may show up due to broader network configurations for stretched L2 operations.

SubnetsVDI (10.78.130.0/22)andDR02 (10.79.120.0/24), although part of the same VPC, are not directly within the immediate CIDR range or may not be recognized in this specific configuration scenario.

Refer to the Nutanix documentation on NC2 AWS VPC subnet configurations and Prism Element settings for detailed guidelines on network visibility and configuration.

For environments requiring highly flexible and complex network addressing,Flow Virtual Networking (FVN)is the superior choice over standard native AWS networking. Native AWS networking is often restricted by the CIDR blocks of the VPC, and managing non-contiguous ranges across multiple subnets can become administratively burdensome.FVNuses an overlay architecture (Geneve) that abstracts the User VM networking from the physical AWS VPC infrastructure. This allows administrators to define virtual networks and subnets using any IP range, including multiplenon-contiguous CIDR ranges, without being constrained by the primary VPC address space. This flexibility is essential for large-scale deployments or multi-tenant environments where overlapping or non-standard IP schemes must be supported seamlessly.

The error message in the image indicates that the cluster creation failed due to reaching the maximum retries for provisioning cluster nodes. Here are two possible scenarios that could lead to this issue:

Insufficient Permissions (Answer B):

If the AWS user or role used to create the cluster does not have sufficient permissions, it can result in failures during the provisioning process. Proper IAM policies must be attached to ensure that the necessary actions can be performed, such as launching instances, creating VPCs, or managing networking components.

AWS Quota Exceeded/Instance Limit Exceeded (Answer D):

AWS imposes quotas and limits on the number of instances and other resources that can be created within an account. If these quotas are exceeded, new instances cannot be provisioned, causing the cluster creation to fail. This can be resolved by requesting a quota increase from AWS.

Nutanix Knowledge Base Article 9774

AWS Service Quotas

Nutanix NC2 on AWS Documentation

With the Nutanix AOS Pro licensing, several advanced features and add-on products become available. Specifically, in the AWS cluster deployment wizard, the following add-ons are available:

Files:

Nutanix Files provides a software-defined, scale-out file storage solution that simplifies the management and scaling of unstructured data.

Advanced Replication:

Advanced Replication features in Nutanix include synchronous and asynchronous replication capabilities, allowing for robust disaster recovery and data protection solutions.

DARE (Data-At-Rest Encryption):

DARE ensures that all data stored on Nutanix clusters is encrypted, providing a higher level of security for sensitive information.

These features are included in the AOS Pro licensing tier, offering enhanced data management, protection, and security capabilities.

Nutanix Licensing Guide

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Advanced Features

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

The administrator has not created the necessary Security Group:

The error message indicates that the creation of network interfaces in a shared subnet requires specifying a security group. This means that the necessary security group has not been created or assigned to the network interfaces.

Creating the appropriate security group and ensuring it is associated with the network interfaces during cluster deployment should resolve this issue.

Refer to AWS documentation on security groups and network interface configuration and Nutanix documentation on prerequisites for deploying NC2 clusters in an existing AWS VPC.

To ensure continuous availability and maintain the specified Replication Factor (RF) during maintenance or hardware issues, Nutanix follows a proactive " provision before removal " logic for host replacement in the cloud. The correct operational sequence begins with adding a new host to the cluster first. This step expands the cluster ' s capacity and ensures there is a destination ready for data synchronization. Once the new host is fully integrated into the storage fabric, the system migrates the virtual machines and their associated data away from the degraded or old host. Only after the old host has been completely evacuated and the cluster returns to a healthy, balanced state does the NC2 console conclude the operation by removing the old host from the cluster configuration.

When opting for a native networking deployment (Standard AWS Networking), the architectural requirements differ from an overlay-based setup.

This configuration typically requiresone private management subnetto house the bare-metal hosts and Controller VMs (CVMs). To facilitate outbound communication and administrative access,two public subnetsare required—one for the NAT Gateway to provide internet access to the private nodes, and another to host resources like the Prism load balancer. Finally,one or more User VM (UVM) subnetsare created to host the actual workloads. Unlike Flow Virtual Networking, which uses a single transit VPC, native networking relies on these multiple standard AWS subnets to segregate management, public-facing, and workload traffic within the VPC.

For VDI workloads that require GPU acceleration, the g4dn.metal nodes are the appropriate choice. These instances are equipped with NVIDIA T4 GPUs, which are well-suited for graphics-intensive applications such as VDI workloads that need GPU acceleration. Other node types like AN36P, m6g.metal, or AN36 do not provide the necessary GPU capabilities.

Nutanix Support and Insights - GPU support in AWS

To ensure that alert emails are sent properly from Prism Central within an NC2 environment, configuring an SMTP server in the Prism Central settings is required. The SMTP server facilitates the sending of email notifications for alerts and other communications.

SMTP Configuration:

Prism Central requires an SMTP server to send email alerts. This involves specifying the SMTP server address, port, and authentication details if needed.

The configuration must include the email address from which the alerts will be sent and the recipient addresses.

Steps to Configure SMTP Server in Prism Central:

Log in to Prism Central.

Navigate to the " Settings " menu.

Select " Email Server " under the " Alerts " section.

Enter the SMTP server details, including the server address, port, and authentication credentials.

Test the configuration to ensure emails are sent correctly.

Nutanix Prism Central Administration Guide

Nutanix Support Documentation on Email Alert Configuration

Best Practices for Configuring SMTP Servers in Cloud Environments

In a Layer 2 stretched environment where the default gateway resides on-premises, a " Forward policy " is used to route traffic from the cloud back to the data center. If the on-premises data center goes completely offline, the on-premises gateway is no longer reachable, which would halt all North-South communication for the VMs failed over to AWS. To restore full service, the administrator must not only failover the VMs to the NC2 cluster but also remove the Forward policy on the on-premises cluster (or specifically update the routing logic to ensure the AWS cluster takes over gateway duties). This allows the cloud cluster to stop attempting to tunnel traffic to the missing on-premises gateway and instead utilize local cloud-based exit points for network traffic, restoring external connectivity.

When creating user VM subnets for multiple NC2 clusters in AWS, the best approach is to create guest-VM subnets for each cluster. This ensures that each cluster has its own dedicated subnets, which simplifies network management and avoids potential IP conflicts.

Advantages of Dedicated Subnets:

Isolation: Each cluster operates in its own subnet, providing better isolation and security.

Management: Easier to manage and troubleshoot network issues when each cluster has its own subnets.

Scalability: More scalable as each subnet can be managed and expanded independently.

Steps to Create Guest-VM Subnets:

Identify the IP range for each subnet.

In the AWS VPC console, create a new subnet for each cluster using the identified IP ranges.

Associate the new subnets with the respective clusters during or after the cluster deployment process.

Why Not Shared Subnets:

Shared subnetscould lead to IP conflicts and make network management more complex, especially as the number of clusters grows.

Nutanix Cloud Clusters on AWS Administration Guide

AWS VPC Subnet Creation Documentation

Hibernation is a key cost-optimization feature of NC2 that allows bare-metal nodes to be powered down while preserving the cluster ' s data state in cloud storage. For this functionality to be supported, the data must reside in a specific storage architecture. Only Volumes-only containers support the hibernate and resume feature in NC2 on AWS. These containers are specifically engineered to allow the Nutanix Distributed Storage Fabric (DSF) to safely offload data and metadata to Amazon S3 during the hibernation process and successfully re-integrate it into new bare-metal instances upon resumption. Standard storage containers or AES-optimized containers do not currently support the data mobility and offloading workflows required to preserve cluster state when the physical compute nodes are completely de-provisioned from the AWS environment.

Flow Virtual Networking (FVN)introduces a software-defined overlay that requires significant management overhead for handling VPC transit, encapsulation, and complex routing tables. Due to the resource-intensive nature of managing these advanced networking services, Nutanix restricts the supported Prism Central (PC) instance sizes for FVN deployments. OnlyLarge and Extra LargePrism Central instances are supported to ensure there is adequate CPU and memory available to run the virtual routing and gateway components effectively. Smaller PC instances (Small or Medium) lack the necessary performance headroom and may experience latency or management failures when trying to process the continuous network synchronization required by the FVN overlay in a production cloud environment.

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix ' s update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

In Nutanix Cloud Integration with AWS, specifically version 6.7, the role that allows full access to clusters created within an organization is the Organization Administrator.

The Organization Administrator role has the highest level of privileges within an organization, enabling the user to manage all aspects of the clusters, including creation, modification, and deletion.

This role is designed to oversee and control the entire organization ' s resources, ensuring comprehensive management capabilities over all clusters and associated resources.

Refer to the Nutanix documentation on roles and permissions for NC2 on AWS for further details.

When planning to leverage NC2 on AWS for an elastic DR scenario where the initial cluster is using 13en.metal, the following additional node types are supported for cluster expansion:

I3.metal: These instances provide high IOPS and low latency with NVMe SSDs, making them suitable for storage-intensive applications.

i4i.metal: These instances offer higher performance with AWS Nitro SSDs, improved network bandwidth, and better compute performance compared to the I3.metal instances.

Nutanix Cloud Clusters on AWS Documentation

Amazon EC2 I4i Instances – AWS

Amazon EC2 I3 Instances – AWS

Within an NC2 environment, the Cluster Protect feature can ensure the protection of:

Nutanix Files: This provides file services within the Nutanix ecosystem, and Cluster Protect can safeguard the data stored in Nutanix Files.

Virtual Machine Disks: This ensures that the data stored on virtual machine disks is protected, providing backup and recovery options for the virtual machines running within the cluster.

Nutanix Cloud Clusters on AWS Administration

Nutanix AOS 6.7 Documentation

Deploying NC2 on AWS using Flow Virtual Networking (FVN) requires a specific landing zone architecture to isolate management and user traffic. The minimum configuration requires three distinct subnets. First, one Private Management Subnet is needed for the bare-metal hosts and Controller VMs (CVMs). Second, one Public Subnet is required to host the NAT Gateway, providing the private management nodes with outbound internet access for Nutanix portal communication and updates. Third, one Flow Virtual Networking Subnet (often referred to as the Transit VPC subnet) is required to handle the encapsulation and routing of User VM traffic. This baseline setup ensures that the management plane is secure, the internet-bound traffic is correctly routed, and the FVN overlay has the necessary transit path for workload communication.

To provide VMs with outbound internet connectivity in AWS using a private subnet, the administrator needs to create the following components in the VPC:

Private Subnet: A private subnet is required to house the VMs that need outbound internet access but do not require direct inbound access from the internet.

NAT Gateway: A NAT (Network Address Translation) Gateway is necessary to allow instances in the private subnet to connect to the internet or other AWS services while preventing the internet from initiating a connection with those instances.

Public EIP (Elastic IP Address): An EIP is associated with the NAT Gateway to provide a persistent public IP address that allows outbound internet traffic from the private subnet to be routed correctly.

Route Table: A route table is configured to route traffic from the private subnet to the NAT Gateway for outbound internet access.

AWS NAT Gateway Documentation

AWS VPC Subnet Basics

For issues related to cloud hardware support such as EC2 instances, VPC, etc., the public cloud vendor (AWS in this case) should be contacted. AWS provides support and documentation for their infrastructure and services, ensuring that users can get assistance for any hardware or cloud-specific queries.

Nutanix Support and Insights

For mission-critical workloads, the Recovery Time Objective (RTO) is a primary concern.

Multicloud Snapshot Technology (MST)coupled with aPilot Light Deploymentprovides the necessary infrastructure to support an automated recovery plan. In a Pilot Light scenario, a small, " always-on " version of the Nutanix cluster (usually the minimum number of nodes) is maintained in AWS to host Prism Central and handle background replication tasks. Because the management layer is already active, recovery plans can be fully automated to power on VMs and adjust networking instantly upon failure. In contrast, a " Zero Compute " deployment lacks an active management interface, requiring manual intervention to provision a cluster before recovery can begin, which significantly increases RTO and prevents full automation.

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

When creating an NC2 cluster in AWS, the account used to run the CloudFormation script requires specific permissions to ensure the deployment is successful. The required permissions are:

IAMFullAccess: Provides full access to IAM resources.

AmazonEC2FullAccess: Allows full access to EC2 resources.

AWSCIoudFormationFullAccess: Grants full access to manage AWS CloudFormation stacks.

These permissions are necessary to create, manage, and deploy the required AWS resources for the NC2 cluster.

Nutanix Support and Insights

AWS IAM Documentation

When a catastrophic failure occurs, such as an entire AWS Availability Zone (AZ) becoming unavailable, the Cluster Protect feature provides a cloud-native orchestrated recovery path. The critical first step for an administrator to trigger the recovery workflow is to manually set the cluster to the " Failed " state within the NC2 console. Marking the cluster as failed signals the NC2 portal that the original infrastructure is non-functional and initiates the logic required to redeploy the cluster in a healthy, alternative AZ. Without this manual confirmation, the portal may continue attempting to reach the original nodes. Once the " Failed " state is confirmed, the portal provides the subsequent options to provision new bare-metal hardware and re-hydrate data from the Amazon S3 snapshots.

To ensure that only application servers from the source subnet 10.79.1.0/24 can access the SQL databases running on the NC2 cluster in the subnet 10.78.1.0/24, the administrator can take the following actions:

Option A: Create a custom Security Group with the following rules:

Key = tag:nutanix:clusters

Key = tag:nutanix:clusters:external

and value = the clusters ' UUID

Key = tag:nutanix:clusters:external

and value = 10.78.1.0/24

Option D: Create a custom Security Group with the following:

Key = nutanix:clusters

Key = nutanix:clusters:external

and value = the clusters ' UUID

Key = nutanix:clusters:external

and value = 10.79.1.0/24

These actions help create security rules that restrict access to the databases only from the specified source subnet, ensuring secure and controlled access.

Nutanix Cloud Clusters on AWS Administration

AWS Security Groups Documentation

The NC2 Tile within the my.nutanix.com portal is the correct interface to deploy NC2. This portal provides an integrated and user-friendly interface specifically designed for deploying and managing Nutanix Clusters on AWS.

NC2 Deployment Interface:

NC2 Tile within the my.nutanix.com portal: This portal provides the necessary tools and options to deploy and manage NC2 clusters. It includes functionalities for setting up the clusters, configuring network settings, and managing resources.

Advantages:

User-Friendly Interface: Simplifies the deployment process with a guided setup.

Integrated Tools: Provides access to all necessary tools for managing the deployment and monitoring of NC2 clusters.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix my.nutanix.com Portal Documentation

Nutanix Best Practices for Cluster Deployment

Migrating an existing NC2 cluster from native AWS networking to an overlay network (Flow Virtual Networking) requires careful coordination between the Nutanix software and the AWS environment. A primary prerequisite is ensuring thatExternal IPAMis correctly configured for the cloud subnets to manage the IP address lifecycle within the new overlay. Additionally, the administrator must ensure thatcorresponding cloud subnets are added in the Prism Element UI and mapped to the existing AWS subnets. This mapping is essential for the Nutanix Controller VMs (CVMs) and AHV hosts to properly encapsulate and route traffic between the virtual overlay and the physical AWS VPC infrastructure. Validating these configurations prevents IP conflicts and connectivity loss during the transition from standard VPC routing to the software-defined Geneve-encapsulated overlay.

Synchronous replication requires extremely low latency (sub-5ms) and a reliable high-speed connection between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various architectures, the most robust and supported way to enable synchronous replication for NC2 clusters in the same region is to ensure thatboth clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the added latency that might be introduced by VPC Peering or a Transit Gateway between separate VPCs. By sharing the same VPC, the clusters can communicate via the same internal AWS network fabric, providing the deterministic performance required for zero-RPO data protection and Metro Availability configurations.

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

For a VM to be accessible over the internet through a load balancer, the VM itself must have a public IP address.

In this case, the health check for the VM target is failing and the DNS returns a " NOT Found " message because web-1 does not have a public IP assigned.

Without a public IP, the load balancer cannot route traffic to web-1 from the internet.

Assigning a public IP to web-1 ensures that the VM can be accessed via the load balancer, resolving the connectivity issue.

Refer to the AWS documentation on network load balancers and public IP assignments, and Nutanix documentation on VM network configurations.

In an NC2 environment using Flow Virtual Networking (FVN), routing traffic between the AWS cloud and on-premises environments requires specific configuration of the Transit VPC and User VPCs.

To ensure that traffic reaching the on-premises environment is not subjected to Network Address Translation (NAT)—which would obscure the original IP addresses and potentially break connectivity for certain applications—the routing tables must point to the correct internal gateway interface. Theoverlay-external-subnet-nonatacts as the designated gateway for traffic that should be routed without address translation. Verifying that the " Next Hop " for on-premises prefixes is set to this specific subnet ensures that internal communication remains transparent and complies with standard corporate networking and security policies.

For AOS software support related to NC2, the appropriate entity to contact is Nutanix. Nutanix provides comprehensive support for their software, including the Acropolis Operating System (AOS) used in NC2 deployments.

Support Scope:

Nutanix offers support for the deployment, configuration, and management of NC2 clusters, including any issues related to AOS software.

This includes troubleshooting, updates, and technical assistance.

Why Not Other Options:

Internal IT Operations team: Typically handles internal issues but does not have the specialized knowledge or resources for AOS software support.

Partner: May provide support but would ultimately escalate issues to Nutanix for software-specific concerns.

Public Cloud Vendor: Manages infrastructure-related issues but does not provide support for Nutanix AOS software.

Nutanix Support Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for AOS Support

In an NC2 heterogeneous cluster (mixing different host types), the ability to addAmazon EBS volumesfor supplemental storage capacity is governed by both host compatibility and cluster redundancy rules. First, the administrator must ensure that the selected host types actually support EBS attachment; if the current selection does not, they mustadd a host type that supports EBS volumes. Second, the cluster must maintain its Replication Factor (RF) integrity. If the number of nodes for a specific storage-heavy host type is not amultiple of the RF(e.g., needing 4 nodes for RF2), the system may restrict storage expansion to prevent data unavailability during a failure. By ensuring the node count aligns with RF requirements and using compatible bare-metal instances, the administrator can unlock the EBS volume configuration options within the deployment workflow.

When extending a Layer 2 subnet from on-premises to NC2 on AWS, the default gateway often remains at the on-premises location.

For Virtual Machines (VMs) running on the NC2 cluster in AWS to communicate with resources outside their immediate subnet, their traffic must be directed back through the tunnel to the on-premises gateway. This is achieved by configuring arouting policyon the NC2 cluster with aForward action. This policy identifies traffic destined for the gateway and encapsulates it via the VTEP (VXLAN Tunnel Endpoint) using port 4789. Without this forward action policy, the AWS-based VMs would attempt to find a local gateway within the AWS VPC, resulting in a loss of connectivity for any North-South traffic.

Enable IGMP snooping on the AHV hosts:

IGMP (Internet Group Management Protocol) snooping is a feature that listens to IGMP traffic between hosts and routers. By enabling IGMP snooping on the AHV (Acropolis Hypervisor) hosts, the switch can intelligently forward multicast traffic only to the ports that have requested it.

This reduces unnecessary multicast traffic on the network and prevents congestion by ensuring that multicast packets are only delivered to the appropriate endpoints.

Refer to the Nutanix documentation on network configuration and best practices for managing multicast traffic.

When connectivity is required between two separate AWS VPCs—one hosting native EC2 instances and the other hosting an NC2 cluster—and advanced overlay networking (FVN) is not in use, the most straightforward solution is VPC Peering. Configuring VPC Peering in Amazon Web Services allows for the routing of traffic between the two VPCs using private IP addresses as if they were on the same network. This method requires the least administrative effort because it does not require the deployment of new software overlays like FVN or the management of a complex Transit Gateway. Administrators simply need to establish the peering connection and update the route tables in both VPCs to allow traffic to flow between the respective CIDR ranges, providing secure, high-performance connectivity.