Nutanix NCP-BC-7.5 - Nutanix Certified Professional - Business Continuity (NCP-BC) 7.5

When a primary Nutanix site suffers a catastrophic failure, the disaster recovery plan must be executed from the recovery (secondary) site . In a legacy Protection Domain-based environment, the secondary site is in a " passive " or " standby " mode, receiving snapshots but not actively running the workloads. The traditional method to failover is using the " Activate " command (Option A), which promotes the PD and registers the VMs. However, in certain specific failure scenarios or older software versions, the secondary cluster may require a service-level reset to recognize its new role as the active master for those specific workloads.

The Cerebro service is the core component responsible for managing Protection Domains and replication metadata. If the primary site is completely inaccessible and the secondary site ' s metadata state needs refreshing to initiate recovery, restarting the Cerebro service on the secondary cluster CVMs can force a re-evaluation of all local snapshots and protection domain states. This action triggers the recovery logic, allowing the administrator to then see and activate the recovery points. While " Activate " is the goal, the first technical step in a situation where the cluster management plane is unstable or the primary is gone is ensuring the data protection services are aware of the current state. This allows the VMs to be restored from the latest snapshots, fulfilling the Recovery Time Objective (RTO) despite the complete loss of the source infrastructure.

IP address management (IPAM) in Nutanix networks ensures that IP assignments are tracked to prevent conflicts. When a Recovery Plan is validated, the orchestrator checks if it can successfully assign the required IPs at the recovery site. The warning occurs when the system detects a potential conflict or cannot automatically " guarantee " the preservation of a static IP, often due to overlapping pools or the way IPAM is configured on the destination subnet.

To resolve this without changing the VM ' s assigned IP, the administrator should use " Custom VM IP Mapping " . This feature allows the administrator to override the default automatic assignment and explicitly state which IP the VM must receive at the recovery site. By manually defining this mapping, the administrator " claims " the IP within the Recovery Plan ' s logic, satisfying the validation check and ensuring that the VM boots with its correct identity during a failover. Disabling IPAM (Option A) is often not feasible in production environments, and adding a vNIC (Option B) complicates the VM ' s OS configuration. Custom IP mapping is the purpose-built administrative tool for resolving IP assignment ambiguity and ensuring predictable recovery in complex, IPAM-enabled networking environments.

Maintaining " predictable and consistent " IP addresses during a failover to a public cloud environment like Nutanix Cloud Clusters (NC2) on Azure is a common requirement for multi-tier applications that rely on static IP references.

To achieve this level of precision, the administrator should configure " Custom VM IP Mapping " within the Nutanix Recovery Plan. This feature allows the administrator to explicitly define the exact IP address that each VM should receive upon recovery at the destination site. While some Nutanix network configurations attempt to preserve the " last octet " of an IP address (Option C), this is not always possible or predictable in a cloud environment with existing subnets. Relying on default IPAM behavior (Option A) often results in dynamic, unpredictable assignments. Using in-guest NGT scripts (Option D) is an overly complex and manual workaround that is natively superseded by the Recovery Plan ' s IP mapping feature. By using custom IP mapping, the administrator ensures that the database, application, and web tiers all come up with the exact addresses required for the application to function immediately without manual intervention.

Volume Groups (VGs) are used in Nutanix to provide block storage to virtual machines, often for high-performance applications like SQL Server. VGs can be attached to VMs in two ways: " In-guest " (using iSCSI initiators) or " Hypervisor-attached " (where the hypervisor handles the connection).

In a disaster recovery scenario managed by Recovery Plans, there is a technical distinction in how these attachments are handled. While Nutanix Disaster Recovery can replicate the data in the Volume Groups and recover the VM itself, VGs that are " hypervisor-attached " do not currently support automatic reattachment as part of the orchestration workflow in all AOS versions. When the failover completes, the VM powers on at the recovery site, but the VGs are not connected to the VM at the hypervisor level. This causes the application (SQL) to find its data disks missing, resulting in the database staying offline. To resolve this, the administrator must manually reattach the Volume Groups to the VM at the recovery site using the Prism interface or a script. This limitation highlights the need to verify specific application storage configurations during DR testing. For automated recovery of VGs, using " In-guest " iSCSI attachments is often preferred because the iSCSI initiator within the guest OS can re-establish the connection to the new cluster ' s Data Services IP once the network is active.

Migrating from legacy Protection Domains to modern Prism Central Protection Policies is a recommended practice for scaling DR management. However, large environments must account for architectural limits during this transition. A Nutanix cluster has specific maximum thresholds for the number of entities (VMs) that can be contained within a single Protection Domain, and similar limits exist for the initial " handoff " to Prism Central.

If a single legacy Protection Domain contains more than 500 VMs, attempting to migrate it as a single unit can lead to timeouts, metadata synchronization failures, and potential gaps in protection. To ensure that all VMs remain consistently protected during the migration, the first step is to " split " the existing large Protection Domain into multiple smaller, more manageable ones. For example, an administrator might split a 600-VM domain into three 200-VM domains. This reduction in " entity density " allows the Nutanix Cerebro and Prism Central services to process the migration tasks more efficiently without hitting resource contention or task timeout limits. Once the VMs are organized into these smaller groups, they can be systematically unlinked from the legacy domains and added to the new PC-based Protection Policies. This phased and controlled approach minimizes risk and ensures that a valid recovery point always exists for every VM throughout the entire migration lifecycle.

Migrating from legacy Protection Domain (PD) based management to the modern Prism Central (PC) based Protection Policies is a recommended best practice for scaling Nutanix Disaster Recovery. This migration involves moving VMs from a " Prism Element " centric management model to a centralized, category-based model in Prism Central.

To ensure that no data is lost during this transition, the most critical prerequisite is to verify that a successful, full replication (backup) of the Protection Domain has recently completed. This ensures that the recovery site already possesses a complete and consistent set of data for the VMs before they are unlinked from the old policy and attached to the new one. While adding VMs to a category (Option A) is a step in the process, it is not the first verification step required for data safety. If an administrator attempts to migrate while a replication is incomplete or failing, the transition to the new policy might leave the VMs unprotected for an extended period, or recovery points might be missing if a disaster occurs mid-migration. By completing a full backup of the PD first, the administrator creates a " safety net " of recovery points that can be used if the migration itself encounters issues. This ensures that the transition to modern DR is performed with minimal risk to the business ' s data protection objectives.

When designing disaster recovery to a cloud environment (such as NC2 on AWS or Azure), organizations must choose a compute model that aligns with their Recovery Time Objective (RTO). The " Zero Compute " model is the most cost-efficient because it stores only the data (snapshots) in low-cost Object Storage (S3 or Blob) and does not maintain a running cluster. However, the RTO for Zero Compute is high because, in a disaster, the organization must first deploy a new Nutanix cluster, configure it, and then begin the process of hydrating data from the Object Storage.

In contrast, the " Pilot Light " model involves keeping a minimal, active Nutanix cluster (e.g., 3 nodes) running at the recovery site. While this carries a moderate ongoing cost, it significantly reduces the RTO. Because the cluster already exists, the management plane (Prism Central), the storage containers, and all metadata are already active. When a failover is triggered, the system only needs to power on the VMs or perform a small amount of data hydration. This allows the organization to meet aggressive RTO targets of under 15 minutes, which is generally impossible with the Zero Compute model. Pilot Light provides the " ready-to-go " infrastructure needed for mission-critical applications that cannot afford the multiple hours required to provision a fresh cluster from scratch during an emergency.

Failback is a critical phase of the disaster recovery lifecycle where workloads are returned to their original primary site. When an " Unplanned Failover " is executed, the system assumes the primary site is gone or unmanaged. Once the primary site (AZ1) is restored, the administrator cannot simply " re-run " the failover in reverse without preparing the source site. The " Clean up of Entities " (Option C) is a mandatory step that must be performed on the original primary cluster after it returns to a healthy state. This process clears the stale VM registrations and metadata that existed prior to the outage, signaling to the Nutanix orchestrator that AZ1 is now ready to re-receive the workloads. Until this cleanup is completed, the Recovery Plan will not list the VMs as eligible for failback because it still detects the " ghost " of the VM at the destination. While reverse replication (Option B) is also necessary to prevent data loss during failback, the reason the VMs are entirely missing from the Recovery Plan interface during the initial failback attempt is the lack of entity cleanup. Performing this cleanup ensures a smooth transition back to primary production without metadata conflicts or registration errors.

The Recovery Point Objective (RPO) is a measure of how much data an organization can afford to lose during an outage. An RPO of zero means that absolutely no data loss is tolerated; every write performed at the primary site must be safely committed to the recovery site before the application receives a confirmation. In the Nutanix portfolio, Synchronous Replication (Option A) is the only technology that guarantees this level of data protection. It mirrors every write in real-time between two clusters, ensuring they are always in perfect synchronization. In contrast, Nearsync Replication (Option B) allows for very low RPOs (as low as 20 seconds to 1 minute), but it is still fundamentally an asynchronous process using lightweight snapshots, meaning some " data-in-flight " could be lost. Async Replication (Option C) typically involves RPOs of one hour or more and is used for less critical workloads. Cloud Connect (Option D) is a legacy feature for off-site backup and does not support zero-RPO requirements. Synchronous Replication is the " gold standard " for Tier-1, mission-critical applications where data integrity and zero loss are the primary business requirements, provided the network latency between sites is 5ms or less.

Nutanix Metro Availability is a continuous availability solution designed to survive a site failure with zero data loss (Zero RPO). Because it operates on a synchronous replication model, every write performed by a virtual machine must be acknowledged by both the local and the remote clusters before the write is confirmed to the application. This process introduces a " latency penalty " equal to the network Round Trip Time (RTT) between the sites.

To maintain acceptable application performance and ensure cluster stability, Nutanix enforces a strict latency limit of 5 ms RTT between the primary and secondary clusters. If the latency exceeds this 5 ms threshold, the time spent waiting for remote acknowledgments would cause severe performance degradation for high-I/O workloads, such as the SQL or Oracle databases common in financial institutions. Furthermore, high latency increases the risk of the synchronous link being " broken " during periods of high data churn. While the Witness VM (used for tie-breaking) can tolerate much higher latency (up to 200 ms), the data-path link must remain under 5 ms to satisfy the technical requirements of the Metro Availability feature and the performance expectations of Tier-1 business-critical applications.