Outbound Communication Whitelisting: For NC2 Azure API calls and telemetry data to function correctly, certain outbound communications must be allowed. If these communications are not whitelisted, API calls can fail, and telemetry or health data might not be reported correctly.

First Check: Given the symptoms (failing API calls and missing telemetry), the first step should be to ensure that all necessary outbound communications are correctly whitelisted. This includes ensuring that endpoints and services required for NC2 operation are accessible.

References:

Nutanix NC2 Networking Requirements

Azure Networking and Security Configuration Guide

ICMP Traffic: ICMP is essential for network diagnostics and troubleshooting, such as ping and traceroute, which help in monitoring the connectivity and health of the network.

Bi-Directional Traffic: Allowing bi-directional ICMP traffic ensures that all nodes (CVMs, Prism Element, and Prism Central) can both send and receive diagnostic messages, which is crucial for maintaining proper communication and network stability.

References:

Nutanix Networking and Connectivity Requirements

Corporate Firewall Configuration Guidelines

Free Trial Expiration: Once the NC2 free trial period expires, the administrator needs to switch to a paid subscription plan to continue using all the features and functionalities provided by Nutanix NC2.

Paid Subscription Benefits: Transitioning to a paid subscription ensures uninterrupted access to NC2 features, support, and updates, maintaining the operational capabilities of the existing clusters.

References:

Nutanix Subscription and Billing Documentation

Nutanix NC2 Support and Subscription Guide

To verify that the NC2 specialist has access to the necessary organizations for troubleshooting the issue, the administrator should:

Confirm that the Support Authorization on the organization is set to Full Access . This ensures that the NC2 specialist has the required permissions to access the necessary resources and perform the necessary actions to resolve the issue.

Providing login credentials or adding the specialist as an admin user is not recommended due to security and privacy concerns. Ensuring the specialist is assigned the correct RBAC role is another valid approach but confirming the support authorization directly ensures they have the needed access.

References

Nutanix Support and Services

Network Configuration : Using a specific IP range for a VNet can cause conflicts if that range is reserved or already in use by the cluster’s internal operations.

Internal Usage : In NC2, certain IP ranges are reserved for internal cluster functions and should not be used for VNets to avoid IP conflicts and connectivity issues.

Impact : If the 10.100.0.0/16 range is reserved for internal usage, using it for a VNet would lead to IP conflicts, causing network connectivity issues.

Verification : It’s important to verify the reserved IP ranges in the NC2 documentation before assigning them to VNets.

Conclusion : The connectivity issues are likely due to using the 10.100.0.0/16 range, which is reserved for internal cluster usage.

References :

Nutanix Networking Guidelines

Azure Virtual Network Documentation

NAT Based Network: A NAT-based network is designed to provide inbound and outbound internet access while obscuring the internal private addresses. This setup uses Network Address Translation (NAT) to map internal IP addresses to a public IP address, ensuring that internal addresses are not exposed to the public internet.

Security and Connectivity: NAT provides a layer of security by hiding internal IP addresses and allowing controlled access to external resources. This configuration is well-suited for VMs that need to communicate with servers on the public internet while maintaining the privacy of their internal network addresses.

References:

Azure Virtual Network NAT Documentation

Nutanix Networking and Security Configuration Guide

Private Endpoint: Private Endpoints allow secure access to Azure services over a private network connection. They do not typically appear on delegated subnets, which are used for specific Azure services.

Prism Central Connectivity: Prism Central can be connected to a private endpoint to ensure secure communication without exposing it to the public internet. This setup ensures secure and private management of the Nutanix environment.

References:

Azure Private Endpoint Documentation

Nutanix NC2 Deployment and Security Guide

Default Route for Internet Traffic: By setting the default route of 0.0.0.0/0 for the Nutanix User VPC pointing to the external-NAT network, all internet-bound traffic from the desktops will be routed through the Azure NAT Gateway, conserving bandwidth on the ExpressRoute connection.

On-Premises Route: Setting a specific route to the on-premises subnet for the Nutanix User VPC pointing to the external-No-NAT network ensures that traffic destined for on-premises resources bypasses the NAT Gateway and utilizes the ExpressRoute connection, optimizing the use of network paths.

References:

Azure NAT Gateway Documentation

Nutanix NC2 Networking Configuration Guide

In the scenario presented, the NC2 cluster was initially deployed with two Flow Gateways (FGW1 and FGW2) in HA. After adding four bare-metal nodes and additional workloads, two more Flow Gateways (FGW3 and FGW4) were added to handle the increased bandwidth for north/south traffic. Given the configuration, the existing workloads can utilize all available Flow Gateways (FGW1, FGW2, FGW3, and FGW4) for No-NAT (routed) traffic paths. This setup allows for Equal Cost Multipath (ECMP) routing, distributing traffic load across all Flow Gateways.

References

Nutanix Flow Networking

To extend an on-premises subnet to an NC2 cluster on Azure, the administrator should configure:

Subnet Type: Both on-premises VLAN subnets and VPC subnets. This ensures that the subnet can span both the on-premises environment and the Azure environment.

Traffic Type: Support for IPv4 unicast traffic, IPv6 unicast traffic, and ARP is necessary to ensure proper communication and address resolution across the extended subnet.

On-premises Hypervisor: ESXi and AHV are supported hypervisors for this type of configuration, allowing for a seamless extension of the subnet between these environments.

References

Nutanix Hybrid Cloud Networking