Installation & Configuration

Many users are unaware that network traffic can be segmented (or separated) within a Nutanix cluster for various functions or purposes. For example, backplane traffic can be separated from Management-Plane Traffic so as to allow for even greater available bandwidth for the backplane traffic. Further, as another example, DMZ related traffic could be isolated to specific host uplinks. The four primary means of network segmentation are the following:Isolating Backplane Traffic by using VLANs (Logical Segmentation) Isolating Backplane Traffic Physically (Physical Segmentation) Isolating Service-Specific Traffic Isolating Stargate-to-Stargate traffic over RDMATo note, certain means of segmentation are limited to certain hypervisor versions. For example, the segmentation of management and backplane traffic is supported across the AHV, ESX and Hyper-V (Hyper-V offering logical segmentation only) hypervisors, while service-specific segmentation is supported only by the AHV and ESX hypervisors.

Nutanix VirtIO includes device drivers specifically used by Windows VMs hosted in the Nutanix environment to enhance their stability and performance. This concept is very similar to VMware Tools for ESXi environments.The VirtIO bundles various drivers including:Balloon Driver Ethernet Adapter RNG Device SCSI pass-through controller Serial Driver SCSI ControllerThe VirtIO package is found on the Support Portal under AHV (please select “VirtIO” from the corresponding drop-down menu).To note, the device driver versions contained within the various available Nutanix VirtIO packages may be the same if there have been no updates for the drivers between the package releases. To correlate the driver versions associated with each VirtIO package release, please reference KB 5491 in the Support Portal.Further to note, beginning with VirtIO package release version 1.1.6 all driver versions match the VirtIO package version.

Hi teams, can i create 3 node cluster with 2 different FC SFP+ switch 10gb because my port is limited? between switch i using FC SFP+ 10gb link. i think the first impact is latency between node, please give me suggestion using this topology  

Nutanix AHV uses Open vSwitch(OVS) to connect to the CVM, the hypervisor and the user VMs to each other and to the physical network on each node. The CVM manages the OVS inside the AHV host. Since the OVS is an open source software switch that behaves like a layer-2 learning switch, it maintains a MAC address table. Each AHV server maintains an OVS instance, managed as a single logical switch through Prism. Bonds:When multiple uplinks are used they are added to a bond acting as a single logical interface, to which the bridge is connected. Open vSwitch (OVS) does not support bonds with single uplink and as workaround we directly connect bridge to single uplink.WARNING:Avoid the use of a single uplink configuration and do not attempt to modify a single uplink configuration using manage_ovs if the version of AOS is 5.10.x prior to 5.10.4. Warning:Updating uplinks can cause short network disconnect. It is strongly recommended performing network changes on a single node at the time after ma

Hi there.  I’m trying to plan an upgrade on our nutanix clusters from VMWare 6.5 to either 6.7 or 7.0 and I’m having a bit of a struggle figuring out the compatibility of the different VMWare versions along with our Nutanix clusters. We have two Nutanix clusters, our main site is a 7-node cluster with 5 Gen5 nodes and 2 Gen7 nodes.  Our remote data center is a 6 node cluster with all Gen 6 hardware.Our main site is running AOS 5.10.5 LTS and our remote datacenter was just recently upgraded to 5.15.2 LTS in preparation for the vmware upgrade.  I plan on upgrading our main site to the same AOS version of 5.15.2 LTS.Where I have an issue is that when running the VMWare Assessment Tool (VSAT) I keep seeing notifications on each cluster that certain nodes may not be compatible with VMWare 6.7 or 7.0 because of various devices that “May not be supported” yet say things like “is certified but current driver (ixgbe) is not supported”.  In some cases the same exact nodes in the same cluster wit

Hello All,I have recently deployed Prism Central and I am trying to give team members access via their AD accounts. I have went through the roles and discovered I cannot add new members to the predefined roles; however, if I duplicate the roles I can add AD users and groups to the new roles. This works for me however when I duplicate a role such as the “Super Admin” role I am warned that not all permissions are going to apply to the new role and I would need to create the new role via CLI to get these permissions. Ok fine that makes some sense. But where is the documentation on how to do that? Can someone point me to the documentation to perform these role creation tasks via CLI?Thanks, Scott 

Hi all,Running AOS 5.10.5, i have changed my cluster from RF2 to RF3, including my main container and the “SelfServiceContainer”,however a week after the change I’m still seeing this error regarding extent groups,I believe that this is due to NutanixManagementShare still being RF2 (with no ability to change it, since its a systemmanaged container), or is there some other reason?

Hi ! Everyone,Does anyone know that Nutanix G7 Model has two built-in M.2 SSDs,is it possible to do Raid 1?How to do it? Thanks

Many users are unaware that there are additional (beyond what is displayed through the Prism web user-interface) configurable security-related options which can be used to increase the security settings of the controller VMs (CVMs) themselves. These options are modified using the Nutanix Command Line Interface (nCLI) of the CVMs and include some of the following items: Enablement of an Advanced Intrusion Detection Environment (AIDE) Enforcement of a strong password policy Enablement of a defense knowledge consent banner Restriction to allow only SNMP version 3 You can find more information regarding these options, including the procedures to enable/disable them, within the Hardening Controller VM section of the AOS Security Guide. Also to note, there are similar options available for Acropolis Hypervisor (AHV) hosts which are configured using the same procedures. You can find more information regarding those options within the Hardening AHV section of this same guide.

Hi there!I’ve installed NutanixCE (twice!) on my existing hardware (custom SuperMicro servers, not Nutanix hardware, though they meet the required specs).  We found it useful, and decided to spring for Ultimate Licenses for the non-Community Edition.So I’ve got those licenses, but now I’m having a heck of a time figuring out what to download and install!  For CE, there was a nice procedure to create an install image on a thumb drive, but I’m not seeing the same thing for non-CE.Can anyone point me to documentation that spells out what needs to be downloaded and how to install it?I’ve already found the AHV admin guide, but that doesn't have installation instructions.I’ve found the “Field Installation Guide - Foundation 4.5.x”, but the “https://portal.nutanix.com/#/page/docs/details?targetId=Field-Installation-Guide-v4_5:Prepare%20Bare-Metal%20Nodes%20for%20Imaging” section seems impossibly complicated; do I really need to install and configure a VM on virtual box on a laptop in order to

https://next.nutanix.com/how-it-works-22/network-segmentation-basics-38414It seems the network segmentation 2.1 doesn’t support the isolation physically between the backplane and management. So, it tries to isolate logically following this procedure.ISOLATING THE BACKPLANE TRAFFIC LOGICALLY ON AN EXISTING CLUSTER (VLAN-BASED SEGMENTATION ONLY)https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v5_15:wc-network-segment-on-existing-cluster-wc-t.htmlAOS5.15.1 / ESXi 6.7u3 Standard vSwitch, vSwitch0 Port Gourp: Backplane Network, CVM Backplane Network (for CVM)it doesn’t recognize any port groups.The procedure doesn’t mention about the vSwitch0 or port group condition. Is there any information of this?Thx,

Are there plans to validate a version of VMware’s ESXi hypervisor that addresses recent vulnerabilities outlined here; https://www.vmware.com/security/advisories/VMSA-2020-0023.html The proposed version to address this threat is ESXi670-202010401-SG for existing 6.5 hosts or ESXi675-202010401-SG for existing 6.7 hosts. It appears that the latest json version for download from My Nutanix is 6.7.0 U3 - which is slightly older than the version being proposed to resolve the vulnerability. Thanks!

We have a couple of 2 node cluster with a Witness VM on a separate host but I can not seem to find any documentation on how to enable SNMP on it.Using the “ncli snmp add-user” command that works for normal CVM’s just throw me the error:“Error: Cannot connect to Prism Gateway”Any ideas?

Hi All I have something odd in my Network view in Prism - I have 3 switches ( 1 switch is a 2 switch stack) but the view shows 5 switches, 2 classified as None. The None entries have the ip addresses of one of the single recognised switches and the stack which is already identified. The other odd thing is that the Nones have ports that I would expect to see in the identified switches. Can anyone tell me how to correct this?

Cluster creation or initialization is a process of bootstrapping the cluster by configuring the unconfigured nodes,  load some node information into Zeus configuration file and start the services.  Let's break it down.  What is an Unconfigured node? Node which are factory shipped. Node which was removed from an existing cluster. These nodes are typically Pre-installed with CVM/HypervisorNO IPv4 address is configured But IPv6 link local address configured on eth0. This will always remain on a host. Before you begin to create a cluster with your brand-new nodes,You Must Have  IPv4 Address configuration IPMI IP address Hypervisor IP address CVM IP address DNS/NTP IP address (Required while creating cluster via foundation) Hypervisor and CVM should be installed.   What are the methods of Cluster initialization? Foundation:  One click process for  cluster creation Re-Images multiple nodes  Assigns IP address on each node Manual Manual Hypervisor inst

We have a very long domain name and with the current config we are using the UPN (name@company.com) name to login. This is becoming very irritating for me to enter the domain name each time I login. Can we configure a default domain for all the login users to use if the user didn’t mention any domain and of course if we don’t have local user by the same name? 

I see that ERA 2.0 has a prerequisite of SQL Server SQLPS PowerShell module. Does anyone know what specific version is required? I ask because when trying to register a single node, I receive the following error:Operation Failed : Unable to import SQLPS module. Please make sure that SQLPS module is available to proceed with Dbserver VM registration.I suspect that the version of SQLPS PowerShell module that we have installed on our SQL servers is too new. 

We have added Dell Switches to see the Interface information and where our AHV hosts are connected through Network Tab.But, I am able to see Interface only on One Switch for one host, not on others. I see below. Is there anything we are missing.  

As companies become more security aware, third party security tools are being utilized more heavily than ever before. One such tool is a security scanner which can review open network ports within an environment and report back on certain vulnerabilities (CVEs). This includes the open ports of Nutanix specific components such as the IPMI.While it is important to keep the IPMI/BMC upgraded to the latest version so as to integrate the latest security patches, there are CVEs that will still report as failed by scanners based upon the default IPMI configuration. This is due to the virtual media port (623) and the iKVM port (5900) being opened by default.The virtual media port allows the user to open a remote session to the host console and the iKVM port allows the hosts to query information from the BMC.The specific CVEs affected by these two ports being open can be found in KB 2555. NOTE: If these features are disabled, you will be unable to query any BMC info nor able to open a remote co

Please consider the possibility of incorporating the existing IP scheme in the new infrastructure. If changing the IP address is the only option we can utilize a script to change the CVM IP address. You can use the external IP address reconfiguration script in the following scenarios: Change the IP addresses of the CVMs in the same subnet. Change the IP addresses of the CVMs to a new or different subnet.In this scenario, the external IP address reconfiguration script works successfully if the new subnet is configured with the required switches and the CVMs can communicate with each other in the new subnet. Change the IP addresses of the CVMs to a new or different subnet if you are moving the cluster to a new physical location.In this scenario, the external IP address reconfiguration script works successfully if the CVMs can still communicate with each other in the old subnet.  Following is the summary of steps that you must perform to change the IP addresses on a Nutanix cluster. 

We have a 15 block HPE environment built with AOS 5.15.2. we need to enable flash mode on a NVMe device (vmdk) which is presented within vSphere but cannot be seen via prism element under the VM vDisks or via ssh shell to cvm’s is this feature not currently supported? any ideas I am struggling to find much on the support portal?still unsure on this how do we pin the NVMe vmdk to the performance tier  cheers

Hello,i have some questions regarding “Switch stacking”1-) Is it possible to use " 2 stacked switches " as TOR with AHV? there will be a problem if we use this configuration?2-) The best practice is to use 2 Stacked switches or 2 individual switches?We plan to use Active-Backup configuration and conect SFP to Switch1 and the other SFP to Switch2I am not a network specialist so i am not sure if both switches are stacked, and we plug 1 SFP to SW1 and the other SFP to SW2, the active passive configuration will work

The upgrade process for the VCSA from a major release to another is as follows:A new VCSA with a temp IP is created in the vSphere host/cluster by the upgrade process. The upgrade process migrates the config/data from the old VCSA to the new one. The Old VCSA is shutdown and the new VCSA is renamed/re-ip with the values of the old VCSA. New VCSA is then rebooted.At this point the new VCSA should have the old VCSA name and IP address.  My question for those that have done this already is, how does the Nutanix cluster Prism element reacts to this in regards to its vcenter registration? Will all this be transparent to it or will it see the new VCSA as a new device and create a duplicate entry? I assume the migration process will copy SSH keys and certs from the old VCSA to the new one so Prism won’t bat an eye, but I just wanted to confirm. 

Hello ... can anyone provide feedback on getting Network Visualization working with Cisco Nexus 9K Switches. The Nexus Series is on the Supported Switch list, but I've had a ticket open with Support for weeks and we can't get it working. https://portal.nutanix.com/#/page/docs/details?targetId=Web-Console-Guide-Prism-v510:wc-network-visualizer-supported-switches-r.html LLDP is enabled globally on the 9K, and I can populate the 9K switch info into Prism just fine. The issue is I can't get any port data. Nutanix Support is saying the issue is by default the "port-id-subtype" is set "locally-assigned", and it needs to be changed to "interface-name". The 9Ks are in ACI-Mode, not NX-OS, and no one seems to know how or where the change is made. Has anyone gotten this setup to work? Here are some pics from my environment. Thanks!

A traditional Nutanix cluster requires a minimum of three nodes, but Nutanix also offers the option of a one-node or two-node cluster for ROBO implementation. Both of these have a minimum requirement for the CVM to be allocated with 6 vCPUs and 20 GB memory.Specifically for two-node, there have been several improvements in 5.10 to ensure optimal health of the cluster.Customers should upgrade to a minimum version of AOS 5.10.7 to avoid encountering any of the potential service impacting issues present in earlier releases of AOS.The table provides a summary of improvements in the document here-https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e0000009DaXCAUMore information about two node cluster can be found out -https://portal.nutanix.com/page/documents/details?targetId=Web-Console-Guide-Prism-v5_18:wc-cluster-two-node-c.htmlROBO implementation meaning - Short for remote office, branch office ROBO is a term used to refer to any off-site office that connects to the organ