NCP-CI-Azure Exam Dumps - Nutanix Certified Professional - Cloud Integration - Azure (NCP-CI-Azure v6.7)

Outbound Communication Whitelisting:For NC2 Azure API calls and telemetry data to function correctly, certain outbound communications must be allowed. If these communications are not whitelisted, API calls can fail, and telemetry or health data might not be reported correctly.

First Check:Given the symptoms (failing API calls and missing telemetry), the first step should be to ensure that all necessary outbound communications are correctly whitelisted. This includes ensuring that endpoints and services required for NC2 operation are accessible.

References:

Nutanix NC2 Networking Requirements

Azure Networking and Security Configuration Guide

Flow Gateway VMs: Flow Gateway VMs are used to manage and route network traffic within an NC2 on Azure cluster, ensuring sufficient bandwidth for workloads.

Scalability: To ensure enough available bandwidth, multiple Flow Gateway VMs can be deployed.

Maximum Limit: The highest number of Flow Gateway VMs that can be deployed within an NC2 on Azure environment is 6, providing the necessary capacity to handle high traffic volumes and ensure optimal performance.

Conclusion: Deploying up to 6 Flow Gateway VMs ensures adequate bandwidth for NC2 workloads.

References:

Nutanix Clusters Networking Guide

Azure Network Performance Documentation

ERP Configuration: ERP (External Route Prefix) settings determine how traffic is routed between subnets and VPCs.

Objective: The goal is to isolate Darren-Tier3 while ensuring proper routing for Tier1 and Tier2.

Transit VPC ERP: Setting it to 10.0.0.0/16 ensures that it covers the entire VPC range, allowing traffic within Tier1 and Tier2.

Servers ERP: Setting it to 10.0.4.0/24 ensures isolation for Darren-Tier3 by limiting traffic to that specific subnet and preventing external traffic from reaching it.

Conclusion: This configuration achieves the isolation of Darren-Tier3 while allowing proper routing for Tier1 and Tier2.

References:

Nutanix Networking Documentation

Azure Virtual Network Documentation

Resource Group Requirement:When deploying NC2 on Azure, it is essential to organize resources such as VNets, subnets, and other components in a dedicated resource group. This helps in managing and maintaining the resources efficiently.

New Resource Group:Creating a new Azure resource group ensures that all the necessary NC2 resources are isolated and managed together, avoiding conflicts with existing resources and providing a clear separation for administration and billing purposes.

References:

Azure Resource Group Documentation

Nutanix NC2 Deployment Guide

In the NC2 on Azure cluster scenario, the existing workloads were using floating IPs for inbound traffic before the addition of new Flow Gateways (FGW3 and FGW4). The NAT traffic path established initially will continue to direct traffic through the originally assigned Flow Gateways (FGW1 and FGW2). The existing workloads will not automatically utilize the new Flow Gateways (FGW3 and FGW4) without a reconfiguration or reboot, which reassigns the NAT paths.

References

Nutanix Flow Networking and Configuration Guide

Minimum Node Requirement:For production deployments, Nutanix typically requires a minimum of three nodes to ensure high availability and fault tolerance within the cluster.

Azure Ready Nodes:Deploying at least three Azure Ready Nodes allows the cluster to provide redundancy, ensuring that the failure of a single node does not affect the overall availability and performance of the cluster.

References:

Nutanix NC2 on Azure Deployment Guide

High Availability and Redundancy Best Practices

Purpose of an Organization in NC2:In the NC2 console, an organization serves to manage and segregate clusters based on specific requirements such as departmental needs, project goals, or security policies.

Cluster Management:This segregation allows administrators to apply unique configurations, permissions, and policies to different clusters within the same environment, providing flexibility and control over resource allocation and management.

References:

Nutanix NC2 Console Documentation

Best Practices for Managing NC2 Clusters

Azure Directory Service Role: Azure Directory Service must be able to resolve specific Nutanix URLs to ensure proper communication and functionality during the deployment of an NC2 cluster.

Critical Endpoint: The address "Gateway-external-api.cloud.nutanix.com" is critical for establishing external API communications required for the deployment and management of the NC2 cluster.

DNS Resolution: Proper DNS resolution of this address ensures that the Azure Directory Service can interact with Nutanix services and APIs necessary for cluster operations.

Verification Process:

Ensure that DNS settings allow resolution of "Gateway-external-api.cloud.nutanix.com".

Test connectivity and resolution prior to deployment to avoid issues.

Importance: Without resolving this address, the deployment process might face connectivity issues, leading to potential deployment failures.

References:

Nutanix NC2 on Azure Setup Guide

Azure Active Directory Integration

To verify that the NC2 specialist has access to the necessary organizations for troubleshooting the issue, the administrator should:

Confirm that theSupport Authorizationon the organization is set toFull Access. This ensures that the NC2 specialist has the required permissions to access the necessary resources and perform the necessary actions to resolve the issue.

Providing login credentials or adding the specialist as an admin user is not recommended due to security and privacy concerns. Ensuring the specialist is assigned the correct RBAC role is another valid approach but confirming the support authorization directly ensures they have the needed access.

References

Nutanix Support and Services

To allow access from the native Azure VMs to the workloads running in the Nutanix User VPC, the administrator needs to:

Adjust the Inbound Network Security Group (NSG) on the Flow Gateway VM's Internal NIC.

Specifically, allow traffic from the subnet range of the native Azure VMs (10.20.80.0/20) in the Inbound rules of the NSG associated with the Internal NIC of the Flow Gateway VM.

This configuration change permits the desired network traffic, ensuring that the native Azure VMs can communicate with the workloads in the Nutanix User VPC.References

Azure Network Security Groups Overview

Nutanix Networking and Security Best Practices

Payment Method Options:When using a Pay As You Go subscription plan and opting to pay directly to Nutanix, wire transfer is a valid and secure payment method.

Direct Payment:Wire transfers allow for the direct transfer of funds from the organization's bank account to Nutanix, ensuring a straightforward and efficient payment process.

References:

Nutanix Billing and Payment Documentation

Pay As You Go Subscription Payment Methods Guide

NAT Based Network:A NAT-based network is designed to provide inbound and outbound internet access while obscuring the internal private addresses. This setup uses Network Address Translation (NAT) to map internal IP addresses to a public IP address, ensuring that internal addresses are not exposed to the public internet.

Security and Connectivity:NAT provides a layer of security by hiding internal IP addresses and allowing controlled access to external resources. This configuration is well-suited for VMs that need to communicate with servers on the public internet while maintaining the privacy of their internal network addresses.

References:

Azure Virtual Network NAT Documentation

Nutanix Networking and Security Configuration Guide

NC2 Console:The NC2 console is specifically designed for deploying and managing Nutanix clusters on Azure. It provides the necessary tools and interface to configure, monitor, and manage the NC2 clusters effectively.

Cluster Deployment:Using the NC2 console ensures that all configurations and integrations with Azure are correctly handled, providing a seamless deployment experience.

References:

Nutanix NC2 Deployment Guide

Nutanix Console Documentation

Flow Virtual Networking: Nutanix Flow Virtual Networking allows for the creation of overlay networks to segment and manage network traffic.

Network Types:

Underlay: Refers to the physical network infrastructure.

Overlay: Logical network built on top of the physical infrastructure, providing flexibility for creating isolated subnets and accommodating different workloads.

VPC: Virtual Private Cloud, a network within a public cloud provider.

VNET: Azure-specific virtual network.

Requirement: Creating a subnet for new workloads within Flow Virtual Networking suggests using an overlay network for logical separation and management.

Conclusion: An overlay network within Flow Virtual Networking will satisfy the task of accommodating a new type of workload in the NC2 Azure instance.

References:

Nutanix Flow Networking Guide

Azure Virtual Network Documentation

Jump Host VM in External VNet with VNet Peering:

Deploy Jump Host VM:Deploy a VM in an external VNet that is not within the same network as Prism Central.

VNet Peering:Establish VNet peering between the external VNet and the Prism Central VNet. This allows the Jump Host to communicate with Prism Central securely.

Jump Host VM in Prism Central VNet Inside a Delegated Subnet:

Deploy Jump Host VM:Deploy the Jump Host VM directly in the Prism Central VNet within a delegated subnet. This places the Jump Host in the same network environment as Prism Central, allowing direct access.

References:

Azure VNet Peering Documentation

Nutanix NC2 Networking and Access Configuration Guide

Microsoft Azure Consumption Commitment (MACC):To ensure that the Nutanix licensing costs apply to the MACC, the company needs to make purchases that are recognized by Azure's billing system.

Azure Marketplace Purchases:By purchasing Nutanix licenses through the Azure Marketplace, the costs will be included in the Azure billing and count towards the MACC, thereby leveraging the committed spend.

References:

Azure Marketplace Documentation

Nutanix Licensing Guide

NC2 on Azure Deployment: Deploying Nutanix clusters in Azure involves configuring various components, each needing appropriate network isolation and configuration.

Components and vNets:

Bare-metal instance: Requires its own vNet to ensure proper network isolation and performance.

Prism Central: Needs a dedicated vNet to manage and monitor the Nutanix environment, ensuring it has the required network access and isolation.

Azure Load Balancer: Does not require its own vNet but needs to be associated with the appropriate vNet where services are deployed.

Virtual Network Gateway: Is used for VPN connections but does not necessitate a separate vNet; it operates within an existing vNet.

Network Isolation: Providing separate vNets for Bare-metal instances and Prism Central ensures optimal performance and management capabilities.

Conclusion: Both Bare-metal instances and Prism Central require their own vNets in the NC2 on Azure deployment.

References:

Nutanix Clusters on Azure Deployment Guide

Azure Virtual Network Documentation

In this scenario, the issue arises from overlapping IP address ranges between the Transit VPC and the User VPC. Here’s a detailed breakdown:

Understanding ERPs (Elastic Routing Prefixes):

The ERP for the Transit VPC is 10.1.1.0/25, which covers IP addresses from 10.1.1.0 to 10.1.1.127.

The ERP for the User VPC is 10.1.1.0/24, which covers IP addresses from 10.1.1.0 to 10.1.1.255.

IP Address Overlap:

Since 10.1.1.0/25 is a subset of 10.1.1.0/24, there is a significant overlap in the IP address ranges of these two ERPs.

This overlap can cause routing issues because the same IP address range is being used in both VPCs, leading to ambiguity in routing and communication.

Communication Issue:

When a VM in the User VPC tries to communicate with other resources, the network cannot accurately determine the correct route due to the overlapping IP address ranges.

This overlap prevents proper routing and results in the VM being unable to communicate with other resources as intended.

Resolution:

To resolve this issue, the ERPs must be in different CIDR ranges. This means the IP address ranges for the Transit VPC and the User VPC should not overlap.

For example, if the Transit VPC uses 10.1.1.0/25, the User VPC could use a different range such as 10.1.2.0/24 or any other range that does not overlap with 10.1.1.0/25.

By ensuring that the ERPs are in different CIDR ranges, the network can properly route traffic between the VPCs without any conflicts or ambiguities, thereby enabling the VM in the User VPC to communicate with other resources effectively.

my.nutanix.com Portal:This portal provides access to various Nutanix services and features, including the NC2 deployment interface.

NC2 Tile:The NC2 tile within the portal is specifically designed for deploying and managing Nutanix Cloud Clusters. It provides the necessary tools and settings to initiate and configure NC2 clusters on Azure or other cloud environments.

References:

Nutanix NC2 Deployment Guide

my.nutanix.com Portal Documentation