Nutanix NCP-CI-Azure Exam Dumps

NAT Based Network: A NAT-based network is designed to provide inbound and outbound internet access while obscuring the internal private addresses. This setup uses Network Address Translation (NAT) to map internal IP addresses to a public IP address, ensuring that internal addresses are not exposed to the public internet.

Security and Connectivity: NAT provides a layer of security by hiding internal IP addresses and allowing controlled access to external resources. This configuration is well-suited for VMs that need to communicate with servers on the public internet while maintaining the privacy of their internal network addresses.

Azure Virtual Network NAT Documentation

Nutanix Networking and Security Configuration Guide

To allow access from the native Azure VMs to the workloads running in the Nutanix User VPC, the administrator needs to:

Adjust the Inbound Network Security Group (NSG) on the Flow Gateway VM's Internal NIC.

Specifically, allow traffic from the subnet range of the native Azure VMs (10.20.80.0/20) in the Inbound rules of the NSG associated with the Internal NIC of the Flow Gateway VM.

This configuration change permits the desired network traffic, ensuring that the native Azure VMs can communicate with the workloads in the Nutanix User VPC. Reference

Azure Network Security Groups Overview

Nutanix Networking and Security Best Practices

Account Administrator Role: This role grants the necessary permissions for managing the Azure account, including the ability to open, close, or extend a support tunnel. These capabilities are crucial for the Nutanix Support team to perform diagnostics and troubleshooting efficiently.

Permissions Included: The Account Administrator role encompasses broader account management rights, ensuring that the user can interact with various support and operational aspects of the NC2 environment within Azure.

Azure Role-Based Access Control (RBAC) Documentation

Nutanix NC2 Support Tunnel Requirements

Network Configuration: Using a specific IP range for a VNet can cause conflicts if that range is reserved or already in use by the cluster's internal operations.

Internal Usage: In NC2, certain IP ranges are reserved for internal cluster functions and should not be used for VNets to avoid IP conflicts and connectivity issues.

Impact: If the 10.100.0.0/16 range is reserved for internal usage, using it for a VNet would lead to IP conflicts, causing network connectivity issues.

Verification: It's important to verify the reserved IP ranges in the NC2 documentation before assigning them to VNets.

Conclusion: The connectivity issues are likely due to using the 10.100.0.0/16 range, which is reserved for internal cluster usage.

Nutanix Networking Guidelines

Azure Virtual Network Documentation

In the scenario presented, the NC2 cluster was initially deployed with two Flow Gateways (FGW1 and FGW2) in HA. After adding four bare-metal nodes and additional workloads, two more Flow Gateways (FGW3 and FGW4) were added to handle the increased bandwidth for north/south traffic. Given the configuration, the existing workloads can utilize all available Flow Gateways (FGW1, FGW2, FGW3, and FGW4) for No-NAT (routed) traffic paths. This setup allows for Equal Cost Multipath (ECMP) routing, distributing traffic load across all Flow Gateways.

Reference

Nutanix Flow Networking