Nutanix NCP-CI-Azure - Nutanix Certified Professional - Cloud Integration - Azure (NCP-CI-Azure v6.7)

NC2 Console:The NC2 console is specifically designed for deploying and managing Nutanix clusters on Azure. It provides the necessary tools and interface to configure, monitor, and manage the NC2 clusters effectively.

Cluster Deployment:Using the NC2 console ensures that all configurations and integrations with Azure are correctly handled, providing a seamless deployment experience.

References:

Nutanix NC2 Deployment Guide

Nutanix Console Documentation

In the NC2 on Azure cluster scenario, the existing workloads were using floating IPs for inbound traffic before the addition of new Flow Gateways (FGW3 and FGW4). The NAT traffic path established initially will continue to direct traffic through the originally assigned Flow Gateways (FGW1 and FGW2). The existing workloads will not automatically utilize the new Flow Gateways (FGW3 and FGW4) without a reconfiguration or reboot, which reassigns the NAT paths.

References

Nutanix Flow Networking and Configuration Guide

Azure Resource Providers: To prepare an Azure subscription for NC2, specific resource providers must be registered to enable necessary services and resources.

Required Providers:

Microsoft.Network: This provider is essential for networking functionalities, including virtual networks, subnets, and other network resources necessary for NC2 deployment.

Microsoft.Nutanix: This provider is specifically required for integrating and managing Nutanix resources within the Azure environment.

Other Providers:

Microsoft.HybridNetworkandMicrosoft.HybridCompute: These are not specifically required for NC2 but might be relevant for other hybrid or extended network configurations.

Conclusion: Registering both "Microsoft.Network" and "Microsoft.Nutanix" ensures that all necessary network and Nutanix-specific resources are available for NC2 deployment.

References:

Azure Resource Providers Documentation

Nutanix on Azure Setup Guide

Jump Host Deployment:A Jump Host is a secure server used to access other systems in a network. In the context of an NC2 cluster on Azure, it serves as an intermediary for accessing Prism Element and Prism Central.

Flexible Deployment Options:The Jump Host can be deployed in either the Prism Central VNet or an external VNet, providing flexibility in network design and access strategies. This allows the organization to choose the most suitable network for deploying the Jump Host based on their security and connectivity requirements.

References:

Nutanix NC2 on Azure Deployment Guide

Azure Virtual Network Configuration Documentation

Cloud Account Configuration:When setting up a cloud account for the NC2 organization, the administrator can specify which regions are available for deploying clusters.

Restricting Regions:This ensures that the Finance organization can only deploy clusters into the designated regions, complying with organizational policies and requirements.

References:

Nutanix NC2 Configuration Guide

Azure Subscription and Resource Management Documentation

User VM:The initial source of the traffic within the Azure environment.

Delegated Subnet:Traffic from the User VM flows through the delegated subnet, which is configured to handle specific network traffic.

Flow Gateway:The Flow Gateway manages and routes the traffic from the delegated subnet, providing network services and connectivity.

Floating IP Address:The Flow Gateway assigns a floating IP address for the outbound traffic, facilitating NAT operations.

Azure NAT Gateway:The traffic is then routed through the Azure NAT Gateway, which provides outbound internet connectivity for the User VMs, ensuring secure and efficient routing.

References:

Azure Virtual Network NAT Documentation

Nutanix NC2 Configuration Guide

ERP Configuration: ERP (External Route Prefix) settings determine how traffic is routed between subnets and VPCs.

Objective: The goal is to isolate Darren-Tier3 while ensuring proper routing for Tier1 and Tier2.

Transit VPC ERP: Setting it to 10.0.0.0/16 ensures that it covers the entire VPC range, allowing traffic within Tier1 and Tier2.

Servers ERP: Setting it to 10.0.4.0/24 ensures isolation for Darren-Tier3 by limiting traffic to that specific subnet and preventing external traffic from reaching it.

Conclusion: This configuration achieves the isolation of Darren-Tier3 while allowing proper routing for Tier1 and Tier2.

References:

Nutanix Networking Documentation

Azure Virtual Network Documentation

Account Administrator Role:This role grants the necessary permissions for managing the Azure account, including the ability to open, close, or extend a support tunnel. These capabilities are crucial for the Nutanix Support team to perform diagnostics and troubleshooting efficiently.

Permissions Included:The Account Administrator role encompasses broader account management rights, ensuring that the user can interact with various support and operational aspects of the NC2 environment within Azure.

References:

Azure Role-Based Access Control (RBAC) Documentation

Nutanix NC2 Support Tunnel Requirements

To allow access from the native Azure VMs to the workloads running in the Nutanix User VPC, the administrator needs to:

Adjust the Inbound Network Security Group (NSG) on the Flow Gateway VM's Internal NIC.

Specifically, allow traffic from the subnet range of the native Azure VMs (10.20.80.0/20) in the Inbound rules of the NSG associated with the Internal NIC of the Flow Gateway VM.

This configuration change permits the desired network traffic, ensuring that the native Azure VMs can communicate with the workloads in the Nutanix User VPC.References

Azure Network Security Groups Overview

Nutanix Networking and Security Best Practices