Traditional data centers use firewalls to implement security checks at the perimeter—the
points at which traffic enters and leaves the data center network. Such perimeter firewalls
are effective at protecting the network from external threats. However, they offer no
protection against threats that originate from within the data center and spread laterally,
from one compromised machine to another.
The problem is compounded by virtualized workloads changing their network configurations and
hosts as they start, stop, and migrate frequently. For example, IP addresses and MAC addresses
can change as applications are shut down on one host and started on another. Manual
enforcement of security policies through traditional firewalls, which rely on network
configurations to inspect traffic, cannot keep up with these frequent changes and are
error-prone.
Network-centric security policies also require the involvement of network security teams that have intimate knowledge of network configuration in terms of VLANs, subnets, and other network entities.
Nutanix Flow includes a policy-driven security framework that inspects traffic within the
data center. The framework works as follows:
Security policies inspect traffic that originates and terminates within a data center and
help eliminate the need for additional firewalls within the data center.
The framework uses a workload-centric approach instead of a network-centric approach.
Therefore, it can scrutinize traffic to and from VMs no matter how their network
configurations change and where they reside in the data center. The workload-centric,
network-agnostic approach also enables the virtualization team to implement these security
policies without having to rely on network security teams.
Security policies are applied to categories (a logical grouping of VMs) and not to the VMs
themselves. Therefore, it does not matter how many VMs are started up in a given category.
Traffic associated with the VMs in a category is secured without administrative
intervention, at any scale.
Prism Central offers a visualization-based approach to configuring policies and monitoring
the traffic to which a given policy applies.
Using Prism Central, you can configure syslog monitoring by forwarding Flow logs to an external syslog server. See Configuring Syslog Monitoring in the
Prism Central Guide
for details.
Note:
Nutanix Flow supports only AHV hypervisor; security policies can not be applied to VMs running on other hypervisors.
Types of Policies
The types of policies in Prism Central and their use cases are described
here.
Table 1.
Types of Policies
Policy Type
Use Case
Application Security Policy
Use an application security policy when you want to secure an application by
specifying allowed traffic sources and destinations. This method of securing an
application is typically called
application ring fencing
.
For example,
use an application security policy when you want to allow only those VMs in the
categories
department: engineering
and
department:
customersupport
(the allowed sources) to communicate with an issue
tracking tool in the category
AppType: IssueTracker
(the secured
application), and you want the issue tracking tool to be able to send traffic only
to an integrated customer relationship management application in the category
AppType: CRM
.
The secured application itself can be divided
into tiers by the use of categories (the built-in AppTier category). For example,
you can divide the issue tracking tool into web, application, and database tiers and
configure tier-to-tier rules.
For more information, see Application Security Policy Configuration.
Isolation Environment Policy
Use an isolation environment policy when you want to block all traffic,
regardless of direction, between two groups of VMs identified by their category. VMs
within a group can communicate with each other.
For example, use an isolation
environment policy when you want to block all traffic between VMs in the category
Environment: sandbox
and VMs in the category
Environment:
production
, and you want to allow all the VMs within each of those
categories to communicate with each other.
For more information, see Isolation Environment Policy Configuration.
Quarantine Policy
Use a quarantine policy when you want to isolate a compromised or infected VM and
optionally want to subject it to forensics.
For more information, see Quarantine Policy Configuration.
VDI Policy
Use a VDI policy when you want to secure your VDI environment.
For more information, see VDI Policy Configuration
Security Policy Model
Application-centricity
The security policy model uses an application-centric policy language instead of the more
complex, traditional network-centric policy language. Configuring an application security
policy involves specifying which VMs belong to the application you want to protect and then
identifying the entities or networks, in the inbound and outbound directions, with which you
want to allow communication.
All the entities in an application security policy are identified by the categories to
which they belong and not by their IP address, VLAN, or other network attributes. After a VM
is associated with a category and the category is specified in a security policy, traffic
associated with the VM is monitored even if it migrates to another network or changes its IP
address.
The default options for allowing traffic on the inbound and outbound directions are also
inherently application centric. For application security policies, the default option for
inbound traffic is
Allowed List
, which means that
Allowed
List
is usually the recommended option for inbound traffic. The default
option can be changed to
Allow All
traffic. The default option in the
outbound direction allows the application to send traffic to all destinations, but you can
configure a destination
Allowed List
if desired.
For forensic quarantine policies, the default option in both directions is
Allowed List
, but you can
Allow All
traffic
in both directions. For strict quarantine policies, no traffic is allowed in either
direction.
All the VMs within a category can communicate with each other. For example, in a tiered
application, regardless of how you configure tier-to-tier rules, the VMs within a given tier
can communicate with each other.
Whitelist-Based Policy Expression
An application security policy is expressed in terms of the categories and subnets with
which you want the application to communicate and therefore, by extension, the traffic you
want to allow. A more granular policy expression can be achieved by specifying which
protocols and ports can be used for communication.
Any category or subnet that is not in the allowed list is blocked. You cannot specify the
categories and subnets you want to block because the number of such entities are typically
much larger and grow at a much higher rate than the categories and subnets with which an
application should be allowed to communicate. Expressing a policy in terms of allowed
traffic results in a smaller, tighter policy configuration that can be modified, monitored,
and controlled more easily.
Enforcement Modes
All policies, whether associated with securing an application, isolating environments, or
quarantining VMs, can be run in the following modes:
Monitor Mode
Allows all traffic, including traffic that is not allowed by the policy. This mode
enables you to visualize both allowed and disallowed traffic and fine-tune the policy
before applying it.
Enforce Mode
Blocks all traffic that is not allowed by the policy.
You can switch a policy between these two modes as many times as you want.
Automated Enforcement
A policy uses categories to identify the VMs to which it must apply. This model allows the
automatic enforcement of a policy to VMs regardless of their number and network attributes.
Connectivity between Prism Central and a registered AHV cluster is required only when
creating and modifying policies, or when changing the mode of operation (applied or
monitoring) of a policy. Policies are applied to the VMs in a cluster even if the cluster
temporarily loses network connectivity with the Prism Central instance with which it is
registered. New policies and changes are applied to the cluster when connectivity is
restored.
Priorities Between Policies
Prism Central does not provide a way for you to specify priorities between policies of a
single type. For example, you cannot prioritize one security policy over another. There is
no limit to the number of inbound and outbound rules that you can add to a security policy,
allowing you to define all of an application's security requirements in a single policy.
This makes priorities between policies unnecessary.
However, priorities exist between the different policy types. Quarantine policies have the highest priority followed by isolation environment policies, and application security policies, in that order. The VDI Policy takes the last precedence, for example, if an application security is protecting a VM, it cannot simultaneously be protected with the VDI policy.
Isolation environment rules take precedence over application security rules, so make sure
that isolation environment policies and application security policies are not in conflict.
An isolation environment rule and an application security rule are said to be in conflict if
they apply to the same traffic (a scenario that is encountered when VMs in one of the
categories in the isolation environment send traffic to an application in the other
category, and some or all of that traffic is either allowed or disallowed by the application
security policy). The effect that an isolation environment policy has on a conflicting
application security policy depends on the mode in which the isolation environment policy is
deployed, and is as follows:
If the isolation environment policy is in the applied mode, it blocks all traffic to the
application, including the traffic that is allowed by the application security
policy.
If the isolation environment policy is in the monitoring mode, it allows all traffic to
the application, including any traffic that is disallowed by the application security
policy.
Requirements
The Security Policies feature has the following requirements:
The feature is supported only on AHV clusters running AOS 5.6 or later and AHV version
20170830.115 or later.
The Prism Central instance must be hosted on one of the AHV clusters registered with it.
The AHV cluster that hosts the Prism Central instance must be running AOS 5.6 or
later.
The host must have at least 1 GB of additional memory for each Prism Central VM hosted
on it.
If you are running a Prism Central scale-out instance, all the VMs in the Prism Central
cluster must be powered on.
The AHV hosts must be allowed to communicate with the Prism Central VMs over TCP port
9446. Keeping the port open enables the hosts to send the Prism Central VMs connection
tracking data. Prism Central uses that data to show network flows.
Flow supports only TCP, UDP, or ICMP traffic.
Caution:
When Flow is enabled, a Kafka container is automatically created on the cluster where
Prism Central is hosted. The container is used to store data that is required for flow
visualization to work and must not be deleted.
Cross cluster live migration of guest VMs that are part of Flow security policy is not
supported.
Security Policies are not supported for VMs that are on the advanced networking stack.
An alert is raised for VMs that are part of both VPC and Flow policy, and Flow policies
are not enforced for VMs on VPCs.
Overlapping or conflicting policy configuration is not supported and might cause
unintended interruption of network services.
Enabling Microsegmentation
Microsegmentation is disabled by default. Before you can configure and use
application security policies, isolation environment policies, and quarantine policies, you
must enable the feature. The feature requires a Flow license. If you have not installed a
Flow license, you can try the feature for a period of 60 days. After this period expires,
you will be required to install the license to continue using the feature.
About this task
To enable microsegmentation, do the following:
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and
then select
Prism Central Settings
to display the
Settings page.
Click
Microsegmentation
from the Settings menu (on the
left).
The
Enable Microsegmentation
dialog box is
displayed.
To determine whether the registered clusters are capable of supporting
microsegmentation, do the following:
Click
View Cluster Capability
, and then review
the results of the capability checks that Prism Central performed on the
registered clusters.
Click
Back
.
Select the
Enable Microsegmentation
check box.
Click
OK
.
Disabling Microsegmentation
Prism Central web console provides you the ability to disable the microsegmentation
feature.
About this task
To disable microsegmentation, do the following:
Procedure
Log on to the Prism Central web console.
Click the gear icon in the main menu and then select
Microsegmentation
in the
Settings
page.
Figure.
Settings Page - Disabling Microsegmentation
Click to enlarge
Click
Disable Microsegmentation
.
A confirmation message appears.
Figure.
Microsegmentation - Confirmation message
Click to enlarge
Click
Disable
to confirm disabling the microsegmentation
feature.
Built-In Categories for Security Policies
Prism Central includes built-in categories that you can use in application security
policies and isolation policies. It also includes a built-in category for quarantining VMs.
Table 1.
Built-In Categories
Category
Description
AppTier
Add values for the tiers in your application (such as web, application_logic, and
database) to this category and use the values to divide the application into tiers
when configuring a security policy.
AppType
Associate the VMs in your application with the appropriate built-in application
type such as Exchange and Apache_Spark. You can also update the category to add values
for applications not listed in this category.
Environment
Add values for environments that you want to isolate from each other and then
associate VMs with the values.
Quarantine
Add a VM to this category when you want to quarantine the VM. You cannot modify
this category. The category has the following values:
Strict
Use this value when you want to block all inbound and outbound traffic.
Forensic
Use this value when you want to block all inbound and outbound traffic except
the traffic to and from categories that contain forensic tools.
ADGroup
This category is managed by ID Based Security (ID Firewall). Each ADGroup value represents an imported group from Active Directory. To add or remove values to use in Flow policies use the
ID Based Security
configuration page (
Prism Central Settings
>
Flow
>
ID Based Security
). The category values may be used in VDI policies, see
VDI Policy Configuration for details.
ADGroup:Default
This category is applied to the VDI VMs of the AD group when the VM inclusion criteria is set and allows you to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Service
Service is a group of protocol-port combination. You can use any of the default services or create a custom service. The ability to use the service entities in the policy creation workflow reduces any manual configuration error and enables reusability of available entities.
To create or update a custom service, see Creating a Service.
To view the list of available services (built-in and custom services), go to
Policies
>
Security
>
Services
.
Creating a Service
About this task
To create a custom service, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
>
Services
.
Click
Create Service
.
Figure.
Create Service Tab
Click to enlarge
Enter a name and description for the service.
Select the
Protocol
from the drop-down menu and enter the port number or port range in the
Port
field.
You can add multiple protocol-port combinations in a single service. To add more protocol-port combination, click
Add Row
and specify the required values.
Click
Save
to save the service.
Address
Address is a way to group one or many IP addresses or ranges. You can create an address entity and use that address entity while creating policies. The ability to use the addresses in the policy creation workflow reduces any manual configuration error and enables reusability of available entities.
To create or update an Address, see Creating an Address.
To view the list of available services (built-in and custom services), go to
Policies
>
Security
>
Address
.
Creating an Address
About this task
To create an Address, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
>
Addresses
.
Click
Create Address
.
Figure.
Create Address Tab
Click to enlarge
Enter a name and description for the address.
Enter the IP address or a IP range in the
Subnet
field.
You can add multiple subnets in a single address entity. To add more subnets, click
Add Row
and specify the required values.
Click
Save
to save the service.
Application Security Policy Configuration
Creating an Application Security Policy
Before you begin
Create the categories you need and associate the VMs that you want to protect
with those categories. You might be required to create categories for the
following purposes. Some categories or category values are required while others
are optional:
Every security policy must be associated with a value in the AppType
category, so make sure that you update the AppType category with
appropriate values if the built-in values do not work for you. For
information about this category and its values, see Category Management in the
Prism Central Guide
.
If you need to apply the policy to an application in a specific
environment (for example, development, test, or production) or an
application at a specific location, create the category you need and
apply it to the application. Prism Central includes a built-in
Environment category that you can use or update with values of your own.
You can also create your own categories.
If you want to specify categories for traffic sources and destinations
instead of allowing all inbound and outbound traffic, create those
categories and apply them to the traffic sources and destinations.
If you want to divide the application into tiers in a security policy,
add tiers to the AppTier category. The AppTier category has a built-in
default
value, but you can update the category to
add values of your choice.
For information about categories and their values, see Category Management in the
Prism Central Guide
.
Security policy configuration might require more time than the default session
timeout allows you. You might want to increase the session timeout so that you
do not lose a configuration that is left unattended while you perform associated
tasks such as referring to this documentation. For more information, see Modifying UI Settings in the
Prism Web Console Guide
.
About this task
To secure an application, do the following:
Procedure
In the
Security Policies
dashboard, click
Create Security Policy
, and then click
Secure an Application
.
The
Create App Security Policy
page is
displayed.
On the
Define Policy
tab, do the following in the
indicated fields, and then click
Next
:
Figure.
Define Policy Tab
Click to enlarge
Name
: Enter a name for the security
policy.
Purpose
: Describe the purpose of the security
policy.
Secure This App
: Select the type of application
that you want to secure.
The
Secure This App
list displays available
values in the AppType category. It uses the format
AppType
:
value
, where value represents a type of
application. Every application that you want Prism Central to secure
must be associated with a value from the built-in AppType category. The
AppType category includes values for frequently encountered
applications, such as Exchange and Hadoop. The AppType category also
includes a built-in
default
value that you can use if
your application cannot be associated with one of the other built-in
values. You can also update the
AppType
category to add
a value of your choice. For information about categories and their
values, see
Category Management
.
If you want to filter the VMs by an additional category, select
Filter the app type by category
, and then
enter the name of the category in the text box that is displayed.
This option enables you to apply the policy to an additional category.
For example, if you are configuring a policy for an application in the
category
AppType: Exchange
, this option enables you to
further restrict the policy to specific locations (such as
Location: US
and
Location: EU
) or
environments (such as
Environment: Production
,
Environment: Development
, and
Environment:
Test
).
Optionally, in the
Advanced Configuration
section, select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Note:
If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
Optionally, click the toggle button against
Policy Hit Logs
to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring
in the
Prism Central Guide
.
Note:
Policy hit logs are not
generated if both source and destination are in inbound or outbound
category.
In the
Securing an App
dialog box, review the schematic
that illustrates the flow of traffic through a secured app, and then click
OK, Got it!
The
Secure Application
tab is displayed. The
schematic on this tab can be divided into three areas of configuration: the
Inbound
side, (for adding traffic source allowlist),
the application at the center (for configuring inbound, outbound, and
tier-to-tier rules), and the
Outbound
side (for adding
traffic destination allowlist).
Figure.
Secure Application Tab
Click to enlarge
On the
Secure Application
tab, do the following, and
then click
Next
:
On the application at the center of the tab, do the following in the
indicated fields:
If you want to divide the application into tiers (such as a web
tier, an application tier, and a database tier) and configure
tier-to-tier rules, first configure the application as described
in this step, and then configure inbound and outbound rules.
This approach ensures that the individual tiers are available
when you want to configure inbound and outbound rules at the
tier level. Skip this step if you want to treat the application
as a single entity in the security policy.
To divide your
application into tiers and create tier-to-tier rules, do the
following:
On the application, click
Set Rules on App
Tiers, Instead
.
Note:
After you click
Set Rules on App Tiers,
Instead
, the link text,
Set
rules on the whole app, instead
, is
displayed in its place. Click
Set rules
on the whole app, instead
if you want
to discard the tiered configuration and return to
configuring rules on the application as a
whole.
Click
Add Tier
, and then select a
tier.
Repeat this step to add as many tiers as you
require. The following figure shows an application
with a web tier, an application tier, and a database
tier:
Figure.
Tiered Application
Click to enlarge
To delete a tier, pause over the tier you want to delete
and click the delete button that is displayed.
Click
Set Rules Within
App
.
Note:
When configuring tier-to-tier
rules, two modes are made available to you through
the buttons
Set Rules to & from
App
and
Set Rules Within
App
. The
Set Rules to &
from App
option enables you to add
application tiers and to specify allowed inbound and
outbound traffic. The
Set Rules Within
App
option enables you to specify
tier-to-tier rules within the application. These
buttons enable you to switch between the two
modes.
Click each tier in the application and click
Yes
or
No
to specify whether or not
you want to allow the VMs in the tier to communicate
with each other.
Configure a tier-to-tier rule as follows:
Click the source tier (for example, if the tiers
are WebTier and AppTier and you want to configure
a tier-to-tier rule from WebTier to AppTier, click
the source tier, WebTier).
Click the plus sign that is displayed on the destination tier (in this example, click the destination tier, AppTier). The
Create Tier to Tier Rule
dialog box
Enter a description for the rule.
Note:
The policy rule description is captured in the policy hitlog data.
Policy hitlog must be enabled
Rule description is added to the hitlog only for allowed traffic
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
Configure tier-to-tier rules for as many source
and destination tiers as you want.
To add traffic sources, on the
Inbound
side of
the
Secure Application
tab, do the
following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic from
all sources.
Whitelist Only
: Allows traffic
only if the traffic originates from entities on the
security policy's source allowlist. This option is the
default option. If this option is selected, you must
also configure the source allowlist by clicking
Add Source
.
Click
Add Source
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
only if that traffic originates from entities that
are in the selected category.
Subnet/IP
: Allows traffic
only if that traffic originates from entities that
are in the selected subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Source
. Add as many categories or
subnets as you want to allow.
Each entry in this list represents a stream of inbound
traffic.
To add traffic destinations, on the
Outbound
side, do the following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic to all
destinations. This option is the default option.
Whitelist Only
: Allows traffic
only if the traffic is destined for entities on the
security policy's destination allowlist. If this option
is selected, you must also configure the destination
allowlist by clicking
Add
Destination
.
Click
Add Destination
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
only if that traffic is destined for entities in
the selected category.
Subnet/IP
: Allows traffic only if that traffic is destined for entities in the selected subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Destination
. Add as many categories or
subnets as you want to allow.
Each entry in this list represents a stream of outbound
traffic.
To specify the protocols that you want to allow from each stream
of inbound and outbound traffic, do the following:
If you added application tiers and configured
tier-to-tier rules, first click
Set Rules to
& from App
.
Click the traffic source or traffic destination (a
category or subnet if you have configured a allowlist or
All Sources
if you have
chosen to allow all sources) for which you want to
create a rule.
Click the plus icon that appears on the application (if you are treating the application as a single entity) or application tier (if you have divided the application into tiers). The
Create Inbound Rule
or
Create Outbound Rule
dialog box appears.
Enter a description for the rule.
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
After you configure a rule, a dotted line appears between the two endpoints of
the rule. Point to the dotted line to show the list of ports that the rule
allows.
On the
Review
tab, review the security policy
configuration, and then do one of the following:
If you want to apply the configuration, click
Apply
Now
.
Applying a security policy enforces the security
policy on the application, and traffic from entities that are not
defined as sources in the policy is blocked.
If you want to save the configuration and monitor how the security
policy works, click
Save and Monitor
.
When a
policy is in the monitoring state, the application continues to
receive all traffic, but disallowed traffic is highlighted on the
monitoring page. Traffic is not blocked until the policy is
enforced.
Note:
A policy that you have chosen to save and monitor
can be applied from the policy update page.
Modifying an Application Security Policy
About this task
To modify a security policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Application Security Policy.
Applying an Application Security Policy
Applying a security policy enforces the security policy on the application, and any
traffic from sources that are not allowed is blocked.
About this task
To apply a security policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then
click
OK
.
Monitoring an Application Security Policy (Visualizing Network Flows)
About this task
When a policy is in the monitoring state, the application continues to receive all
traffic, but disallowed traffic is highlighted on the monitoring page. Traffic is not
blocked until the policy is applied.
To monitor a security policy, do the
following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then
click
OK
.
Allowed network flows and disallowed network flows are shown on the
monitoring page, as shown in the following figure. Allowed flows are depicted
with a blue dotted line and disallowed network flows are depicted with a red
dotted line:
Figure.
Monitoring Page for an Application Security Policy
Click to enlarge
To show a preview of the network flow in a tooltip, pause over the dotted line
that depicts the network flow in the diagram.
A tooltip similar to the following is displayed. The tooltip shows a
graph for each connection:
Figure.
Tooltip Showing a Preview of the Network Flow
Click to enlarge
To see a graph of a network flow, click the dotted line that depicts the
network flow in the visualization.
A more detailed graph of the network flows is displayed, as shown in the
following figure:
Figure.
Network Flows Graph
Click to enlarge
To block unwanted flows, click
Update
, and then update
the policy. For information about updating an application security policy, see
Modifying an Application Security Policy.
To apply the policy, click
Apply
.
Applying a policy enforces the policy and traffic from sources that are
not allowed is blocked.
Deleting an Application Security Policy
About this task
To delete an application security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to delete.
You can select multiple policies and delete them all at once.
Click
Delete
in the
Actions
menu.
Isolation Environment Policy Configuration
An isolation environment identifies two groups of VMs by category, and it blocks
communications between the groups.
You can also specify an additional category to restrict the scope of the isolation
environment to that category.
For example, consider that you have an
application
category with values
app1
and
app2
and that you have associated some VMs with
application: app1
and some VMs with
application: app2
.
Also, consider that these same VMs are distributed between two sites, and have accordingly
been associated with values site1 and site2 in a category named location (
location:
site1
and
location: site2
).
In this example, you might want to block communications between the VMs in the two locations.
Additionally, you might want to restrict the scope of the policy to VMs in category
application: app1
. In other words,
app1
VMs in
site1
cannot communicate with
app1
VMs in
site2
. The following diagram illustrates the desired outcome. The red
connectors illustrate blocked traffic. The green connectors illustrate allowed traffic.
Figure.
Applications Across Sites
Click to enlarge
You can configure an isolation policy for this by creating the following categories and
isolation policy in Prism Central:
Table 1.
Sample Configurations For Categories and the Isolation Policy
Entity
Values
Categories
Name
:
application
Values
:
app1
and
app2
Name
:
location
Values
:
site1
and
site2
Isolation Policy
Name
:
eng_isolation_policy_across_sites
Description
: Isolate engineering VMs across sites
Isolate This Category
:
location:
site1
From This Category
:
location: site2
Apply the isolation only within a subset of the data
center
:
application: app1
Layer 2 Isolation
Flow supports Layer 2 isolation to enable filtering of the layer 2 packets across all isolated entities. When an isolation policy is applied between two category-based VM groups, all ingress and egress traffic (broadcast, unknown-unicast, and multicast traffic) is dropped at the destination VM group.
Note:
If VMs are part of both isolation policy and quarantine policy, the quarantine policy takes priority of processing over the isolation policy. For example, if VMs with category app1 are isolated from VMs with category app2 using an isolation policy, the traffic between these VM groups are not dropped if the VM groups are also part of a quarantine forensic policy that allows communication between these VMs. In this case, since the quarantine forensics policy matches the VMs, and this policy allows the traffic, the isolation policy is not enforced.
IPv6 traffic between isolated VMs is blocked by default with the introduction of layer 2 isolation.
Creating an Isolation Environment Policy
An isolation environment policy identifies two groups of VMs and blocks
communications between the groups. The two groups are identified by category. You can
specify an additional category to restrict the scope of the policy to that
category.
About this task
To create an isolation environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), click
Create
Security Policy
, and then click
Isolate
Environments
.
The
Create Isolation Policy
page is displayed.
Figure.
Create Isolation Policy
Click to enlarge
Do the following in the indicated fields:
Name
: Enter a name for the isolation policy.
Purpose
: Describe the purpose of the isolation
policy.
Isolate this category
: Type the name of one of
the two categories that you want to isolate from each other.
Matching
names appear in a list as you type. You can click the name of the
category you want.
From this category
: Type the name of other
category.
Apply the isolation only within a subset of the data center
. If
you want to restrict the scope of the policy to a specific category of
VMs, select this check box, type the name of the category in the text
box, and select the category from the list of matches.
If you isolate
VMs in category
Environment: Production
from VMs in
category
Environment: Staging
, and you restrict the
scope of the policy to VMs in the category
Environment:
Dev
, Prism Central applies the isolation policy to the
following groups:
VMs that are in both
Environment: Production
and
Environment: Dev
VMs that are in both
Environment: Staging
and
Environment: Dev
.
IPv6 Traffic
. Optionally, in the
Advanced Configuration
section, select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Policy Hit Logs
. Optionally, click the toggle button against
Policy Hit
Logs
to log traffic flow hits on the policy rules. You
can configure syslog monitoring for the policy hit logs for Flow. For
details, see Configuring Syslog Monitoring
in the
Prism Central Guide
.
Note:
Policy hit logs are not
generated if both source and destination are in inbound or outbound
category.
Do one of the following:
Click
Apply Now
to apply the isolation
environment.
Click
Save and Monitor
to save the configuration
and place the isolation environment in the monitoring mode.
You can switch between the monitoring and applied states by selecting the
isolation environment on the
Security Policies
page and
clicking the appropriate option in the
Actions
menu.
Modifying an Isolation Environment Policy
About this task
To modify an isolation environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the isolation policy
that you want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For
information about the options, see Creating an Isolation Environment Policy.
Applying an Isolation Environment Policy
Applying an isolation environment policy enforces the policy on the specified
categories, and any traffic between the categories is blocked.
About this task
Note:
Changing the state of an isolation environment policy affects the functioning of
any conflicting application security policies. For more information, see Priorities Between Policies.
To apply an isolation environment policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then
click
OK
.
Monitoring an Isolation Environment Policy (Visualizing Network Flows)
About this task
The VMs in the two categories in an isolation environment policy are allowed to
communicate with each other when the policy is in the monitoring state. Traffic is
blocked only during the time the policy is applied.
Note:
Changing the state of an
isolation environment policy affects the functioning of any conflicting application
security policies. For more information, see Priorities Between Policies.
To monitor a security policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then
click
OK
.
The monitoring page shows the flows between the two
categories.
To view information about a particular network flow, pause over the flow.
A tooltip similar to the following is displayed:
Figure.
Monitoring Page for an Isolation Environment Policy
Click to enlarge
Deleting an Isolation Environment Policy
About this task
To delete an isolation environment policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to delete.
You can select multiple policies to delete them all at once.
Click
Delete
in the
Actions
menu.
Quarantine Policy Configuration
Prism Central includes a built-in quarantine policy that enables you to perform the following
tasks:
Completely isolate an infected VM that must not have any traffic associated with it.
Isolate an infected VM but specify a set of forensic tools that can communicate with the
VM.
For these use cases, Prism Central includes built-in categories that are included in the
built-in quarantine policy.
Prism Central also enables you to monitor the quarantine policy before applying it.
The quarantine policy cannot be deleted.
Configuring the Quarantine Policy
In the built-in quarantine policy, you specify categories that can communicate with
VMs that have been added to the
Quarantine: Forensics
category.
About this task
To configure the quarantine policy, do the following;
Procedure
In the
Security Policies
dashboard, select
Quarantine
, and then click
Update
in the
Actions
menu.
Optionally, in the
Advanced Configuration
under the
Define Policy
tab, do the following.
Select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default. You can configure the allow option for both
Forensic
and
Strict
modes.
Optionally, click the toggle button against
Policy Hit Logs
to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow, see Configuring Syslog Monitoring in the
Prism Central Guide
for details. You can enable the policy hit log option for both
Forensic
and
Strict
modes.
Note:
Policy hit logs are not generated if both source and destination are in inbound or outbound category.
On the
Add Forensic Tools
tab, do the following, and
then click
Next
:
To specify the categories that contain forensic tools, on the
Inbound
and
Outbound
sides of the policy diagram, do the following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic
associated with all sources or destinations.
Whitelist Only
: Allows traffic
only if the traffic is associated with the categories
and subnets on the allowlist. This option is the default
option. If this option is selected, you must also
configure the allowlist by clicking
Add
Source
or
Add
Destination
.
Click
Add Source
or
Add
Destination
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
to or from the specified category.
Subnet/IP
: Allows traffic
to or from the specified subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Source
or
Add
Destination
. Add as many categories or
subnets as you want to allow.
To specify the protocols and ports over which the forensic tools can
communicate with the VMs in the forensic category, do the
following:
On the
Inbound
and
Outbound
sides of the policy
diagram, click a category or subnet (if you have
configured a allowlist) or
All
Sources
(if you have chosen to allow all
sources) for which you want to create a rule.
Click the plus icon that appears on the
Quarantine: Forensic
category. The
Create Inbound Rule
or
Create Outbound Rule
dialog box
Enter a description for the rule.
Note:
The policy rule description is captured in the policy hitlog data.
Policy hitlog must be enabled
Rule description is added to the hitlog only for allowed traffic
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
After you configure a rule, a dotted line appears between the two endpoints of
the rule. Point to the dotted line to show the list of ports that the rule
allows.
On the
Review
tab, do one of the following:
Click
Apply Now
to apply the quarantine
policy.
Click
Save and Monitor
to save the configuration
and place the quarantine policy in the monitoring mode.
You can switch between the monitoring and applied states by selecting
Quarantine
on the
Security
Policies
page and clicking the appropriate option in the
Actions
menu.
Quarantining a VM
You quarantine a VM by adding the VM to a quarantine category.
About this task
To add an infected VM to a quarantine category, do the following:
Procedure
In the VMs dashboard
List
tab (see VMs Summary View in the
Prism Central Guide
), select the infected VM,
click
Actions
, and then click
Quarantine
VMs
.
Under Quarantine Method, click one of the following options:
Strict.
Isolates the VM from all traffic. No
exceptions can be made for forensics.
Forensic.
Isolates the VM from all traffic except
traffic from categories specified in the built-in quarantine policy. The
allowed categories contain forensic tools that enable you to perform
forensics on the VM.
For VMs added to the strict quarantine, a red icon is displayed in the
name column.
Click
Quarantine
.
Removing a VM from the Quarantine
About this task
To remove a VM from the quarantine, do the following:
Procedure
In the VMs dashboard
List
tab (see VMs Summary View in the
Prism Central Guide
), select the VM that you want
to remove from the quarantine, click
Actions
, and then
click
Unquarantine VMs
.
You can select multiple VMs and remove them from the quarantine in a single
step.
In the
Unquarantine VMs
dialog box, click
Unquarantine
.
VDI Policy Configuration
The
VDI Policy
is based on identity-based categorization of the VDI VMs using Active Directory group membership. Configuring VDI policy includes adding an Active Directory domain that is used for the ID firewall (
ID Based Security
) and configuring a service account for the domain.
ID Based Security
ID firewall is an extension to Flow that allows you to write security policies based on users and groups in an Active Directory domain in which your VDI VMs are attached. When using ID firewall, you can import groups from Active Directory into Prism Central as categories (in the category key ADGroup), and then write policies around these categories, just as you would for any other category. A new type of policy has been added for this purpose - the
VDI Policy
. ID firewall takes care of automatically placing VDI VMs in the appropriate categories on detecting user logons into the VM hosted on Nutanix infrastructure associated with Prism Central, thus allowing user and group based enforcement of Flow policies.
See Configuring Active Directory Domain Services to import user groups for identity-based security policies.
See Creating a VDI Policy to create a VDI policy.
See Default VDI Policy configuration to define a default VDI policy.
Note:
It is recommended to disable credential caching on VDI VMs for Flow ID Firewall. The Flow ID Firewall checks the domain controller events for logon attempts. If the VM connection to the domain controller is not available, a user is able to logon (if credential caching enabled) but no event is generated on the domain controller inhibiting the ID Firewall to detect the logon.
To disable credential caching, see
Interactive logon: Number of previous logons to cache (in case domain controller is not available)
on
Microsoft
documentation website.
A basic assumption of VDI Policies is that a single end-user is logged on to each desktop VM at a point in time. As a result, if multiple users log into a single desktop VM at once, the security posture of the VM may change in unpredictable ways. Please ensure that for predictable behavior, only one user is logged into desktop VMs at a time.
Creating a VDI Policy
ID firewall integrates Nutanix Flow with Microsoft Active Directory (AD), such that the groups in the AD can be imported into Prism Central as categories. These imported categories can then be used in the VDI policy as target groups, inbound traffic, and outbound traffic. Prism Central automatically places VMs inside the imported AD group categories when user logons are detected on VMs that are part of the Active Directory domain and also present on Nutanix managed clusters, thus applying security policies based on user group membership.
Before you begin
Note:
Flow ID firewall is supported only for AHV host compatible with AOS version 5.17 and
above and Prism Central version 5.17 and above.
Flow ID firewall does not detect user logoffs. The policy applied to a VM is kept applied until next user logon on the same VM.
VMs with an
AppType
category assignment do not get categorized by
ID Based Security
.
You can use the Default VDI Policy to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Since a VM user can be a member of multiple ADGroups that are mapped into Prism Central from Active Directory, when a user logs on, a VM may be placed in multiple ADGroups at once. This is the correct behavior, and the policy applied to the VM will be a union of the respective combination of inbounds and outbounds across all ADGroups the VM is placed into.
If not already available, configure an Active Directory domain that is used for ID firewall, see Configuring Active Directory Domain Services.
Configure a service account with required configuration for the Active Directory domain, see Configure Service Account for ID Firewall.
About this task
To secure a VDI environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
) and click
Create Security
Policy
. Select
Secure VDI Groups (VDI Policy)
and
click
Create
.
You can create only one VDI policy for securing applications through ID
Firewall.
The
Define Policy
page is displayed.
On the
Define Policy
tab, do the following in the indicated fields, and then click
Next
:
The
Policy Name
and
Purpose
fields are auto-populated.
Select either
Include all VMs
or
Include VMs by name
as the
VDI VM Filter
.
You can use the VDI VM Filter for the following scenarios.
Include VMs by name
- Select
Include VMs by name
and enter the matching criteria in the
VM Name Contains
field. Select the
Assign matching VMs to an optional default category (ADGroup:Default)
check-box to to apply a default posture to the VMs, see Default VDI Policy for details. Optionally, select the
Keep the default category upon user logon
check-box to preserve the default category even after user logon.
Note:
Assign ADGroup categories only when the VM matches the filter criteria, otherwise ADGroups apply to all VMs where a logon is detected.
VMs with an AppType category assigned is never categorized with an ADGroup.
While updating the VDI policy, if inclusion criteria is changed to exclude and then re-include previously included VMs (that were previously logged on and categorized), upon re-inclusion the previous categories will not be applied; consecutively, a new logon must occur for the VM for categories to apply.
Include all VMs
- Select
Include all VMs
to include all the VMs in the AD group in the policy. Note that non-VDI VMs will also be included in the policy if
Include all VMs
option is selected.
Optionally, in the
Advanced Configuration
section, select the
Allow
option to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Note:
If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
Optionally, turn on the
Policy Hit Logs
option to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow, see "Configuring Syslog Monitoring" in the
Prism Central Guide
for details.
Note:
Policy hit logs are not generated if both source and destination are in inbound or outbound category.
In the
Secure AD Groups
tab, do the following in the indicated fields and click
Next
.
For
Inbound Traffic
, click
+ Add Source
and enter the category or subnets that the VDI group can receive the traffic from, as the source.
For each
VDI ADGroup
, click
+Add AD Group
to select the AD groups (categorized VDI VMs) that you want to secure. You can click
Import all AD Groups
to add all imported ADGroup categories to the VDI policy.
For
Outbound Traffic
, click
+ Add Destination
and enter the category or subnets that the VDI group can send the traffic to, as the destination.\
Note:
If you have not used the default VDI option in
Step 2b
, ensure that you add all of your Active Directory domain controllers as part of this step, using either categories or subnets, for each ADGroup.
Figure.
Secure AD Groups Tab
Click to enlarge
Do one of the following:
Click
Apply Now
to apply the VDI Policy.
Click
Save and Monitor
to save the configuration.
You can switch between the monitoring and applied states on the
Security Policies
page and clicking the appropriate option in the
Actions
menu.
Default VDI Policy
The Default VDI policy feature allows you to apply a default set of rules as defined by the
desktop administrator for VDI VMs and users. There are two primary use cases for Default VDI
Policy (
ADGroup:Default
).
To ensure that a VDI VM is secure even before a user logs on to the VDI VM.
To enable access to common network resources without the need to add the resources to every tier of a VDI policy.
You can define a default VDI policy at the time of creating a new VDI policy, or by updating any existing VDI policy. See
Step 2b
of the VDI Policy Configuration topic for details.
Configuring Active Directory Domain Services
Active Directory Domain Services configuration is used to import user groups for identity based security policies.
Before you begin
Microsegmentation must be enabled to be able to use the ID Firewall feature, see Enabling Microsegmentation.
You must allow WMI access from Prism Central to all the Active Directory Domain Controllers in your network firewall and Active Directory firewall.
Active Directory Requirements:
Minimum supported domain functional level in Active Directory is Windows Server 2008 R2.
ID Firewall checks the membership of Security Groups only, Distribution Groups are not supported.
NTP must be configured on Active Directory and Prism Central.
DNS must be configured on Prism Central if you want to use host name for domain controllers.
About this task
To configure an Active Directory domain, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select
Prism Central Settings
to display the Settings page.
Click
ID Based Security
from the Settings menu (on the left).
The
ID Based Security
page is displayed. This page allows you to
Add New Domain
or use an
Existing AD
.
If you select
Use Existing AD
in step 3, do the following in the indicated fields:
Click the
Manually Add Domain Controller
button, then click
+ Domain Controller
.
Enter the
IP Address
or
Host Name
of the domain controllers that you want to monitor for user logons events. You must add all the domain controllers associated with your Active Directory manually.
Click
+
and add each domain controller individually, then click the blue check mark icon to save.
Note:
DNS must be configured on Prism Central for the host name option to work.
If you select
Add New Domain
in step 3, a set of fields is displayed. Do the following in the indicated fields:
Name
: Enter a directory name.
This is a name you choose to identify this entry; it need not be the name of an actual directory.
Domain
: Enter the domain name.
Enter the domain name in DNS format, for example,
nutanix.com
.
Directory URL
: Enter the LDAP address of the directory, including the port number.
Service Account Username
: Enter the service account user name in the
user_name@domain.com
format that you want Prism Central to use to detect logons and query user and group information from Active Directory.
Caution:
Do not use the Domain Admin account as the service account considering the security best practices. Create a new domain user and grant it required permissions as described in Configure Service Account for ID Firewall.
A service account is a special user account that an application or service uses to interact with the Active Directory. Enter your Active Directory service account credentials in this (username) and the following (password) field.
Note:
Ensure that you update the service account credentials here whenever the service account password changes or when a different service account is used.
Service Account Password
: Enter the service account password.
When all the fields are correct, click the
Save
button (lower right).
ID Firewall uses the service account for ID based security with additional requirements, see Configure Service Account for ID Firewall.
Once saved, the
Referenced AD Groups
section is displayed. You can add a new user group by clicking
+ Add User Group
and edit the auto-generated
Category Value
. After the active directory configuration is complete, you can create the VDI Policy, see Creating a VDI Policy
Optionally, click
Add Inclusion Criteria
under
Manage the VM Inclusion Criteria
to specify which VMs are assigned to AD Group categories upon user logon based on VM name.
Note:
It is recommend that users add inclusion criteria if at all possible to prevent any unintended categorizations.
Note:
The VMs with AppType category assigned cannot be categorized by ID Based Security.
Configure Service Account for ID Firewall
Active Directory service account in Prism Central is used for connectivity with the Active Directory domain services. ID Firewall also uses the same service account for ID based security.
To configure a service account for ID firewall, do the following.
Create a new user in the Active Directory.
Add the user to the
Distributed COM Users
group and the
Event Log Readers
domain groups.
Start the
dcomcnfg.exe
utility and go to
Component Services
>
Computers
>
My Computer
>
DCOM Config
.
Right-click on
Windows Management and Instrumentation
and select
Properties
from the menu.
Switch to
Security
tab, select
Customize
option in the
Access Permissions
section and then click
Edit
.
Add the user and grant
Local Access
and
Remote Access
permissions to the user. Click
OK
to confirm changes.
Run the
WMIMGMT.msc
command to start
Windows Management Instrumentation
snap-in.
Right-click on
WMI control (local)
and select
Properties
from the menu.
Switch to
Security
tab and expand
Root
tree.
Select
CIMV2
in the expanded tree and click
Security
.
Go to
Advanced
>
Add
>
Principal
and enter the user name.
Change scope by selecting
This namespace and subnamespaces
in the
Applies to
drop-down menu.
Click the check-box to grant the
Enable Account
and
Remote Enable
permissions. Click
OK
to confirm changes.
Restart the
winmgmt
service.
C:\> net stop winmgmt
C:\> net start winmgmt
Alternatively, reboot the domain controller.
Repeat step 3 to step 14 on every domain controller.
Modifying the VDI Policy
About this task
To modify the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating a VDI Policy.
Applying the VDI Policy
Applying the VDI policy enforces the policy on the specified categories (VDI AD groups), and any traffic between the categories is blocked.
About this task
To apply the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then click
OK
.
Monitoring the VDI Policy
About this task
The VMs in VDI AD Groups in the VDI policy are allowed to communicate with each other when
the policy is in the monitoring state. Traffic is blocked only during the time the
policy is applied.
To monitor a security policy, do the following:
Procedure
In the
Security Policies
dashboard, select the policy
that you want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then click
OK
.
Deleting the VDI Policy
About this task
To delete the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard, select the VDI
policy.
Click
Delete
in the
Actions
menu.
Applying Filtering and Grouping to a Security Policy
You can apply different types of filters to view results based on properties like source , destination, category, ports, and more. You can also group related rule attributes together for easier visualization of connection flows. Grouping and Filtering work together to provide an intuitive view for the security policy.
About this task
To apply filtering and grouping to a security policy, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
. The
Policies
page is displayed.
Click any policy to view the inbound, application, and outbound configuration.
To view specific rule properties, do one of the following.
In the
Search
box, search for the required string using the default
All
filter.
Click the filter drop-down menu to search the policy based on any of the following filter types.
Category
search category name and value
Address
search address and subnet IP address
Subnet IP
search subnet IP address
Service
search service name
Rule Description
search rule description
Ports (TCP/UDP)
search TCP/UDP ports and services
ICMP
search ICMP ports and services
Figure.
Filtering Policies
Click to enlarge
To group related rule entities together, click the group icon.
The group option organizes related rule attributes like subnet IP, categories, and service in distinct boxes. Also, the connection flows for all the entities in a group are displayed as a single connection flow. To view all the entities belonging to a group, click the down-arrow icon to expand the group.
Figure.
Filtering Policies
Click to enlarge
Exporting and Importing Security Policies
Prism Central allows you to export and import security policies for the following security administration aspects.
Have a snapshot of a working security configuration so that system can be restored to the desired state when needed.
Ability to apply security policies as templates. This scenario is useful in ROBO environments (disaster recovery deployments) where the datacenters are being managed by multiple Prism Central instances.
Exporting Security Policies
To export or import security policy, do the following in the
Security
Policies
dashboard.
Note:
For VDI policy, the inclusion criteria and default
VDI category settings are not included in the export process. You must set these manually
after an import if required.
Click the
Export & Import
drop down menu.
To export the security policies, select
Export Security Policy
. The security policies binary file is downloaded.
To import any previously exported security policies binary file, select
Import Security Policy
, then click
Browse
to select the binary file. Click
Import
. The security policies are imported.
Note:
Existing policies are overridden with new policies. Policies that are not part of this import are deleted.
Flow Microsegmentation Guide
Flow Microsegmentation 6.5
Product Release Date: 2022-07-25
Last updated: 2022-12-14
Security Policies
Traditional data centers use firewalls to implement security checks at the perimeter—the
points at which traffic enters and leaves the data center network. Such perimeter firewalls
are effective at protecting the network from external threats. However, they offer no
protection against threats that originate from within the data center and spread laterally,
from one compromised machine to another.
The problem is compounded by virtualized workloads changing their network configurations and
hosts as they start, stop, and migrate frequently. For example, IP addresses and MAC addresses
can change as applications are shut down on one host and started on another. Manual
enforcement of security policies through traditional firewalls, which rely on network
configurations to inspect traffic, cannot keep up with these frequent changes and are
error-prone.
Network-centric security policies also require the involvement of network security teams that have intimate knowledge of network configuration in terms of VLANs, subnets, and other network entities.
Nutanix Flow includes a policy-driven security framework that inspects traffic within the
data center. The framework works as follows:
Security policies inspect traffic that originates and terminates within a data center and
help eliminate the need for additional firewalls within the data center.
The framework uses a workload-centric approach instead of a network-centric approach.
Therefore, it can scrutinize traffic to and from VMs no matter how their network
configurations change and where they reside in the data center. The workload-centric,
network-agnostic approach also enables the virtualization team to implement these security
policies without having to rely on network security teams.
Security policies are applied to categories (a logical grouping of VMs) and not to the VMs
themselves. Therefore, it does not matter how many VMs are started up in a given category.
Traffic associated with the VMs in a category is secured without administrative
intervention, at any scale.
Prism Central offers a visualization-based approach to configuring policies and monitoring
the traffic to which a given policy applies.
Using Prism Central, you can configure syslog monitoring by forwarding Flow logs to an external
syslog server. For details, see Configuring Syslog Monitoring in the
Prism
Central Guide
.
Note:
Nutanix Flow supports only AHV hypervisor; security policies can not be applied to VMs running on other hypervisors.
Types of Policies
The types of policies in Prism Central and their use cases are described
here.
Table 1.
Types of Policies
Policy Type
Use Case
Application Security Policy
Use an application security policy when you want to secure an application by
specifying allowed traffic sources and destinations. This method of securing an
application is typically called
application ring fencing
.
For example,
use an application security policy when you want to allow only those VMs in the
categories
department: engineering
and
department:
customersupport
(the allowed sources) to communicate with an issue
tracking tool in the category
AppType: IssueTracker
(the secured
application), and you want the issue tracking tool to be able to send traffic only
to an integrated customer relationship management application in the category
AppType: CRM
.
The secured application itself can be divided
into tiers by the use of categories (the built-in AppTier category). For example,
you can divide the issue tracking tool into web, application, and database tiers and
configure tier-to-tier rules.
For more information, see Application Security Policy Configuration.
Isolation Environment Policy
Use an isolation environment policy when you want to block all traffic,
regardless of direction, between two groups of VMs identified by their category. VMs
within a group can communicate with each other.
For example, use an isolation
environment policy when you want to block all traffic between VMs in the category
Environment: sandbox
and VMs in the category
Environment:
production
, and you want to allow all the VMs within each of those
categories to communicate with each other.
For more information, see Isolation Environment Policy Configuration.
Quarantine Policy
Use a quarantine policy when you want to isolate a compromised or infected VM and
optionally want to subject it to forensics.
For more information, see Quarantine Policy Configuration.
VDI Policy
Use a VDI policy when you want to secure your VDI environment.
For more information, see VDI Policy Configuration
Security Policy Model
Application-centricity
The security policy model uses an application-centric policy language instead of the more
complex, traditional network-centric policy language. Configuring an application security
policy involves specifying which VMs belong to the application you want to protect and then
identifying the entities or networks, in the inbound and outbound directions, with which you
want to allow communication.
All the entities in an application security policy are identified by the categories to
which they belong and not by their IP address, VLAN, or other network attributes. After a VM
is associated with a category and the category is specified in a security policy, traffic
associated with the VM is monitored even if it migrates to another network or changes its IP
address.
The default options for allowing traffic on the inbound and outbound directions are also
inherently application centric. For application security policies, the default option for
inbound traffic is
Allowed List
, which means that
Allowed
List
is usually the recommended option for inbound traffic. The default
option can be changed to
Allow All
traffic. The default option in the
outbound direction allows the application to send traffic to all destinations, but you can
configure a destination
Allowed List
if desired.
For forensic quarantine policies, the default option in both directions is
Allowed List
, but you can
Allow All
traffic
in both directions. For strict quarantine policies, no traffic is allowed in either
direction.
All the VMs within a category can communicate with each other. For example, in a tiered
application, regardless of how you configure tier-to-tier rules, the VMs within a given tier
can communicate with each other.
Whitelist-Based Policy Expression
An application security policy is expressed in terms of the categories and subnets with
which you want the application to communicate and therefore, by extension, the traffic you
want to allow. A more granular policy expression can be achieved by specifying which
protocols and ports can be used for communication.
Any category or subnet that is not in the allowed list is blocked. You cannot specify the
categories and subnets you want to block because the number of such entities are typically
much larger and grow at a much higher rate than the categories and subnets with which an
application should be allowed to communicate. Expressing a policy in terms of allowed
traffic results in a smaller, tighter policy configuration that can be modified, monitored,
and controlled more easily.
Enforcement Modes
All policies, whether associated with securing an application, isolating environments, or
quarantining VMs, can be run in the following modes:
Monitor Mode
Allows all traffic, including traffic that is not allowed by the policy. This mode
enables you to visualize both allowed and disallowed traffic and fine-tune the policy
before applying it.
Enforce Mode
Blocks all traffic that is not allowed by the policy.
You can switch a policy between these two modes as many times as you want.
Automated Enforcement
A policy uses categories to identify the VMs to which it must apply. This model allows the
automatic enforcement of a policy to VMs regardless of their number and network attributes.
Connectivity between Prism Central and a registered AHV cluster is required only when
creating and modifying policies, or when changing the mode of operation (applied or
monitoring) of a policy. Policies are applied to the VMs in a cluster even if the cluster
temporarily loses network connectivity with the Prism Central instance with which it is
registered. New policies and changes are applied to the cluster when connectivity is
restored.
Priorities Between Policies
Prism Central does not provide a way for you to specify priorities between policies of a
single type. For example, you cannot prioritize one security policy over another. There is
no limit to the number of inbound and outbound rules that you can add to a security policy,
allowing you to define all of an application's security requirements in a single policy.
This makes priorities between policies unnecessary.
However, priorities exist between the different policy types. Quarantine policies have the highest priority followed by isolation environment policies, and application security policies, in that order. The VDI Policy takes the last precedence, for example, if an application security is protecting a VM, it cannot simultaneously be protected with the VDI policy.
Isolation environment rules take precedence over application security rules, so make sure
that isolation environment policies and application security policies are not in conflict.
An isolation environment rule and an application security rule are said to be in conflict if
they apply to the same traffic (a scenario that is encountered when VMs in one of the
categories in the isolation environment send traffic to an application in the other
category, and some or all of that traffic is either allowed or disallowed by the application
security policy). The effect that an isolation environment policy has on a conflicting
application security policy depends on the mode in which the isolation environment policy is
deployed, and is as follows:
If the isolation environment policy is in the applied mode, it blocks all traffic to the
application, including the traffic that is allowed by the application security
policy.
If the isolation environment policy is in the monitoring mode, it allows all traffic to
the application, including any traffic that is disallowed by the application security
policy.
Requirements
The Security Policies feature has the following requirements:
The feature is supported only on AHV clusters running AOS 5.6 or later and AHV version
20170830.115 or later.
The Prism Central instance must be hosted on one of the AHV clusters registered with it.
The AHV cluster that hosts the Prism Central instance must be running AOS 5.6 or
later.
The host must have at least 1 GB of additional memory for each Prism Central VM hosted
on it.
If you are running a Prism Central scale-out instance, all the VMs in the Prism Central
cluster must be powered on.
The AHV hosts must be allowed to communicate with the Prism Central VMs over TCP port
9446. Keeping the port open enables the hosts to send the Prism Central VMs connection
tracking data. Prism Central uses that data to show network flows.
Flow supports only TCP, UDP, or ICMP traffic.
Caution:
When Flow is enabled, a Kafka container is automatically created on the cluster where
Prism Central is hosted. The container is used to store data that is required for flow
visualization to work and must not be deleted.
Cross cluster live migration of guest VMs that are part of Flow security policy is not
supported.
Security Policies are not supported for VMs that are on the advanced networking stack.
An alert is raised for VMs that are part of both VPC and Flow policy, and Flow policies
are not enforced for VMs on VPCs.
Overlapping or conflicting policy configuration is not supported and might cause
unintended interruption of network services.
Enabling Microsegmentation
Microsegmentation is disabled by default. Before you can configure and use
application security policies, isolation environment policies, and quarantine policies, you
must enable the feature. The feature requires a Flow license. If you have not installed a
Flow license, you can try the feature for a period of 60 days. After this period expires,
you will be required to install the license to continue using the feature.
Before you begin
Ensure that you meet Microsegmentation requirements.
About this task
To enable microsegmentation, do the following:
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and
then select
Prism Central Settings
to display the
Settings page.
Click
Microsegmentation
from the Settings menu (on the
left).
The
Enable Microsegmentation
dialog box is
displayed.
To determine whether the registered clusters are capable of supporting
microsegmentation, do the following:
Click
View Cluster Capability
, and then review
the results of the capability checks that Prism Central performed on the
registered clusters.
Click
Back
.
Select the
Enable Microsegmentation
check box.
Click
OK
.
Disabling Microsegmentation
Prism Central web console provides you the ability to disable the microsegmentation
feature.
About this task
To disable microsegmentation, do the following:
Procedure
Log on to the Prism Central web console.
Click the gear icon in the main menu and then select
Microsegmentation
in the
Settings
page.
Figure.
Settings Page - Disabling Microsegmentation
Click to enlarge
Click
Disable Microsegmentation
.
A confirmation message appears.
Figure.
Microsegmentation - Confirmation message
Click to enlarge
Click
Disable
to confirm disabling the microsegmentation
feature.
Built-in Categories for Security Policies
Prism Central includes built-in categories that you can use in application security
policies and isolation policies. It also includes a built-in category for quarantining VMs.
Table 1.
Built-In Categories
Category
Description
AppTier
Add values for the tiers in your application (such as web, application_logic, and
database) to this category and use the values to divide the application into tiers
when configuring a security policy.
AppType
Associate the VMs in your application with the appropriate built-in application
type such as Exchange and Apache_Spark. You can also update the category to add values
for applications not listed in this category.
Environment
Add values for environments that you want to isolate from each other and then
associate VMs with the values.
Quarantine
Add a VM to this category when you want to quarantine the VM. You cannot modify
this category. The category has the following values:
Strict
Use this value when you want to block all inbound and outbound traffic.
Forensic
Use this value when you want to block all inbound and outbound traffic except
the traffic to and from categories that contain forensic tools.
ADGroup
This category is managed by ID Based Security (ID Firewall). Each ADGroup value represents an imported group from Active Directory. To add or remove values to use in Flow policies use the
ID Based Security
configuration page (
Prism Central Settings
>
Flow
>
ID Based Security
). The category values may be used in VDI policies, see
VDI Policy Configuration for details.
ADGroup:Default
This category is applied to the VDI VMs of the AD group when the VM inclusion criteria is set and allows you to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Services
Service is a group of protocol-port combination. You can use any of the default services or create a custom service. The ability to use the service entities in the policy creation workflow reduces any manual configuration error and enables reusability of available entities.
To create or update a custom service, see Creating a Service.
To view the list of available services (built-in and custom services), go to
Policies
>
Security
>
Services
.
Creating a Service
About this task
To create a custom service, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
>
Services
.
Click
Create Service
.
Figure.
Create Service Tab
Click to enlarge
Enter a name and description for the service.
Select the
Protocol
from the drop-down menu and enter the port number or port range in the
Port
field.
You can add multiple protocol-port combinations in a single service. To add more protocol-port combination, click
Add Row
and specify the required values.
Click
Save
to save the service.
Addresses
Address is a way to group one or many IP addresses or ranges. You can create an address entity
and use that address entity while creating policies. The ability to use the addresses in
the policy creation work flow reduces any manual configuration error and enables
reusability of available entities.
To create or update an Address, see Creating an Address.
To view the list of available services (built-in and custom services), go to
Policies
>
Security
>
Address
.
Creating an Address
About this task
To create an Address, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
>
Addresses
.
Click
Create Address
.
Figure.
Create Address Tab
Click to enlarge
Enter a name and description for the address.
Enter the IP address or a IP range in the
Subnet
field.
You can add multiple subnets in a single address entity. To add more subnets, click
Add Row
and specify the required values.
Click
Save
to save the service.
Application Security Policy Configuration
Creating an Application Security Policy
Before you begin
Create the categories you need and associate the VMs that you want to protect
with those categories. You might be required to create categories for the
following purposes. Some categories or category values are required while others
are optional:
Every security policy must be associated with a value in the AppType
category, so make sure that you update the AppType category with
appropriate values if the built-in values do not work for you. For
information about this category and its values, see Category Details View in the
Prism Central Guide
.
If you need to apply the policy to an application in a specific
environment (for example, development, test, or production) or an
application at a specific location, create the category you need and
apply it to the application. Prism Central includes a built-in
Environment category that you can use or update with values of your own.
You can also create your own categories.
If you want to specify categories for traffic sources and destinations
instead of allowing all inbound and outbound traffic, create those
categories and apply them to the traffic sources and destinations.
If you want to divide the application into tiers in a security policy,
add tiers to the AppTier category. The AppTier category has a built-in
default
value, but you can update the category to
add values of your choice.
For information about categories and their values, see Category Management in the
Prism Central Guide
.
Security policy configuration might require more time than the default session
timeout allows you. You might want to increase the session timeout so that you
do not lose a configuration that is left unattended while you perform associated
tasks such as referring to this documentation. For more information, see Modifying UI Settings (Prism Central)
in the
Prism Central Guide
.
About this task
To secure an application, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), click
Create Security
Policy
, and then click
Secure an
Application
.
The
Create App Security Policy
page is
displayed.
On the
Define Policy
tab, do the following in the
indicated fields, and then click
Next
:
Figure.
Define Policy Tab
Click to enlarge
Name
: Enter a name for the security
policy.
Purpose
: Describe the purpose of the security
policy.
Secure This App
: Select the type of application
that you want to secure.
The
Secure This App
list displays available
values in the AppType category. It uses the format
AppType
:
value
, where value represents a type of
application. Every application that you want Prism Central to secure
must be associated with a value from the built-in AppType category. The
AppType category includes values for frequently encountered
applications, such as Exchange and Hadoop. The AppType category also
includes a built-in
default
value that you can use if
your application cannot be associated with one of the other built-in
values. You can also update the
AppType
category to add
a value of your choice. For information about categories and their
values, see Category Management in the
Prism Central Guide
.
If you want to filter the VMs by an additional category, select
Filter the app type by category
, and then
enter the name of the category in the text box that is displayed.
This option enables you to apply the policy to an additional category.
For example, if you are configuring a policy for an application in the
category
AppType: Exchange
, this option enables you to
further restrict the policy to specific locations (such as
Location: US
and
Location: EU
) or
environments (such as
Environment: Production
,
Environment: Development
, and
Environment:
Test
).
Optionally, in the
Advanced Configuration
section, select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Note:
If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
Optionally, click the toggle button against
Policy Hit Logs
to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring
in the
Prism Central Guide
.
Note:
Policy hit logs are not
generated if both source and destination are in inbound or outbound
category.
In the
Securing an App
dialog box, review the schematic
that illustrates the flow of traffic through a secured app, and then click
OK, Got it!
The
Secure Application
tab is displayed. The
schematic on this tab can be divided into three areas of configuration: the
Inbound
side, (for adding traffic source allowlist),
the application at the center (for configuring inbound, outbound, and
tier-to-tier rules), and the
Outbound
side (for adding
traffic destination allowlist).
Figure.
Secure Application Tab
Click to enlarge
On the
Secure Application
tab, do the following, and
then click
Next
:
On the application at the center of the tab, do the following in the
indicated fields:
If you want to divide the application into tiers (such as a web
tier, an application tier, and a database tier) and configure
tier-to-tier rules, first configure the application as described
in this step, and then configure inbound and outbound rules.
This approach ensures that the individual tiers are available
when you want to configure inbound and outbound rules at the
tier level. Skip this step if you want to treat the application
as a single entity in the security policy.
To divide your
application into tiers and create tier-to-tier rules, do the
following:
On the application, click
Set Rules on App
Tiers, Instead
.
Note:
After you click
Set Rules on App Tiers,
Instead
, the link text,
Set
rules on the whole app, instead
, is
displayed in its place. Click
Set rules
on the whole app, instead
if you want
to discard the tiered configuration and return to
configuring rules on the application as a
whole.
Click
Add Tier
, and then select a
tier.
Repeat this step to add as many tiers as you
require. The following figure shows an application
with a web tier, an application tier, and a database
tier:
Figure.
Tiered Application
Click to enlarge
To delete a tier, pause over the tier you want to delete
and click the delete button that is displayed.
Click
Set Rules Within
App
.
Note:
When configuring tier-to-tier
rules, two modes are made available to you through
the buttons
Set Rules to & from
App
and
Set Rules Within
App
. The
Set Rules to &
from App
option enables you to add
application tiers and to specify allowed inbound and
outbound traffic. The
Set Rules Within
App
option enables you to specify
tier-to-tier rules within the application. These
buttons enable you to switch between the two
modes.
Click each tier in the application and click
Yes
or
No
to specify whether or not
you want to allow the VMs in the tier to communicate
with each other.
Configure a tier-to-tier rule as follows:
Click the source tier (for example, if the tiers
are WebTier and AppTier and you want to configure
a tier-to-tier rule from WebTier to AppTier, click
the source tier, WebTier).
Click the plus sign that is displayed on the destination tier (in this example, click the destination tier, AppTier). The
Create Tier to Tier Rule
dialog box
Enter a description for the rule.
Note:
The policy rule description is captured in the policy hitlog data.
Policy hitlog must be enabled
Rule description is added to the hitlog only for allowed traffic
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
Configure tier-to-tier rules for as many source
and destination tiers as you want.
To add traffic sources, on the
Inbound
side of
the
Secure Application
tab, do the
following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic from
all sources.
Whitelist Only
: Allows traffic
only if the traffic originates from entities on the
security policy's source allowlist. This option is the
default option. If this option is selected, you must
also configure the source allowlist by clicking
Add Source
.
Click
Add Source
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
only if that traffic originates from entities that
are in the selected category.
Subnet/IP
: Allows traffic
only if that traffic originates from entities that
are in the selected subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Source
. Add as many categories or
subnets as you want to allow.
Each entry in this list represents a stream of inbound
traffic.
To add traffic destinations, on the
Outbound
side, do the following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic to all
destinations. This option is the default option.
Whitelist Only
: Allows traffic
only if the traffic is destined for entities on the
security policy's destination allowlist. If this option
is selected, you must also configure the destination
allowlist by clicking
Add
Destination
.
Click
Add Destination
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
only if that traffic is destined for entities in
the selected category.
Subnet/IP
: Allows traffic only if that traffic is destined for entities in the selected subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Destination
. Add as many categories or
subnets as you want to allow.
Each entry in this list represents a stream of outbound
traffic.
To specify the protocols that you want to allow from each stream
of inbound and outbound traffic, do the following:
If you added application tiers and configured
tier-to-tier rules, first click
Set Rules to
& from App
.
Click the traffic source or traffic destination (a
category or subnet if you have configured a allowlist or
All Sources
if you have
chosen to allow all sources) for which you want to
create a rule.
Click the plus icon that appears on the application (if you are treating the application as a single entity) or application tier (if you have divided the application into tiers). The
Create Inbound Rule
or
Create Outbound Rule
dialog box appears.
Enter a description for the rule.
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
After you configure a rule, a dotted line appears between the two endpoints of
the rule. Point to the dotted line to show the list of ports that the rule
allows.
On the
Review
tab, review the security policy
configuration, and then do one of the following:
If you want to apply the configuration, click
Apply
Now
.
Applying a security policy enforces the security
policy on the application, and traffic from entities that are not
defined as sources in the policy is blocked.
If you want to save the configuration and monitor how the security
policy works, click
Save and Monitor
.
When a
policy is in the monitoring state, the application continues to
receive all traffic, but disallowed traffic is highlighted on the
monitoring page. Traffic is not blocked until the policy is
enforced.
Note:
A policy that you have chosen to save and monitor
can be applied from the policy update page.
Modifying an Application Security Policy
About this task
To modify a security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Application Security Policy.
Applying an Application Security Policy
Applying a security policy enforces the security policy on the application, and any
traffic from sources that are not allowed is blocked.
About this task
To apply a security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then
click
OK
.
Monitoring an Application Security Policy (Visualizing Network Flows)
About this task
When a policy is in the monitoring state, the application continues to receive all
traffic, but disallowed traffic is highlighted on the monitoring page. Traffic is not
blocked until the policy is applied.
To monitor a security policy, do the
following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then
click
OK
.
Allowed network flows and disallowed network flows are shown on the
monitoring page, as shown in the following figure. Allowed flows are depicted
with a blue dotted line and disallowed network flows are depicted with a red
dotted line:
Figure.
Monitoring Page for an Application Security Policy
Click to enlarge
To show a preview of the network flow in a tooltip, pause over the dotted line
that depicts the network flow in the diagram.
A tooltip similar to the following is displayed. The tooltip shows a
graph for each connection:
Figure.
Tooltip Showing a Preview of the Network Flow
Click to enlarge
To see a graph of a network flow, click the dotted line that depicts the
network flow in the visualization.
A more detailed graph of the network flows is displayed, as shown in the
following figure:
Figure.
Network Flows Graph
Click to enlarge
To block unwanted flows, click
Update
, and then update
the policy. For information about updating an application security policy, see
Modifying an Application Security Policy.
To apply the policy, click
Apply
.
Applying a policy enforces the policy and traffic from sources that are
not allowed is blocked.
Deleting an Application Security Policy
About this task
To delete an application security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to delete.
You can select multiple policies and delete them all at once.
Click
Delete
in the
Actions
menu.
Isolation Environment Policy Configuration
An isolation environment identifies two groups of VMs by category, and it blocks
communications between the groups.
You can also specify an additional category to restrict the scope of the isolation
environment to that category.
For example, consider that you have an
application
category with values
app1
and
app2
and that you have associated some VMs with
application: app1
and some VMs with
application: app2
.
Also, consider that these same VMs are distributed between two sites, and have accordingly
been associated with values site1 and site2 in a category named location (
location:
site1
and
location: site2
).
In this example, you might want to block communications between the VMs in the two locations.
Additionally, you might want to restrict the scope of the policy to VMs in category
application: app1
. In other words,
app1
VMs in
site1
cannot communicate with
app1
VMs in
site2
. The following diagram illustrates the desired outcome. The red
connectors illustrate blocked traffic. The green connectors illustrate allowed traffic.
Figure.
Applications Across Sites
Click to enlarge
You can configure an isolation policy for this by creating the following categories and
isolation policy in Prism Central:
Table 1.
Sample Configurations For Categories and the Isolation Policy
Entity
Values
Categories
Name
:
application
Values
:
app1
and
app2
Name
:
location
Values
:
site1
and
site2
Isolation Policy
Name
:
eng_isolation_policy_across_sites
Description
: Isolate engineering VMs across sites
Isolate This Category
:
location:
site1
From This Category
:
location: site2
Apply the isolation only within a subset of the data
center
:
application: app1
Layer 2 Isolation
Flow supports Layer 2 isolation to enable filtering of the layer 2 packets across all isolated entities. When an isolation policy is applied between two category-based VM groups, all ingress and egress traffic (broadcast, unknown-unicast, and multicast traffic) is dropped at the destination VM group.
Note:
If VMs are part of both isolation policy and quarantine policy, the quarantine policy takes priority of processing over the isolation policy. For example, if VMs with category app1 are isolated from VMs with category app2 using an isolation policy, the traffic between these VM groups are not dropped if the VM groups are also part of a quarantine forensic policy that allows communication between these VMs. In this case, since the quarantine forensics policy matches the VMs, and this policy allows the traffic, the isolation policy is not enforced.
IPv6 traffic between isolated VMs is blocked by default with the introduction of layer 2 isolation.
Creating an Isolation Environment Policy
An isolation environment policy identifies two groups of VMs and blocks
communications between the groups. The two groups are identified by category. You can
specify an additional category to restrict the scope of the policy to that
category.
About this task
To create an isolation environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), click
Create
Security Policy
, and then click
Isolate
Environments
.
The
Create Isolation Policy
page is displayed.
Figure.
Create Isolation Policy
Click to enlarge
Do the following in the indicated fields:
Name
: Enter a name for the isolation policy.
Purpose
: Describe the purpose of the isolation
policy.
Isolate this category
: Type the name of one of
the two categories that you want to isolate from each other.
Matching
names appear in a list as you type. You can click the name of the
category you want.
From this category
: Type the name of other
category.
Apply the isolation only within a subset of the data center
. If
you want to restrict the scope of the policy to a specific category of
VMs, select this check box, type the name of the category in the text
box, and select the category from the list of matches.
If you isolate
VMs in category
Environment: Production
from VMs in
category
Environment: Staging
, and you restrict the
scope of the policy to VMs in the category
Environment:
Dev
, Prism Central applies the isolation policy to the
following groups:
VMs that are in both
Environment: Production
and
Environment: Dev
VMs that are in both
Environment: Staging
and
Environment: Dev
.
IPv6 Traffic
. Optionally, in the
Advanced Configuration
section, select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Policy Hit Logs
. Optionally, click the toggle button against
Policy Hit
Logs
to log traffic flow hits on the policy rules. You
can configure syslog monitoring for the policy hit logs for Flow. For
details, see Configuring Syslog Monitoring
in the
Prism Central Guide
for details.
Note:
Policy hit
logs are not generated if both source and destination are in inbound
or outbound category.
Do one of the following:
Click
Apply Now
to apply the isolation
environment.
Click
Save and Monitor
to save the configuration
and place the isolation environment in the monitoring mode.
You can switch between the monitoring and applied states by selecting the
isolation environment on the
Security Policies
page and
clicking the appropriate option in the
Actions
menu.
Modifying an Isolation Environment Policy
About this task
To modify an isolation environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the isolation policy
that you want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For
information about the options, see Creating an Isolation Environment Policy.
Applying an Isolation Environment Policy
Applying an isolation environment policy enforces the policy on the specified
categories, and any traffic between the categories is blocked.
About this task
Note:
Changing the state of an isolation environment policy affects the functioning of
any conflicting application security policies. For more information, see Priorities Between Policies.
To apply an isolation environment policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then
click
OK
.
Monitoring an Isolation Environment Policy (Visualizing Network Flows)
About this task
The VMs in the two categories in an isolation environment policy are allowed to
communicate with each other when the policy is in the monitoring state. Traffic is
blocked only during the time the policy is applied.
Note:
Changing the state of an
isolation environment policy affects the functioning of any conflicting application
security policies. For more information, see Priorities Between Policies.
To monitor a security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then
click
OK
.
The monitoring page shows the flows between the two
categories.
To view information about a particular network flow, pause over the flow.
A tooltip similar to the following is displayed:
Figure.
Monitoring Page for an Isolation Environment Policy
Click to enlarge
Deleting an Isolation Environment Policy
About this task
To delete an isolation environment policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to delete.
You can select multiple policies to delete them all at once.
Click
Delete
in the
Actions
menu.
Quarantine Policy Configuration
Prism Central includes a system defined quarantine policy that enables you to perform the
following tasks:
Completely isolate an infected VM that must not have any traffic associated with it.
Isolate an infected VM but specify a set of forensic tools that can communicate with the
VM.
For these use cases, Prism Central includes built-in categories that are included in the
system defined quarantine policy.
Note:
You cannot create a quarantine policy. However, you can modify existing (system defined)
quarantine policy.
Prism Central also enables you to monitor the quarantine policy before applying it.
The quarantine policy cannot be deleted.
Configuring the Quarantine Policy
In the built-in quarantine policy, you specify categories that can communicate with
VMs that have been added to the
Quarantine: Forensics
category.
About this task
To configure the quarantine policy, do the following;
Procedure
In the
Security Policies
dashboard, select
Quarantine
, and then click
Update
in the
Actions
menu.
Optionally, in the
Advanced Configuration
under the
Define Policy
tab, do the following.
Select the
Allow
radio button to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default. You can configure the allow option for both
Forensic
and
Strict
modes.
Optionally, click the toggle button against
Policy Hit Logs
to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring
in the
Prism Central Guide
. You can enable the policy hit
log option for both
Forensic
and
Strict
modes.
Note:
Policy hit logs are not
generated if both source and destination are in inbound or outbound
category.
On the
Add Forensic Tools
tab, do the following, and
then click
Next
:
To specify the categories that contain forensic tools, on the
Inbound
and
Outbound
sides of the policy diagram, do the following:
From the drop-down list, select one of the following options:
Allow All
: Allows traffic
associated with all sources or destinations.
Whitelist Only
: Allows traffic
only if the traffic is associated with the categories
and subnets on the allowlist. This option is the default
option. If this option is selected, you must also
configure the allowlist by clicking
Add
Source
or
Add
Destination
.
Click
Add Source
or
Add
Destination
, and then do the following:
Select one of the following options from the drop-down
list:
Category
: Allows traffic
to or from the specified category.
Subnet/IP
: Allows traffic
to or from the specified subnet.
Addresses
: Allows traffic only if the traffic originates from the entities that are in the selected address.
Enter the value (category name or subnet) in the text
box, and then click
Add
.
When
entering the name of a category, a list of matching
names is displayed, and you can select the name you
want to specify. The subnet mask must be specified
in the CIDR format.
To add another category or subnet, click
Add
Source
or
Add
Destination
. Add as many categories or
subnets as you want to allow.
To specify the protocols and ports over which the forensic tools can
communicate with the VMs in the forensic category, do the
following:
On the
Inbound
and
Outbound
sides of the policy
diagram, click a category or subnet (if you have
configured a allowlist) or
All
Sources
(if you have chosen to allow all
sources) for which you want to create a rule.
Click the plus icon that appears on the
Quarantine: Forensic
category. The
Create Inbound Rule
or
Create Outbound Rule
dialog box
Enter a description for the rule.
Note:
The policy rule description is captured in the policy hitlog data.
Policy hitlog must be enabled
Rule description is added to the hitlog only for allowed traffic
In
Service Details
, click
Allow all traffic
to allow all types of traffic or click
Select a service
to choose any default or custom service.
Click
Save
.
After you configure a rule, a dotted line appears between the two endpoints of
the rule. Point to the dotted line to show the list of ports that the rule
allows.
On the
Review
tab, do one of the following:
Click
Apply Now
to apply the quarantine
policy.
Click
Save and Monitor
to save the configuration
and place the quarantine policy in the monitoring mode.
You can switch between the monitoring and applied states by selecting
Quarantine
on the
Security
Policies
page and clicking the appropriate option in the
Actions
menu.
Quarantining a VM
You quarantine a VM by adding the VM to a quarantine category.
About this task
To add an infected VM to a quarantine category, do the following:
Procedure
In the VMs dashboard
List
tab (see VMs Summary View in the
Prism Central Guide
), select the infected VM,
click
Actions
, and then click
Quarantine
VMs
.
Under Quarantine Method, click one of the following options:
Strict.
Isolates the VM from all traffic. No
exceptions can be made for forensics.
Forensic.
Isolates the VM from all traffic except
traffic from categories specified in the built-in quarantine policy. The
allowed categories contain forensic tools that enable you to perform
forensics on the VM.
For VMs added to the strict quarantine, a red icon is displayed in the
name column.
Click
Quarantine
.
Removing a VM from the Quarantine
About this task
To remove a VM from the quarantine, do the following:
Procedure
In the VMs dashboard
List
tab (see VMs Summary View in the
Prism Central Guide
), select the VM that you want
to remove from the quarantine, click
Actions
, and then
click
Unquarantine VMs
.
You can select multiple VMs and remove them from the quarantine in a single
step.
In the
Unquarantine VMs
dialog box, click
Unquarantine
.
VDI Policy Configuration
The
VDI Policy
is based on identity-based categorization of the VDI VMs using Active Directory group membership. Configuring VDI policy includes adding an Active Directory domain that is used for the ID firewall (
ID Based Security
) and configuring a service account for the domain.
ID Based Security
ID firewall is an extension to Flow that allows you to write security policies based on users and groups in an Active Directory domain in which your VDI VMs are attached. When using ID firewall, you can import groups from Active Directory into Prism Central as categories (in the category key ADGroup), and then write policies around these categories, just as you would for any other category. A new type of policy has been added for this purpose - the
VDI Policy
. ID firewall takes care of automatically placing VDI VMs in the appropriate categories on detecting user logons into the VM hosted on Nutanix infrastructure associated with Prism Central, thus allowing user and group based enforcement of Flow policies.
See Configuring Active Directory Domain Services to import user groups for identity-based security policies.
See Creating a VDI Policy to create a VDI policy.
See Default VDI Policy configuration to define a default VDI policy.
Note:
It is recommended to disable credential caching on VDI VMs for Flow ID Firewall. The Flow ID Firewall checks the domain controller events for logon attempts. If the VM connection to the domain controller is not available, a user is able to logon (if credential caching enabled) but no event is generated on the domain controller inhibiting the ID Firewall to detect the logon.
To disable credential caching, see
Interactive logon: Number of previous logons to cache (in case domain controller is not available)
on
Microsoft
documentation website.
A basic assumption of VDI Policies is that a single end-user is logged on to each desktop VM at
a point in time. As a result, if multiple users log into a single desktop VM at once,
the security posture of the VM may change in unpredictable ways. Please ensure that for
predictable behavior, only one user is logged into the desktop VMs at a time.
Creating a VDI Policy
ID firewall integrates Nutanix Flow with Microsoft Active Directory (AD), such that the groups in the AD can be imported into Prism Central as categories. These imported categories can then be used in the VDI policy as target groups, inbound traffic, and outbound traffic. Prism Central automatically places VMs inside the imported AD group categories when user logons are detected on VMs that are part of the Active Directory domain and also present on Nutanix managed clusters, thus applying security policies based on user group membership.
Before you begin
Note:
Flow ID firewall is supported only for AHV host compatible with AOS version 5.17 and
above and Prism Central version 5.17 and above.
Flow ID firewall does not detect user logoffs. The policy applied to a VM is kept applied until next user logon on the same VM.
VMs with an
AppType
category assignment do not get categorized by
ID Based Security
.
You can use the Default VDI Policy to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Since a VM user can be a member of multiple ADGroups that are mapped into Prism Central from Active Directory, when a user logs on, a VM may be placed in multiple ADGroups at once. This is the correct behavior, and the policy applied to the VM will be a union of the respective combination of inbounds and outbounds across all ADGroups the VM is placed into.
If not already available, configure an Active Directory domain that is used for ID firewall, see Configuring Active Directory Domain Services.
Configure a service account with required configuration for the Active Directory domain, see Configure Service Account for ID Firewall.
About this task
To secure a VDI environment, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
) and click
Create Security
Policy
. Select
Secure VDI Groups (VDI Policy)
and
click
Create
.
You can create only one VDI policy for securing applications through ID
Firewall.
The
Define Policy
page is displayed.
On the
Define Policy
tab, do the following in the indicated fields, and then click
Next
:
The
Policy Name
and
Purpose
fields are auto-populated.
Select either
Include all VMs
or
Include VMs by name
as the
VDI VM Filter
.
You can use the VDI VM Filter for the following scenarios.
Include VMs by name
- Select
Include VMs by name
and enter the matching criteria in the
VM Name Contains
field. Select the
Assign matching VMs to an optional default category (ADGroup:Default)
check-box to to apply a default posture to the VMs, see Default VDI Policy for details. Optionally, select the
Keep the default category upon user logon
check-box to preserve the default category even after user logon.
Note:
Assign ADGroup categories only when the VM matches the filter criteria, otherwise ADGroups apply to all VMs where a logon is detected.
VMs with an AppType category assigned is never categorized with an ADGroup.
While updating the VDI policy, if inclusion criteria is changed to exclude and then re-include previously included VMs (that were previously logged on and categorized), upon re-inclusion the previous categories will not be applied; consecutively, a new logon must occur for the VM for categories to apply.
Include all VMs
- Select
Include all VMs
to include all the VMs in the AD group in the policy. Note that non-VDI VMs will also be included in the policy if
Include all VMs
option is selected.
Optionally, in the
Advanced Configuration
section, select the
Allow
option to allow
IPv6 traffic
. The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
Note:
If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
Optionally, turn on the
Policy Hit Logs
option to log traffic flow hits on the policy rules.
You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the
Prism Central Guide
.
Note:
Policy hit logs are not generated if both
source and destination are in inbound or outbound category.
In the
Secure AD Groups
tab, do the following in the indicated fields and click
Next
.
For
Inbound Traffic
, click
+ Add Source
and enter the category or subnets that the VDI group can receive the traffic from, as the source.
For each
VDI ADGroup
, click
+Add AD Group
to select the AD groups (categorized VDI VMs) that you want to secure. You can click
Import all AD Groups
to add all imported ADGroup categories to the VDI policy.
For
Outbound Traffic
, click
+ Add Destination
and enter the category or subnets that the VDI group can send the traffic to, as the destination.\
Note:
If you have not used the default VDI option in
Step 2b
, ensure that you add all of your Active Directory domain controllers as part of this step, using either categories or subnets, for each ADGroup.
Figure.
Secure AD Groups Tab
Click to enlarge
Do one of the following:
Click
Apply Now
to apply the VDI Policy.
Click
Save and Monitor
to save the configuration.
You can switch between the monitoring and applied states on the
Security Policies
page and clicking the appropriate option in the
Actions
menu.
Default VDI Policy
The Default VDI policy feature allows you to apply a default set of rules as defined by the
desktop administrator for VDI VMs and users. There are two primary use cases for Default VDI
Policy (
ADGroup:Default
).
To ensure that a VDI VM is secure even before a user logs on to the VDI VM.
To enable access to common network resources without the need to add the resources to every tier of a VDI policy.
You can define a default VDI policy at the time of creating a new VDI policy, or by updating any existing VDI policy. See
Step 2b
of the VDI Policy Configuration topic for details.
Configuring Active Directory Domain Services
Active Directory Domain Services configuration is used to import user groups for identity based security policies.
Before you begin
Microsegmentation must be enabled to be able to use the ID Firewall feature. For more
information, see Enabling Microsegmentation.
You must allow WMI access from Prism Central to all the Active Directory Domain Controllers in your network firewall and Active Directory firewall.
Active Directory Requirements:
Minimum supported domain functional level in Active Directory is Windows Server 2008 R2.
ID Firewall checks the membership of Security Groups only, Distribution Groups are not supported.
NTP must be configured on Active Directory and Prism Central.
DNS must be configured on Prism Central if you want to use host name for domain controllers.
About this task
To configure an Active Directory domain, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select
Prism Central Settings
to display the Settings page.
Click
ID Based Security
from the Settings menu (on the left).
The
ID Based Security
page is displayed. This page allows you to
Add New Domain
or use an
Existing AD
.
If you select
Use Existing AD
in step 3, do the following in the indicated fields:
Click the
Manually Add Domain Controller
button, then click
+ Domain Controller
.
Enter the
IP Address
or
Host Name
of the domain controllers that you want to monitor for user logons events. You must add all the domain controllers associated with your Active Directory manually.
Click
+
and add each domain controller individually, then click the blue check mark icon to save.
Note:
DNS must be configured on Prism Central for the host name option to work.
If you select
Add New Domain
in step 3, a set of fields is displayed. Do the following in the indicated fields:
Name
: Enter a directory name.
This is a name you choose to identify this entry; it need not be the name of an actual directory.
Domain
: Enter the domain name.
Enter the domain name in DNS format, for example,
nutanix.com
.
Directory URL
: Enter the LDAP address of the directory, including the port number.
Service Account Username
: Enter the service account user name in the
user_name@domain.com
format that you want Prism Central to use to detect logons and query user and group information from Active Directory.
Caution:
Do not use the Domain Admin account as the service account considering the security best practices. Create a new domain user and grant it required permissions as described in Configure Service Account for ID Firewall.
A service account is a special user account that an application or service uses to interact with the Active Directory. Enter your Active Directory service account credentials in this (username) and the following (password) field.
Note:
Ensure that you update the service account credentials here whenever the service account password changes or when a different service account is used.
Service Account Password
: Enter the service account password.
When all the fields are correct, click the
Save
button (lower right).
ID Firewall uses the service account for ID based security with additional requirements, see Configure Service Account for ID Firewall.
Once saved, the
Referenced AD Groups
section is displayed. You can add a new user group by clicking
+ Add User Group
and edit the auto-generated
Category Value
. After the active directory configuration is complete, you can create the VDI Policy, see Creating a VDI Policy
Select
Add Inclusion Criteria
under
Manage
the VM Inclusion Criteria
to specify which VMs are assigned to
AD Group categories upon user logon based on VM name.
Note:
It is recommend that users add inclusion criteria if at all possible to
prevent any unintended categorizations.
Note:
The VMs with AppType category assigned cannot be categorized by ID Based
Security.
Configure Service Account for ID Firewall
Active Directory service account in Prism Central is used for connectivity with the Active Directory domain services. ID Firewall also uses the same service account for ID based security.
To configure a service account for ID firewall, do the following.
Create a new user in the Active Directory.
Add the user to the
Distributed COM Users
group and the
Event Log Readers
domain groups.
Start the
dcomcnfg.exe
utility and go to
Component Services
>
Computers
>
My Computer
>
DCOM Config
.
Right-click on
Windows Management and Instrumentation
and select
Properties
from the menu.
Switch to
Security
tab, select
Customize
option in the
Access Permissions
section and then click
Edit
.
Add the user and grant
Local Access
and
Remote Access
permissions to the user. Click
OK
to confirm changes.
Run the
WMIMGMT.msc
command to start
Windows Management Instrumentation
snap-in.
Right-click on
WMI control (local)
and select
Properties
from the menu.
Switch to
Security
tab and expand
Root
tree.
Select
CIMV2
in the expanded tree and click
Security
.
Go to
Advanced
>
Add
>
Principal
and enter the user name.
Change scope by selecting
This namespace and subnamespaces
in the
Applies to
drop-down menu.
Click the check-box to grant the
Enable Account
and
Remote Enable
permissions. Click
OK
to confirm changes.
Restart the
winmgmt
service.
C:\> net stop winmgmt
C:\> net start winmgmt
Alternatively, reboot the domain controller.
Repeat step 3 to step 14 on every domain controller.
Modifying the VDI Policy
About this task
To modify the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to modify, click
Actions
, and then click
Update
.
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating a VDI Policy.
Applying the VDI Policy
Applying the VDI policy enforces the policy on the specified categories (VDI AD groups), and any traffic between the categories is blocked.
About this task
To apply the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard ((see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to apply, click
Actions
, and then click
Apply
.
Confirm by typing
Apply
in the dialog box, and then click
OK
.
Monitoring the VDI Policy
About this task
The VMs in VDI AD Groups in the VDI policy are allowed to communicate with each other when
the policy is in the monitoring state. Traffic is blocked only during the time the
policy is applied.
To monitor a security policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the policy that you
want to monitor, click
Actions
, and then click
Monitor
.
Confirm by typing
Monitor
in the dialog box, and then click
OK
.
Deleting the VDI Policy
About this task
To delete the VDI policy, do the following:
Procedure
In the
Security Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
), select the VDI policy.
Click
Delete
in the
Actions
menu.
Applying Filtering and Grouping to a Security Policy
You can apply different types of filters to view results based on properties like
source , destination, category, ports, and more. You can also group related rule attributes
together for easier visualization of connection flows. Grouping and Filtering work together
to provide an intuitive view for the security policy.
About this task
To apply filtering and grouping to a security policy, do the following.
Procedure
Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to
Policies
>
Security
. The
Policies
page is displayed.
Click any policy to view the inbound, application, and outbound configuration.
To view specific rule properties, do one of the following.
In the
Search
box, search for the required string using the default
All
filter.
Click the filter drop-down menu to search the policy based on any of the following filter types.
Category
search category name and value
Address
search address and subnet IP address
Subnet IP
search subnet IP address
Service
search service name
Rule Description
search rule description
Ports (TCP/UDP)
search TCP/UDP ports and services
ICMP
search ICMP ports and services
Figure.
Filtering Policies
Click to enlarge
To group related rule entities together, click the group icon.
The group option organizes related rule attributes like subnet IP, categories, and service in distinct boxes. Also, the connection flows for all the entities in a group are displayed as a single connection flow. To view all the entities belonging to a group, click the down-arrow icon to expand the group.
Figure.
Filtering Policies
Click to enlarge
Exporting and Importing Security Policies
Prism Central allows you to export and import security policies for the following security administration aspects.
Have a snapshot of a working security configuration so that system can be restored to the desired state when needed.
Ability to apply security policies as templates. This scenario is useful in ROBO environments (disaster recovery deployments) where the datacenters are being managed by multiple Prism Central instances.
Exporting Security Policies
To export or import security policy, do the following in the
Security
Policies
dashboard (see Security Policies Summary View in the
Prism Central Guide
)
Note:
For VDI policy, the inclusion criteria
and default VDI category settings are not included in the export process. You must set
these manually after an import if required.
Click the
Export & Import
drop down menu.
To export the security policies, select
Export Security Policy
. The security policies binary file is downloaded.
To import any previously exported security policies binary file, select
Import Security Policy
, then click
Browse
to select the binary file. Click
Import
. The security policies are imported.
Note:
Existing policies are overridden with new policies. Policies that are not part of this import are deleted.
This
Flow Networking Guide
describes how to enable and deploy Nutanix Flow
Networking on Prism Central.
Upgrading from EA Versions
If you have enabled the early access (EA) version of Flow Networking, disable it before
upgrading the Prism Central and enabling the general availability (GA) version of Flow
Networking.
Related Documentation
Links to Nutanix Support Portal software and documentation.
The
Nutanix Support
Portal
provides software download pages, documentation, compatibility, and other
information/
Documentation
Description
Release Notes | Flow Networking
Flow Networking Release Notes
Port Reference
Port Reference: See this page for details of ports that must be open in the
firewalls to enable
Flow Virtual Networking
to function.
Nutanix Security Guide
Prism Element and Prism Central security, cluster hardening, and
authentication.
AOS guides and release notes
Covers AOS Administration, Hyper-V Administration for Acropolis, Command
Reference, Powershell Cmdlets Reference, AOS Family Release Notes, and AOS
release-specific Release Notes
Acropolis Upgrade Guide
How to upgrade core and other Nutanix software.
AHV guides and release notes
Administration and release information about AHV.
Prism Central and Web Console guides and release notes
Administration and release information about Prism Central and Prism Element.
Flow Networking Overview
Enabled and administered from Prism Central, Flow Networking powers network virtualization to
offer a seamless network experience with enhanced security. It is disabled by default.
To enable and use Flow Networking, ensure that you log on to Prism Central as a local account
user with
Prism Admin
role. If you log on to Prism Central as a
non-local account (IDP-based) user or without
Prism Admin
role
privileges, then Prism Central does not allow you to enable or use Flow Networking. The task
is reported as
Failed
with a
User Denied Access
message.
Note:
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable Flow Networking to function. To see the ports and protocols used
Flow Networking, see Port Reference.
It is a software-defined network virtualization solution providing overlay capabilities for
the on-prem AHV clusters. It integrates tools to deploy networking features like Virtual
Private Cloud (VPC) and Virtual Private Network (VPN) to support flexible app-driven
networking that focuses on VMs and applications instead of virtual LANs and network
addresses.
After you enable it on Prism Central, Flow Networking delivers the following.
A simplified, Prism Central-based workflow that deploys the application-driven network
virtualization feature.
A secure multi-tenancy solution allowing per-tenant isolation using VPC-based network
segmentation and namespace isolation.
A secure VPN-based connectivity solution for multiple sites, with automated VPN bundle
upgrades.
NAT-based secure egress to external networks, with IP address retention and policy-based
routing.
Self-serve networking services using REST APIs.
Enhanced networking features for more effective disaster recovery.
Note:
You can enable
network segmentation on a Layer 2 extended virtual subnet that does not have a gateway.
For more information about Layer 2 subnet extensions, see Layer 2 Virtual Network Extension. For information about network
segmentation of an extended layer 2 subnet, see
Segmenting a Stretched L2 Network
for Disaster Recovery
in the
Securing Traffic through Network
Segmentation
section of the
Security Guide
.
Deployment Workflow
You can enable Flow Networking using a simple Prism Central driven workflow, which installs
the network controller. The network controller is a collection of containerized services
that run directly on the Prism Central VM(s). The network controller orchestrates all the
virtual networking operations.
Ensure that microservices infrastructure is enabled in
Prism Central Settings
>
Prism Central Management
. See
Prism Central Guide
for information about enabling
microservices infrastructure.
Enable Flow Networking in
Prism Central Settings
>
Advanced Networking
. It is disabled by default. See
Enabling Flow Networking
You can opt out of Flow networking by disabling the
Advanced
Networking
option subject to prerequisites to disable advanced networking.
See Disabling Flow Networking.
You can deploy Flow Networking in a dark site (a site that does not have Internet
access) environment. See the Deploying Flow Networking at a Dark Site topic
for more information.
You can upgrade the Flow networking controller. Nutanix releases an upgrade for the
Flow networking controller with AOS and Prism Central releases. See Upgrading Flow Networking.
See the
AOS Family Release Notes
and
Release Notes | Prism
Central
.
Flow networking allows you to create and manage virtual private clouds (VPCs) and
overlay subnets to leverage the underlying physical networks that connect clusters and
datacenters. See Virtual Private Cloud.
You can upgrade the network gateway version. Network gateway is used to create VPN or
VTEP gateways to connect subnets using VPN connections, or Layer 2 subnet extensions
over VPN or VTEP.
Flow Networking Architecture
The Flow Networking architecture uses a three-plane approach to simplify network
virtualization.
Prism Central provides the management plane, the network controller itself acts as the
control plane while the AHV nodes provide the data plane. This architecture provides a
strong foundation for Flow Networking. This architecture is depicted in the following
chart.
Figure.
Flow Networking Architecture
Click to enlarge
Deployment Scale
Flow Networking supports the following scale:
Entities
Scale
Virtual Private Clouds
500
Subnets
5,000
Ports
50,000
Floating IPs
2,000 per networking controller-enabled Prism Central.
Routing Policies
1,000 per Virtual Private Cloud.
10,000 per networking controller-enabled Prism Central.
Essential Concepts
VPC
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that
functions as a logically isolated virtual network. A VPC could be made up of one or
more subnets that are connected through a logical or virtual router. The IP addresses
within a VPC must be unique. However, IP addresses may overlap across VPCs. As VPCs
are provisioned on top of another IP-based infrastructure (connecting AHV nodes), they
are often referred to as the overlay networks. Tenants may spin up VMs and connect
them to one or more subnets within a VPC. Virtual Private Cloud (VPC) is a virtualized
network of resources that are specifically isolated from the rest of the resource
pool. VPC allows you to manage the isolated and secure virtual network with enhanced
automation and scaling. The isolation is done using network namespace techniques like
IP-based subnets or VLAN based networking.
VPC Subnets
You can use IP address-based subnets to network virtual machines within a VPC. A VPC
may use multiple subnets. VPC subnets use private IP address ranges. IP addresses
within a single VPC must be unique, in other words, IP addresses inside the same VPC
cannot be repeated. However, IP addresses can overlap across multiple VPCs. The
following figure shows two VPCs named Blue and Green. Each VPC has two subnets,
192.168.1.0/24 and 192.168.2.0/24, that are connected by a logical router. Each subnet
has a VM with an IP address assigned. The subnets and VM IP addresses overlap between
the two VPCs.
Figure.
VPC Subnet
Click to enlarge
The communication between VMs in the same subnets or different subnets in the same VPC
(also called East-West communication) is enabled using GEneric NEtwork Virtualization
Encapsulation (GENEVE). If a Prism Central manages multiple clusters, then the VMs that
belong to the same VPC could be deployed across different clusters. The virtual switch on
the AHV nodes provide distributed virtual switching and distributed virtual routing for all
VPCs.
The communication from a VM in a VPC to an endpoint outside the VPC (called external
communication or North-South communication) is enabled by an external network connection.
Such a connection may be secured using VPN. The following figure shows the logical
connectivity of the VPCs to the external network, and subsequently to the Internet.
Note:
You
must configure the default route (0.0.0.0/0) to the external subnet as the next hop for
connectivity outside the cluster (north-south connectivity).
Figure.
External Communication
Click to enlarge
External Subnets
Subnets outside a VPC are external subnets. External subnets may be subnets within
the deployment but not included in a specific VPC. External subnets may also be
subnets that connect to the endpoints outside the deployment such as another
deployment or site.
External subnets can be deployed with NAT or without NAT. You can add a maximum of
two external subnets - one external subnet with NAT and one external subnet without
NAT to a VPC. Both external subnets cannot be of the same type. For example, you
cannot add two external subnets, both with NAT. You can update an existing VPC
similarly.
Primary and Secondary IP Addresses for VMs
See VM IP Address Management.
SNAT and Floating IP Address
SNAT and Floating IP addresses are used only when you use NAT for an external
subnet.
In Source Network Address Translation (SNAT), the NAT router modifies the IP address
of the sender in IP packets. SNAT is commonly used to enable hosts with private
addresses to communicate with servers on the public Internet.
For VMs within the VPC to communicate with the rest of the deployment, the VPC must
be associated with an external network. In such a case, the VPC is assigned a unique
IP address, called the SNAT IP, from the subnet prefix of the external network. When
the traffic from a VM needs to be transmitted outside the VPC, the source IP address
of the VM, which is a private IP address, is translated to the SNAT IP address. The
reverse translation from SNAT IP to private IP address occurs for the return traffic.
Since the SNAT IP is shared by multiple VMs within a VPC, only the VMs within the VPC
can initiate connections to endpoints outside the VPC. The NAT gateway allows the
return traffic for these connections only. Endpoints outside the VPC cannot initiate
connections to VMs within a VPC.
In addition to the SNAT IP address, you can also request a Floating IP address — an
IP from the external subnet prefix that is assigned to a VM via the VPC that manages
the network of the VM. Unless the floating IP address is assigned to the private IP
address (primary or secondary IP address) of the VM, the floating IP address is not
reachable. When the VM transmits packets outside the VPC, the private IP of the VM is
modified to the Floating IP. The reverse translation occurs on the return traffic. As
the VM uses the Floating IP address, an endpoint outside the VPC can also initiate a
connection to the VM with the floating IP address.
The translation of the private IP addresses to Floating IP or SNAT IP address, and
vice versa, is performed in the hypervisor virtual switch. Therefore, the VM is not
aware of this translation. Floating IP translation may be performed on the hypervisor
that hosts the VM to which the floating IP is assigned to. However, SNAT translation
is typically performed in a centralized manner on a specific host.
NAT Gateway
NAT Gateways are used only when you use NAT for an external subnet.
Network Address Translation (NAT) is a process for modifying the source or
destination addresses in the headers of an IP packet while the packet is in transit.
In general, the sender and receiver applications are not aware that the IP packets are
being manipulated.
A NAT Gateway provides the entities inside an internal network with connectivity to
the Internet without exposing the internal network and its entities.
A NAT Gateway is:
A node or a AHV host. You need a host or a node to implement a NAT Gateway because
NAT gateways require operations like load balancing and routing that are
automatically performed by Flow Networking.
Connected to the internal network with an internal subnet based IP address and to
the external network with an externally-routable IP address.
The
externally-routable IP address may be an IP address from a private IP address
space or an RFC1918 address that is used as a NAT gateway. The NAT Gateway IP
address could be a static IP address or a DHCP assigned IP address.
Table 1.
NAT Gateway Failover Time
Event
Failover Time
Network controller stops on AHV
Up to 45 seconds.
Node reboot
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
not on the same node.
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
on the same node.
Up to 300 seconds (5 minutes).
Static IP Address
A static IP address is a fixed IP address that is manually assigned to an interface
in a network. Static IP addresses provide stable routes that do not have to be updated
frequently in the routing table since the static routes generated using static IP
addresses do not need to be updated.
Usually in a large IP-based network (a network that uses IP addresses), a Dynamic
Host Configuration Protocol or DHCP server assigns IP addresses to interfaces of an
entity (using DHCP client service on the entity). However, some entities may require a
static IP address that can be reached (manual remote access or via VPN) quickly. A
static IP address can be reached quickly because the IP address is fixed, assigned
manually and is stored in the routing table for a long duration. For example, a
printer in an internal network would need a static IP address so that it can be
connected reliably. Static IP addresses can be used to generate static routes which
remain unchanged in routing tables, thus providing stable long-term connectivity to
the entity that has the static IP address assigned.
Static Route
Static routes are fixed routes that are created manually by the network
administrator. Static routes are more suited for small networks or subnets.
Irrespective of the size of a network, static routes may be required in a variety of
cases. For example, in VPCs where you use virtual private networks (VPNs) or Virtual
Tunnel End Point (VTEP) over VxLAN transport connections to manage secure connections,
you could use static routes for specific connections such as site-to-site connections
for disaster recovery. In such a case it is necessary to have a known reliable route
over which the disaster recovery operations can be performed smoothly. Static routes
are primarily used for:
Facilitating the easy maintenance of the routing table in small networks that are
not expected to grow.
Routing to and from other internal route or stub networks. A stub network or an
internal route network is a network accessed using a single route and the router has
only one neighbor.
Use as a default or backup route. Such a route is not expected to specifically
match any other route in the routing table.
In a network that is not constantly changing, static routes can provide faster and
more reliable services by avoiding the network overheads like route advertisement and
routing table updates for specific routes.
Overlay networks
You can create an IP-based Overlay subnet for a VPC. An Overlay network is a
virtualized network that is configured on top of an underlying virtual or physical
network. A special purpose multicast network can be created as an Overlay network
within an existing network. A peer-to-peer network or a VPN are also examples of
Overlay networks. An important assumption for an Overlay network is that the
underlying network is fully connected. Nutanix provides the capability to create
Overlay network-based VPCs.
Comparing Overlay with VLAN
See how overlay networks compare with VLAN networks. A virtual local area network or VLAN
network is a Layer 2 network that provides virtualized network segmentation solution. VLANs
route and balance traffic in a network based on MAC addresses, Protocols such as Ethernet,
ports or specific subnets. A VLAN creates a virtual Layer 3 network using Layer 2 addressing
by separating broadcast domains virtually or logically. A VLAN configured network behaves as
if the network is segmented using a physical layer 2 switch without implementing a layer 3
IP based subnet for the segmentation. VLAN traffic usually cannot traverse outside the
VLAN.
The main advantage that VLAN networks provide is that VLAN networks require only layer 2
(L2) connectivity. VLANs do not require any of the layer 3 (L3) Flow Networking
features.
Overlay networks can be laid on underlying physical network connections including VLAN
networks. Overlay networks provide the following advantages and constraints:
IP address namespace is decoupled from the physical network.
You can create, update or delete overlay networks without requiring any configurations
on the physical network and powering down the systems.
You can create overlay networks that can span across multiple clusters.
VLAN networks are necessary for Bootstrapping of Flow Networking.
Note:
Nutanix
recommends using VLAN0 as the default untagged (also called native) VLAN for a CVM and
AHV host. You can create VLANs for user VMs using the
Network
Configuration
page. You can use the
Create Virtual
Switch
dialog box from the
Network Configuration
page
to create virtual switches for the user VM VLANs.
AHV Networking VLAN and Flow Networking VLAN: VLAN backed subnets for external
connectivity are managed by the Flow Networking control plane. Traditional AHV VLAN IPAM
networks are managed by Acropolis. Do not configure the same VLAN as both a Flow
Networking external network and an AHV IPAM network, as this can lead to IP address
conflicts.
Traffic Behavior
Broadcast Traffic
When all the guest VMs belonging to a subnet are in the same AHV: Flow Networking
broadcasts the traffic to all guest VMs in the same subnet.
When some VMs belonging to a subnet are in other AHVs: Flow Networking tunnels the
traffic to only those AHVs which have endpoints in the same subnet.
In other words, Flow Networking broadcasts traffic to all the guest VMs in the same
subnet.
Unicast Traffic
Unicast traffic is traffic transmitted on a one-to-one basis between IP addresses and
ports. There is only one sender and one receiver for the traffic. Unicast traffic is
usually the most used form of traffic in any LAN network using Ethernet or IP
networking. Flow Networking transmits unicast traffic based on the networking policies
set.
Unknown Unicast Traffic
Flow Networking always drops unknown unicast traffic. It is not transmitted to any
guest VM within or outside the source AHV.
Multicast Traffic
Flow Networking transmits the traffic to the VMs in the multicast group within the
same subnet. If the VM is on another AHV, the destination AHV must have an endpoint in
the subnet.
Multicast Group
A multicast group is defined by an IP address (called a multicast IP address, usually
a Class D IP address) and a port number. Once a host has group membership, the host
will receive any data packets that are sent to that group defined by an IP
address/port number.
Prerequisites for Enabling Flow Networking
Make sure you meet these prerequisites before you enable Flow networking on Prism
Central.
Requirements
Important:
Prism Central protection and recovery does not protect or recover
Flow networking services.
You must have the following fulfilled to enable Flow networking:
Ensure that you log on to Prism Central as a local account user with
Prism
Admin
role. If you log on to Prism Central as a non-local account
(IDP-based) user or without
Prism Admin
role privileges, then
Prism Central does not allow you to enable or use Flow Networking. The task is reported
as
Failed
with a
User Denied Access
message.
Ensure that the Prism Central running Flow networking is hosted on an AOS cluster
running AHV.
The network controller has a dependency only on the AHV version.
Ensure that microservices infrastructure on Prism Central is enabled. See
Prism
Central Guide
for information about microservices infrastructure.
Choose the x-large PC VM size for Flow networking deployments. Small or large PC VMs
are not supported for Flow Networking.
If you are running a small or large Prism Central VMs, upgrade the Prism Central VM
resources to x-large PC VM. See
Acropolis Upgrade Guide
for procedure to
install an x-large Prism Central deployment.
Although Flow networking may be enabled on a single-node PC, Nutanix strongly
recommends that you deploy a three-node scale-out Prism Central for production
deployments. The availability of Flow networking service in Prism Central is critical
for performing operations on VMs that are connected to overlay networks. A three-node
scale-out Prism Central ensures that Flow networking continues to run even if one of the
nodes with a PCVM fails.
Prism Central VM registration. You cannot unregister the Prism Element cluster that is
hosting the Prism Central deployment where you have enabled Flow Networking. You can
unregister other clusters being managed by this Prism Central deployment.
Ensure that Microservices Infrastructure (CMSP) is enabled on Prism Central before you
enable Flow Networking. See the
Prism Central Guide
for more
information.
For the procedure to enable Microservices Infrastructure (including enable in dark
site), see
Enabling Micro Services Infrastructure
section in the
Prism Central Guide
.
Note:
When you configure microservices infrastructure, ensure that the DNS name you
configure for CMSP does not end with
test
. Flow networking does not support
test
as a top level domain. For example, the following are valid domain configurations:
my.cluster.domain
my.test.cluster.test.domain
However, the following are examples of domains that Flow networking does not support:
my.cluster.test
my.cluster.domain.test
Ensure that you have created a virtual IP address (VIP) for Prism Central. The
Acropolis Upgrade Guide
describes how to set the VIP for the Prism
Central VM. Once set, do not change this address.
Ensure connectivity:
Between Prism Central and its managed Prism Element clusters.
To the Internet for connectivity (not required for dark site) to:
ECR for Docker images
S3 storage for LCM portal
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
Prism Central backup, restore, and migration. You cannot perform these operations on
MSP-enabled Prism Central.
Nutanix recommends increasing the MTU to 9000 bytes on the virtual switch vs0 and
ensure that the physical networking infrastructure supports higher MTU values (jumbo
frame support). The recommended MTU range is 1600-9000 bytes.
Nutanix CVMs use the standard Ethernet MTU (maximum transmission unit) of 1,500 bytes
for all the network interfaces by default. The system advertises the MTU of 1442 bytes
to guest VMs using DHCP to account for the extra 58 bytes used by Generic Network
Virtualization Encapsulation (Geneve). However, some VMs ignore the MTU advertisements
in the DHCP response. Therefore, to ensure that Flow networking functions properly with
such VMs, enable jumbo frame support on the physical network and the default virtual
switch vs0.
If you cannot increase the MTU of the physical network, decrease the MTU of every VM in
a VPC to 1442 bytes in the guest VM console.
Note:
Do not change the MTU of the CVM.
Figure.
Sample Configurations with and without Higher MTU - VS0, CVM and UVMs
Click to enlarge
Requirements for Upgrades
The following applies to upgrades of Flow networking network controller
(
Advanced Networking
in
Prism Control
Settings
):
Ensure that the Prism Central host is running an AHV version compatible with the
networking controller upgrade version. If necessary, upgrade the AHV version using LCM to
the version compatible with the network controller upgrade version.
Note:
See Compatibility and Interoperability Matrix on
the Nutanix Support portal for AOS and Prism Central compatibility.
Ensure that all the AHV hosts in the AOS cluster are running the version compatible with
the network controller upgrade version.
The network controller upgrade fails if any of
the AHV hosts is running an incompatible version.
Limitations
Limitations for Flow networking are as follows.
Flow networking does not support Flow security for guest VMs.
You cannot configure rules for Flow security if a guest VM has any NICs connected to
VPCs.
Flow networking is supported only on AHV clusters. It is not supported on ESXi or
Hyper-V clusters.
Flow networking is not enabled on the new PE cluster registering with the Flow
networking-enable Prism Central if the Prism Element cluster has an incompatible AHV
version.
Flow networking does not support updating a VLAN-backed subnet as an external subnet.
You cannot enable the external connectivity option in the
Update
Subnet
dialog box. Therefore, you cannot modify an existing VLAN-backed
subnet to add external connectivity.
VLAN backed subnets for external connectivity are managed by the Flow networking
control plane. Traditional AHV VLAN IPAM networks are managed by acropolis.
Note:
Do not configure the same VLAN as both a Flow networking external network and an AHV
IPAM network, as this can lead to IP address conflicts.
Flow networking cannot be disabled if any external subnets and VPCs are in use. Delete
the external subnets and VPCs and then disable Flow Networking.
Disaster Recovery backup and migration: CMSP-enabled Prism Central does not support
disaster recovery backup and migration operations both as a source and target host.
Flow Networking Configurations
Enabling Flow Networking
Before you begin
Ensure tha microservices infrastructure is enabled on Prism Central. See
Enabling Micro Services Infrastructure
section in the
Prism
Central Guide
.
About this task
Before you proceed to enable Flow Networking by enabling the
Advanced
Networking
option, see Prerequisites for Enabling Flow Networking.
To enable Advanced Networking, go to
Prism Central Settings
>
Advanced Networking
and do the following.
Procedure
In the
Advanced Networking
pane, click
Enable
.
Ensure that the prerequisites specified on the pane are fulfilled.
Figure.
Enabling Flow Networking
Click to enlarge
Prism Central displays the deployment in-progress.
Figure.
Deployment Progress
Click to enlarge
Flow Networking is enabled.
Figure.
Flow Networking Status
Click to enlarge
Disabling Flow Networking
About this task
You can disable Flow Networking. However, the network controller cannot be disabled
if any external subnets and VPCs are in use. Delete the subnets and VPCs before you
disable advanced networking.
Note:
Flow Networking cannot be disabled if any external subnets and VPCs are in use.
Delete the external subnets and VPCs and then disable Flow Networking.
To disable Flow Networking, do the following.
Procedure
On the
Advanced Networking
page, click
Disable
.
Figure.
Click to enlarge
On the confirmation message box, click
Confirm
to
confirm disablement.
To exit without disabling the
Advanced Networking
controller, click
Cancel
.
Unregistering a PE from the PC
Before unregistering a Prism Element from PC, disable Flow Networking on that Prism
Element using network controller CLI (or atlas_cli).
About this task
When Flow Networking is enabled on a Prism Central, it propagates the capability to
participate in VPC networking to all the registered Prism Elements that are running
the required AHV version.
In cases where there are VMs on the Prism Element attached to the VPC network, or if
the Prism Element is used to host one or more of the external VLAN networks attached
to a VPC, Prism Central alerts you with a prompt. When being alerted about the
aforementioned conditions, close the CLI and make adequate configuration to resolve
the condition (for example, select a different cluster for the external VLAN network
and delete the VMs attached to the VPC network running on the Prism Element). After
making such configurations, execute the network controller CLI to disable Flow
Networking. If the command goes through successfully, it is safe to unregister the
Prism Element.
For example, in a deployment of three Prism Elements - PE1, PE2 and PE3 - registered
to the Flow Networking-enabled PC, you want to unregister PE3 from the PC. You must
first disable Flow Networking using the following steps:
Procedure
SSH to PE3.
Run the
ncli cluster info
or
ncli cluster
get-params
command to get the cluster parameters.
Copy the cluster UUID (For example: 017457d3-1012-465c-9c54-aa145f2da7d9) from
the displayed cluster parameters.
SSH to the Prism Central VM.
Open the network controller console by executing the
atlas_cli
command.
nutanix@cvm$ atlas_cli
<atlas>
Execute the
config.add_to_excluded_clusters <cluster
uuid>
command, providing the cluster UUID that you copied
earlier.
An example of the PC alert, for the condition that PE3 VM is attached to an
external network, is as follows:
<atlas> config.add_to_excluded_clusters 0005bf8d-2a7f-3b2e-0310-d8e34995511e
Cluster 0005bf8d-2a7f-3b2e-0310-d8e34995511e has 1 external subnet,
which will lose connectivity. Are you sure? (yes/no)
Note:
To enable Flow Networking on the cluster, execute the
config.remove_from_excluded_clusters <cluster
uuid>
command, providing the cluster UUID.
What to do next
To verify if Flow Networking is disabled or enabled, SSH to PE3 and run the
acli atlas_config.get
command.
The output displays the
enable_atlas_networking
parameter as
False
if Flow
Networking is disabled and as
True
if Flow Networking is enabled on
the Prism
Element.
You can upgrade the Flow networking controller (
Advanced Networking
Controller
in
Prism Central Settings
) using Life Cycle Manager
(LCM) on Prism Central.
Before you begin
See Prerequisites for Enabling Flow Networking.
In case of upgrading the Flow networking controller in a dark site, ensure that LCM
is configured to reach the local web server that hosts the dark site upgrade
bundles.
Note:
The network controller upgrade fails to start after the pre-check if one or more
clusters have Flow Networking enabled and are running an AHV version
incompatible with the new network controller upgrade version.
About this task
To upgrade the network controller using LCM, do the following.
Procedure
Choose one of the following ways to reach the LCM page:
Go to
Administration
>
LCM
>
Inventory
Click
Check for Updates
on the
Advanced
Networking
page.
Figure.
Check for Updates
Click to enlarge
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the LCM page under
Software
.
Go to
Updates
>
Software
. Select the
Advanced Networking Controller
version you want to upgrade to and click
Update
.
Figure.
Networking Controller version
Click to enlarge
Deploying Flow Networking at a Dark Site
About this task
Dark sites are primarily on-premises installations which do not have access to the
internet. Such sites are disconnected from the internet for a range of reasons
including security. To deploy Flow networking at such dark sites, you need to deploy
the dark site bundle at the site.
This dark site deployment procedure includes downloading and deploying MSP and the
network controller bundles.
Before you begin
See Prerequisites for Enabling Flow Networking.
You need access to the Nutanix Portal from an Internet-connected device to
download the following dark site bundles:
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
MSP dark site bundle: https://portal.nutanix.com/page/downloads/list > Microservices Platform (MSP)
Flow Networking network controller dark site bundle: See the
Flow
Networking Release Notes
for the link to download the dark
site bundle.
Network Gateway bundle: See the
Flow Networking Release
Notes
for the link to download the dark site bundle with
checksum text file. Also, see
KB-12393
.
To deploy Flow Networking at a dark site, do the following.
Procedure
Start a web server to host the dark site bundles and act as a source for the
LCM downloads, if one is not already created.
The web server can be a virtual machine on a cluster at the dark site. All
the Prism Central VMs at the dark
site must have access to this web server. This web server
is used when you deploy any dark site bundle including the network
controller darksite bundle.
For more information about the server installation, see:
Linux web server
Windows web server
In Prism Central, go to
Administration
>
LCM
>
Inventory
.
Alternatively, SSH into the Prim Central VM as an admin user and run the
following command.
Where <LCM-web-server-ip> is the IP address of the LCM web server and
release is the name of the directory where the packages were extracted.
For example,
admin@pcvm$ mspctl controller airgap enable
--url=http://10.48.111.33/release
. Here,
10.48.111.33
is the IP address of the LCM web server
and
release
is the name of the directory where the
packages were extracted.
Verify the configuration by running the following command:
nutanix@cvm$ mspctl controller airgap get
From a device that has public Internet access, click the Nutanix Compatibility Bundle link and
down the bundle. Transfer this bundle to the LCM web server and extract the
contents.
From a device that has public Internet access, Nutanix recommends that you
download and extract the latest MSP dark site bundle, transfer it to the LCM web
server, and extract the contents.
From a device that has public Internet access, download the Flow networking
dark site bundle (see Release Notes | Flow Networking for
download links). Transfer the bundle to the LCM web server.
Extract or unpack the Flow networking dark site bundle on the LCM web
server.
After unpacking, check if the system shows a directory path that includes the
following as per the example:
http://<LCM-web-server-ip>/release/builds/msp-builds/msp-services/464585393164.dkr.ecr.us-west-2.amazonaws.com/nutanix-msp/atlas-hermes/
.
Run the following command after unpacking to ensure that the file permissions
are not disrupted during the unpacking:
Linux.
chmod -R +r builds
Windows
NTFS.
$> takeown / R / F *
$> icacls <Build-file-path> /t /grant:F
This section provides information to assist troubleshooting of Flow Networking
deployments. This is in addition to the information that the "Prism Central Guide"
provides.
Audit Logs
Prism Central generates audit logs for all the flow networking activities like it
does for other activities on Prism Central. See
Audit Summary View
in the
Prism Central Guide
, for more information about Audit log.
Support Bundle Collection
To support troubleshooting for Flow Networking, you can collect logs.
To collect the logs, run the following commands on the Prism Central VM console:
msp
tag will collect logs from the services running on MSP
pods and persistent log volumes (application-level logs)
anc
tag will collect the support bundle, which includes
database dumps and OVN state
-O
flag adds tag-level options
msp_pod=true
collects logs from MSP service pods
On the PC, these logs can be found under
/var/log/containers
.
persistent=true
collects persistent log volumes
(application-level logs for ANC)
On the PC, these can be found under /var/log/ctrlog
kubectl_cmds=true
runs
kubectl
commands to
get the Kubernetes resource state
--duration
sets the duration from the present to collect
The command run generates a zip file at a location, for example:
/home/nutanix/data/logbay/bundles/<filename>.zip
Unzip the bundle and you'll find the
anc
logs under a directory
specific to your MSP cluster, the worker VM where the pod is running, and the logging
persistent volume of that pod. For example:
For more information about the task run, see the text file that the command generates
at a location, for
example:
/home/nutanix/data/logbay/taskdata/<taskID>/collection_result.txt
For more information about the
logbay collect
command, see the
Logbay Log Collection (Command Line)
topic in the
Nutanix Cluster
Check Guide
(NCC Guide).
Layer 2 Virtual Subnet Extension Alert
The
L2StretchLocalIfConflict
alert (Alert with Check ID
- 801109) may occur while performing Layer 2 virtual subnet extensions. See KB-10395
for more information about its resolution.
Network Gateway Upgrades
Nutanix deployment can detect and install upgrades for the onprem Nutanix Gateways.
For information about identifying the current Nutanix Gateway version, see Identifying the Gateway Version.
For onprem Nutanix Gateways, the upgrades need to be detected and installed on the respective
PC on which each Nutanix Gateway is installed.
For more information, see Detecting Upgrades for Gateways.
When PC detects the upgrades, it displays a banner on the
Gateways
tab
of the
Connectivity
page. The banner notifies you that a Gateway upgrade
is available after you have run LCM inventory. The table on the
Gateways
tab also displays an alert (exclamation mark) icon for the network gateways that the upgrade
applies to. The hover message for the icon informs you that an upgrade is available for that
Gateway.
Figure.
Upgrade Banner
Click to enlarge
For more information about the upgrade procedure, see Upgrading the PC-managed Onprem Nutanix VPN Gateways.
Identifying the Gateway Version
About this task
To identify the current Nutanix Gateway version, do the following:
Procedure
Click the hamburger icon and
Networking & Security
>
Connectivity
.
On the
Gateways
tab, click the Gateway name link text to open the
Gateway details page.
In the Gateway table, the VPN Gateway name is a clickable link text.
The
Gateway Version
is listed in the
Properties
widget.
Figure.
Gateway Version
Click to enlarge
Detecting Upgrades for Gateways
About this task
Prism Central can detect whether new Gateway upgrades are available, or not, for
Nutanix Gateways using LCM. You can then install the upgrade.
Procedure
Click the hamburger icon of
Dashboard
.
Click
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
Note:
Nutanix recommends that you select
Enable LCM Auto
Inventory
in the
LCM
page in Prism
Central to continuously detect new Gateway upgrades as soon as they are
available.
The upgrade notification banner is displayed on the
Gateways
page.
Upgrading the PC-managed Onprem Nutanix VPN Gateways
About this task
Perform upgrades of PC-managed Nutanix Gateways using the respective PC on which the
Gateway is created.
To upgrade the on-prem Nutanix Gateways, do the following:
Procedure
Log on to the Prism Central as the admin user and click the gear icon.
Go to
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the
LCM
page under
Software
.
Note:
Skip this step if you have enabled auto-inventory in the
LCM
page in Prism Central.
Go to
Updates
>
Software
. Select the
Gateway version you want to upgrade to and click
Update
.
LCM upgrades the Gateway version. This process takes sometime.
Network and Security View
The
Network and Security
category in the
Entities
Menu
expands on-click to display the following networking and security
entities that are configured for the registered clusters:
Subnets
: This dashboard displays the subnets and the operations
that you can perform on subnets.
Virtual Private Clouds
: This dashboard displays the VPCs and the
operations that you can perform on VPCs.
Floating IPs
: This dashboard displays a list of floating IP
addresses that you are using in the network. It allows you to request for floating IP
addresses from the free pool of I addresses available to the clusters managed by the
Prism Central instance.
Connectivity
: This dashboard allows you to manage the following
networking capabilities:
Gateways
: This tab provides a list of network gateways that
you have created and configured, and the operations you can perform on the network
gateways. You can check and upgrade the Gateway bundle in
Administration
>
LCM
>
Inventory
.
VPN Connections
: This tab provides a list of VPN connections
that you have created and configured, and the operations you can perform on VPN
connections.
Subnet Extensions
: This tab provides a list of subnets that
you have extended at the Layer 2 level using VPN (point-to-point over Nutanix VPN)
or VTEP (point-to-multi-point including third party).
Security Policies
: This dashboard provides a list of security
policies you configured using Flow Segmentation. For more information about Security
Policies, see the Flow Microsegmentation Guide.
See "Network Connections" section for information on how to configure network connections.
Subnets (Overlay IP subnets), Virtual private clouds, floating IPs, and Connectivity are
Flow Networking features. These features support flexible app-driven networking that focuses
on VMs and applications instead of virtual LANs and network addresses. Flow Networking
powers network virtualization to offer a seamless network experience with enhanced security.
It is disabled by default. It is a software-defined network virtualization solution
providing overlay capabilities for the on-premises AHV clusters.
Security policies drives the Flow Segmentation features for secure communications. See
Flow Microsegmentation Guide.
Subnets
Manage subnets in the
List
view of
Subnets
dashboard in the
Network and
Security
section.
To access the
Subnets
dashboard, select
Subnets
from the entities menu in Prism Central. The
Subnets
dashboard allows you to view information about the subnets configured for the registered
clusters.
Note:
This section describes the information and options that appear in the
Network
and Security
dashboard. See
Entity Exploring
for instructions on how
to view and organize that information in a variety of ways.
Figure.
Subnets Dashboard
Click to enlarge
The following table describes the fields that appear in the subnets list. A dash (-) is
displayed in a field when a value is not available or applicable.
Table 1.
Subnets Dashboard Fields
Parameter
Description
Values
Name
Displays the subnet name.
(subnet name)
External Connectivity
Displays whether or not the subnet has external connectivity
configured.
(Yes/No)
Type
Displays the subnet type.
VLAN
VLAN ID
Displays the VLAN identification number.
(ID number)
VPC
Displays the name of the VPC that the Subnet is used in.
(Name of VPC)
Virtual Switch
Displays the virtual switch that is configured for the VLAN you selected. The
default value is the default virtual switch
vs0
.
Note:
The virtual
switch name is displayed only if you add a VLAN ID in the VLAN ID
field.
(virtual switch name)
IP Prefix
Displays the IPv4 Address of the network with the prefix.
(IPv4 Address/Prefix)
Cluster
Displays the name of the cluster for which this subnet is configured.
(cluster name)
Hypervisor
Displays the hypervisor that the subnet is hosted on.
(Hypervisor)
To filter the list by network name, enter a string in the filter field. (Ignore the
Filters
pane as it is blank.)
To view focused fields in the List, select the focus parameter from the
Focus
drop down list. You can create your own customised focus
parameters by selecting
Add custom
from the drop down list and
selecting the necessary fields after providing a
Name
, in the
Subnet Columns
.
There is a
Network Config
action button to configure a new network
(see
Configuring Network Connections
The
Actions
menu appears when one or more networks are selected and
includes a
Manage Categories
option (see
Assigning a Category
).
Go to the
Subnets
list view by clicking
Network and Security
>
Subnets
on the left side-bar.
Figure.
Subnets Page
Click to enlarge
To view or select actions you can perform on a subnet, select the subnet and click the
Actions
dropdown.
Figure.
Subnet Actions
Click to enlarge
Table 2.
Subnet Actions
Action
Description
Update
Click this action to update the selected subnet. see Updating a Subnet in the Flow Networking
Guide.
Manage Extension
Click this action to create a subnet extension. A subnet extension allows VMs
to communicate over the same broadcast domain to a remote Xi availability zone (in
case of Xi-Leap based disaster recovery) via the extension.
Manage Categories
Click this action to associate the subnet with a category or change the
categories that the subnet is associated with.
Delete
Click this action to delete the selected subnet. See Deleting Subnets, Policies, or Routes in the
Flow Networking Guide
.
You can also filter the list of subnets by clicking the
Filters
option and selecting the filtering parameters.
Subnet Summary View
View the details of a subnet listed on the Subnets page.
To view the details of a subnet, click the name of the subnet on the subnet list view.
Figure.
Subnet Summary Page
Click to enlarge
The
Summary
page provides buttons for the actions you can perform on
the subnet, at the top of the page. Buttons for the following actions are available:
Update
,
Extend
,
Manage
Categories
, and
Delete
.
The subnet
Summary
page has the following widgets:
Widget Name
Information provided
Subnet Details
Provides the following:
Type
— Displays the type of network like VLAN or
Overlay.
VLAN ID
— Displays the VLAN ID. This parameter is
displayed only for VLAN networks.
VPC
— Displays the VPC name. This parameter is displayed
only for Overlay networks.
Cluster
— Displays the cluster that the VLAN network is
configured on. This parameter is displayed only for VLAN networks.
IP Prefix
— Displays the IP address prefix configured for
the network. This parameter is displayed for both VLAN and Overlay
networks.
IP Pool
Provides the IP address
Pool Range
assigned to the
network.
External Connectivity
Provides the following:
NAT
— Displays whether NAT is enabled or disabled for
VPCs connecting to the network. When you hover on the
Enabled
/
Disabled
status, the hover message displays details of VPCs connected to the external
subnet.
Associated VPCs
— Displays the VPCs associated with this
external subnet.
Virtual Private Clouds
You can manage Virtual Private Clouds (VPCs) on the
Virtual Private
Clouds
dashboard.
Go to the
Virtual Private Clouds
dashboard by clicking
Network and Security
>
Virtual Private Clouds
on the left side-bar.
Figure.
Virtual Private Clouds dashboard
Click to enlarge
You can configure the table columns for the VPC list table. The available column list
includes
Externally Routable IP Addresses
that provides address
space within the VPC that is reachable externally without NAT.. For the list of columns that
you can add to the list table, see Customizing the VPC List View.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
To view or select actions you can perform on a VPC, select the VPC and click the
Actions
drop down.
You can also filter the list of VPC by clicking the
Filters
option
and selecting the filtering parameters.
Customizing the VPC List View
About this task
You can customize the columns in the table. Click the
View by
drop down and select
+ Add custom
.
In the
Virtual Network Columns
dialog box, do the following.
Procedure
Enter a name for the view.
Select the columns you want displayed in the table.
During the column selection, the columns you select are moved under the
Selected Columns
list. The
Name
(of the VPC) column is the default column
already selected. You can add a maximum of 10 columns (including the
Name
column) to the
Selected
Column
list.
Figure.
Customizing Columns in VPC View
Click to enlarge
To arrange the order of the selected columns, hover on the column name and
click the up or down arrow button as appropriate.
Click
Save
.
VPC Details View
To view the details of a VPC, click the name of the VPC on the VPC list view.
The VPC details view has the following tabs:
Summary
Figure.
Summary Tab
Click to enlarge
The
Summary
tab provides the following panes:
DNS Servers
—Provides more information about the DNS Servers
used by the VPC.
External Connectivity
—Provides the name of the external
subnet, NAT Gateway host details, router/SNAT IP address and the IP address spaces or
ranges configured for the VPC.
Floating IP Addresses
—Provides details of the floating IP
addresses that the VPC uses.
Subnets
Figure.
Subnet Tab
Click to enlarge
The
Subnet
tab provides the following information for the
subnets:
Name
—Displays the name of the subnet.
IP Range
—Displays the IP address range configured for the
subnet.
DHCP IP Pool
—Displays the DHCP IP address pool configured for
the subnet.
Default Gateway IP
—Displays the IP address used as the
default gateway by the entities in the subnet.
Actions
—Displays the actionable links to
Edit
or
Delete
the subnet.
Policies
Figure.
Policies Tab
Click to enlarge
The
Policies
tab maps the following information about the
security-based traffic shaping policies you configure:
Priority
—The traffic priority.
Rule
—The
Allow
or
Deny
rule set for the priority.
Traffic
—The traffic type that the priority and rule should be
applied to.
Actions
—Actions you can take on the policy. You can perform
three actions:
Clear counters
,
Edit
the
policy or
Delete
the policy.
Routes
Figure.
Routes Tab
Click to enlarge
The
Routes
tab provides the following information about the
routes:
The VPC details view has the following configuration options for the VPC:
Update
: Use this option to update the VPC. For more information,
see Updating Virtual Private Cloud.
Add Subnet
: Use this option to add a subnet to the VPC. For more
information, see Creating a Subnet.
Create Static Routes
: Use this option to create a static route.
For more information, Creating Static Routes.
Update Static Routes
: Use this option to update static route
configurations that you already created. For more information, see Updating Static Routes.
Create Policy
: Use this option to create traffic policies in
addition to the pre-configured default policy. When you create a VPC, there is one default
policy that Advanced Networking creates for the VPC. This policy is pre-configured and
cannot be edited. For more information, see Creating a Policy.
Clear All Counters
: Allows you to clear all the counters for the
VPC.
Delete
: Allows you to delete the VPC. For more information, see
Deleting a Virtual Private Cloud.
Floating IPs
You can access floating IPs on the
Floating IPs
dashboard or list view in the
Network and Security
section.
For information about floating IP addresses and their role in Flow Networking, see SNAT and Floating IP Address.
Go to the
Floating IPs
dashboard by clicking
Network and Security
>
Floating IPs
on the left side-bar.
Figure.
Floating IPs dashboard
Click to enlarge
To view or select actions you can perform on a floating IP address assigned, select the
floating IP address and click the
Actions
drop down. The following
actions are available for a selected floating IP address:
Update—Assign or change the assignment of the floating IP address. You can assign the
floating IP address to a IP address such as a private IP address in a VPC or the primary
IP address of a VM or a secondary IP address created on a VM.
Delete—Delete the floating IP address. The deleted IP address returns to the IP address
pool as unused. Before you delete, ensure that it is not assigned to a private IP address
or a VM. Change the assignment to
None
if it is already assigned,
using the
Update
action.
Note:
Floating IP addresses are not reachable (Pings fail) unless you associate them to
primary or secondary IP addresses of VMs. For more information about assigning floating IP
addresses to secondary IP addresses of VMs, see
Assigning Secondary IP Addresses to Floating
IPs
.
To filter the list of floating IP address assignments, click the
Filters
option and select the appropriate filtering
parameters.
To request floating IP addresses, see Requesting Floating IPs.
Connectivity
You can access network Gateways, VPN connections and subnet extensions on the
Connectivity
dashboard.
Click
Network & Security
>
Connectivity
to see the
Connectivity
dashboard.
The
Connectivity
dashboard opens on the
Gateways
tab. To see the VPN connections, click the
VPN Connections
tab. To see
the subnets extended across AZs, click the
Subnet Extensions
tab.
Gateways Summary View
The Connectivity dashboard opens on the Gateways dashboard or summary view.
The
Gateway
dashboard provides a list of gateways created for the
clusters managed by the Prism Central.
The
Gateways
dashboard provides a
Create
Gateway
dropdown menu that lets you create a
Local
or a
Remote
gateway. You can create a local or remote gateway with
VPN
or
VTEP
service. For more information,
see Creating a Network Gateway.
You can select a gateway from the list (select the checkbox provided for the gateway) and
then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected gateway.
Figure.
Gateways dashboard
Click to enlarge
The
Gateway
summary list view provides the following details about
the gateway.
Table 1.
Gateway List Fields
Parameter
Description
Values
Name
Displays the name of the gateway.
(Name of gateway)
Type
Displays the gateway type.
(Local or Remote)
Service
Displays the service that the gateway uses.
(VPN or VTEP)
Service IP
Displays the IP address used by the service.
(IP address)
Status
Displays the operational status of the gateway.
(Up or Down)
Attachment Type/Vendor
Displays the type of subnet associated with the gateway.
(VLAN or Overlay-VPC name)
Connections
Displays the number of service connections (such as VPN connections) configured
and operational on the gateway.
(number)
You can click the name of a gateway to open the gateway details page that presents the
information about the gateway in widgets.
Gateway Details View
You can click the name of a gateway in the
Gateway
dashboard
list to open the gateway details page that presents the information about the gateway in
widgets.
The gateway details page displays the name of the gateway on the top left corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update
Gateway
page. For more information, see Updating a Network Gateway in
Flow
Networking Guide
.
The
Delete
button allows you to delete the gateway. For more
information, see Deleting a Network Gateway in
Flow
Networking Guide
.
Figure.
Gateway Details View
Click to enlarge
The details about the gateway are organized in widgets as follows:
Table 1.
Gateway Details
Parameter
Description
Values
Properties widget
Type
Displays the gateway type.
(Local or Remote)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address)
Status
Displays the operational status of the gateway.
(Up or Down)
Gateway Version
Displays the version of the Nutanix gateway appliance deployed.
(Version)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Service Configuration
Service
Displays the service used by the gateway.
(VPN or VTEP)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
VPN Connections
Displays the total number of VPN connections associated with the
gateway.
(Number - actionable link. Click the link to open the VPN connection details
page for the associated VPN connection.)
View VPN Connections
Click this link to open the VPN Connections tab.
-
VPN Connections Summary View
The Connectivity dashboard allows you to open the VPN Connections dashboard or summary
view.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways between
which you want to create the VPN connection.
The
VPN Connections
dashboard provides a list of VPN connections
created for the clusters managed by the Prism Central.
The
VPN Connections
dashboard provides a
Create VPN
Connection
button that opens the
Create VPN Connection
.
For more information, see Creating a VPN Connection in
Flow Networking
Guide
.
You can select a VPN connection from the list (select the checkbox provided for the VPN
connection) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected VPN
connection.
The
VPN Connections
summary list view provides the following details
about the VPN connection.
Figure.
VPN Connections dashboard
Click to enlarge
Table 1.
VPN Connections List Fields
Parameter
Description
Values
Name
Displays the name of the connection.
(gateway name)
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Local Gateway
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Remote Gateway
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
VPN Connections Details View
You can click the name of a VPN connection in the
VPN
Connections
dashboard list to open the VPN connection details page that presents
the information about the VPN connection in widgets.
The VPN connection details page displays the name of the VPN connection on the top left
corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update VPN
Connection
page. For more information, see Updating a VPN Connection in
Flow
Networking Guide
.
The
Delete
button allows you to delete the VPN connection. For
more information, see Deleting a VPN Connection in
Flow
Networking Guide
.
Figure.
VPN Connection Details
Click to enlarge
The details about the VPN connection are organized in widgets as follows:
Summary tab—See the
VPN Connection Summary Tab Details
table below.
Throughput tab—See the
VPN Connection Throughput Tab Details
table
below.
IPSec Logging tab—Provides logs for the IPSec tunnel.
Routing Protocol Logging tab—Provides logs for the routing protocol used in the VPN
connection.
Table 1.
VPN Connection Summary Tab Details
Parameter
Description
Values
VPN Connection widget
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
Local Gateway Properties
Gateway Name
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Type
Displays the type of gateway.
(Local)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Tunnel IP
Displays the Tunnel IP address of the local gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address that you assigned to the local gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
(Up or Down)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Remote Gateway Properties
Gateway Name
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Type
Displays the type of gateway.
(Remote)
Tunnel IP
Displays the Tunnel IP address of the remote gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
ASN
Displays the ASN of the EBGP route. This information is only displayed if you
configured EBGP as the External Routing protocol.
(Number)
Vendor
Displays the name of the vendor of the gateway appliance at the remote
site.
(Name of vendor of gateway appliance)
External IP
Displays the IP address assigned to remote the gateway.
(IP Address that you assigned to the remote gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
-
Protocol Details
Service
Displays the service used by the gateway.
(VPN or VTEP)
Gateway Routes
Displays the status of the routes used by the gateways.
(Sent)
Subnet Extensions Summary View
The Connectivity dashboard opens on the Subnet Extensions dashboard or summary
view.
The
Subnet Extensions
dashboard provides a list of subnet extensions
created for the clusters managed by the Prism Central.
The
Subnet Extensions
dashboard provides a
Create Subnet
Extension
dropdown menu that lets you extend a subnet
Across
Availability Zones
or
To a Third Party Data Center
. You
can extend a subnet using
VPN
or
VTEP
service.
See Layer 2 Virtual Network Extension for more information.
You can select a subnet extension from the list (select the checkbox provided for the
subnet extension) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected subnet
extension.
Figure.
Subnet Extensions dashboard
Click to enlarge
The
Subnet Extensions
summary list view provides the following
details about the gateway.
Table 1.
Subnet Extensions List Fields
Parameter
Description
Values
Name
Displays the name of the subnet extension.
(Name of subnet extension)
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Extension Over
Displays the service that the subnet extension uses.
(VPN or VTEP)
Extension Uses
Displays the name of the local network gateway that the subnet extension
uses.
(Name of local network gateway)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Remote Site
Displays the name of the remote network gateway that the subnet extension
uses.
(Name of remote network gateway)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
You can click the name of a subnet extension to open the subnet extension details page that
presents the information about the subnet extension in widgets.
Subnet Extensions Details View
You can click the name of a subnet extension in the
Subnet
Extensions
dashboard list to open the subnet extension details page that presents
the information about the subnet extension in widgets.
The subnet extension details page displays the name of the subnet extension on the top left
corner. It has two tabs -
Summary
and
Address
Table
. The
Summary
tab provides the information about the
subnet extension in widgets. The
Address Table
tab provides MAC Address
information only when the subnet extension uses VTEP service.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update Subnet
Extension
page. See Updating an Extended Subnet for more information.
The
Delete
button allows you to delete the subnet extension. See
Removing an Extended Subnet for more information.
Figure.
Subnet Extensions Details View - Address Table Tab for VPN-based Extension
Click to enlarge
Figure.
Subnet Extensions Details View - Address Table Tab for VTEP-based Extension
Click to enlarge
The details about the subnet extension are organized in two tabs. The
Summary
tab organizes the subnet extension details in the extended
widget as provided in the table. The
Address Table
tab provides
details about the MAC addresses in a list.
(For VLAN subnets only) Displays the VLAN ID of the VLAN subnet that is
extended.
(VLAN ID number)
VPC
(For Overlay subnets only) Displays the name of the VPC subnet that is
extended.
(Name of VPC)
Cluster
(For VLAN subnets only) Displays the cluster that the VLAN subnet belongs
to.
(Name of cluster)
IP Address Prefix
Displays the network IP address with prefix, of the VLAN subnet that is
extended.
(IP Address with prefix)
Virtual Switch
(For VLAN subnets only) Displays the virtual switch on which the VLAN subnet is
configured.
(Virtual Switch name such as vs0 or vs1)
IP Address Pools
Pool Range
Displays the range of IP addresses in the pool configured in the subnet that is
extended.
(IP address range)
(Interactive Graphic Pie Chart)
Displays a dynamic pie chart that displays the statistic you hover on. Displays
the following IP address statistics outside the pie chart, that you can hover on:
Total number of IP addresses available.
Used IP addresses in the subnets
Used IP addresses in the IP address pools
Free IP addresses in the subnets
Free IP addresses in the IP address pools
(IP Address statistics)
Subnet Extension
Subnet Extension (properties) - Common
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Local IP Address
Displays the IP address that you entered in the
Local IP
Address
field while creating the subnet extension.
(IP Address)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Subnet Extension (properties) - (Only for
Across Availability Zones
type)
Local Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the local AZ that is hosting the subnet that is extended.
(Name of the local Availability Zone)
Remote Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the remote AZ that the subnet is extended to.
(Name of the remote Availability Zone)
Remote Subnet
(Only for
Across Availability Zones
type) Displays the
name of the remote subnet that the subnet extension connects to.
(Name of remote subnet)
Remote IP Address
(Only for
Across Availability Zones
type) Displays the
IP address that you entered in the
Remote IP Address
field
while creating the subnet extension.
(IP Address)
Subnet Extension (properties) - (Only for
To a Third Party Data Center
type)
Local Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the local gateway used for the subnet extension.
(Name of local gateway)
Remote Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the remote gateway used for the subnet extension.
Note:
This section describes the information and options that appear in the security policies dashboard.
See Entity Exploring for instructions on how to view
and organize that information in a variety of ways.
See Flow Microsegmentation Guide for information
about how to create and apply security policies.
Figure.
Security Policies Dashboard
Click to enlarge
The following table describes the fields that appear in the security policies list. A dash
(-) is displayed in a field when a value is not available or applicable.
Table 1.
Security Policies List Fields
Parameter
Description
Values
Name
Displays the policy name. The policy is one of three types: application,
quarantine, or isolation.
(name), Application, Quarantine, Isolation
Purpose
Describes (briefly) the policy's purpose.
(text string)
Policy
Displays (high level) what the policy does.
(boxed text)
Status
Displays the current status of the policy (either applied currently or in
monitoring mode).
Applied, Monitoring
Last Modified
Displays the date the policy was last modified (or the creation date if the
policy has never been modified).
(date)
You can filter the security polices list based on several parameter values. The following
table describes the filter options available when you open the Security Policies view
Filter
pane. To apply a filter, select a parameter and check the
box of the desired value (or multiple values) you want to use as a filter. You can apply
filters across multiple parameters.
Table 2.
Filter Pane Fields
Parameter
Description
Values
Name
Filters on the item name. Select a condition from the pull-down list
(
Contains
,
Doesn't contain
,
Starts with
,
Ends with
, or
Equal to
) and enter a string in the field. It will return a
list of security policies that satisfy the name condition/string.
(policy name string)
Type
Filters on the policy type. Check the box for one or more of the policy types
(application, quarantine, isolation). It will limit the list to just those policy
types.
Application, Quarantine, Isolation
Status
Filters on the policy status. Check the box for applied or monitoring.
Applied, Monitoring
The security policies dashboard includes a
Create Security Policy
action button with a drop-down list to
Secure an Application
or
Isolation Environments
.
The
Actions
menu appears when one or more policies are selected. It
includes options to update, apply, monitor, and delete. The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Security Policy Details View
To access the details page for a security policy, click on the desired security policy name
in the list (see Security Policies Summary View).
The Security Policy details page includes the following:
The policy name appears in the upper left. You can switch from one policy to another by
selecting the policy name from the pull-down list.
The rule status appears below the name and indicates whether the policy is being applied
currently or is in monitoring mode.
Three columns appear that specify the Inbound policy (on the left), the affected
entities (in the middle), and the Outbound policy (on the right).
There are three action buttons (upper right).
Click the appropriate button to update, apply, monitor, or delete the policy (see
Nutanix Security Guide
for details). The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Click the question mark icon to open a help page in a separate tab or window.
Click the X icon to close the details page.
Figure.
Security Policy Details View: Monitoring Rule Example
Click to enlarge
Figure.
Security Policy Details View: Applied Rule Example
Click to enlarge
For more information about Security Policies, see Flow Microsegmentation Guide.
Virtual Private Cloud
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that functions
as a logically isolated virtual network. A VPC could be made up of one or more subnets that
are connected through a logical or virtual router. The IP addresses within a VPC must be
unique. However, IP addresses may overlap across VPCs. As VPCs are provisioned on top of
another IP-based infrastructure (connecting AHV nodes), they are often referred to as the
overlay networks. Tenants may spin up VMs and connect them to one or more subnets within a
VPC.
Virtual Private Cloud (VPC) is a virtualized network of resources that are specifically
isolated from the rest of the resource pool. VPC allows you to manage the isolated and secure
virtual network with enhanced automation and scaling. The isolation is done using network
namespace techniques like IP-based subnets or VLAN based networking.
AHV provides the framework to deploy VPC on on-premises clusters using the following.
Advanced Networking subnets and DHCP management
Multiple uplink and bridge management via virtual switch (VS)
Virtual Private Network (VPN) gateways and connections
Flow Networking simplifies the deployment and configuration of overlay-based VPCs. It allows
you to quickly:
Create, update and delete VPCs.
Create, update and delete subnets within VPCs.
Note:
Create subnets as necessary when you
create VPCs.
Add network security policies and services.
Configure hybrid cloud connectivity with VPNs.
This section covers the concepts and procedures necessary to implement VPCs in the
network.
VM IP Address Management
Primary Address
The primary IP address is assigned to a VM during initialization when the cluster provides
any virtual NIC (NIC) to a VM.
Select
Assign Static IP
as the
Assignment
Type
to add a static IP address as primary IP address of the VM, when you
attach a subnet to a VM.
Select
Assign with DHCP
as the
Assignment
Type
to allow DHCP to dynamically assign an IP address to the VM.
Select
No Private IP
as the
Assignment
Type
if you do not want to assign an IP address to the vNIC of the VM.
For more information about attaching a subnet to a VM, see Creating a VM through Prism Central (AHV) in the
Prism Central Guide
.
Secondary IP Addresses (Overlay Networks only)
For your deployment, you may need to configure multiple (static) IP addresses to a single
NIC. These IP addresses (other than the primary IP address) are secondary IP addresses. A
secondary IP address can be permanently associated with a specific NIC or be changed to any
other NIC. The NIC ownership of a secondary IP address is important for security routing
policies.
Note:
You can configure secondary IP addresses only for VMs in an Overlay network.
You can configure secondary IP addresses to a NIC when you want to:
Associate multiple floating IP addresses with one VM without creating multiple NICs
(each with one primary IP address) for the VM. You can assign one floating IP address to
one secondary IP address that you create for the single NIC. For information about
floating IP addresses, see Requesting Floating IPs.
Run appliances, such as load balancers, that have multiple IP addresses on each
interface.
Host applications in a High Availability (HA) configuration where the ownership of IP
address moves from the active entity to the standby entity when the active entity goes
down.
Host applications in a clustered configuration where the ownership of IP address follows
the leader.
Host Nutanix Files service in a VPC as a case of clustered application.
Note:
In applications that use secondary IP addresses as virtual IP addresses and the NIC
ownership of the secondary IP address changes dynamically from one NIC to another,
configure the application to incorporate the ownership change in its settings or
configuration. If the applications do not incorporate these ownership changes, the VPCs
configured for such applications fail.
For information about configuring secondary IP addresses, see Creating Secondary IP Addresses.
IP Address Information
You can view the IP addresses configured on a VM by clicking the
See
More
link in the
IP Address
column in the VM
details view to open the
IP Address Information
box.
Note:
The
See More
link in the
IP Address
column in the VM details view and the
IP Address Information
box are
available only if the VM has any secondary IP addresses configured.
Figure.
IP Address Information
Click to enlarge
Creating Secondary IP Addresses
You can assign multiple secondary IP addresses to a single vNIC.
About this task
You can add multiple secondary IP addresses to the vNIC configured on a VM. Add the
secondary IP addresses to the vNIC in the
Create
VM
or the
Update
VM
page.
Procedure
Go to the
Networks
section.
Click the
Edit
icon for the subnet that you want to add
the secondary IP addresses from.
The
Update NIC
dialog box opens.
Check the
Add Secondary IPs
check box in the
Update NIC
dialog box.
Figure.
Add Secondary IP Addresses
Click to enlarge
Add a comma-separated list of the secondary IP addresses that you want to add
to the vNIC of the VM.
Note:
Ensure that the secondary IP addresses are within the same subnet that
the primary IP address of the
NIC
is from. The subnets are displayed in the
Private IP Assignment
section in the
Update NIC
dialog box.
Ensure that the secondary IP address is not the same as the IP address
provided in the
Private IP Assignment
field.
Click
Save
.
Click
Next
on the
Resources
and the
Management
tabs of the
Update VM
page.
If you need to make any other changes on the
Resources
and the
Management
tabs for any configurations other
than adding secondary IP addresses, make the changes and then click
Next
on these tabs.
Click
Launch VM
on the
Review
tab
after you review
What to do next
You can view the secondary IP addresses configured on the VM in the
IP
Address Information
box.
Assigning Secondary IP Addresses to Interfaces
Assign the secondary IP addresses to interfaces or subinterfaces on the
VM.
About this task
To assign the secondary IP addresses to virtual interfaces on the VM, do the
following on the VM details page:
Procedure
Click
Console
.
Log in as a root user.
Run the
ifconfig
command as follows:
root@host$ ifconfig <interface> <secondary ip address> <network mask>
Provide the following in the command:
Parameter
Description
<interface>
The interface of the VM such as eth0. You can provide
subinterfaces
such as eth0:1 and eth0:2.
<secondary IP address>
The secondary IP address that you created and want to
associate with the interface.
<network mask>
The network mask that is an expansion of the network prefix
of the network that the secondary IP address belongs to. For
example, if the secondary IP address belongs to 10.0.0.0/24 then
the network mask is 255.255.255.0.
Repeat the aforementioned steps for all the secondary IP addresses you want to
associate with interfaces on the VM.
Exit from the Console.
Assigning Secondary IP Addresses to Floating IPs
Assign the secondary IP addresses to floating IP addresses on the VM.
About this task
After you assign secondary IP addresses to interfaces or subinterfaces on the VM, you
can assign the secondary IP addresses to floating IP addresses that may be used for
external connectivity.
Do one of the following:
Procedure
Assign floating IP addresses when you request floating IP addresses in the
Assign Floating IPs
section of the
Request
Floating IP
dialog box.
To assign floating IP addresses while requesting for them, you must have the
secondary IP addresses configured and ready when you are requesting the floating
IP addresses.
Select the floating IP address you want to assign, in the
Floating
IPs
dashboard. Click the
Update
option in
the
Actions
drop-down menu.
Assign the secondary IP addresses you configured to the floating IP addresses
you have.
VPC Workflow
A virtual private cloud (VPC) can be deployed on Nutanix cluster infrastructure to manage
the internal and external networking requirements using Flow Networking. The workflow to
create a complete network based on VPC is described below.
Create a VPC—See Creating Virtual Private Cloud. See Updating Virtual Private Cloud to update a VPC you created.
Add Subnets to the VPC—See Creating a Subnet to create a
Subnet. See Updating a Subnet to update a subnet.
Attach the Subnet to VMs—See Attaching a Subnet to a Virtual Machine.
VPC Management
This section provides information and procedures that you need to manage virtual
private clouds using Flow networking.
Creating Virtual Private Cloud
About this task
You can create VPCs on the Virtual Private Clouds page. Go to the Virtual Private
Clouds page by clicking
Virtual Infrastructure
>
Networking
>
Virtual Private Clouds
.
To create a VPC, do the following.
Procedure
On the VPC dashboard, click
Create VPC
.
See Network and Security View for more information about the
VPC dashboard.
The
Create Virtual Private Cloud (VPC)
dialog box opens.
Figure.
Create Virtual Private Cloud
Click to enlarge
Provide the necessary values in respective fields in the
Create
Virtual Private Cloud (VPC)
dialog box.
Fields
Description and Values
Name
Provide a name for the VPC.
External Connectivity
This section takes you through configuration of the
parameters necessary for connectivity to the Internet or
clusters outside the VPC.
A subnet with external connectivity
(External Subnet) is required if the VPC needs to send
traffic to a destination outside of the VPC.
Note:
You
can add a maximum of two external subnets - one external
subnet with NAT and one external subnet without NAT to a
VPC. Both external subnets cannot be of the same type. For
example, you cannot add two external subnets, both with NAT.
You can update an existing VPC similarly.
Network
address translation (NAT) Gateways perform the required
IP-address translations required for external routing. You
can also have external connectivity without NAT.
External Subnet
Select an external subnet from the drop down list. By
associating the VPC with the external subnet you can provide
external connectivity to the VPC.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
Externally Routable IP Addresses
Provide IP addresses that are externally routable. Externally
routable IP addresses are IP addresses that within the VPC which
can communicate externally without NAT. These IP addresses are
used when an external subnet without NAT is used.
Domain Name Servers (DNS)
(Optional) DNS is advertised to Guest VMs via DHCP. This can
be overridden in the subnet configuration.
Click
+
Server IP
to add DNS server IPs under
IP Address
and click the check
mark.
You can
Edit
or
Delete
an IP address you added
using the options under
Actions
.
Click
Save
.
Requesting Floating IPs
About this task
Each VPN gateway requires a floating IP. If you do not provide one during the VPN
gateway creation, then Flow Networking automatically allocates a floating IP to a
VPN gateway. To provide floating IP during the VPN gateway creation, you can request
floating IPs and assign them to VMs.
You can view the allocated floating IPs on the
Floating IPs
page. Click
Networking
>
>
Floating IPs
.
To request a floating IP, do the following.
Procedure
Click the
Request Floating IP
button on the
Floating IPs
page.
On the
Request Floating IP
dialog box, provide the
information in the respective fields.
Figure.
Request and Assign Floating IPs
Click to enlarge
Note:
Uncheck the
Assign Floating IPs
box if you want to
assign the requested IP addresses after you receive it.
See Floating IPs for more
information.
Fields
Description and Values
External Subnet
Select a subnet that you configured with external
connectivity.
Number of Floating IPs
Enter the number of floating IPs you want. You can request a
maximum of 5 floating IP addresses.
Assign Floating IPs
Select this check box if you want to assign the floating IPs
to specific VMs in the table.
Based on the number you entered in the
Number of
Floating IPs
field, the system provides an
equivalent number of rows of
Search
VMs
and
IP
Address
in the table.
Under
Search VMs
, select the VM to
which you want to assign a floating IP address. Under
IP Address
, select the IP address
on the VM (primary or secondary IP address) to which you
want to assign the floating IP.
You can assign multiple floating IP addresses to multiple
secondary IP addresses that you can create on the NIC of the
VM.
For information about configuring secondary IP addresses, see
Creating Secondary IP Addresses.
Note:
Click
Save
.
What to do next
When you receive the floating IP address you requested, you can see it, assign it
(if not already assigned while requesting) or delete it in the
Floating
IPs
view.
Creating a Subnet
About this task
You can create subnets on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
and open the
Create Subnet
dialog box.
You can also open the
Create Subnet
dialog box from the VPC
details view by clicking the
Add Subnet
option.
To create a subnet, do the following.
Procedure
Click
Create Subnet
.
The
Create Subnet
dialog box opens. The following
figure displays the Create Subnet dialog box with all the options. These options
are displayed based on the values you select in the
Type
field.
Figure.
Create Subnet (With External Connectivity Disabled)
Click to enlarge
Figure.
Create Subnet (With External Connectivity Enabled)
Click to enlarge
Fields
Description and Values
Name
Provide a name for the subnet.
Type
Select the type of subnet you want to create.
You can create a
VLAN
subnet or an
Overlay
subnet.
VLAN ID
(VLAN subnet only) Enter the number of the
VLAN
.
Enter just the number in this field, for example 1 or 27.
Enter 0 for the native VLAN. The value is displayed as
vlan.1 or vlan.27 in the View pages.
Note:
Provision any single VLAN ID either in the AHV network
stack or in the Flow Networking (brAtlas) networking stack.
Do not use the same VLAN ID in both the stacks.
IP Address management
(Mandatory for Overlay type subnets) This section provides
the
Network IP Prefix
and
Gateway IP
fields for the subnet.
(Optional for VLAN type subnet) Check this box to display the
Network IP Prefix
and
Gateway IP
fields and configure the
IP address details.
Unchecking this box hides these fields. In this case, it is
assumed that this virtual LAN is managed outside the
cluster.
Note:
The
DHCP Settings
option is only
available for VLAN subnets if you select this
option.
DHCP Settings
(Optional for both VLAN and Overlay subnets) Check this box
to display fields for defining a domain.
Checking this box displays fields to specify DNS servers and
domains. Unchecking this box hides those fields.
See Settings the DHCP Options for more
information.
Cluster (VLAN subnet only)
(VLAN subnet only) This option is available only for
VLAN
subnet configuration. Select the
cluster that you want to assign to the subnet.
External Connectivity
(VLAN subnet
only) Turn on this toggle switch if you want use this
VLAN
subnet for external
connectivity.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
NAT
(Option under
External Connectivity
)
If you turn on the
External Connectivity
toggle switch, then you can choose whether to connect to
external networks with or without enabling NAT. Check the
NAT
check box to enable NAT for
external connectivity for VPCs.
Virtual Switch
(VLAN subnet only) Select the virtual switch that is
configured for the VLAN you selected. The default value is the
default virtual switch vs0. This option is displayed only if you
add a VLAN ID in the VLAN ID field.
VPC (Overlay subnet only)
Select the
Virtual Private Cloud (VPC)
that you want to assign to the subnet from the drop down
list.
You can create VPCs and assign them to
Overlay
subnets.
IP Address Pool
Defines a range of addresses for automatic assignment to
virtual NICs.
This field is optional for both
VLAN
and
Overlay
. For
VLAN
, this field is displayed
only if you select the
IP Address
Management
option.
Note:
Configure this field for
VLAN
or
Overlay
to complete the creation
of the VPC, if you do not need external connectivity for
this subnet. You must configure this field only if you need
external connectivity for this subnet.
Click the
Create Pool
button and enter
the following in the
Add IP Pool
page:
Enter the starting IP address of the range in the
Start Address
field.
Enter the ending IP address of the range in the
End Address
field.
Under
Actions
, click the check
mark to submit the starting and ending IP addresses
you entered.
Click the X mark to remove the entries.
Override DHCP Server
(VLAN subnet only) To configure a DHCP server, check the
Override DHCP Server
box and
enter an IP address in the
DHCP Server IP
Address
field.
See
Override DHCP Server (VLAN Only)
in Settings the DHCP Options for information
about this option.
Click
Save
.
Settings the DHCP Options
About this task
Selecting the
DHCP Settings
checkbox in
Create
Subnet
or
Update Subnet
allows you to configure
the DHCP options for the VMs within the subnet. When DHCP settings are configured
for a VM in a subnet and the VM is powered on, Flow Networking configures these
options on the VM automatically. If you do not configure the DHCP settings, then
these options are not available on the VM automatically when you power it on.
You can enable
DHCP Settings
when you create a subnet and
configure the
DHCP Settings
for the new subnet. You could also
update the DHCP Settings for an existing subnet.
DHCP Settings
is common to and is available on both the
Create Subnet
and the
Update Subnet
dialog boxes.
To configure the
DHCP Settings
, do the following in the
Create Subnet
or the
Update Subnet
dialog box:
Procedure
Provide the information in the
DHCP Settings
fields.
Figure.
DHCP Settings
Click to enlarge
Fields
Description and Values
Domain Name Servers
Provide a comma-separated list of DNS IP addresses.
Example: 8.8.8.8, 9.9.9.9
Domain Search
Enter the VLAN domain name. Use only the domain name
format.
Example: nutanix.com
TFTP Server Name
Enter a valid TFTP host server name of the TFTP server where
you host the host boot file. The IP address of the TFTP
server must be accessible to the virtual machines to
download a boot file.
Example: tftp_vlan103
Boot File Name
The name of the boot file that the VMs need to download from
the TFTP host server.
Example: boot_ahv2020xx
(Optional and for VLAN networks only) Check the
Override DHCP
Server
dialog box and enter an IP address in the
DHCP
Server IP Address
field.
You can configure a DHCP server using the
Override DHCP
Server
option only in case of VLAN networks.
The DHCP Server IP address (reserved IP address for the Acropolis DHCP
server) is visible only to VMs on this network and responds only to DHCP
requests. If this box is not checked, the DHCP Server IP Address field is
not displayed and the DHCP server IP address is generated automatically. The
automatically generated address is
network_IP_address_subnet.254
, or if the default
gateway is using that address,
network_IP_address_subnet.253
.
Usually the default DHCP server IP is configured as the last usable IP in the
subnet (For eg., its 10.0.0.254 for 10.0.0.0/24 subnet). If you want to use
a different IP address in the subnet as the DHCP server IP, use the override
option.
Attaching a Subnet to a Virtual Machine
About this task
To attach a subnet to a VM, go to the
Virtual Infrastructure
>
VM
>
List view
in Prism Central and do the following.
Procedure
Select the VM you want to attach a subnet to. Click
Actions
>
>
Update
.
In the
Update VM
dialog box, click
Add
NIC
.
Figure.
Click to enlarge
Provide the necessary information in the indicated fields in the
Create NIC
dialog box.
Select the
Subnet Name
from the drop down
list.
Select the
Network Connection State
as
Connected
or
Disconnected
.
The
Network Connection State
selection defines
the state of the connection after the NIC configuration is
implemented.
Select the
Assignment Type
.
You can select
Assign with DHCP
to assign a
DHCP based IP address to the VM.
You can select
Assign Static IP
to assign a
static IP address to the VM to reach the VM quickly from any
endpoint in the network such as a laptop.
Click
Add
.
Click
Save
on the
Update VM
dialog
box.
Creating a Policy
About this task
For Policy-based routing you need to create policies that route the traffic in the
network.
When you create a VPC, there is one default policy that Flow Networking creates for
the VPC. This policy is pre-configured with the Priority 1 and other default values
to
Deny
traffic flow and service (see the table of field
descriptions and values for this dialog box).
Note:
You cannot update or delete the
default policy.
Policies control the traffic flowing between subnets (inter-subnet
traffic).
Policies control the traffic flowing in and out of the VPC.
Policies do not control the traffic within a subnet (intra-subnet
traffic).
Figure.
Policy Tab
Click to enlarge
You can create
a traffic policy using the
Create Policy
dialog box. You can
open the
Create Policy
dialog box either from the VPC list view
or the VPC list view.
On the VPC list view, select the VPC you want to update and click
Create Policy
in the
Actions
drop down menu.
On the VPC details view, click the
Create Policy
option
in the
More
drop down menu.
To create a policy, do the following in the
Create Policy
dialog
box.
Procedure
Provide the necessary values in the respective fields.
Figure.
Create Policy
Click to enlarge
Fields
Description and Values
Value in Default Policy
Priority
The priority of the access list (ACL) determines which ACL is
processed first. Priority is indicated by an integer number. A
higher priority number indicates a higher priority.For example,
if two ACLs have priority numbers 100 and 70 respectively, the
ACL with priority 100 takes precedence over the ACl with
priority 70.
Note:
Click the
Understand
Priorities
link to see the
Understand Priorities
information box (see the image of this box below
this table).
1
Source
The source indicates the source IP or subnet for which you
want to manage traffic.
Source can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Source Subnet IP
with
prefix.
Any
Source Subnet IP
Only required if you selected the
Source
as
Custom
. Provide the subnet IP and
prefix that you want to designate as the source for the
policy. Use the CIDR notation format to provide the subnet
IP. For example, 10.10.10.0/24.
None
Destination
The destination is the destination IP or subnet for which you
want to set the priority.
Destination can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Destination Subnet IP
with prefix.
Any
Destination Subnet IP
Only required if you selected the
Destination
as
Custom
.
None
Protocol
You can also set the priority configure policy for certain
protocols. You can select one of the following options:
Any
: Indicates any IP
address.
Protocol Number
: Provide an
integer number that indicates the protocol you want
to prioritize.
Provide the appropriate value in
the
Protocol Number
field.
TCP
UDP
ICMP
Protocol Number
This field is displayed only if you select
Protocol Number
as the value in
the
Protocol
field. The number you
provide must be the IANA designated number that indicates
respective protocol. See
IANA Protocol
Numbers
.
None
Action
Assign the appropriate action for implementation of the
policy.
Permit
: Permits traffic and
services based on the parameters set.
If the Permit rule is set to override a Drop rule,
then the Permit rule must be set in both the
directions to allow bidirectional communication
between the
Source
and
Destination
.
Deny
: Denies traffic and
service based on the parameters set.
Re-route
:Sends matching traffic
to the next-hop IP address specified by the
Reroute IP
. In case of
reroute, you need to provide an IP address that the
traffic needs to be re-routed to, in the
Reroute IP
field.
Permit
Figure.
Understanding Priorities
Click to enlarge
Click
Save
.
Creating Static Routes
About this task
You can create a static route using the
Create Static Routes
dialog box. You can open the
Create Static Routes
dialog box
either from the VPC list view or the VPC details view.
On the VPC list view, select the VPC and click
Create Static
Routes
in the Actions drop down menu.
On the VPC details view, click the
Create Static
Routes
option in the
More
drop down
menu.
Figure.
Create Static Routes
Click to enlarge
To create static route, do the following in the
Create Static
Routes
dialog box:
Procedure
Provide the necessary values in the respective fields.
Fields
Description and Values
Destination Prefix
Provide the IP address with prefix of the destination
subnet.
Next Hop Link
Select the next hop link from the drop down list. The next
hop link is the IP address that the traffic must be sent for the
static route you are configuring.
Add Prefix
You can create multiple static routes using this option.
Click this link to add another set of
Destination
Prefix
and
Next Hop Link
to configure another static route.
Click
Save
.
Updating Virtual Private Cloud
About this task
You can update a VPC using the
Update Virtual Private Cloud
(VPC)
dialog box. You can open the
Update Virtual Private
Cloud (VPC)
dialog box either from the VPC list view or the VPC
details view.
On the VPC list view, select the VPC you want to update and click
Update
in the
Actions
drop
down menu.
On the VPC details view, click the
Update
option.
The
Update Virtual Private Cloud (VPC)
dialog box is identical
to the
Create Virtual Private Cloud (VPC)
dialog box.
Figure.
Update VPC
Click to enlarge
For details about the parameters that you can update in the
Update Virtual
Private Cloud (VPC)
dialog box, see Creating Virtual Private Cloud.
Procedure
Update the parameters in the
Update Virtual Private Cloud
(VPC)
dialog box.
Click
Save
.
Updating a Subnet
About this task
You can update a subnet displayed on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
>
Subnets
and open the
Update Subnet
dialog box.
You can also open the
Update Subnet
dialog box from the VPC
dashboard for a specific VPC. Click the
Edit
option for the
subnet listed on the
Subnets
tab of the VPC dashboard.
The fields in the
Update Subnet
and the
Create
Subnet
dialog boxes are the same.
Note:
You cannot edit or update the
subnet type. For example, if the subnet type is already configured as
VLAN
, you cannot modify it to an
Overlay
type subnet.
To update a subnets, do the following.
Procedure
Select the subnet you want to update. Select
Actions
>
Update Subnet
.
Update the necessary values in the respective fields in the
Update
Subnet
dialog box.
Figure.
Update Subnet
Click to enlarge
The
Update Subnet
dialog box has the same fields as the
Create Subnet
dialog box. For details about the
fields and the values that can be updated in the
Update
Subnet
dialog box, see Creating a Subnet.
Click
Save
to ensure that the updates are saved in the
configuration.
Category Management
A category is a key-value pair that groups similar entities. Associating a policy with a
category ensures that the policy applies to all the entities in the group regardless of how
the group scales with time. For example, you can associate a group of VMs with the Department:
Marketing category, where Department is a category that includes a value Marketing along with
other values such as Engineering and Sales.
Currently, you can associate only VMs with a category. Categories are implemented in the same
way on on-premises Prism Central instances and in Xi Cloud Services. For information about
configuring categories, see the
Prism Central Guide
.
Updating a Policy
About this task
You can update a policy using the
Update Policy
dialog box. You
can open the
Update Policy
dialog box in two ways in the VPC
details view.
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
Note:
You cannot update or delete the default policy.
The
Update Policy
dialog box has the same parameters as the
Create Policy
dialog box.
For details about the parameters that you can update in the
Update
Policy
dialog box, see Creating a Policy.
Procedure
Update the parameters in the
Update Policy
dialog
box.
Click
Save
.
Updating Static Routes
About this task
You can update a static route using the
Update Static Routes
dialog box. You can open the
Update Static Routes
dialog box
either from the VPC list view or the VPC details view.
Note:
You must configure the default route (0.0.0.0/0) to the external subnet as the
next hop for connectivity outside the cluster (north-south connectivity).
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
The
Update Static Routes
dialog box has the same parameters as
the
Create Static Routes
dialog box.
For details about the parameters that you can update in the
Update Static
Routes
dialog box, see Creating Static Routes.
Procedure
Update the parameters in the
Update Static Routes
dialog
box.
Click
Save
.
Deleting a Virtual Private Cloud
About this task
Prism Central
does not allow you to delete a VPC if the VPC is associated with any subnets and/or
VPNs. After you remove all the subnets or VPN associations from the VPC, delete the
VPC.
You can delete a VPC from the VPC list view or the VPC details view.
Procedure
Do one of the following.
To delete a VPC from the VPC list view, select the VPC you want to
delete and click
Delete
in the
Actions
drop down menu.
To delete a VPC from the VPC details view, click the VPC name to go to
the VPC details view and click the
Delete
option in
the
More
drop down menu.
In the confirmation dialog box, do the following.
Click
Delete
to delete the VPC.
Click
Cancel
to exit without deleting the
VPC.
Deleting Subnets, Policies or Routes
About this task
You can delete VPC entities such as subnets, policies or routes from the VPC details
page.
Note:
You cannot update or delete the default policy.
Do the following.
Procedure
Open the VPC details page and go to the respective tab like
Subnets
,
Policies
or
Routes
.
Click the
Delete
option provided for the selected entity
(subnet, policy or route respectively).
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Connections Management
This section covers the management of network gateways, VPN connections and Subnet
Extensions including operations like create, update and delete network gateways and VPN
connections, and extending subnets.
Network Gateway Management
You can create, update or delete network gateways that host one of VPN or VTEP service for
connections.
Creating a Network Gateway
About this task
VPN or s connect two networks together, and can be used in both VLAN and VPC networks
on AHV. In other words, you can extend the routing domain of a VLAN network or that
of a VPC using a VPN. Accordingly, VPN gateways can be configured using VLANs or
VPCs. You need VPN gateways on clusters to provide a gateway to the traffic between
on-premise clusters or remote sites.
You can create multiple VPN gateways for a VPC. Since a VPC is configured
only on a PC, the VPC is available to all the clusters registered to that PC.
A VPN gateway may be defined as a Local gateway or a Remote gateway based on where
the traffic needs to be routed.
To create a VPN gateway, do the following on the
Networking & Security
>
Connectivity
>
Gateways
page.
Procedure
Select
Local
or
Remote
in the
Create Gateway
drop-down menu.
If you select
Local
in the drop-down menu, the
Create Local Gateway
dialog box opens. If you select
Remote
in the drop-down menu, the
Create
Remote Gateway
dialog box opens.
Provide the necessary values in the respective fields as described in the
table.
For example, if you select
Local
in the drop-down menu,
then the
Create Local Gateway
dialog box opens. Provide the
necessary values in the respective fields as described in the table.
Figure.
Sample Create Local Gateway - VM Deployment
Click to enlarge
Figure.
Sample Create Local Gateway - VPN Service Configuration
Click to enlarge
Figure.
Sample Create Local Gateway - VTEP Service Configuration
Click to enlarge
Figure.
Sample Create Remote Gateway - VPN Gateway Service
Click to enlarge
Figure.
Sample Create Remote Gateway - VTEP Gateway Service
Click to enlarge
Table 1.
Local Gateway Fields
Fields
Description
Values
VM
Deployment
Name
Enter a name for the network gateway.
(Name)
Gateway Attachments
(for Local gateway type only) Select the gateway attachment
as
VPC
or
VLAN
.
The VPN VM is deployed on a VPC VM or a cluster that has the
selected VLAN respectively.
If you select
VPC
, then
VPC Attachment
is displayed.
VPC
is the default value for
the
Gateway Attachments
field. The
Gateway VM is deployed on the cluster and associated
with the VPC selected in the
VPC
Attachment
section.
VPC
attachment
mode provides the options of
eBGP and Static routing methods for external routing
(configured in the
External Routing
Configuration
section).
If you select
VLAN
, then the
VLAN Attachment
is displayed. The
Gateway VM is deployed on the cluster that has the VLAN
and the subnet specified in the
VLAN
Attachment
section.
VLAN
attachment
mode provides only the eBGP
routing method for external routing.
(VLAN or VPC)
Gateway VM Deployment - VPC
Attachment
Cluster
Select the cluster on which you want to deploy the Gateway VM
on.
(Name of the cluster)
VPC (If Gateway Attachment type is VPC)
Select the VPC configured on the selected cluster that you
want to use for the Gateway VM deployment.
(Name of the VPC selected)
Floating IP (Optional)
Select a floating IP for the network gateway configuration.
If you do not select a floating IP address then Prism
Central allocates a floating IP automatically. This
allocated floating IP is deleted when you delete the
gateway.
To request floating IPs and allocate them to subnets, see
Requesting Floating IPs
(IP address)
Gateway VM Deployment - VLAN
Attachment
Cluster
Select the Cluster, from the drop down list, on which you
want to deploy the Gateway VM on.
Note:
Only clusters with VLANs
are available in the list.
(Name of the cluster)
Subnet
Select the subnet you want to attach the Gateway VM to, from
the drop down list.
Note:
The list includes all the subnets you
created on the selected cluster.
After you select the
subnet, the details of the subnet are displayed in a box below
the
Subnet
field. The details include:
VLAN ID, IPAM type being Managed or Unmanaged, and Network
Address with Prefix.
(Name of the VLAN subnet)
Static IP Address for VPN Gateway VM
Enter the static IP address that the Gateway VM needs to
use.
(IP Address with Prefix)
Default Gateway IP
Enter the default gateway IP of the subnet for the Gateway
VM.
(IP Address)
Service
Configuration
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service Configuration -
External Routing Configuration (This section is available for
VLAN and VPC attachment types)
Routing Protocol
For
VPC
gateway attachments:
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
For
VLAN
gateway attachments:
External routing protocol is pre-set to
eBGP
. You cannot change
the routing protocol.
(Static or eBGP)
Redistribute Connected Routes (Applicable only if VLAN type
gateway attachment is selected)
(
VLAN
only) Select this checkbox to
enable the redistribution of connected routes into the
eBGP.
(Check mark or blank)
ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
eBGP Password
(For
eBGP
in
Local
gateway type only) Enter the
eBGP password for the eBGP route.
(Password: The password must be between 1 and 80 characters.
Password length: Minimum 1 and maximum 80
characters.
)
VPN Service Configuration -
Internal Routing Configuration (This section is available for
VLAN attachment type only.)
Routing Protocol (Between On-prem Gateway and On-prem
Router)
Select the
Routing Protocol
to be used
between on-premises Nutanix gateway and on-premises
router.
You can select:
Static
: Select this protocol
to provide a static route configuration for the VLAN
gateway.
OSPF
: Select this protocol to
provide an OSPF routing configuration for the VLAN
gateway.
iBGP
: Select this protocol to
provide a iBGP route configuration for the VLAN
gateway.
Note:
For iBGP, the ASN must be the same
between the Gateway appliance and the peer iBGP,
when iBGP is selected as the internal routing
protocol.
(Static or OSPF or iBGP)
+Add Prefix (Applicable to Static routing)
(For
Static
routing selected in
Routing Protocol
) Click this to
enter a
Local Prefix
and click the
check mark under
Actions
to add the
prefix.
If you click the X mark under
Actions
,
the local prefix you entered is not added.
The prefixes you add are advertised to all the connected
peers via eBGP.
The prefix must be a valid IP address with the host bits not
set.
You can add multiple local prefix IP addresses.
(prefix like /24)
Area ID (Applicable to OSPF protocol)
(OSPF only) Enter the OSPF area id in the IPv4 address
format.
Password Type
(OSPF only) Select the password type you want to set for the
OSPF route. The options are:
MD5
: Select this option to
encrypt the packets with MD5 hash that can be
decrypted with the MD5 password at the
destination.
Plain Text
: Select this option
to set a clear-text password.
None
: Select this if you do to
set an open route without password protection
Password
(OSPF only) Enter a password for the MD5 or Plain Text
password type you select in the
Password
Type
field.
For
MD5
: The password must be
1-16 characters long.
Characters allowed for OSPF passwords (MD5)
a-z
A-Z
0-9
For
Plain Text
: The password
must be 1-8 characters long.
Characters allowed for OSPF passwords (Plain text):
a-z.
Peer IP (for iBGP)
Enter the IP Address of the On-prem router used to exchange
routes with the network gateway.
(IP Address)
Password
Enter a password with 1-80 characters.
(Password)
VTEP Service Configurations
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Table 2.
Remote Gateway Fields
Fields
Description
Values
Name
Enter a name for the network gateway.
(Name)
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service
Configurations
Public IP Address
Enter the public IP address of the remote endpoint. If a
Floating IP is not selected, a new Floating IP is automatically
allocated for the Gateway. These allocated IP addresses are
deleted when the network gateway is deleted.
(IP Address)
Vendor
Select the vendor of the third party gateway
appliance.
(Name of Vendor)
External Routing
Protocol
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
(Static or eBGP)
eBGP ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 1-65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
VTEP Service
Configurations
VTEP IP Address
Enter VTEP IP Addresses of the remote endpoints that you want
to create the gateway for. You can add IP addresses of multiple
endpoints in one remote gateway.
(Comma separated list of IP Addresses)
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Click
Save
.
What to do next
The Gateway you create is displayed in the
Gateways
page.
Updating a Network Gateway
About this task
You can update a network gateway using the
Update Gateway
dialog
box.
You can open the
Update Gateway
dialog box. The parameters in
the
Update Gateway
dialog box are the same as those in the
Create Local Gateway
or
Create Remote
Gateway
dialog box.
Procedure
Select the gateway you want to update on
Gateways
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update Gateway
dialog
box.
You cannot modify some information. Such fields are greyed and in-actionable.
If you need to modify such information, consider creating a new gateway with the
updated parameters and deleting the current gateway.
Click
Save
.
Deleting a Network Gateway
About this task
If you want to delete a network gateway, you must first delete all the VPN
connections associated with the gateway and only then you can delete the network
gateway.
To delete a network gateway, do the following on the
Gateway
page.
Procedure
Do one of the following.
Select the check box next to the name of the gateway and, in the
Actions
drop-down list, click
Delete
.
Click the name of the gateway and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Virtual Network Connections
Virtual Private Network
You can use the Nutanix VPN solution to set up VPN between your on-prem clusters, which
exist in distinct routing domains that are not directly connected. These distinct routing
domains could either be VPCs within the same cluster or remote clusters or sites.
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. Local VPN gateway can be
instantiated in a VPC context or a legacy VLAN context. Launching the VPN gateway within a
VPC allows stretching of the VPC. For example, in the figure, the Blue VPC is stretched
between two sites with a VPN.
Figure.
VPN Working
Click to enlarge
VPN connections are useful in connecting two points. You can connect two VPCs in the same
cluster using a VPN or VPCs in different clusters in the same site. However, VPN connection
can connect only one endpoint to another endpoint. Flow networking based VPN service allows
you to only connect two endpoints that use Nutanix VPN based gateway service.
Virtual Tunnel End Points Based Network Extensions
To connect one endpoint to multiple endpoints or third party (non Nutanix) networks, use
Virtual Tunnel End Point (VTEP) service based subnet extensions. For more information about
VTEP, see .
VPN Workflow
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. You can configure multiple
VPN endpoints for a site.
Each endpoint must have configurations for a local VPN gateway, remote VPN gateway (pointer
information for the peer local VPN in the remote site endpoint) and a VPN connection
(connecting the two endpoints). Then, based on the VPN connection configuration as initiator
or acceptor, one endpoint initiates a tunnel and the endpoint at the other end accepts the
tunnel connection and, thus, establishes the VPN tunnel.
Gateways: Every VPN endpoint for each site consists of two VPN gateway configurations -
Local and Remote.
Local gateway is a VM that runs the VPN protocols (IKEv2, IPSec) and routing (BGP and
OSPF). Remote gateway is a pointer - database entry - that provides information about
the peer remote VPN endpoint. One of the key information contained in the remote gateway
is the source IP of the remote VPN endpoint. For security reasons, the local VPN gateway
will accept IKEv2 packets originating only from this Source IP.
VPN gateways are of the following types:
On premises Nutanix VPN Gateway: Represents the VPN gateway appliance at your
on-premises local or remote site if you are using the Nutanix VPN solution.
On premises Third Party Gateway: Represents the VPN gateway appliance at your
on-prem site if you are using your own VPN solution (provided by a third-party
vendor).
To configure third party VPN Gateways, see the relevant third party
documentation.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways
between which you want to create the VPN connection.
VPN appliances perform the following:
Implementation of IKEv2 and IPSec protocols.
Routing: Between remote sites, Flow Networking advertises prefixes using eBGP.
Optionally it uses Static routing. Within a site, Flow Networking uses iBGP or OSPF to
share prefixes between the Nutanix VPN appliance and the edge router.
Prerequisites for VPN Configurations
General Requirements
Ensure that you have enabled Flow Networking with microservices Infrastructure.
Ensure that you have floating IP addresses when you create VPN gateways.
Flow Networking automatically allocates a floating IP to a VPN gateway if you do not
provide one during the VPN gateway creation. To provide floating IP during the VPN
gateway creation, you can request floating IPs. See Requesting Floating IPs.
Ensure that you have one of the following, depending on whether you are using iBGP or
OSPF:
Peer IP (for iBGP): The IP address of the router to exchange routes with the VPN
gateway VM.
Area ID (for OSPF): The OSPF area ID for the VPN gateway in the IP address format.
Ensure that you have the following details for the deployment of the VPN gateway
VM:
Public IP address of the VPN Gateway Device: A public WAN IP address that you want
the on-prem gateway to use to communicate with the Xi VPN gateway appliance.
Static IP Address: A static IP address that you want to allocate to the VPN gateway
VM. Use a floating IP address requested as the static IP address.
IP Prefix Length: The subnet mask in CIDR format of the subnet on which you want to
install the VPN gateway VM. You can use an overlay subnet used for a VPC and
assigned to the VM that you are using for the VPN gateway.
Default Gateway IP: The gateway IP address for the on-premise VPN gateway
appliance.
Gateway ASN: ASN must not be the same as any of your on-prem BGP ASNs. If you
already have a BGP environment in your on-prem site, the customer gateway is the ASN
for your organization. If you do not have a BGP environment in your on-prem site,
you can choose any number. For example, you can choose a number in the 65000
range.
Ports and Protocols
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable Flow Networking to function. To see the ports and protocols used
Flow Networking, see Port Reference.
Endpoints and Terminations
The following endpoints and terminations occur in the course of Flow networking based
connections. For information about creating, updating or deleting VPN connections, see Connections Management.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
VPN Endpoint Behind a Network Address Translation or Firewall Device
In this scenario, the IPSec tunnel terminates behind a network address translation
(NAT) or firewall device. For NAT to work, open UDP ports 500 and 4500 in both
directions.
Figure.
VPN Endpoint Behind NAT or Firewall
Click to enlarge
Things to do in NAT
Things to do in on-prem VPN GW
Open UDP ports 500 and 4500 on both directions
Enable the business application policies to
Allow
the
commonly-used business application ports.
IPSec Terminates on the Firewall Device
In this scenario, you do not need to open the ports for NAT (500 and 4500).
However, enable the on-prem VPN gateway to allow the traffic from the PC subnet to
the advertised load balancer route where the Source port is any and the Destination
port may be in the range of 1024-1034.
The PC subnet refers to the subnet where your Prism Central is running.
Figure.
Tunnel Terminates on NAT or Firewall
Click to enlarge
Creating a VPN Connection
About this task
Create a VPN connection to establish a VPN IPSec tunnel between VPN gateways in your
on-prem site. Select the gateways between which you want to create the VPN
connection.
To create a VPN connection, do the following on the
Networking
>
VPN Connections
page.
Procedure
Click the
Create VPN Connection
button on the
VPN Connections
page.
In the
Create VPN Connection
dialog box, provide the
values in the respective fields.
Fields
Description and Values
Name
Enter a name for the connection.
VPN Connection
IPSec Secret
Enter a secret password for the IPSec connection. To see the
password, click
Show
. To hide the
password, click
Hide
.
Local Gateway
Select the connection parameters on the local gateway as
Initiator or Acceptor of VPN Tunnel connections.
VPN Gateway
Select the appropriate VPN Gateway as the local gateway for
the VPN connection
VTI Prefix - Local Gateway
Enter a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel
Interface
IP address with prefix for the local
gateway. The subnet for this IP address must be a /30 subnet
with two usable IP addresses. One of the IP addresses is
used for Local Gateway. Use the other IP address for the
Remote Gateway.
Connection Handshake
This defines the type of handshake that the connection must
use. There are two types of connection handshakes:
Initiator
: The local VPN gateway
acts as the initiator of the connection and thus
initializes the VPN tunnel.
Acceptor
: The local VPN gateway
accepts or rejects incoming connection requests from
other gateways.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
Remote Gateway
For a specific VPN connection, set the remote gateway as
Initiator or Acceptor when you configure the VPN connection on
the Remote Gateway.
VPN Gateway
Select the appropriate VPN Gateway as the remote gateway for
the VPN connection.
VTI Prefix - Remote Gateway
The VPN Tunnel Interface IP address with prefix for the local
gateway. Provide a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel Interface
IP address with prefix for the local gateway. The subnet for
this IP address must be a /30 subnet with two usable IP
addresses. One of the IP addresses is used for Local
Gateway. Use the other IP address for the Remote
Gateway.
Advanced Settings
Set the traffic route priority for the VPN connection. The
route priority uses Dynamic route priority because the priority
is dependent on the routing protocol configured in the VPN
gateway.
Route Priority - Dynamic Route Priority
Set the route priority as an integer number. The greater the
number, higher is the priority.
Click
Save
.
What to do next
The VPN connection you create is displayed in the
VPN
Connections
page.
Updating VPN Connection
About this task
You can update a VPN Connection using the
Update VPN Connection
dialog box.
You can open the
Update VPN Connection
dialog box. The
parameters in the
Update VPN Connection
dialog box are the same
as those in the
Create VPN Connection
dialog box.
Procedure
Select the VPN Connection you want to update on the
VPN
Connection
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update VPN Connection
dialog box.
Click
Save
.
Deleting a VPN Connection
About this task
To delete a VPN connection, do the following on the
VPN
Connection
page.
Procedure
Do one of the following.
Select the check box next to the name of the VPN connection and, in the
Actions
drop-down list, click
Delete
.
Click the name of the VPN connection and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
VPN Connection within Same Prism Central
You can connect two VPCs within the same Prism Central availability zone using a VPN
connection.
About this task
Assume that you have created two VPCs named
vpc-a
and
vpc-b
with overlay subnets named
subnet-a
and
subnet-b
.
To connect the two VPCs within the same Prism Central using a VPN connection, do the
following.
Procedure
Do the following for local gateways:
Create a local VPN gateway with dynamically assigned address for
vpc-a
, for example, named
local-vpn-a
. Note or write down the assigned
IP address.
Create a local VPN gateway with dynamically assigned address for
vpc-b
, for example, named
local-vpn-b
. Note or write down the assigned
IP address.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Do the following for remote gateways:
Create a remote VPN gateway with the IP address noted in 1.a for
vpc-a
, for example, named
remote-vpn-a
.
create a local VPN gateway with the IP address noted in 1.b for
vpc-b
, for example, named
remote-vpn-b
.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Create a VPN connection between
vpc-a
and
vpc-b
named, for example,
vpn-conn-a-to-b
.
Ensure that the VTI IP addresses for the local and remote gateways is unique
with /30 prefix.
Note:
The
VPN Tunnel Interface
IP address with
prefix for the local gateway. The subnet for this IP address must be a /30
subnet with two usable IP addresses. One of the IP addresses is used for
Local Gateway. Use the other IP address for the Remote
Gateway.
Ensure that you select
local-vpn-a
as the local gateway with
Connection Handshake
set as
Acceptor
.
Ensure that you select
remote-vpn-b
as the remote gateway.
Create a VPN connection between
vpc-b
and
vpc-a
named, for example,
vpn-conn-b-to-a
.
Ensure that the VTI IP addresses with /30 prefix for local and remote gateways
are the reverse (vice versa) of what you configured for the VPN connection in
previous step. For example, if in previous step you configured the VTI IP
addresses as 10.20.20.5/30 for local and 10.20.20.6/30 for remote then for VPN
connection in this step, configure 10.20.20.6/30 for local gateway and
10.20.20.5/30 for remote gateway respectively. These IP addresses do not need to
be reachable anywhere else in the network. However, ensure that these IP
addresses do not overlap with any other IP addresses assigned in the
network.
Ensure that you select
local-vpn-b
as the
local gateway with
Connection Handshake
set as
Initiator
.
Ensure that you select
remote-vpn-a
as the remote gateway.
Layer 2 Virtual Network Extension
You can extend a subnet between
on-prem
local and remote clusters or sites (Availability Zones or AZs) to support seamless application
migration between these clusters or sites.
Note:
One or more on-prem cluster or sites managed by one Prism Central instance is defined as
an Availability Zone or AZ. In this section, Availability Zone or AZ refers to and must be
understood as one or more on-prem clusters or sites managed by one Prism Central. Local AZ
refers to local on-prem clusters or sites managed by a Prism Central instance and
remote
AZ
refers
to another on-prem cluster or site managed by another Prism Central
instance.
With Layer 2 subnet extension, you can migrate a set of applications to the remote AZ while
retaining their network bindings such as IP address, MAC address, and default gateway. Since
the subnet extension mechanism allows VMs to communicate over the same broadcast domain, it
eliminates the need to re-architect the network topology, which could otherwise result in
downtime.
Layer 2 extension assumes that there are underlying existing layer 3 connectivity already
available between the Availability Zones. You can extend a subnet from a remote AZ to the
primary (Local) AZ (and other remote AZs in case of VTEP-based subnet extensions)
You can extend a Layer 2 subnet across two Nutanix AZs over either VPN or Virtual tunnel
End Point (VTEP). SeeLayer 2 Virtual Subnet Extension Over VPN.
You can extend a Layer 2 subnet between a Nutanix AZ and one or more non-Nutanix
datacenters only over VTEP. See Layer 2 Virtual Subnet Extension Over VTEP.
You can extend subnets for the following configurations.
IPAM Type.
Managed and unmanaged networks.
Subnet Type.
On-prem VLAN subnets and VPC subnets.
Traffic Type.
IPv4 unicast traffic and ARP.
On-prem Hypervisor.
AHV and ESXi
Note:
If your cluster is ESXi, use vCenter Server
to manually configure the port group attached to the subnet you want to extend. Set the
security settings,
Promiscuous mode
and
Forged
transmits
to
Accept
on the vSwitch as shown in the
following image.
Figure.
ESXi Host Port Group Configuration
Click to enlarge
Prerequisites for Setting Up Subnet Extension
Ensure the following before you configure Layer 2 subnet extension between your on-prem
AZs.
Ensure that the Prism Central versions support Layer 2 virtual subnet extension as
specified in the Release Notes. See
AOS Family Release Notes
and
Release Notes | Prism Central
as applicable.
See the
Prism Central
Upgrade and Installation Guidelines and Requirements
section of the
Acropolis Upgrade Guide
for instructions about how to upgrade a Prism
Central instance through the Prism Central web console.
Ensure that you pair the Prism Central at the local AZ with the Prism Central at the
remote AZ to use
Create Subnet Extension
wizard to extend a subnet
across the AZs and facilitate bidirectional communication between these clusters or sites.
Using paired availability zones it is possible to configure both VXLAN over VPN and VTEP
based subnet extension. You can also extend subnets using the manual gateway and
connection workflows instead of pairing the AZs.
See the Pairing Availability Zones for instructions about how to pair the
local and remote AZs.
Ensure that you set up a default static route with
0.0.0.0/0
prefix and
the External Network next hop for the VPC you use for any subnet extension. This allows
NTP and DNS access for the Network Gateway appliance.
Best Practices for Subnet Extension
Nutanix recommends the following configurations to allow IP address retention for VMs on
extended subnets.
When using Nutanix IPAM ensure the address ranges in the paired subnets are unique to
avoid conflict between VM IP addresses across extended subnets.
If the source and target sites use third-party IPAM, ensure that there are no
conflicting IP address assignments across the two sites.
Note:
If the source and target
sites use Nutanix IPAM, the Prism Central web console displays a message that indicates
an IP address conflict if one exists.
If connectivity between sites already provides encryption, consider using VTEP only
subnet extension to reduce encryption overhead.
Use the
Subnet Extension to a Third Party Data-Center
workflow in
the following scenarios
To extend a subnet to more than one other AZ. This is also known as point to
multi-point.
To extend subnets between clusters managed by the same Prism Central.
Subnet Extension Workflow
You can manage Layer 2 subnet extension on the
Subnet Extensions
tab
of the
Connectivity
page. Open the
Subnet
Extensions
by clicking the hamburger icon in the top-left corner of the
Dashboard
and then clicking
Connectivity
.
You can create point-to-point Layer 2 subnet extensions between two AZs over VPN or
VTEP by opening the
Create Subnet Extension Across Availability
Zones
dialog box. See Extending a Subnet Over VPN for
VPN-based extensions. See Extending a Subnet Across Availability Zones Over VTEP for
VTEP-based extensions.
You can create point-to-point or point-to-multipoint Layer 2 subnet extensions to third
party datacenters over VTEP by opening the
Create Subnet Extension To A Third
Party Data-Center
dialog box. See Extending a Subnet to Third Party Datacenters Over VTEP.
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
dialog box. The
Update
Subnet Extension Across Availability Zones
has the same parameters and
fields as the
Create Subnet Extension Across Availability Zones
dialog box. You can open the
Update Subnet Extension Across Availability
Zones
dialog box by:
Selecting the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
You can update a subnet extension that extends to multiple AZs or third party datacenters
using the
Update Subnet Extension To A Third Party Data-Center
dialog
box.
Update Subnet Extension To A Third Party Data-Center
dialog box
has the same parameters and fields as the
Create Subnet Extension To A Third Party
Data-Center
dialog box. You can open the
Update Subnet Extension To A
Third Party Data-Center
dialog box by:
Selecting the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
See Updating an Extended Subnet.
Layer 2 Virtual Subnet Extension Over VPN
Subnet extension using VPN allows seamless, secure migration to a new datacenter or for
disaster recovery. VPN based Layer 2 extension provides secure point to point connection to
migrate workloads between Availability Zones. Consider VTEP-only Subnet Extension without VPN
when encryption is not required.
Subnet extension using VPN is useful:
When the two Availability Zones (where the subnets to be extended belong) do not have any
underlying secure connectivity. For example, when connecting over the Internet, VPN (IPSec)
provides the necessary connectivity and encryption (security).
Sometimes when you need to move (lift-and-shift) workloads from a VLAN subnet to a VPC
subnet retaining the same VM IP addresses . You need connectivity from other subnets to
workloads that have already migrated to VPC. In such cases, VPN provides the Layer 3
connectivity and encryption between the VPC segment of extended subnet to other VLAN
subnets.
Prerequisites for Setting Up Subnet Extension Over VPN
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VPN gateway services and a VPN connection between local AZ and the remote AZ.
The subnet extension feature supports only the Nutanix VPN solution (not a third-party
VPN solution) at the both the local and remote AZs. See the Virtual Network Connections for instructions about how to upgrade the VPN gateway
VM at the local and remote clusters or sites.
Note:
Ensure that the VPN gateway version
is 5.0 or higher. See the Updating a Network Gateway section
of the
Nutanix Flow Networking Guide
for instructions about how to
upgrade the network gateway at the local and remote sites.
Configure subnets with the same IP CIDR prefix at the source and target sites. For
example, if the IP prefix at one site is 30.0.0.0/24, the IP prefix at the other site must
also be 30.0.0.0/24. The network and mask must match at both AZs.
Configure distinct DHCP pools for the source and target sites with no IP address
overlap. Separate DHCP pools ensure no IP address conflicts occur for dynamically assigned
IP addresses between the two AZs.
Procure two free IP addresses, one from each subnet, for the Network Gateway in the
subnets to be extended. These IP addresses are configured as local IP address and remote
IP address for the subnet extension in the
Subnet Extension
wizard.
These two free IP addresses are the externally accessible IP addresses for the local
gateway, and the remote gateway. Those two usable IP addresses are already contained
inside the VPN connection and must not conflict with the following:
DHCP pools on any of the Availability Zones.
Gateway IP address on any of the Availability Zones.
IP addresses allocated to existing user VMs on any of the Availability Zones.
IP addresses used by Network Gateway Management NIC subnet (IP pool
100.64.1.0/24)
Limitation
To use subnet extension over a VPN, both sites must use the VPN service of the Nutanix
Network Gateway. Consider VTEP-only subnet extension to connect to non-Nutanix third party
sites.
Pairing AZs (Nutanix Disaster Recovery)
To replicate entities (protection policies, recovery plans, and recovery points) to
different on-prem AZs (AZs) bidirectionally, pair the AZs with each
other. To replicate entities to different Nutanix clusters at the same AZ bidirectionally,
you need not pair the AZs because the primary and the recovery Nutanix clusters are
registered to the same AZ (Prism Central). Without pairing the AZs, you cannot perform
DR to a different AZ.
About this task
To pair an on-prem AZ with another on-prem AZ, perform the following procedure at
both the AZs.
Procedure
Log on to the Prism Central web console.
Click the hamburger icon at the top-left corner of the window. Go to
Administration
>
AZs
in the left pane.
Figure.
Pairing AZ
Click to enlarge
Click
Connect to AZ
.
Specify the following information in the
Connect to Availability
Zone
window.
Figure.
Connect to AZ
Click to enlarge
AZ Type
: Select
Physical Location
from the drop-down
list.
A physical location is an on-prem AZ (AZ). To pair
the on-prem AZ with Xi Cloud Services, select
XI
from the drop-down list, and enter the
credentials of your Xi Cloud Services account in step c and set
d.
IP Address for Remote PC
: Enter the IP address
of the recovery AZ Prism Central.
Username
: Enter the username of your recovery
AZ Prism Central.
Password
: Enter the password of your recovery
AZ Prism Central.
Click
Connect
.
Extending a Subnet Over VPN
The subnet extension allows VMs to communicate over the same broadcast domain to a
remote site or Availability Zone (AZ).
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VPN for information on prerequisites
and best practices for extending a subnet.
About this task
Perform the following procedure to extend a subnet from the on-prem site.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
>
Networking & Security
>
Connectivity
>
Subnet Extension
.
On the
Subnet Extension
page, select
Create Subnet Extension
>
Across Availability Zones
.
In the
Create Subnet Extension Across Availability Zones
dialog box, enter the necessary details as described in the table.
Figure.
Create Subnet Extension Across Availability Zones
Click to enlarge
Fields
Description
Values
Extend Subnet over a
Select the gateway service you want to use for the subnet
extension.
(VPN or VTEP)
Note:
Configure the following fields for the
Local
and the
Remote
sides of the dialog
box.
Availability Zone
(For Local) Local AZ is pre-selected default.
(For Remote)
Select the appropriate AZ from the drop-down list of
AZs.
(Local: Local AZ)
(Remote: Dropdown list of
AZs.)
Subnet Type
Select the type of subnet that you want to extend.
(VLAN or Overlay)
Cluster
Displayed if your selected VLAN subnet. Select the cluster
from the dropdown list of clusters.
(Name of cluster selected from dropdown list)
VPC
Displayed if your selected Overlay subnet. Select the
appropriate VPC from the dropdown list of VPCs.
(Name of VPC selected from dropdown list)
Subnet
Select the subnet that needs to be extended.
(Name of subnet selected from dropdown list)
(Network Information frame)
Displays the details of the VLAN or Overlay network that you
selected in the preceding fields.
(Network information)
Gateway IP Address/Prefix
Displays the gateway IP address for the subnet. This field is
already populated based on the subnet selected.
(IP Address)
(Local or Remote) IP Address
Enter a unique and available IP address that are externally
accessible IP addresses in
Local IP
Address
and
Remote IP
Address
.
(IP Address)
VPN Connection
Select the appropriate VPN Connection from the dropdown list
that Flow networking must use for the subnet extension. See
Creating a VPN Connection for
instructions to create VPN connection.
(Name of VPN connection selected from the dropdown
list)
Click
Save
.
A successful subnet extension is listed on the
Subnet
Extension
dashboard. See .
Layer 2 Virtual Subnet Extension Over VTEP
Subnet extension using Virtual tunnel End Point (VTEP) allows seamless migration to new
datacenters or for disaster recovery. VTEP based Layer 2 extension provides
point-to-multipoint connections to migrate workloads from one Availability Zone to multiple
Availability Zones
without
encryption.
If you need security and encryption, consider using Subnet Extension over VPN.
Subnet extension using VTEP is useful:
When both subnets that need to be stretched are Nutanix subnets (managed or unmanaged).
VTEP provides an optimized workflow to stretch the two subnets.
When both subnets are connected over an existing private and secure link that does not
need additional encryption.
When one Nutanix subnet needs to be stretched across one or more non-Nutanix
networks,
sites, or datacenters.
Subnet
Extension with third-party VTEPs provides point-to-multipoint connectivity
to third party datacenters assuming that there is underlying
layer 3
connectivity between these VTEPs.
VTEP-based Layer 2 Subnet Extension provides the following advantages:
Layer 2 subnet extension from one AZ to multiple AZs.
Layer 2 subnet extension between Nutanix AZs and non-Nutanix third party VTEP-based
AZs.
The Remote VTEP Gateway is a set of endpoint IP addresses. You can add endpoint IP
addresses to an existing operational Remote VTEP Gateway without stopping the subnet
extension services. This on-the-fly addition enables you to extend the subnets to more AZs
than originally
planned, or
perform maintenance, without disrupting the running services or
configuring new remote VTEP gateways.
Prerequisite for Setting Up Subnet Extension Over VTEP
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VTEP local and remote gateway services on local and remote AZs. In case of
point-to-multipoint extension, ensure that you create local and remote VTEP gateways on
all the remote AZs that the subnet needs to be extended to.
For each
extended subnet within the same Network Gateway appliance
ensure
that you have unique VxLAN Network Identifiers (VNIs) that you can use for the VTEP subnet
extensions. VNI may be any number between 0 and 16777215.
Extending a Subnet Across Availability Zones Over VTEP
The subnet extension over VTEP allows VMs to communicate two Availability Zones (AZ)
without a VPN connection.
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VTEP for information on prerequisites and
best practices for extending a subnet.
About this task
To extend a subnet over VTEP across two availability zones (AZs), do the
following.
Procedure
Open the
Create Subnet Extension Across Availability Zones
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
Across Availability Zones
>
.
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
Across Availability Zones
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
Across Availability Zones
.
Figure.
Example of Create VTEP Extension Across AZs with VLAN Subnet
Click to enlarge
For
Extend Subnet over a
, select
VTEP
.
Enter or select the necessary values for the parameters in the
Local
and
Remote
(AZ)
sections as described in the table.
Parameters
Description and Value
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address.
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a
/24
subnet then provide the
gateway
IP address as
10.20.20.1/24
.
Note:
For
an
unmanaged network, enter the gateway IP
address of the created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the Network
Gateway appliance.
Remote IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the remote
Network Gateway appliance.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for information
about creating VTEP gateways.
Remote VTEP Gateway
Select the VTEP gateway you created on the remote AZ. See
Creating a Network Gateway for information
about creating VTEP gateways.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the local or
remote VTEP Gateways.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation requires
50. However, you can enter any valid MTU value for the network,
taking this overhead into account. For example, if the physical
network MTU and vs0 MTU are 1600 bytes, the Network Gateway MTU
can be set to 1492 to account for 108 bytes of overhead. Ensure
that the MTU value does not exceed the MTU of the AHV Host
interface and all the network interfaces between the local and
remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Extending a Subnet to Third Party Datacenters Over VTEP
The subnet extension over VTEP allows VMs to communicate with multiple remote sites
or Availability Zones (AZ) that may be third party (non-Nutanix) networks, or datacenters.
It also provides the flexibility of adding more remote AZs to the same VTEP-based extended
Layer 2 subnet. Examples of compatible VTEP gateways are switches from Cisco, Juniper,
Arista, and others that support plain VXLAN VTEP termination.
About this task
To extend a subnet over VTEP across multiple availability zones (AZs) or third party
datacenters, do the following.
Procedure
Open the
Create Subnet Extension To A Third Party
Data-Center
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
To A Third Party Data-Center
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
To A Third Party Data-Center
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
To A Third Party Data-Center
.
Figure.
Example of Create VTEP Extension To A Third Party Data-Center with
VLAN Subnet
Click to enlarge
Enter or select the necessary values for the parameters in the
Local
,
Remote
(AZ), and
Connection Properties
sections as described in the
table.
Parameters
Description and Value
Local
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a .24 subnet then provide the gatewway IP
address as
10.20.20.1/24
.
Note:
For
unmanaged network, enter the gateway IP address of the
created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a local VTEP gateway.
Remote
Remote VTEP Gateway
Select the remote VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a remote VTEP gateway.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the networks
that the Prism Central and Cluster are a part of.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation
requires 50. However, you can enter any valid MTU value for
the network, taking this overhead into account. For example,
if the physical network MTU and vs0 MTU are 1600 bytes, the
Network Gateway MTU can be set to 1492 to account for 108
bytes of overhead. Ensure that the MTU value does not exceed
the MTU of the AHV Host interface and all the network
interfaces between the local and remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Updating an Extended Subnet
The
Update Subnet Extension Across Availability Zones
has the same
parameters and fields as the
Create Subnet Extension Across Availability Zones
dialog box.
About this task
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
or the
Update
Subnet Extension To A Third Party data center
dialog box. The
Update Subnet Extension Across Availability Zones
or the
Update Subnet Extension To A Third Party data center
dialog
box has the same parameters and fields as the
Create Subnet Extension
Across Availability Zones
or the
Create Subnet Extension To
A Third Party data center
dialog box, respectively.
Based on the type of the subnet extension that you want to modify, refer to the
following:
Procedure
Extending a Subnet Over VPN
Extending a Subnet Across Availability Zones Over VTEP
Extending a Subnet to Third Party Datacenters Over VTEP
Removing an Extended Subnet
About this task
Perform the following procedure to remove the subnet extension. This procedure
deletes the extended subnet between the two Availability Zones (AZs) or between one
Nutanix AZ and one or more third party subnets. Deleting the subnet extension does
not automatically remove the network gateways or VPN connections that may have
automatically been created by the Subnet Extension wizard. You need to separately
delete these entities created automatically when the subnet was extended.
Note:
Removing an extended subnet from a cluster or AZ (either source or target AZs)
automatically deletes the extended subnet from the corresponding source or target
AZs.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
.
This
Flow Virtual Networking Guide
describes how to enable and deploy Nutanix
Flow Virtual Networking on Prism Central.
Upgrading from EA Versions
If you have enabled the early access (EA) version of Flow Virtual Networking, disable it
before upgrading the Prism Central and enabling the general availability (GA) version of
Flow Virtual Networking.
Related Documentation
Links to Nutanix Support Portal software and documentation.
The
Nutanix Support
Portal
provides software download pages, documentation, compatibility, and other
information/
Port Reference: See this page for details of ports that must be open in the
firewalls to enable
Flow Virtual Networking
to function.
Nutanix Security Guide
Prism Element and Prism Central security, cluster hardening, and
authentication.
AOS guides and release notes
Covers AOS Administration, Hyper-V Administration for Acropolis, Command
Reference, Powershell Cmdlets Reference, AOS Family Release Notes, and AOS
release-specific Release Notes
Acropolis Upgrade Guide
How to upgrade core and other Nutanix software.
AHV guides and release notes
Administration and release information about AHV.
Prism Central and Web Console guides and release notes
Administration and release information about Prism Central and Prism Element.
Flow Virtual Networking Overview
Enabled and administered from Prism Central,
Flow Virtual Networking
powers network virtualization to
offer a seamless network experience with enhanced security. It is disabled by default.
To enable and use
Flow Virtual Networking
, ensure
that you log on to Prism Central as a local account user with
Prism
Admin
role. If you log on to Prism Central as a non-local account (IDP-based)
user or without
Prism Admin
role privileges, then Prism Central does
not allow you to enable or use
Flow Virtual Networking
. The task is reported as
Failed
with a
User Denied
Access
message.
Note:
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable
Flow Virtual Networking
to
function. To see the ports and protocols used
Flow Virtual Networking
, see Port Reference.
It is a software-defined network virtualization solution providing overlay capabilities for
the on-prem AHV clusters. It integrates tools to deploy networking features like Virtual
Private Cloud (VPC) and Virtual Private Network (VPN) to support flexible app-driven
networking that focuses on VMs and applications instead of virtual LANs and network
addresses.
After you enable it on Prism Central,
Flow Virtual Networking
delivers the following.
A simplified, Prism Central-based workflow that deploys the application-driven network
virtualization feature.
A secure multi-tenancy solution allowing per-tenant isolation using VPC-based network
segmentation and namespace isolation.
A secure VPN-based connectivity solution for multiple sites, with automated VPN bundle
upgrades.
NAT-based secure egress to external networks, with IP address retention and policy-based
routing.
Self-serve networking services using REST APIs.
Enhanced networking features for more effective disaster recovery.
Note:
You can enable
network segmentation on a Layer 2 extended virtual subnet that does not have a gateway.
For more information about Layer 2 subnet extensions, see Layer 2 Virtual Network Extension. For information about network
segmentation of an extended layer 2 subnet, see
Segmenting a Stretched L2 Network
for Disaster Recovery
in the
Securing Traffic through Network
Segmentation
section of the
Security Guide
.
Deployment Workflow
You can enable
Flow Virtual Networking
using a
simple Prism Central driven workflow, which installs the network controller. The network
controller is a collection of containerized services that run directly on the Prism Central
VM(s). The network controller orchestrates all the virtual networking operations.
Ensure that microservices infrastructure is enabled in
Prism Central Settings
>
Prism Central Management
. See
Prism Central Guide
for information about enabling
microservices infrastructure.
Enable
Flow Virtual Networking
in
Prism Central Settings
>
Advanced Networking
. It is disabled by default. See
Enabling Flow Virtual Networking
You can opt out of
Flow Virtual Networking
by
disabling the
Advanced Networking
option subject to prerequisites
to disable advanced networking. See Disabling Flow Virtual Networking.
You can deploy
Flow Virtual Networking
in a
dark site (a site that does not have Internet access) environment. See the Deploying Flow Virtual Networking at a Dark Site topic for more information.
You can upgrade the
Flow Virtual Networking
controller. Nutanix releases an upgrade for the Flow Virtual Networking controller with
AOS and Prism Central releases. See Upgrading Flow Virtual Networking.
See the
AOS Family Release Notes
and
Release Notes | Prism
Central
.
Flow Virtual Networking
allows you to create
and manage virtual private clouds (VPCs) and overlay subnets to leverage the underlying
physical networks that connect clusters and datacenters. See Virtual Private Cloud.
You can upgrade the network gateway version. Network gateway is used to create VPN or
VTEP gateways to connect subnets using VPN connections, or Layer 2 subnet extensions
over VPN or VTEP.
Flow Virtual Networking Architecture
The Flow virtual networking architecture uses a three-plane approach to simplify network
virtualization.
Prism Central provides the management plane, the network controller itself acts as the
control plane while the AHV nodes provide the data plane. This architecture provides a
strong foundation for Flow virtual networking. This architecture is depicted in the
following chart.
Figure.
Flow Virtual Networking Architecture
Click to enlarge
Deployment Scale
Flow virtual networking supports the following scale:
Entities
Scale
Virtual Private Clouds
500
Subnets
5,000
Ports
50,000
Floating IPs
2,000 per networking controller-enabled Prism Central.
Routing Policies
1,000 per Virtual Private Cloud.
10,000 per networking controller-enabled Prism Central.
Essential Concepts
VPC
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that
functions as a logically isolated virtual network. A VPC could be made up of one or
more subnets that are connected through a logical or virtual router. The IP addresses
within a VPC must be unique. However, IP addresses may overlap across VPCs. As VPCs
are provisioned on top of another IP-based infrastructure (connecting AHV nodes), they
are often referred to as the overlay networks. Tenants may spin up VMs and connect
them to one or more subnets within a VPC. Virtual Private Cloud (VPC) is a virtualized
network of resources that are specifically isolated from the rest of the resource
pool. VPC allows you to manage the isolated and secure virtual network with enhanced
automation and scaling. The isolation is done using network namespace techniques like
IP-based subnets or VLAN based networking.
VPC Subnets
You can use IP address-based subnets to network virtual machines within a VPC. A VPC
may use multiple subnets. VPC subnets use private IP address ranges. IP addresses
within a single VPC must be unique, in other words, IP addresses inside the same VPC
cannot be repeated. However, IP addresses can overlap across multiple VPCs. The
following figure shows two VPCs named Blue and Green. Each VPC has two subnets,
192.168.1.0/24 and 192.168.2.0/24, that are connected by a logical router. Each subnet
has a VM with an IP address assigned. The subnets and VM IP addresses overlap between
the two VPCs.
Figure.
VPC Subnet
Click to enlarge
The communication between VMs in the same subnets or different subnets in the same VPC
(also called East-West communication) is enabled using GEneric NEtwork Virtualization
Encapsulation (GENEVE). If a Prism Central manages multiple clusters, then the VMs that
belong to the same VPC could be deployed across different clusters. The virtual switch on
the AHV nodes provide distributed virtual switching and distributed virtual routing for all
VPCs.
The communication from a VM in a VPC to an endpoint outside the VPC (called external
communication or North-South communication) is enabled by an external network connection.
Such a connection may be secured using VPN. The following figure shows the logical
connectivity of the VPCs to the external network, and subsequently to the Internet.
Note:
You
must configure the default route (0.0.0.0/0) to the external subnet as the next hop for
connectivity outside the cluster (north-south connectivity).
Figure.
External Communication
Click to enlarge
External Subnets
Subnets outside a VPC are external subnets. External subnets may be subnets within
the deployment but not included in a specific VPC. External subnets may also be
subnets that connect to the endpoints outside the deployment such as another
deployment or site.
External subnets can be deployed with NAT or without NAT. You can add a maximum of
two external subnets - one external subnet with NAT and one external subnet without
NAT to a VPC. Both external subnets cannot be of the same type. For example, you
cannot add two external subnets, both with NAT. You can update an existing VPC
similarly.
Primary and Secondary IP Addresses for VMs
See VM IP Address Management.
SNAT and Floating IP Address
SNAT and Floating IP addresses are used only when you use NAT for an external
subnet.
In Source Network Address Translation (SNAT), the NAT router modifies the IP address
of the sender in IP packets. SNAT is commonly used to enable hosts with private
addresses to communicate with servers on the public Internet.
For VMs within the VPC to communicate with the rest of the deployment, the VPC must
be associated with an external network. In such a case, the VPC is assigned a unique
IP address, called the SNAT IP, from the subnet prefix of the external network. When
the traffic from a VM needs to be transmitted outside the VPC, the source IP address
of the VM, which is a private IP address, is translated to the SNAT IP address. The
reverse translation from SNAT IP to private IP address occurs for the return traffic.
Since the SNAT IP is shared by multiple VMs within a VPC, only the VMs within the VPC
can initiate connections to endpoints outside the VPC. The NAT gateway allows the
return traffic for these connections only. Endpoints outside the VPC cannot initiate
connections to VMs within a VPC.
In addition to the SNAT IP address, you can also request a Floating IP address — an
IP from the external subnet prefix that is assigned to a VM via the VPC that manages
the network of the VM. Unless the floating IP address is assigned to the private IP
address (primary or secondary IP address) of the VM, the floating IP address is not
reachable. When the VM transmits packets outside the VPC, the private IP of the VM is
modified to the Floating IP. The reverse translation occurs on the return traffic. As
the VM uses the Floating IP address, an endpoint outside the VPC can also initiate a
connection to the VM with the floating IP address.
The translation of the private IP addresses to Floating IP or SNAT IP address, and
vice versa, is performed in the hypervisor virtual switch. Therefore, the VM is not
aware of this translation. Floating IP translation may be performed on the hypervisor
that hosts the VM to which the floating IP is assigned to. However, SNAT translation
is typically performed in a centralized manner on a specific host.
NAT Gateway
NAT Gateways are used only when you use NAT for an external subnet.
Network Address Translation (NAT) is a process for modifying the source or
destination addresses in the headers of an IP packet while the packet is in transit.
In general, the sender and receiver applications are not aware that the IP packets are
being manipulated.
A NAT Gateway provides the entities inside an internal network with connectivity to
the Internet without exposing the internal network and its entities.
A NAT Gateway is:
A node or a AHV host. You need a host or a node to implement a NAT Gateway because
NAT gateways require operations like load balancing and routing that are
automatically performed by Flow virtual networking.
Connected to the internal network with an internal subnet based IP address and to
the external network with an externally-routable IP address.
The
externally-routable IP address may be an IP address from a private IP address
space or an RFC1918 address that is used as a NAT gateway. The NAT Gateway IP
address could be a static IP address or a DHCP assigned IP address.
Table 1.
NAT Gateway Failover Time
Event
Failover Time
Network controller stops on AHV
Up to 45 seconds.
Node reboot
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
not on the same node.
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
on the same node.
Up to 300 seconds (5 minutes).
Static IP Address
A static IP address is a fixed IP address that is manually assigned to an interface
in a network. Static IP addresses provide stable routes that do not have to be updated
frequently in the routing table since the static routes generated using static IP
addresses do not need to be updated.
Usually in a large IP-based network (a network that uses IP addresses), a Dynamic
Host Configuration Protocol or DHCP server assigns IP addresses to interfaces of an
entity (using DHCP client service on the entity). However, some entities may require a
static IP address that can be reached (manual remote access or via VPN) quickly. A
static IP address can be reached quickly because the IP address is fixed, assigned
manually and is stored in the routing table for a long duration. For example, a
printer in an internal network would need a static IP address so that it can be
connected reliably. Static IP addresses can be used to generate static routes which
remain unchanged in routing tables, thus providing stable long-term connectivity to
the entity that has the static IP address assigned.
Static Route
Static routes are fixed routes that are created manually by the network
administrator. Static routes are more suited for small networks or subnets.
Irrespective of the size of a network, static routes may be required in a variety of
cases. For example, in VPCs where you use virtual private networks (VPNs) or Virtual
Tunnel End Point (VTEP) over VxLAN transport connections to manage secure connections,
you could use static routes for specific connections such as site-to-site connections
for disaster recovery. In such a case it is necessary to have a known reliable route
over which the disaster recovery operations can be performed smoothly. Static routes
are primarily used for:
Facilitating the easy maintenance of the routing table in small networks that are
not expected to grow.
Routing to and from other internal route or stub networks. A stub network or an
internal route network is a network accessed using a single route and the router has
only one neighbor.
Use as a default or backup route. Such a route is not expected to specifically
match any other route in the routing table.
In a network that is not constantly changing, static routes can provide faster and
more reliable services by avoiding the network overheads like route advertisement and
routing table updates for specific routes.
Overlay networks
You can create an IP-based Overlay subnet for a VPC. An Overlay network is a
virtualized network that is configured on top of an underlying virtual or physical
network. A special purpose multicast network can be created as an Overlay network
within an existing network. A peer-to-peer network or a VPN are also examples of
Overlay networks. An important assumption for an Overlay network is that the
underlying network is fully connected. Nutanix provides the capability to create
Overlay network-based VPCs.
Comparing Overlay with VLAN
See how overlay networks compare with VLAN networks. A virtual local area network or VLAN
network is a Layer 2 network that provides virtualized network segmentation solution. VLANs
route and balance traffic in a network based on MAC addresses, Protocols such as Ethernet,
ports or specific subnets. A VLAN creates a virtual Layer 3 network using Layer 2 addressing
by separating broadcast domains virtually or logically. A VLAN configured network behaves as
if the network is segmented using a physical layer 2 switch without implementing a layer 3
IP based subnet for the segmentation. VLAN traffic usually cannot traverse outside the
VLAN.
The main advantage that VLAN networks provide is that VLAN networks require only layer 2
(L2) connectivity. VLANs do not require any of the layer 3 (L3) Flow virtual networking
features.
Overlay networks can be laid on underlying physical network connections including VLAN
networks. Overlay networks provide the following advantages and constraints:
IP address namespace is decoupled from the physical network.
You can create, update or delete overlay networks without requiring any configurations
on the physical network and powering down the systems.
You can create overlay networks that can span across multiple clusters.
VLAN networks are necessary for Bootstrapping of Flow virtual networking.
Note:
Nutanix
recommends using VLAN0 as the default untagged (also called native) VLAN for a CVM and
AHV host. You can create VLANs for user VMs using the
Network
Configuration
page. You can use the
Create Virtual
Switch
dialog box from the
Network Configuration
page
to create virtual switches for the user VM VLANs.
AHV Networking VLAN and Flow virtual networking VLAN: VLAN backed subnets for external
connectivity are managed by the Flow virtual networking control plane. Traditional AHV
VLAN IPAM networks are managed by Acropolis. Do not configure the same VLAN as both a Flow
virtual networking external network and an AHV IPAM network, as this can lead to IP
address conflicts.
Traffic Behavior
Broadcast Traffic
When all the guest VMs belonging to a subnet are in the same AHV: Flow virtual
networking broadcasts the traffic to all guest VMs in the same subnet.
When some VMs belonging to a subnet are in other AHVs: Flow virtual networking
tunnels the traffic to only those AHVs which have endpoints in the same subnet.
In other words, Flow virtual networking broadcasts traffic to all the guest VMs in
the same subnet.
Unicast Traffic
Unicast traffic is traffic transmitted on a one-to-one basis between IP addresses and
ports. There is only one sender and one receiver for the traffic. Unicast traffic is
usually the most used form of traffic in any LAN network using Ethernet or IP
networking. Flow virtual networking transmits unicast traffic based on the networking
policies set.
Unknown Unicast Traffic
Flow virtual networking always drops unknown unicast traffic. It is not transmitted
to any guest VM within or outside the source AHV.
Multicast Traffic
Flow virtual networking transmits the traffic to the VMs in the multicast group
within the same subnet. If the VM is on another AHV, the destination AHV must have an
endpoint in the subnet.
Multicast Group
A multicast group is defined by an IP address (called a multicast IP address, usually
a Class D IP address) and a port number. Once a host has group membership, the host
will receive any data packets that are sent to that group defined by an IP
address/port number.
Prerequisites for Enabling Flow Virtual Networking
Make sure you meet these prerequisites before you enable
Flow Virtual Networking
on Prism Central.
Requirements
Important:
Prism Central protection and recovery does not protect or recover
Flow Virtual Networking
services.
You must have the following fulfilled to enable
Flow Virtual Networking
:
Ensure that you log on to Prism Central as a local account user with
Prism
Admin
role. If you log on to Prism Central as a non-local account
(IDP-based) user or without
Prism Admin
role privileges, then
Prism Central does not allow you to enable or use
Flow Virtual Networking
. The task is reported as
Failed
with a
User Denied Access
message.
Ensure that the Prism Central running
Flow Virtual Networking
is hosted on an AOS
cluster running AHV.
The network controller has a dependency only on the AHV version.
Ensure that microservices infrastructure on Prism Central is enabled. See
Prism
Central Guide
for information about microservices infrastructure.
Choose the x-large PC VM size for
Flow Virtual Networking
deployments. Small or
large PC VMs are not supported for Flow virtual networking.
If you are running a small or large Prism Central VMs, upgrade the Prism Central VM
resources to x-large PC VM. See
Acropolis Upgrade Guide
for procedure to
install an x-large Prism Central deployment.
Although
Flow Virtual Networking
may be enabled
on a single-node PC, Nutanix strongly recommends that you deploy a three-node scale-out
Prism Central for production deployments. The availability of
Flow Virtual Networking
service in Prism Central
is critical for performing operations on VMs that are connected to overlay networks. A
three-node scale-out Prism Central ensures that
Flow Virtual Networking
continues to run even if
one of the nodes with a PCVM fails.
Prism Central VM registration. You cannot unregister the Prism Element cluster that is
hosting the Prism Central deployment where you have enabled
Flow Virtual Networking
. You can unregister other
clusters being managed by this Prism Central deployment.
Ensure that Microservices Infrastructure (CMSP) is enabled on Prism Central before you
enable
Flow Virtual Networking
. See the
Prism Central Guide
for more information.
For the procedure to enable Microservices Infrastructure (including enable in dark
site), see
Enabling Micro Services Infrastructure
section in the
Prism Central Guide
.
Note:
When you configure microservices infrastructure, ensure that the DNS name you
configure for CMSP does not end with
test
.
Flow Virtual Networking
does not support
test
as a top level domain. For example, the following are valid domain configurations:
my.cluster.domain
my.test.cluster.test.domain
However, the following are examples of domains that
Flow Virtual Networking
does not support:
my.cluster.test
my.cluster.domain.test
Ensure that you have created a virtual IP address (VIP) for Prism Central. The
Acropolis Upgrade Guide
describes how to set the VIP for the Prism
Central VM. Once set, do not change this address.
Ensure connectivity:
Between Prism Central and its managed Prism Element clusters.
To the Internet for connectivity (not required for dark site) to:
ECR for Docker images
S3 storage for LCM portal
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
Prism Central backup, restore, and migration. You cannot perform these operations on
MSP-enabled Prism Central.
Nutanix recommends increasing the MTU to 9000 bytes on the virtual switch vs0 and
ensure that the physical networking infrastructure supports higher MTU values (jumbo
frame support). The recommended MTU range is 1600-9000 bytes.
Nutanix CVMs use the standard Ethernet MTU (maximum transmission unit) of 1,500 bytes
for all the network interfaces by default. The system advertises the MTU of 1442 bytes
to guest VMs using DHCP to account for the extra 58 bytes used by Generic Network
Virtualization Encapsulation (Geneve). However, some VMs ignore the MTU advertisements
in the DHCP response. Therefore, to ensure that Flow Virtual Networking functions properly with
such VMs, enable jumbo frame support on the physical network and the default virtual
switch vs0.
If you cannot increase the MTU of the physical network, decrease the MTU of every VM in
a VPC to 1442 bytes in the guest VM console.
Note:
Do not change the MTU of the CVM.
Figure.
Sample Configurations with and without Higher MTU - VS0, CVM and UVMs
Click to enlarge
Requirements for Upgrades
The following applies to upgrades of
Flow Virtual Networking
network controller
(
Advanced Networking
in
Prism Control
Settings
):
Ensure that the Prism Central host is running an AHV version compatible with the
networking controller upgrade version. If necessary, upgrade the AHV version using LCM to
the version compatible with the network controller upgrade version.
Note:
See Compatibility and Interoperability Matrix on
the Nutanix Support portal for AOS and Prism Central compatibility.
Ensure that all the AHV hosts in the AOS cluster are running the version compatible with
the network controller upgrade version.
The network controller upgrade fails if any of
the AHV hosts is running an incompatible version.
Limitations
Limitations for Flow Virtual Networking are as follows.
Flow Virtual Networking
does not support
Flow Network Security
for guest VMs.
You cannot configure rules for
Flow Network Security
if a guest VM has any NICs
connected to VPCs.
Flow Virtual Networking
is supported only on
AHV clusters. It is not supported on ESXi or Hyper-V clusters.
Flow Virtual Networking
is not enabled on the
new PE cluster registering with the
Flow Virtual Networking
-enabled Prism Central if
the Prism Element cluster has an incompatible AHV version.
Flow Virtual Networking does not support updating a VLAN-backed subnet as an external subnet.
You cannot enable the external connectivity option in the
Update
Subnet
dialog box. Therefore, you cannot modify an existing VLAN-backed
subnet to add external connectivity.
VLAN backed subnets for external connectivity are managed by the
Flow Virtual Networking
control plane. Traditional
AHV VLAN IPAM networks are managed by acropolis.
Note:
Do not configure the same VLAN as both a
Flow Virtual Networking
external network and an
AHV IPAM network, as this can lead to IP address conflicts.
Flow Virtual Networking
cannot be disabled if
any external subnets and VPCs are in use. Delete the external subnets and VPCs and then
disable
Flow Virtual Networking
.
Disaster Recovery backup and migration: CMSP-enabled Prism Central does not support
disaster recovery backup and migration operations both as a source and target host.
Flow Virtual Networking Configurations
Enabling Flow Virtual Networking
Before you begin
Ensure that microservices infrastructure is enabled on Prism Central. See
Enabling Micro Services Infrastructure
section in the
Prism
Central Guide
.
About this task
Before you proceed to enable Flow virtual networking by enabling the
Advanced Networking
option, see Prerequisites for Enabling Flow Virtual Networking.
To enable Advanced Networking, go to
Prism Central Settings
>
Advanced Networking
and do the following.
Procedure
In the
Advanced Networking
pane, click
Enable
.
Ensure that the prerequisites specified on the pane are fulfilled.
Figure.
Enabling Flow Virtual Networking
Click to enlarge
Prism Central displays the deployment in-progress.
Figure.
Deployment Progress
Click to enlarge
Flow virtual networking is enabled.
Figure.
Flow Virtual Networking Status
Click to enlarge
Disabling Flow Virtual Networking
About this task
You can disable Flow virtual networking. However, the network controller cannot be
disabled if any external subnets and VPCs are in use. Delete the subnets and VPCs
before you disable advanced networking.
Note:
Flow virtual networking cannot be disabled if any external subnets and VPCs are
in use. Delete the external subnets and VPCs and then disable Flow virtual
networking.
To disable Flow virtual networking, do the following.
Procedure
On the
Advanced Networking
page, click
Disable
.
Figure.
Click to enlarge
On the confirmation message box, click
Confirm
to
confirm disablement.
To exit without disabling the
Advanced Networking
controller, click
Cancel
.
Unregistering a PE from the PC
Before unregistering a Prism Element from PC, disable Flow virtual networking on that
Prism Element using network controller CLI (or atlas_cli).
About this task
When Flow virtual networking is enabled on a Prism Central, it propagates the
capability to participate in VPC networking to all the registered Prism Elements
that are running the required AHV version.
In cases where there are VMs on the Prism Element attached to the VPC network, or if
the Prism Element is used to host one or more of the external VLAN networks attached
to a VPC, Prism Central alerts you with a prompt. When being alerted about the
aforementioned conditions, close the CLI and make adequate configuration to resolve
the condition (for example, select a different cluster for the external VLAN network
and delete the VMs attached to the VPC network running on the Prism Element). After
making such configurations, execute the network controller CLI to disable Flow
virtual networking. If the command goes through successfully, it is safe to
unregister the Prism Element.
For example, in a deployment of three Prism Elements - PE1, PE2 and PE3 - registered
to the Flow virtual networking-enabled PC, you want to unregister PE3 from the PC.
You must first disable Flow virtual networking using the following steps:
Procedure
SSH to PE3.
Run the
ncli cluster info
or
ncli cluster
get-params
command to get the cluster parameters.
Copy the cluster UUID (For example: 017457d3-1012-465c-9c54-aa145f2da7d9) from
the displayed cluster parameters.
SSH to the Prism Central VM.
Open the network controller console by executing the
atlas_cli
command.
nutanix@cvm$ atlas_cli
<atlas>
Execute the
config.add_to_excluded_clusters <cluster
uuid>
command, providing the cluster UUID that you copied
earlier.
An example of the PC alert, for the condition that PE3 VM is attached to an
external network, is as follows:
<atlas> config.add_to_excluded_clusters 0005bf8d-2a7f-3b2e-0310-d8e34995511e
Cluster 0005bf8d-2a7f-3b2e-0310-d8e34995511e has 1 external subnet,
which will lose connectivity. Are you sure? (yes/no)
Note:
To enable Flow virtual networking on the cluster, execute the
config.remove_from_excluded_clusters <cluster
uuid>
command, providing the cluster UUID.
What to do next
To verify if Flow virtual networking is disabled or enabled, SSH to PE3 and run the
acli atlas_config.get
command.
The output displays the
enable_atlas_networking
parameter as
False
if Flow
virtual networking is disabled and as
True
if Flow virtual networking
is enabled on the Prism
Element.
You can upgrade the Flow virtual networking controller (
Advanced Networking
Controller
in
Prism Central Settings
) using Life Cycle Manager
(LCM) on Prism Central.
Before you begin
See Prerequisites for Enabling Flow Virtual Networking.
In case of upgrading the Flow virtual networking controller in a dark site, ensure
that LCM is configured to reach the local web server that hosts the dark site
upgrade bundles.
Note:
The network controller upgrade fails to start after the pre-check if one or more
clusters have Flow virtual networking enabled and are running an AHV version
incompatible with the new network controller upgrade version.
About this task
To upgrade the network controller using LCM, do the following.
Procedure
Choose one of the following ways to reach the LCM page:
Go to
Administration
>
LCM
>
Inventory
Click
Check for Updates
on the
Advanced
Networking
page.
Figure.
Check for Updates
Click to enlarge
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the LCM page under
Software
.
Go to
Updates
>
Software
. Select the
Advanced Networking Controller
version you want to upgrade to and click
Update
.
Figure.
Networking Controller version
Click to enlarge
Deploying Flow Virtual Networking at a Dark Site
About this task
Dark sites are primarily on-premises installations which do not have access to the
internet. Such sites are disconnected from the internet for a range of reasons
including security. To deploy Flow virtual networking at such dark sites, you need
to deploy the dark site bundle at the site.
This dark site deployment procedure includes downloading and deploying MSP and the
network controller bundles.
Before you begin
See Prerequisites for Enabling Flow Virtual Networking.
You need access to the Nutanix Portal from an Internet-connected device to
download the following dark site bundles:
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
MSP dark site bundle: https://portal.nutanix.com/page/downloads/list > Microservices Platform (MSP)
Flow virtual network controller dark site bundle: See the
Flow
Virtual Networking Release Notes
for the link to download the
dark site bundle.
Network Gateway bundle: See the
Flow Virtual Networking Release
Notes
for the link to download the dark site bundle with
checksum text file. Also, see
KB-12393
.
To deploy Flow virtual networking at a dark site, do the following.
Procedure
Start a web server to host the dark site bundles and act as a source for the
LCM downloads, if one is not already created.
The web server can be a virtual machine on a cluster at the dark site. All
the Prism Central VMs at the dark site must have access to this web server.
This web server is used when you deploy any dark site bundle including the
network controller darksite bundle.
For more information about the server installation, see:
Linux web server
Windows web server
In Prism Central, go to
Administration
>
LCM
>
Inventory
.
Alternatively, SSH into the Prim Central VM as an admin user and run the
following command.
Where <LCM-web-server-ip> is the IP address of the LCM web server and
release is the name of the directory where the packages were extracted.
For example,
admin@pcvm$ mspctl controller airgap enable
--url=http://10.48.111.33/release
. Here,
10.48.111.33
is the IP address of the LCM web server
and
release
is the name of the directory where the
packages were extracted.
Verify the configuration by running the following command:
nutanix@cvm$ mspctl controller airgap get
From a device that has public Internet access, click the Nutanix Compatibility Bundle link and
down the bundle. Transfer this bundle to the LCM web server and extract the
contents.
From a device that has public Internet access, Nutanix recommends that you
download and extract the latest MSP dark site bundle, transfer it to the LCM web
server, and extract the contents.
From a device that has public Internet access, download the Flow virtual
networking dark site bundle (see Release Notes | Flow Virtual Networking for download links).
Transfer the bundle to the LCM web server.
Extract or unpack the Flow Virtual Networking dark site bundle on the LCM web
server.
After unpacking, check if the system shows a directory path that includes the
following as per the example:
http://<LCM-web-server-ip>/release/builds/msp-builds/msp-services/464585393164.dkr.ecr.us-west-2.amazonaws.com/nutanix-msp/atlas-hermes/
.
Run the following command after unpacking to ensure that the file permissions
are not disrupted during the unpacking:
Linux.
chmod -R +r builds
Windows
NTFS.
$> takeown / R / F *
$> icacls <Build-file-path> /t /grant:F
This section provides information to assist troubleshooting of Flow virtual networking
deployments. This is in addition to the information that the "Prism Central Guide"
provides.
Audit Logs
Prism Central generates audit logs for all the flow networking activities like it
does for other activities on Prism Central. See
Audit Summary View
in the
Prism Central Guide
, for more information about Audit log.
Support Bundle Collection
To support troubleshooting for Flow virtual networking, you can collect logs.
To collect the logs, run the following commands on the Prism Central VM console:
msp
tag will collect logs from the services running on MSP
pods and persistent log volumes (application-level logs)
anc
tag will collect the support bundle, which includes
database dumps and OVN state
-O
flag adds tag-level options
msp_pod=true
collects logs from MSP service pods
On the PC, these logs can be found under
/var/log/containers
.
persistent=true
collects persistent log volumes
(application-level logs for ANC)
On the PC, these can be found under /var/log/ctrlog
kubectl_cmds=true
runs
kubectl
commands to
get the Kubernetes resource state
--duration
sets the duration from the present to collect
The command run generates a zip file at a location, for example:
/home/nutanix/data/logbay/bundles/<filename>.zip
Unzip the bundle and you'll find the
anc
logs under a directory
specific to your MSP cluster, the worker VM where the pod is running, and the logging
persistent volume of that pod. For example:
For more information about the task run, see the text file that the command generates
at a location, for
example:
/home/nutanix/data/logbay/taskdata/<taskID>/collection_result.txt
For more information about the
logbay collect
command, see the
Logbay Log Collection (Command Line)
topic in the
Nutanix Cluster
Check Guide
(NCC Guide).
Layer 2 Virtual Subnet Extension Alert
The
L2StretchLocalIfConflict
alert (Alert with Check ID
- 801109) may occur while performing Layer 2 virtual subnet extensions. See KB-10395
for more information about its resolution.
Network Gateway Upgrades
Nutanix deployment can detect and install upgrades for the onprem Nutanix Gateways.
For information about identifying the current Nutanix Gateway version, see Identifying the Gateway Version.
For onprem Nutanix Gateways, the upgrades need to be detected and installed on the respective
PC on which each Nutanix Gateway is installed.
For more information, see Detecting Upgrades for Gateways.
When Prism Central detects the upgrades, it displays a banner on the
Gateways
tab of the
Connectivity
page. The banner
notifies you that a Gateway upgrade is available after you have run LCM inventory. The table
on the
Gateways
tab also displays an alert (exclamation mark) icon for
the network gateways that the upgrade applies to. The hover message for the icon informs you
that an upgrade is available for that Gateway.
Figure.
Upgrade Banner
Click to enlarge
For more information about the upgrade procedure, see Upgrading the PC-managed Onprem Nutanix VPN Gateways.
Identifying the Gateway Version
About this task
To identify the current Nutanix Gateway version, do the following:
Procedure
Click the hamburger icon and
Networking & Security
>
Connectivity
.
On the
Gateways
tab, click the Gateway name link text to open the
Gateway details page.
In the Gateway table, the VPN Gateway name is a clickable link text.
The
Gateway Version
is listed in the
Properties
widget.
Figure.
Gateway Version
Click to enlarge
Detecting Upgrades for Gateways
About this task
Prism Central can detect whether new Gateway upgrades are available, or not, for
Nutanix Gateways using LCM. You can then install the upgrade.
Procedure
Click the hamburger icon of
Dashboard
.
Click
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
Note:
Nutanix recommends that you select
Enable LCM Auto
Inventory
in the
LCM
page in Prism
Central to continuously detect new Gateway upgrades as soon as they are
available.
The upgrade notification banner is displayed on the
Gateways
page.
Upgrading the PC-managed Onprem Nutanix VPN Gateways
About this task
Perform upgrades of PC-managed Nutanix Gateways using the respective PC on which the
Gateway is created.
To upgrade the on-prem Nutanix Gateways, do the following:
Procedure
Log on to the Prism Central as the admin user and click the gear icon.
Go to
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the
LCM
page under
Software
.
Note:
Skip this step if you have enabled auto-inventory in the
LCM
page in Prism Central.
Go to
Updates
>
Software
. Select the
Gateway version you want to upgrade to and click
Update
.
LCM upgrades the Gateway version. This process takes sometime.
Network and Security View
The
Network and Security
category in the
Entities
Menu
expands on-click to display the following networking and security
entities that are configured for the registered clusters:
Subnets
: This dashboard displays the subnets and the operations
you can perform on subnets.
Virtual Private Clouds
: This dashboard displays the VPCs and the
operations you can perform on VPCs.
Floating IPs
: This dashboard displays a list of floating IP
addresses that you are using in the network. It allows you to request for floating IP
addresses from the free pool of I addresses available to the clusters managed by the
Prism Central instance.
Connectivity
: This dashboard allows you to manage the following
networking capabilities:
Gateways
: This tab provides a list of network Gateways you
have created and configured, and the operations you can perform on the network
Gateways. You can check and upgrade the Gateway bundle in
Administration
>
LCM
>
Inventory
.
VPN Connections
: This tab provides a list of VPN connections
you have created and configured, and the operations you can perform on VPN
connections.
Subnet Extensions
: This tab provides a list of subnets that
you have extended at the Layer 2 level using VPN (point-to-point over Nutanix VPN)
or VTEP (point-to-multi-point including third party).
Security Policies
: This dashboard provides a list of security
policies you configured using Flow Segmentation. For more information about Security
Policies, see the Flow Microsegmentation Guide.
See Network Connections section for information on how
to configure network connections.
Subnets (Overlay IP subnets), Virtual private clouds, floating IPs, and Connectivity are
Flow virtual networking features. These features support flexible app-driven networking that
focuses on VMs and applications instead of virtual LANs and network addresses. Flow virtual
networking powers network virtualization to offer a seamless network experience with
enhanced security. It is disabled by default. It is a software-defined network
virtualization solution providing overlay capabilities for the on-premises AHV clusters.
Security policies drives the Flow Segmentation features for secure communications. See
Flow Microsegmentation Guide.
Subnets
Manage subnets in the
List
view of
Subnets
dashboard in the
Network and
Security
section.
To access the
Subnets
dashboard, select
Subnets
from the entities menu in Prism Central. The
Subnets
dashboard allows you to view information about the subnets configured for the registered
clusters.
Note:
This section describes the information and options that appear in the
Network
and Security
dashboard. See Entity Exploring for instructions on how to view and
organize that information in a variety of ways.
Figure.
Subnets Dashboard
Click to enlarge
The following table describes the fields that appear in the subnets list. A dash (-) is
displayed in a field when a value is not available or applicable.
Table 1.
Subnets Dashboard Fields
Parameter
Description
Values
Name
Displays the subnet name.
(subnet name)
External Connectivity
Displays whether or not the subnet has external connectivity
configured.
(Yes/No)
Type
Displays the subnet type.
VLAN
VLAN ID
Displays the VLAN identification number.
(ID number)
VPC
Displays the name of the VPC that the Subnet is used in.
(Name of VPC)
Virtual Switch
Displays the virtual switch that is configured for the VLAN you selected. The
default value is the default virtual switch
vs0
.
Note:
The virtual
switch name is displayed only if you add a VLAN ID in the VLAN ID
field.
(virtual switch name)
IP Prefix
Displays the IPv4 Address of the network with the prefix.
(IPv4 Address/Prefix)
Cluster
Displays the name of the cluster for which this subnet is configured.
(cluster name)
Hypervisor
Displays the hypervisor that the subnet is hosted on.
(Hypervisor)
To filter the list by network name, enter a string in the filter field. (Ignore the
Filters
pane as it is blank.)
To view focused fields in the List, select the focus parameter from the
Focus
drop down list. You can create your own customised focus
parameters by selecting
Add custom
from the drop down list and
selecting the necessary fields after providing a
Name
, in the
Subnet Columns
.
There is a
Network Config
action button to configure a new network
(see Configuring Network Connections)
The
Actions
menu appears when one or more networks are selected and
includes a
Manage Categories
option (see Assigning a Category).
Go to the
Subnets
list view by clicking
Network and Security
>
Subnets
on the left side-bar.
Figure.
Subnets Page
Click to enlarge
To view or select actions you can perform on a subnet, select the subnet and click the
Actions
dropdown.
Figure.
Subnet Actions
Click to enlarge
Table 2.
Subnet Actions
Action
Description
Update
Click this action to update the selected subnet. see Updating a Subnet.
Manage Extension
Click this action to create a subnet extension. A subnet extension allows VMs
to communicate over the same broadcast domain to a remote Xi availability zone (in
case of Xi-Leap based disaster recovery) via the extension.
Manage Categories
Click this action to associate the subnet with a category or change the
categories that the subnet is associated with.
Delete
Click this action to delete the selected subnet. See Deleting Subnets, Policies, or Routes.
You can also filter the list of subnets by clicking the
Filters
option and selecting the filtering parameters.
Subnet Summary View
View the details of a subnet listed on the Subnets page.
To view the details of a subnet, click the name of the subnet on the subnet list view.
Figure.
Subnet Summary Page
Click to enlarge
The
Summary
page provides buttons for the actions you can perform on
the subnet, at the top of the page. Buttons for the following actions are available:
Update
,
Extend
,
Manage
Categories
, and
Delete
.
The subnet
Summary
page has the following widgets:
Widget Name
Information provided
Subnet Details
Provides the following:
Type
— Displays the type of network like VLAN or
Overlay.
VLAN ID
— Displays the VLAN ID. This parameter is
displayed only for VLAN networks.
VPC
— Displays the VPC name. This parameter is displayed
only for Overlay networks.
Cluster
— Displays the cluster that the VLAN network is
configured on. This parameter is displayed only for VLAN networks.
IP Prefix
— Displays the IP address prefix configured for
the network. This parameter is displayed for both VLAN and Overlay
networks.
IP Pool
Provides the IP address
Pool Range
assigned to the
network.
External Connectivity
Provides the following:
NAT
— Displays whether NAT is enabled or disabled for
VPCs connecting to the network. When you hover on the
Enabled
/
Disabled
status, the hover message displays details of VPCs connected to the external
subnet.
Associated VPCs
— Displays the VPCs associated with this
external subnet.
Virtual Private Clouds
You can manage Virtual Private Clouds (VPCs) on the
Virtual Private
Clouds
dashboard.
Go to the
Virtual Private Clouds
dashboard by clicking
Network and Security
>
Virtual Private Clouds
on the left side-bar.
Figure.
Virtual Private Clouds dashboard
Click to enlarge
You can configure the table columns for the VPC list table. The available column list
includes
Externally Routable IP Addresses
that provides address
space within the VPC that is reachable externally without NAT.. For the list of columns that
you can add to the list table, see Customizing the VPC List View.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
To view or select actions you can perform on a VPC, select the VPC and click the
Actions
drop down.
You can also filter the list of VPC by clicking the
Filters
option
and selecting the filtering parameters.
Customizing the VPC List View
About this task
You can customize the columns in the table. Click the
View by
drop down and select
+ Add custom
.
In the
Virtual Network Columns
dialog box, do the following.
Procedure
Enter a name for the view.
Select the columns you want displayed in the table.
During the column selection, the columns you select are moved under the
Selected Columns
list. The
Name
(of the VPC) column is the default column
already selected. You can add a maximum of 10 columns (including the
Name
column) to the
Selected
Column
list.
Figure.
Customizing Columns in VPC View
Click to enlarge
To arrange the order of the selected columns, hover on the column name and
click the up or down arrow button as appropriate.
Click
Save
.
VPC Details View
To view the details of a VPC, click the name of the VPC on the VPC list view.
The VPC details view has the following tabs:
Summary
Figure.
Summary Tab
Click to enlarge
The
Summary
tab provides the following panes:
DNS Servers—Provides more information about the DNS Servers used by the VPC.
External Connectivity—Provides the name of the external subnet, NAT Gateway host
details, router/SNAT IP address and the IP address spaces or ranges configured for the
VPC.
Floating IP Addresses—Provides details of the floating IP addresses that the VPC
uses.
Subnets
Figure.
Subnet Tab
Click to enlarge
The
Subnet
tab provides the following information for the
subnets:
Name—Displays the name of the subnet.
IP Range—Displays the IP address range configured for the subnet.
DHCP IP Pool—Displays the DHCP IP address pool configured for the subnet.
Default Gateway IP—Displays the IP address used as the default gateway by the
entities in the subnet.
Actions—Displays the actionable links to
Edit
or
Delete
the subnet.
Policies
Figure.
Policies Tab
Click to enlarge
The
Policies
tab maps the following information about the
security-based traffic shaping policies you configure:
Priority—The traffic priority.
Rule—The
Allow
or
Deny
rule set for
the priority.
Traffic—The traffic type that the priority and rule should be applied to.
Actions—Actions you can take on the policy. You can perform three actions:
Clear counters
,
Edit
the policy or
Delete
the policy.
Routes
Figure.
Routes Tab
Click to enlarge
The
Routes
tab provides the following information about the
routes:
The VPC details view has the following configuration options for the VPC:
Update
: Use this option to update the VPC. For more information,
see Updating Virtual Private Cloud.
Add Subnet
: Use this option to add a subnet to the VPC. For more
information, see Creating a Subnet.
Create Static Routes
: Use this option to create a static route.
For more information, Creating Static Routes.
Update Static Routes
: Use this option to update static route
configurations that you already created. For more information, see Updating Static Routes.
Create Policy
: Use this option to create traffic policies in
addition to the pre-configured default policy. When you create a VPC, there is one default
policy that Advanced Networking creates for the VPC. This policy is pre-configured and
cannot be edited. For more information, see Creating a Policy.
Clear All Counters
: Allows you to clear all the counters for the
VPC.
Delete
: Allows you to delete the VPC. For more information, see
Deleting a Virtual Private Cloud.
Floating IPs
You can access floating IPs on the
Floating IPs
dashboard or list view in the
Network and Security
section.
For information about floating IP addresses and their role in Flow virtual networking, see
SNAT and Floating IP Address.
Go to the
Floating IPs
dashboard by clicking
Network and Security
>
Floating IPs
on the left side-bar.
Figure.
Floating IPs dashboard
Click to enlarge
To view or select actions you can perform on a floating IP address assigned, select the
floating IP address and click the
Actions
drop down. The following
actions are available for a selected floating IP address:
Update—Assign or change the assignment of the floating IP address. You can assign the
floating IP address to a IP address such as a private IP address in a VPC or the primary
IP address of a VM or a secondary IP address created on a VM.
Delete—Delete the floating IP address. The deleted IP address returns to the IP address
pool as unused. Before you delete, ensure that it is not assigned to a private IP address
or a VM. Change the assignment to
None
if it is already assigned,
using the
Update
action.
Note:
Floating IP addresses are not reachable (Pings fail) unless you associate them to
primary or secondary IP addresses of VMs. For more information about assigning floating IP
addresses to secondary IP addresses of VMs, see
Assigning Secondary IP Addresses to Floating
IPs
.
To filter the list of floating IP address assignments, click the
Filters
option and select the appropriate filtering
parameters.
To request floating IP addresses, see Requesting Floating IPs.
Connectivity
You can access network Gateways, VPN connections and subnet extensions on the
Connectivity
dashboard.
Click
Network & Security
>
Connectivity
to see the
Connectivity
dashboard.
The
Connectivity
dashboard opens on the
Gateways
tab. To see the VPN connections, click the
VPN Connections
tab. To see
the subnets extended across AZs, click the
Subnet Extensions
tab.
Gateways Summary View
The
Connectivity
dashboard opens on the
Gateways
dashboard or summary view.
The
Gateway
dashboard provides a list of gateways created for the
clusters managed by the Prism Central.
The
Gateways
dashboard provides a
Create
Gateway
dropdown menu that lets you create a
Local
or a
Remote
gateway. You can create a local or remote gateway with
VPN
or
VTEP
service. For more information,
see Creating a Network Gateway.
You can select a gateway from the list (select the checkbox provided for the gateway) and
then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected gateway.
Figure.
Gateways dashboard
Click to enlarge
The
Gateway
summary list view provides the following details about
the gateway.
Table 1.
Gateway List Fields
Parameter
Description
Values
Name
Displays the name of the gateway.
(Name of gateway)
Type
Displays the gateway type.
(Local or Remote)
Service
Displays the service that the gateway uses.
(VPN or VTEP)
Service IP
Displays the IP address used by the service.
(IP address)
Status
Displays the operational status of the gateway.
(Up or Down)
Attachment Type/Vendor
Displays the type of subnet associated with the gateway.
(VLAN or Overlay-VPC name)
Connections
Displays the number of service connections (such as VPN connections) configured
and operational on the gateway.
(number)
You can click the name of a gateway to open the gateway details page that presents the
information about the gateway in widgets.
Gateway Details View
You can click the name of a gateway in the
Gateway
dashboard
list to open the gateway details page that presents the information about the gateway in
widgets.
The gateway details page displays the name of the gateway on the top left corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update
Gateway
page. For more information, see Updating a Network Gateway in
Flow
Networking Guide
.
The
Delete
button allows you to delete the gateway. For more
information, see Deleting a Network Gateway in
Flow
Networking Guide
.
Figure.
Gateway Details View
Click to enlarge
The details about the gateway are organized in widgets as follows:
Table 1.
Gateway Details
Parameter
Description
Values
Properties widget
Type
Displays the gateway type.
(Local or Remote)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address)
Status
Displays the operational status of the gateway.
(Up or Down)
Gateway Version
Displays the version of the Nutanix gateway appliance deployed.
(Version)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Service Configuration
Service
Displays the service used by the gateway.
(VPN or VTEP)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
VPN Connections
Displays the total number of VPN connections associated with the
gateway.
(Number - actionable link. Click the link to open the VPN connection details
page for the associated VPN connection.)
View VPN Connections
Click this link to open the VPN Connections tab.
-
VPN Connections Summary View
The
Connectivity
dashboard allows you to open the
VPN
Connections
dashboard or summary view.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways between
which you want to create the VPN connection.
The
VPN Connections
dashboard provides a list of VPN connections
created for the clusters managed by the Prism Central.
The
VPN Connections
dashboard provides a
Create VPN
Connection
button that opens the
Create VPN Connection
.
For more information, see Creating a VPN Connection in
Flow Networking
Guide
.
You can select a VPN connection from the list (select the checkbox provided for the VPN
connection) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected VPN
connection.
The
VPN Connections
summary list view provides the following details
about the VPN connection.
Figure.
VPN Connections dashboard
Click to enlarge
Table 1.
VPN Connections List Fields
Parameter
Description
Values
Name
Displays the name of the connection.
(gateway name)
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Local Gateway
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Remote Gateway
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow Virtual Networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
VPN Connections Details View
You can click the name of a VPN connection in the
VPN
Connections
dashboard list to open the VPN connection details page that presents
the information about the VPN connection in widgets.
The VPN connection details page displays the name of the VPN connection on the top left
corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update VPN
Connection
page. For more information, see Updating a VPN Connection in
Flow
Networking Guide
.
The
Delete
button allows you to delete the VPN connection. For
more information, see Deleting a VPN Connection in
Flow
Networking Guide
.
Figure.
VPN Connection Details
Click to enlarge
The details about the VPN connection are organized in widgets as follows:
Summary tab—See the
VPN Connection Summary Tab Details
table below.
Throughput tab—See the
VPN Connection Throughput Tab Details
table
below.
IPSec Logging tab—Provides logs for the IPSec tunnel.
Routing Protocol Logging tab—Provides logs for the routing protocol used in the VPN
connection.
Table 1.
VPN Connection Summary Tab Details
Parameter
Description
Values
VPN Connection widget
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow Virtual Networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
Local Gateway Properties
Gateway Name
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Type
Displays the type of gateway.
(Local)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Tunnel IP
Displays the Tunnel IP address of the local gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address that you assigned to the local gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
(Up or Down)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Remote Gateway Properties
Gateway Name
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Type
Displays the type of gateway.
(Remote)
Tunnel IP
Displays the Tunnel IP address of the remote gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
ASN
Displays the ASN of the EBGP route. This information is only displayed if you
configured EBGP as the External Routing protocol.
(Number)
Vendor
Displays the name of the vendor of the gateway appliance at the remote
site.
(Name of vendor of gateway appliance)
External IP
Displays the IP address assigned to remote the gateway.
(IP Address that you assigned to the remote gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
-
Protocol Details
Service
Displays the service used by the gateway.
(VPN or VTEP)
Gateway Routes
Displays the status of the routes used by the gateways.
(Sent)
Subnet Extensions Summary View
The
Connectivity
dashboard opens on the
Subnet
Extensions
dashboard or summary view.
This Guide does not provide detailed information about
Security Policies
. It
only describes the Summary and Details views for the same. For detailed information about
Security Policies
, see Flow Microsegmentation Guide
The
Subnet Extensions
dashboard provides a list of subnet extensions
created for the clusters managed by the Prism Central.
The
Subnet Extensions
dashboard provides a
Create Subnet
Extension
dropdown menu that lets you extend a subnet
Across
Availability Zones
or
To a Third Party Data Center
. You
can extend a subnet using
VPN
or
VTEP
service.
See Layer 2 Virtual Network Extension for more information.
You can select a subnet extension from the list (select the checkbox provided for the
subnet extension) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected subnet
extension.
Figure.
Subnet Extensions dashboard
Click to enlarge
The
Subnet Extensions
summary list view provides the following
details about the gateway.
Table 1.
Subnet Extensions List Fields
Parameter
Description
Values
Name
Displays the name of the subnet extension.
(Name of subnet extension)
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Extension Over
Displays the service that the subnet extension uses.
(VPN or VTEP)
Extension Uses
Displays the name of the local network gateway that the subnet extension
uses.
(Name of local network gateway)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Remote Site
Displays the name of the remote network gateway that the subnet extension
uses.
(Name of remote network gateway)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
You can click the name of a subnet extension to open the subnet extension details page that
presents the information about the subnet extension in widgets.
Subnet Extensions Details View
You can click the name of a subnet extension in the
Subnet
Extensions
dashboard list to open the subnet extension details page that presents
the information about the subnet extension in widgets.
The subnet extension details page displays the name of the subnet extension on the top left
corner. It has two tabs -
Summary
,
Address Table
and
Throughput
.
Summary
The
Summary
tab provides the information about the subnet extension in
widgets. It also allows you to take the following actions:
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update Subnet
Extension
page. See Updating an Extended Subnet for more
information.
The
Delete
button allows you to delete the subnet extension. See
Removing an Extended Subnet for more
information.
Figure.
Subnet Extensions Details View - Summary tab sample for VTEP extension
Click to enlarge
(For VLAN subnets only) Displays the VLAN ID of the VLAN subnet that is
extended.
(VLAN ID number)
VPC
(For Overlay subnets only) Displays the name of the VPC subnet that is
extended.
(Name of VPC)
Cluster
(For VLAN subnets only) Displays the cluster that the VLAN subnet belongs
to.
(Name of cluster)
IP Address Prefix
Displays the network IP address with prefix, of the VLAN subnet that is
extended.
(IP Address with prefix)
Virtual Switch
(For VLAN subnets only) Displays the virtual switch on which the VLAN subnet is
configured.
(Virtual Switch name such as vs0 or vs1)
IP Address Pools
Pool Range
Displays the range of IP addresses in the pool configured in the subnet that is
extended.
(IP address range)
(Interactive Graphic Pie Chart)
Displays a dynamic pie chart that displays the statistic you hover on. Displays
the following IP address statistics outside the pie chart, that you can hover on:
Total number of IP addresses available.
Used IP addresses in the subnets
Used IP addresses in the IP address pools
Free IP addresses in the subnets
Free IP addresses in the IP address pools
(IP Address statistics)
Subnet Extension
Subnet Extension (properties) - Common
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Local IP Address
Displays the IP address that you entered in the
Local IP
Address
field while creating the subnet extension.
(IP Address)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Subnet Extension (properties) - (Only for
Across Availability Zones
type)
Local Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the local AZ that is hosting the subnet that is extended.
(Name of the local Availability Zone)
Remote Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the remote AZ that the subnet is extended to.
(Name of the remote Availability Zone)
Remote Subnet
(Only for
Across Availability Zones
type) Displays the
name of the remote subnet that the subnet extension connects to.
(Name of remote subnet)
Remote IP Address
(Only for
Across Availability Zones
type) Displays the
IP address that you entered in the
Remote IP Address
field
while creating the subnet extension.
(IP Address)
Subnet Extension (properties) - (Only for
To a Third Party Data Center
type)
Local Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the local gateway used for the subnet extension.
(Name of local gateway)
Remote Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the remote gateway used for the subnet extension.
(Name of remote gateway)
Address Table
The
Address Table
tab provides MAC Address information only when the
subnet extension uses VTEP service. The tab provides the following information in the
table:
MAC Address
: This provides the MAC addresses of devices connected
to the remote VTEP endpoint in the subnet extension.
Remote VTEP Endpoint
: This provides the IP address of the remote
VTEP endpoint in the subnet extension.
Figure.
Subnet Extensions Details View - Address Table tab sample for VTEP extension
Click to enlarge
Figure.
Subnet Extensions Details View - Address Table tab sample for VPN-based
Extension
Click to enlarge
Throughput
The
Throughput
tab provides a graphical representation of the
throughput of the subnet extension.
Figure.
Subnet Extensions Details View - Throughput tab sample for VTEP Extension
Click to enlarge
Note:
This section describes the information and options that appear in the security policies dashboard.
See Entity Exploring for instructions on how to view
and organize that information in a variety of ways.
See Flow Microsegmentation Guide for information
about how to create and apply security policies.
Figure.
Security Policies Dashboard
Click to enlarge
The following table describes the fields that appear in the security policies list. A dash
(-) is displayed in a field when a value is not available or applicable.
Table 1.
Security Policies List Fields
Parameter
Description
Values
Name
Displays the policy name. The policy is one of three types: application,
quarantine, or isolation.
(name), Application, Quarantine, Isolation
Purpose
Describes (briefly) the policy's purpose.
(text string)
Policy
Displays (high level) what the policy does.
(boxed text)
Status
Displays the current status of the policy (either applied currently or in
monitoring mode).
Applied, Monitoring
Last Modified
Displays the date the policy was last modified (or the creation date if the
policy has never been modified).
(date)
You can filter the security polices list based on several parameter values. The following
table describes the filter options available when you open the Security Policies view
Filter
pane. To apply a filter, select a parameter and check the
box of the desired value (or multiple values) you want to use as a filter. You can apply
filters across multiple parameters.
Table 2.
Filter Pane Fields
Parameter
Description
Values
Name
Filters on the item name. Select a condition from the pull-down list
(
Contains
,
Doesn't contain
,
Starts with
,
Ends with
, or
Equal to
) and enter a string in the field. It will return a
list of security policies that satisfy the name condition/string.
(policy name string)
Type
Filters on the policy type. Check the box for one or more of the policy types
(application, quarantine, isolation). It will limit the list to just those policy
types.
Application, Quarantine, Isolation
Status
Filters on the policy status. Check the box for applied or monitoring.
Applied, Monitoring
The security policies dashboard includes a
Create Security Policy
action button with a drop-down list to
Secure an Application
or
Isolation Environments
.
The
Actions
menu appears when one or more policies are selected. It
includes options to update, apply, monitor, and delete. The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Security Policy Details View
This Guide does not provide detailed information about
Security Policies
. It
only describes the Summary and Details views for the same. For detailed information about
Security Policies
, see Flow Microsegmentation Guide
To access the details page for a security policy, click on the desired security policy name
in the list (see Security Policies Summary View).
The Security Policy details page includes the following:
The policy name appears in the upper left. You can switch from one policy to another by
selecting the policy name from the pull-down list.
The rule status appears below the name and indicates whether the policy is being applied
currently or is in monitoring mode.
Three columns appear that specify the Inbound policy (on the left), the affected
entities (in the middle), and the Outbound policy (on the right).
There are three action buttons (upper right).
Click the appropriate button to update, apply, monitor, or delete the policy (see
Nutanix Security Guide
for details). The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Click the question mark icon to open a help page in a separate tab or window.
Click the X icon to close the details page.
Figure.
Security Policy Details View: Monitoring Rule Example
Click to enlarge
Figure.
Security Policy Details View: Applied Rule Example
Click to enlarge
For more information about Security Policies, see Flow Microsegmentation Guide.
Virtual Private Cloud
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that functions
as a logically isolated virtual network. A VPC could be made up of one or more subnets that
are connected through a logical or virtual router. The IP addresses within a VPC must be
unique. However, IP addresses may overlap across VPCs. As VPCs are provisioned on top of
another IP-based infrastructure (connecting AHV nodes), they are often referred to as the
overlay networks. Tenants may spin up VMs and connect them to one or more subnets within a
VPC.
Virtual Private Cloud (VPC) is a virtualized network of resources that are specifically
isolated from the rest of the resource pool. VPC allows you to manage the isolated and secure
virtual network with enhanced automation and scaling. The isolation is done using network
namespace techniques like IP-based subnets or VLAN based networking.
AHV provides the framework to deploy VPC on on-premises clusters using the following.
Advanced Networking subnets and DHCP management
Multiple uplink and bridge management via virtual switch (VS)
Virtual Private Network (VPN) gateways and connections
Flow Virtual Networking simplifies the deployment and configuration of overlay-based VPCs. It allows
you to quickly:
Create, update and delete VPCs.
Create, update and delete subnets within VPCs.
Note:
Create subnets as necessary when you
create VPCs.
Add network security policies and services.
Configure hybrid cloud connectivity with VPNs.
This section covers the concepts and procedures necessary to implement VPCs in the
network.
VM IP Address Management
Primary Address
The primary IP address is assigned to a VM during initialization when the cluster provides
any virtual NIC (NIC) to a VM.
Select
Assign Static IP
as the
Assignment
Type
to add a static IP address as primary IP address of the VM, when you
attach a subnet to a VM.
Select
Assign with DHCP
as the
Assignment
Type
to allow DHCP to dynamically assign an IP address to the VM.
Select
No Private IP
as the
Assignment
Type
if you do not want to assign an IP address to the vNIC of the VM.
For more information about attaching a subnet to a VM, see Creating a VM through Prism Central (AHV) in the
Prism Central Guide
.
Secondary IP Addresses (Overlay Networks only)
For your deployment, you may need to configure multiple (static) IP addresses to a single
NIC. These IP addresses (other than the primary IP address) are secondary IP addresses. A
secondary IP address can be permanently associated with a specific NIC or be changed to any
other NIC. The NIC ownership of a secondary IP address is important for security routing
policies.
Note:
You can configure secondary IP addresses only for VMs in an Overlay network.
You can configure secondary IP addresses to a NIC when you want to:
Associate multiple floating IP addresses with one VM without creating multiple NICs
(each with one primary IP address) for the VM. You can assign one floating IP address to
one secondary IP address that you create for the single NIC. For information about
floating IP addresses, see Requesting Floating IPs.
Run appliances, such as load balancers, that have multiple IP addresses on each
interface.
Host applications in a High Availability (HA) configuration where the ownership of IP
address moves from the active entity to the standby entity when the active entity goes
down.
Host applications in a clustered configuration where the ownership of IP address follows
the leader.
Host Nutanix Files service in a VPC as a case of clustered application.
Note:
In applications that use secondary IP addresses as virtual IP addresses and the NIC
ownership of the secondary IP address changes dynamically from one NIC to another,
configure the application to incorporate the ownership change in its settings or
configuration. If the applications do not incorporate these ownership changes, the VPCs
configured for such applications fail.
For information about configuring secondary IP addresses, see Creating Secondary IP Addresses.
IP Address Information
You can view the IP addresses configured on a VM by clicking the
See
More
link in the
IP Address
column in the VM
details view to open the
IP Address Information
box.
Note:
The
See More
link in the
IP Address
column in the VM details view and the
IP Address Information
box are
available only if the VM has any secondary IP addresses configured.
Figure.
IP Address Information
Click to enlarge
Creating Secondary IP Addresses
You can assign multiple secondary IP addresses to a single vNIC.
About this task
You can add multiple secondary IP addresses to the vNIC configured on a VM. Add the
secondary IP addresses to the vNIC in the
Create
VM
or the
Update
VM
page.
Procedure
Go to the
Networks
section.
Click the
Edit
icon for the subnet that you want to add
the secondary IP addresses from.
The
Update NIC
dialog box opens.
Check the
Add Secondary IPs
check box in the
Update NIC
dialog box.
Figure.
Add Secondary IP Addresses
Click to enlarge
Add a comma-separated list of the secondary IP addresses that you want to add
to the vNIC of the VM.
Note:
Ensure that the secondary IP addresses are within the same subnet that
the primary IP address of the
NIC
is from. The subnets are displayed in the
Private IP Assignment
section in the
Update NIC
dialog box.
Ensure that the secondary IP address is not the same as the IP address
provided in the
Private IP Assignment
field.
Click
Save
.
Click
Next
on the
Resources
and the
Management
tabs of the
Update VM
page.
If you need to make any other changes on the
Resources
and the
Management
tabs for any configurations other
than adding secondary IP addresses, make the changes and then click
Next
on these tabs.
Click
Launch VM
on the
Review
tab
after you review
What to do next
You can view the secondary IP addresses configured on the VM in the
IP
Address Information
box.
Assigning Secondary IP Addresses to Interfaces
Assign the secondary IP addresses to interfaces or subinterfaces on the
VM.
About this task
To assign the secondary IP addresses to virtual interfaces on the VM, do the
following on the VM details page:
Procedure
Click
Console
.
Log in as a root user.
Run the
ifconfig
command as follows:
root@host$ ifconfig <interface> <secondary ip address> <network mask>
Provide the following in the command:
Parameter
Description
<interface>
The interface of the VM such as eth0. You can provide
subinterfaces
such as eth0:1 and eth0:2.
<secondary IP address>
The secondary IP address that you created and want to
associate with the interface.
<network mask>
The network mask that is an expansion of the network prefix
of the network that the secondary IP address belongs to. For
example, if the secondary IP address belongs to 10.0.0.0/24 then
the network mask is 255.255.255.0.
Repeat the aforementioned steps for all the secondary IP addresses you want to
associate with interfaces on the VM.
Exit from the Console.
Assigning Secondary IP Addresses to Floating IPs
Assign the secondary IP addresses to floating IP addresses on the VM.
About this task
After you assign secondary IP addresses to interfaces or subinterfaces on the VM, you
can assign the secondary IP addresses to floating IP addresses that may be used for
external connectivity.
Do one of the following:
Procedure
Assign floating IP addresses when you request floating IP addresses in the
Assign Floating IPs
section of the
Request
Floating IP
dialog box.
To assign floating IP addresses while requesting for them, you must have the
secondary IP addresses configured and ready when you are requesting the floating
IP addresses.
Select the floating IP address you want to assign, in the
Floating
IPs
dashboard. Click the
Update
option in
the
Actions
drop-down menu.
Assign the secondary IP addresses you configured to the floating IP addresses
you have.
VPC Workflow
A virtual private cloud (VPC) can be deployed on Nutanix cluster infrastructure to manage
the internal and external networking requirements using Flow Virtual Networking. The workflow to
create a complete network based on VPC is described below.
Create a VPC—See Creating Virtual Private Cloud. See Updating Virtual Private Cloud to update a VPC you created.
Add Subnets to the VPC—See Creating a Subnet to create a
Subnet. See Updating a Subnet to update a subnet.
Attach the Subnet to VMs—See Attaching a Subnet to a Virtual Machine.
VPC Management
This section provides information and procedures that you need to manage virtual
private clouds using Flow Virtual Networking.
Creating Virtual Private Cloud
About this task
You can create VPCs on the Virtual Private Clouds page. Go to the Virtual Private
Clouds page by clicking
Virtual Infrastructure
>
Networking
>
Virtual Private Clouds
.
To create a VPC, do the following.
Procedure
On the VPC dashboard, click
Create VPC
.
See Network and Security View for more information about the
VPC dashboard.
The
Create Virtual Private Cloud (VPC)
dialog box opens.
Figure.
Create Virtual Private Cloud
Click to enlarge
Provide the necessary values in respective fields in the
Create
Virtual Private Cloud (VPC)
dialog box.
Fields
Description and Values
Name
Provide a name for the VPC.
External Connectivity
This section takes you through configuration of the
parameters necessary for connectivity to the Internet or
clusters outside the VPC.
A subnet with external connectivity
(External Subnet) is required if the VPC needs to send
traffic to a destination outside of the VPC.
Note:
You
can add a maximum of two external subnets - one external
subnet with NAT and one external subnet without NAT to a
VPC. Both external subnets cannot be of the same type. For
example, you cannot add two external subnets, both with NAT.
You can update an existing VPC similarly.
Network
address translation (NAT) Gateways perform the required
IP-address translations required for external routing. You
can also have external connectivity without NAT.
External Subnet
Select an external subnet from the drop down list. By
associating the VPC with the external subnet you can provide
external connectivity to the VPC.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
Externally Routable IP Addresses
Provide IP addresses that are externally routable. Externally
routable IP addresses are IP addresses that within the VPC which
can communicate externally without NAT. These IP addresses are
used when an external subnet without NAT is used.
Domain Name Servers (DNS)
(Optional) DNS is advertised to Guest VMs via DHCP. This can
be overridden in the subnet configuration.
Click
+
Server IP
to add DNS server IPs under
IP Address
and click the check
mark.
You can
Edit
or
Delete
an IP address you added
using the options under
Actions
.
Click
Save
.
Requesting Floating IPs
About this task
Each VPN gateway requires a floating IP. If you do not provide one during the VPN
gateway creation, then Flow Virtual Networking automatically allocates a floating IP to a
VPN gateway. To provide floating IP during the VPN gateway creation, you can request
floating IPs and assign them to VMs.
You can view the allocated floating IPs on the
Floating IPs
page. Click
Networking
>
>
Floating IPs
.
To request a floating IP, do the following.
Procedure
Click the
Request Floating IP
button on the
Floating IPs
page.
On the
Request Floating IP
dialog box, provide the
information in the respective fields.
Figure.
Request and Assign Floating IPs
Click to enlarge
Note:
Uncheck the
Assign Floating IPs
box if you want to
assign the requested IP addresses after you receive it.
See Floating IPs for more
information.
Fields
Description and Values
External Subnet
Select a subnet that you configured with external
connectivity.
Number of Floating IPs
Enter the number of floating IPs you want. You can request a
maximum of 5 floating IP addresses.
Assign Floating IPs
Select this check box if you want to assign the floating IPs
to specific VMs in the table.
Based on the number you entered in the
Number of
Floating IPs
field, the system provides an
equivalent number of rows of
Search
VMs
and
IP
Address
in the table.
Under
Search VMs
, select the VM to
which you want to assign a floating IP address. Under
IP Address
, select the IP address
on the VM (primary or secondary IP address) to which you
want to assign the floating IP.
You can assign multiple floating IP addresses to multiple
secondary IP addresses that you can create on the NIC of the
VM.
For information about configuring secondary IP addresses, see
Creating Secondary IP Addresses.
Note:
Click
Save
.
What to do next
When you receive the floating IP address you requested, you can see it, assign it
(if not already assigned while requesting) or delete it in the
Floating
IPs
view.
Creating a Subnet
About this task
You can create subnets on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
and open the
Create Subnet
dialog box.
You can also open the
Create Subnet
dialog box from the VPC
details view by clicking the
Add Subnet
option.
To create a subnet, do the following.
Procedure
Click
Create Subnet
.
The
Create Subnet
dialog box opens. The following
figure displays the Create Subnet dialog box with all the options. These options
are displayed based on the values you select in the
Type
field.
Figure.
Create Subnet (With External Connectivity Disabled)
Click to enlarge
Figure.
Create Subnet (With External Connectivity Enabled)
Click to enlarge
Fields
Description and Values
Name
Provide a name for the subnet.
Type
Select the type of subnet you want to create.
You can create a
VLAN
subnet or an
Overlay
subnet.
VLAN ID
(VLAN subnet only) Enter the number of the
VLAN
.
Enter just the number in this field, for example 1 or 27.
Enter 0 for the native VLAN. The value is displayed as
vlan.1 or vlan.27 in the View pages.
Note:
Provision any single VLAN ID either in the AHV network
stack or in the Flow Virtual Networking (brAtlas) networking stack.
Do not use the same VLAN ID in both the stacks.
IP Address management
(Mandatory for Overlay type subnets) This section provides
the
Network IP Prefix
and
Gateway IP
fields for the subnet.
(Optional for VLAN type subnet) Check this box to display the
Network IP Prefix
and
Gateway IP
fields and configure the
IP address details.
Unchecking this box hides these fields. In this case, it is
assumed that this virtual LAN is managed outside the
cluster.
Note:
The
DHCP Settings
option is only
available for VLAN subnets if you select this
option.
DHCP Settings
(Optional for both VLAN and Overlay subnets) Check this box
to display fields for defining a domain.
Checking this box displays fields to specify DNS servers and
domains. Unchecking this box hides those fields.
See Settings the DHCP Options for more
information.
Cluster (VLAN subnet only)
(VLAN subnet only) This option is available only for
VLAN
subnet configuration. Select the
cluster that you want to assign to the subnet.
External Connectivity
(VLAN subnet
only) Turn on this toggle switch if you want use this
VLAN
subnet for external
connectivity.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
NAT
(Option under
External Connectivity
)
If you turn on the
External Connectivity
toggle switch, then you can choose whether to connect to
external networks with or without enabling NAT. Check the
NAT
check box to enable NAT for
external connectivity for VPCs.
Virtual Switch
(VLAN subnet only) Select the virtual switch that is
configured for the VLAN you selected. The default value is the
default virtual switch vs0. This option is displayed only if you
add a VLAN ID in the VLAN ID field.
VPC (Overlay subnet only)
Select the
Virtual Private Cloud (VPC)
that you want to assign to the subnet from the drop down
list.
You can create VPCs and assign them to
Overlay
subnets.
IP Address Pool
Defines a range of addresses for automatic assignment to
virtual NICs.
This field is optional for both
VLAN
and
Overlay
. For
VLAN
, this field is displayed
only if you select the
IP Address
Management
option.
Note:
Configure this field for
VLAN
or
Overlay
to complete the creation
of the VPC, if you do not need external connectivity for
this subnet. You must configure this field only if you need
external connectivity for this subnet.
Click the
Create Pool
button and enter
the following in the
Add IP Pool
page:
Enter the starting IP address of the range in the
Start Address
field.
Enter the ending IP address of the range in the
End Address
field.
Under
Actions
, click the check
mark to submit the starting and ending IP addresses
you entered.
Click the X mark to remove the entries.
Override DHCP Server
(VLAN subnet only) To configure a DHCP server, check the
Override DHCP Server
box and
enter an IP address in the
DHCP Server IP
Address
field.
See
Override DHCP Server (VLAN Only)
in Settings the DHCP Options for information
about this option.
Click
Save
.
Settings the DHCP Options
About this task
Selecting the
DHCP Settings
checkbox in
Create
Subnet
or
Update Subnet
allows you to configure
the DHCP options for the VMs within the subnet. When DHCP settings are configured
for a VM in a subnet and the VM is powered on, Flow Virtual Networking configures these
options on the VM automatically. If you do not configure the DHCP settings, then
these options are not available on the VM automatically when you power it on.
You can enable
DHCP Settings
when you create a subnet and
configure the
DHCP Settings
for the new subnet. You could also
update the DHCP Settings for an existing subnet.
DHCP Settings
is common to and is available on both the
Create Subnet
and the
Update Subnet
dialog boxes.
To configure the
DHCP Settings
, do the following in the
Create Subnet
or the
Update Subnet
dialog box:
Procedure
Provide the information in the
DHCP Settings
fields.
Figure.
DHCP Settings
Click to enlarge
Fields
Description and Values
Domain Name Servers
Provide a comma-separated list of DNS IP addresses.
Example: 8.8.8.8, 9.9.9.9
Domain Search
Enter the VLAN domain name. Use only the domain name
format.
Example: nutanix.com
TFTP Server Name
Enter a valid TFTP host server name of the TFTP server where
you host the host boot file. The IP address of the TFTP
server must be accessible to the virtual machines to
download a boot file.
Example: tftp_vlan103
Boot File Name
The name of the boot file that the VMs need to download from
the TFTP host server.
Example: boot_ahv2020xx
(Optional and for VLAN networks only) Check the
Override DHCP
Server
dialog box and enter an IP address in the
DHCP
Server IP Address
field.
You can configure a DHCP server using the
Override DHCP
Server
option only in case of VLAN networks.
The DHCP Server IP address (reserved IP address for the Acropolis DHCP
server) is visible only to VMs on this network and responds only to DHCP
requests. If this box is not checked, the DHCP Server IP Address field is
not displayed and the DHCP server IP address is generated automatically. The
automatically generated address is
network_IP_address_subnet.254
, or if the default
gateway is using that address,
network_IP_address_subnet.253
.
Usually the default DHCP server IP is configured as the last usable IP in the
subnet (For eg., its 10.0.0.254 for 10.0.0.0/24 subnet). If you want to use
a different IP address in the subnet as the DHCP server IP, use the override
option.
Attaching a Subnet to a Virtual Machine
About this task
To attach a subnet to a VM, go to the
Virtual Infrastructure
>
VM
>
List view
in Prism Central and do the following.
Procedure
Select the VM you want to attach a subnet to. Click
Actions
>
>
Update
.
In the
Update VM
dialog box, click
Add
NIC
.
Figure.
Click to enlarge
Provide the necessary information in the indicated fields in the
Create NIC
dialog box.
Select the
Subnet Name
from the drop down
list.
Select the
Network Connection State
as
Connected
or
Disconnected
.
The
Network Connection State
selection defines
the state of the connection after the NIC configuration is
implemented.
Select the
Assignment Type
.
You can select
Assign with DHCP
to assign a
DHCP based IP address to the VM.
You can select
Assign Static IP
to assign a
static IP address to the VM to reach the VM quickly from any
endpoint in the network such as a laptop.
Click
Add
.
Click
Save
on the
Update VM
dialog
box.
Creating a Policy
About this task
For Policy-based routing you need to create policies that route the traffic in the
network.
When you create a VPC, there is one default policy that Flow Virtual Networking creates for
the VPC. This policy is pre-configured with the Priority 1 and other default values
to
Deny
traffic flow and service (see the table of field
descriptions and values for this dialog box).
Note:
You cannot update or delete the
default policy.
Policies control the traffic flowing between subnets (inter-subnet
traffic).
Policies control the traffic flowing in and out of the VPC.
Policies do not control the traffic within a subnet (intra-subnet
traffic).
Figure.
Policy Tab
Click to enlarge
You can create
a traffic policy using the
Create Policy
dialog box. You can
open the
Create Policy
dialog box either from the VPC list view
or the VPC list view.
On the VPC list view, select the VPC you want to update and click
Create Policy
in the
Actions
drop down menu.
On the VPC details view, click the
Create Policy
option
in the
More
drop down menu.
To create a policy, do the following in the
Create Policy
dialog
box.
Procedure
Provide the necessary values in the respective fields.
Figure.
Create Policy
Click to enlarge
Fields
Description and Values
Value in Default Policy
Priority
The priority of the access list (ACL) determines which ACL is
processed first. Priority is indicated by an integer number. A
higher priority number indicates a higher priority.For example,
if two ACLs have priority numbers 100 and 70 respectively, the
ACL with priority 100 takes precedence over the ACl with
priority 70.
Note:
Click the
Understand
Priorities
link to see the
Understand Priorities
information box (see the image of this box below
this table).
1
Source
The source indicates the source IP or subnet for which you
want to manage traffic.
Source can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Source Subnet IP
with
prefix.
Any
Source Subnet IP
Only required if you selected the
Source
as
Custom
. Provide the subnet IP and
prefix that you want to designate as the source for the
policy. Use the CIDR notation format to provide the subnet
IP. For example, 10.10.10.0/24.
None
Destination
The destination is the destination IP or subnet for which you
want to set the priority.
Destination can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Destination Subnet IP
with prefix.
Any
Destination Subnet IP
Only required if you selected the
Destination
as
Custom
.
None
Protocol
You can also set the priority configure policy for certain
protocols. You can select one of the following options:
Any
: Indicates any IP
address.
Protocol Number
: Provide an
integer number that indicates the protocol you want
to prioritize.
Provide the appropriate value in
the
Protocol Number
field.
TCP
UDP
ICMP
Protocol Number
This field is displayed only if you select
Protocol Number
as the value in
the
Protocol
field. The number you
provide must be the IANA designated number that indicates
respective protocol. See
IANA Protocol
Numbers
.
None
Action
Assign the appropriate action for implementation of the
policy.
Permit
: Permits traffic and
services based on the parameters set.
If the Permit rule is set to override a Drop rule,
then the Permit rule must be set in both the
directions to allow bidirectional communication
between the
Source
and
Destination
.
Deny
: Denies traffic and
service based on the parameters set.
Re-route
:Sends matching traffic
to the next-hop IP address specified by the
Reroute IP
. In case of
reroute, you need to provide an IP address that the
traffic needs to be re-routed to, in the
Reroute IP
field.
Permit
Figure.
Understanding Priorities
Click to enlarge
Click
Save
.
Creating Static Routes
About this task
You can create a static route using the
Create Static Routes
dialog box. You can open the
Create Static Routes
dialog box
either from the VPC list view or the VPC details view.
On the VPC list view, select the VPC and click
Create Static
Routes
in the Actions drop down menu.
On the VPC details view, click the
Create Static
Routes
option in the
More
drop down
menu.
Figure.
Create Static Routes
Click to enlarge
To create static route, do the following in the
Create Static
Routes
dialog box:
Procedure
Provide the necessary values in the respective fields.
Fields
Description and Values
Destination Prefix
Provide the IP address with prefix of the destination
subnet.
Next Hop Link
Select the next hop link from the drop down list. The next
hop link is the IP address that the traffic must be sent for the
static route you are configuring.
Add Prefix
You can create multiple static routes using this option.
Click this link to add another set of
Destination
Prefix
and
Next Hop Link
to configure another static route.
Click
Save
.
Updating Virtual Private Cloud
About this task
You can update a VPC using the
Update Virtual Private Cloud
(VPC)
dialog box. You can open the
Update Virtual Private
Cloud (VPC)
dialog box either from the VPC list view or the VPC
details view.
On the VPC list view, select the VPC you want to update and click
Update
in the
Actions
drop
down menu.
On the VPC details view, click the
Update
option.
The
Update Virtual Private Cloud (VPC)
dialog box is identical
to the
Create Virtual Private Cloud (VPC)
dialog box.
Figure.
Update VPC
Click to enlarge
For details about the parameters that you can update in the
Update Virtual
Private Cloud (VPC)
dialog box, see Creating Virtual Private Cloud.
Procedure
Update the parameters in the
Update Virtual Private Cloud
(VPC)
dialog box.
Click
Save
.
Updating a Subnet
About this task
You can update a subnet displayed on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
>
Subnets
and open the
Update Subnet
dialog box.
You can also open the
Update Subnet
dialog box from the VPC
dashboard for a specific VPC. Click the
Edit
option for the
subnet listed on the
Subnets
tab of the VPC dashboard.
The fields in the
Update Subnet
and the
Create
Subnet
dialog boxes are the same.
Note:
You cannot edit or update the
subnet type. For example, if the subnet type is already configured as
VLAN
, you cannot modify it to an
Overlay
type subnet.
To update a subnets, do the following.
Procedure
Select the subnet you want to update. Select
Actions
>
Update Subnet
.
Update the necessary values in the respective fields in the
Update
Subnet
dialog box.
Figure.
Update Subnet
Click to enlarge
The
Update Subnet
dialog box has the same fields as the
Create Subnet
dialog box. For details about the
fields and the values that can be updated in the
Update
Subnet
dialog box, see Creating a Subnet.
Click
Save
to ensure that the updates are saved in the
configuration.
Category Management
A category is a key-value pair that groups similar entities. Associating a policy with a
category ensures that the policy applies to all the entities in the group regardless of how
the group scales with time. For example, you can associate a group of VMs with the Department:
Marketing category, where Department is a category that includes a value Marketing along with
other values such as Engineering and Sales.
Currently, you can associate only VMs with a category. Categories are implemented in the same
way on on-premises Prism Central instances and in Xi Cloud Services. For information about
configuring categories, see the
Prism Central Guide
.
Updating a Policy
About this task
You can update a policy using the
Update Policy
dialog box. You
can open the
Update Policy
dialog box in two ways in the VPC
details view.
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
Note:
You cannot update or delete the default policy.
The
Update Policy
dialog box has the same parameters as the
Create Policy
dialog box.
For details about the parameters that you can update in the
Update
Policy
dialog box, see Creating a Policy.
Procedure
Update the parameters in the
Update Policy
dialog
box.
Click
Save
.
Updating Static Routes
About this task
You can update a static route using the
Update Static Routes
dialog box. You can open the
Update Static Routes
dialog box
either from the VPC list view or the VPC details view.
Note:
You must configure the default route (0.0.0.0/0) to the external subnet as the
next hop for connectivity outside the cluster (north-south connectivity).
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
The
Update Static Routes
dialog box has the same parameters as
the
Create Static Routes
dialog box.
For details about the parameters that you can update in the
Update Static
Routes
dialog box, see Creating Static Routes.
Procedure
Update the parameters in the
Update Static Routes
dialog
box.
Click
Save
.
Deleting a Virtual Private Cloud
About this task
Prism Central
does not allow you to delete a VPC if the VPC is associated with any subnets and/or
VPNs. After you remove all the subnets or VPN associations from the VPC, delete the
VPC.
You can delete a VPC from the VPC list view or the VPC details view.
Procedure
Do one of the following.
To delete a VPC from the VPC list view, select the VPC you want to
delete and click
Delete
in the
Actions
drop down menu.
To delete a VPC from the VPC details view, click the VPC name to go to
the VPC details view and click the
Delete
option in
the
More
drop down menu.
In the confirmation dialog box, do the following.
Click
Delete
to delete the VPC.
Click
Cancel
to exit without deleting the
VPC.
Deleting Subnets, Policies or Routes
About this task
You can delete VPC entities such as subnets, policies or routes from the VPC details
page.
Note:
You cannot update or delete the default policy.
Do the following.
Procedure
Open the VPC details page and go to the respective tab like
Subnets
,
Policies
or
Routes
.
Click the
Delete
option provided for the selected entity
(subnet, policy or route respectively).
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Connections Management
This section covers the management of network gateways, VPN connections and subnet
extensions including operations like create, update and delete network gateways and VPN
connections, and extending subnets.
Network Gateway Management
You can create, update or delete network gateways that host one of VPN or VTEP service for
connections.
Creating a Network Gateway
About this task
VPN or s connect two networks together, and can be used in both VLAN and VPC networks
on AHV. In other words, you can extend the routing domain of a VLAN network or that
of a VPC using a VPN. Accordingly, VPN gateways can be configured using VLANs or
VPCs. You need VPN gateways on clusters to provide a gateway to the traffic between
on-premise clusters or remote sites.
You can create multiple VPN gateways for a VPC. Since a VPC is configured
only on a PC, the VPC is available to all the clusters registered to that PC.
A VPN gateway may be defined as a Local gateway or a Remote gateway based on where
the traffic needs to be routed.
To create a VPN gateway, do the following on the
Networking & Security
>
Connectivity
>
Gateways
page.
Procedure
Select
Local
or
Remote
in the
Create Gateway
drop-down menu.
If you select
Local
in the drop-down menu, the
Create Local Gateway
dialog box opens. If you select
Remote
in the drop-down menu, the
Create
Remote Gateway
dialog box opens.
Provide the necessary values in the respective fields as described in the
table.
For example, if you select
Local
in the drop-down menu,
then the
Create Local Gateway
dialog box opens. Provide the
necessary values in the respective fields as described in the table.
Figure.
Sample Create Local Gateway - VM Deployment
Click to enlarge
Figure.
Sample Create Local Gateway - VPN Service Configuration
Click to enlarge
Figure.
Sample Create Local Gateway - VTEP Service Configuration
Click to enlarge
Figure.
Sample Create Remote Gateway - VPN Gateway Service
Click to enlarge
Figure.
Sample Create Remote Gateway - VTEP Gateway Service
Click to enlarge
Table 1.
Local Gateway Fields
Fields
Description
Values
VM
Deployment
Name
Enter a name for the network gateway.
(Name)
Gateway Attachments
(for Local gateway type only) Select the gateway attachment
as
VPC
or
VLAN
.
The VPN VM is deployed on a VPC VM or a cluster that has the
selected VLAN respectively.
If you select
VPC
, then
VPC Attachment
is displayed.
VPC
is the default value for
the
Gateway Attachments
field. The
Gateway VM is deployed on the cluster and associated
with the VPC selected in the
VPC
Attachment
section.
VPC
attachment
mode provides the options of
eBGP and Static routing methods for external routing
(configured in the
External Routing
Configuration
section).
If you select
VLAN
, then the
VLAN Attachment
is displayed. The
Gateway VM is deployed on the cluster that has the VLAN
and the subnet specified in the
VLAN
Attachment
section.
VLAN
attachment
mode provides only the eBGP
routing method for external routing.
(VLAN or VPC)
Gateway VM Deployment - VPC
Attachment
Cluster
Select the cluster on which you want to deploy the Gateway VM
on.
(Name of the cluster)
VPC (If Gateway Attachment type is VPC)
Select the VPC configured on the selected cluster that you
want to use for the Gateway VM deployment.
(Name of the VPC selected)
Floating IP (Optional)
Select a floating IP for the network gateway configuration.
If you do not select a floating IP address then Prism
Central allocates a floating IP automatically. This
allocated floating IP is deleted when you delete the
gateway.
To request floating IPs and allocate them to subnets, see
Requesting Floating IPs
(IP address)
Gateway VM Deployment - VLAN
Attachment
Cluster
Select the Cluster, from the drop down list, on which you
want to deploy the Gateway VM on.
Note:
Only clusters with VLANs
are available in the list.
(Name of the cluster)
Subnet
Select the subnet you want to attach the Gateway VM to, from
the drop down list.
Note:
The list includes all the subnets you
created on the selected cluster.
After you select the
subnet, the details of the subnet are displayed in a box below
the
Subnet
field. The details include:
VLAN ID, IPAM type being Managed or Unmanaged, and Network
Address with Prefix.
(Name of the VLAN subnet)
Static IP Address for VPN Gateway VM
Enter the static IP address that the Gateway VM needs to
use.
(IP Address with Prefix)
Default Gateway IP
Enter the default gateway IP of the subnet for the Gateway
VM.
(IP Address)
Service
Configuration
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service Configuration -
External Routing Configuration (This section is available for
VLAN and VPC attachment types)
Routing Protocol
For
VPC
gateway attachments:
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
For
VLAN
gateway attachments:
External routing protocol is pre-set to
eBGP
. You cannot change
the routing protocol.
(Static or eBGP)
Redistribute Connected Routes (Applicable only if VLAN type
gateway attachment is selected)
(
VLAN
only) Select this checkbox to
enable the redistribution of connected routes into the
eBGP.
(Check mark or blank)
ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
eBGP Password
(For
eBGP
in
Local
gateway type only) Enter the
eBGP password for the eBGP route.
(Password: The password must be between 1 and 80 characters.
Password length: Minimum 1 and maximum 80
characters.
)
VPN Service Configuration -
Internal Routing Configuration (This section is available for
VLAN attachment type only.)
Routing Protocol (Between On-prem Gateway and On-prem
Router)
Select the
Routing Protocol
to be used
between on-premises Nutanix gateway and on-premises
router.
You can select:
Static
: Select this protocol
to provide a static route configuration for the VLAN
gateway.
OSPF
: Select this protocol to
provide an OSPF routing configuration for the VLAN
gateway.
iBGP
: Select this protocol to
provide a iBGP route configuration for the VLAN
gateway.
Note:
For iBGP, the ASN must be the same
between the Gateway appliance and the peer iBGP,
when iBGP is selected as the internal routing
protocol.
(Static or OSPF or iBGP)
+Add Prefix (Applicable to Static routing)
(For
Static
routing selected in
Routing Protocol
) Click this to
enter a
Local Prefix
and click the
check mark under
Actions
to add the
prefix.
If you click the X mark under
Actions
,
the local prefix you entered is not added.
The prefixes you add are advertised to all the connected
peers via eBGP.
The prefix must be a valid IP address with the host bits not
set.
You can add multiple local prefix IP addresses.
(prefix like /24)
Area ID (Applicable to OSPF protocol)
(OSPF only) Enter the OSPF area id in the IPv4 address
format.
Password Type
(OSPF only) Select the password type you want to set for the
OSPF route. The options are:
MD5
: Select this option to
encrypt the packets with MD5 hash that can be
decrypted with the MD5 password at the
destination.
Plain Text
: Select this option
to set a clear-text password.
None
: Select this if you do to
set an open route without password protection
Password
(OSPF only) Enter a password for the MD5 or Plain Text
password type you select in the
Password
Type
field.
For
MD5
: The password must be
1-16 characters long.
Characters allowed for OSPF passwords (MD5)
a-z
A-Z
0-9
For
Plain Text
: The password
must be 1-8 characters long.
Characters allowed for OSPF passwords (Plain text):
a-z.
Peer IP (for iBGP)
Enter the IP Address of the On-prem router used to exchange
routes with the network gateway.
(IP Address)
Password
Enter a password with 1-80 characters.
(Password)
VTEP Service Configurations
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Table 2.
Remote Gateway Fields
Fields
Description
Values
Name
Enter a name for the network gateway.
(Name)
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service
Configurations
Public IP Address
Enter the public IP address of the remote endpoint. If a
Floating IP is not selected, a new Floating IP is automatically
allocated for the Gateway. These allocated IP addresses are
deleted when the network gateway is deleted.
(IP Address)
Vendor
Select the vendor of the third party gateway
appliance.
(Name of Vendor)
External Routing
Protocol
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
(Static or eBGP)
eBGP ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 1-65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
VTEP Service
Configurations
VTEP IP Address
Enter VTEP IP Addresses of the remote endpoints that you want
to create the gateway for. You can add IP addresses of multiple
endpoints in one remote gateway.
(Comma separated list of IP Addresses)
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Click
Save
.
What to do next
The Gateway you create is displayed in the
Gateways
page.
Updating a Network Gateway
About this task
You can update a network gateway using the
Update Gateway
dialog
box.
You can open the
Update Gateway
dialog box. The parameters in
the
Update Gateway
dialog box are the same as those in the
Create Local Gateway
or
Create Remote
Gateway
dialog box.
Procedure
Select the gateway you want to update on
Gateways
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update Gateway
dialog
box.
You cannot modify some information. Such fields are greyed and in-actionable.
If you need to modify such information, consider creating a new gateway with the
updated parameters and deleting the current gateway.
Click
Save
.
Deleting a Network Gateway
About this task
If you want to delete a network gateway, you must first delete all the VPN
connections associated with the gateway and only then you can delete the network
gateway.
To delete a network gateway, do the following on the
Gateway
page.
Procedure
Do one of the following.
Select the check box next to the name of the gateway and, in the
Actions
drop-down list, click
Delete
.
Click the name of the gateway and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Virtual Network Connections
Virtual Private Network
You can use the Nutanix VPN solution to set up VPN between your on-prem clusters, which
exist in distinct routing domains that are not directly connected. These distinct routing
domains could either be VPCs within the same cluster or remote clusters or sites.
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. Local VPN gateway can be
instantiated in a VPC context or a legacy VLAN context. Launching the VPN gateway within a
VPC allows stretching of the VPC. For example, in the figure, the Blue VPC is stretched
between two sites with a VPN.
Figure.
VPN Working
Click to enlarge
VPN connections are useful in connecting two points. You can connect two VPCs in the same
cluster using a VPN or VPCs in different clusters in the same site. However, VPN connection
can connect only one endpoint to another endpoint. Flow virtual networking based VPN service
allows you to only connect two endpoints that use Nutanix VPN based gateway service.
Virtual Tunnel End Points Based Network Extensions
To connect one endpoint to multiple endpoints or third party (non Nutanix) networks, use
Virtual Tunnel End Point (VTEP) service based subnet extensions. For more information about
VTEP, see Layer 2 Virtual Subnet Extension Over VTEP.
VPN Workflow
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. You can configure multiple
VPN endpoints for a site.
Each endpoint must have configurations for a local VPN gateway, remote VPN gateway (pointer
information for the peer local VPN in the remote site endpoint) and a VPN connection
(connecting the two endpoints). Then, based on the VPN connection configuration as initiator
or acceptor, one endpoint initiates a tunnel and the endpoint at the other end accepts the
tunnel connection and, thus, establishes the VPN tunnel.
Gateways: Every VPN endpoint for each site consists of two VPN gateway configurations -
Local and Remote.
Local gateway is a VM that runs the VPN protocols (IKEv2, IPSec) and routing (BGP and
OSPF). Remote gateway is a pointer - database entry - that provides information about
the peer remote VPN endpoint. One of the key information contained in the remote gateway
is the source IP of the remote VPN endpoint. For security reasons, the local VPN gateway
will accept IKEv2 packets originating only from this Source IP.
VPN gateways are of the following types:
On premises Nutanix VPN Gateway: Represents the VPN gateway appliance at your
on-premises local or remote site if you are using the Nutanix VPN solution.
On premises Third Party Gateway: Represents the VPN gateway appliance at your
on-prem site if you are using your own VPN solution (provided by a third-party
vendor).
To configure third party VPN Gateways, see the relevant third party
documentation.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways
between which you want to create the VPN connection.
VPN appliances perform the following:
Implementation of IKEv2 and IPSec protocols.
Routing: Between remote sites, Flow virtual networking advertises prefixes using eBGP.
Optionally it uses Static routing. Within a site, Flow virtual networking uses iBGP or
OSPF to share prefixes between the Nutanix VPN appliance and the edge router.
Prerequisites for VPN Configurations
General Requirements
Ensure that you have enabled Flow virtual networking with microservices Infrastructure.
Ensure that you have floating IP addresses when you create VPN gateways.
Flow virtual networking automatically allocates a floating IP to a VPN gateway if you
do not provide one during the VPN gateway creation. To provide floating IP during the
VPN gateway creation, you can request floating IPs. See Requesting Floating IPs.
Ensure that you have one of the following, depending on whether you are using iBGP or
OSPF:
Peer IP (for iBGP): The IP address of the router to exchange routes with the VPN
gateway VM.
Area ID (for OSPF): The OSPF area ID for the VPN gateway in the IP address format.
Ensure that you have the following details for the deployment of the VPN gateway
VM:
Public IP address of the VPN Gateway Device: A public WAN IP address that you want
the on-prem gateway to use to communicate with the Xi VPN gateway appliance.
Static IP Address: A static IP address that you want to allocate to the VPN gateway
VM. Use a floating IP address requested as the static IP address.
IP Prefix Length: The subnet mask in CIDR format of the subnet on which you want to
install the VPN gateway VM. You can use an overlay subnet used for a VPC and
assigned to the VM that you are using for the VPN gateway.
Default Gateway IP: The gateway IP address for the on-premise VPN gateway
appliance.
Gateway ASN: ASN must not be the same as any of your on-prem BGP ASNs. If you
already have a BGP environment in your on-prem site, the customer gateway is the ASN
for your organization. If you do not have a BGP environment in your on-prem site,
you can choose any number. For example, you can choose a number in the 65000
range.
Ports and Protocols
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable
Flow Virtual Networking
to
function. To see the ports and protocols used
Flow Virtual Networking
, see Port Reference.
Endpoints and Terminations
The following endpoints and terminations occur in the course of Flow virtual networking
based connections. For information about creating, updating or deleting VPN connections, see
Connections Management.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
VPN Endpoint Behind a Network Address Translation or Firewall Device
In this scenario, the IPSec tunnel terminates behind a network address translation
(NAT) or firewall device. For NAT to work, open UDP ports 500 and 4500 in both
directions.
Figure.
VPN Endpoint Behind NAT or Firewall
Click to enlarge
Things to do in NAT
Things to do in on-prem VPN GW
Open UDP ports 500 and 4500 on both directions
Enable the business application policies to
Allow
the
commonly-used business application ports.
IPSec Terminates on the Firewall Device
In this scenario, you do not need to open the ports for NAT (500 and 4500).
However, enable the on-prem VPN gateway to allow the traffic from the PC subnet to
the advertised load balancer route where the Source port is any and the Destination
port may be in the range of 1024-1034.
The PC subnet refers to the subnet where your Prism Central is running.
Figure.
Tunnel Terminates on NAT or Firewall
Click to enlarge
Creating a VPN Connection
About this task
Create a VPN connection to establish a VPN IPSec tunnel between VPN gateways in your
on-prem site. Select the gateways between which you want to create the VPN
connection.
To create a VPN connection, do the following on the
Networking
>
VPN Connections
page.
Procedure
Click the
Create VPN Connection
button on the
VPN Connections
page.
In the
Create VPN Connection
dialog box, provide the
values in the respective fields.
Fields
Description and Values
Name
Enter a name for the connection.
VPN Connection
IPSec Secret
Enter a secret password for the IPSec connection. To see the
password, click
Show
. To hide the
password, click
Hide
.
Local Gateway
Select the connection parameters on the local gateway as
Initiator or Acceptor of VPN Tunnel connections.
VPN Gateway
Select the appropriate VPN Gateway as the local gateway for
the VPN connection
VTI Prefix - Local Gateway
Enter a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel
Interface
IP address with prefix for the local
gateway. The subnet for this IP address must be a /30 subnet
with two usable IP addresses. One of the IP addresses is
used for Local Gateway. Use the other IP address for the
Remote Gateway.
Connection Handshake
This defines the type of handshake that the connection must
use. There are two types of connection handshakes:
Initiator
: The local VPN gateway
acts as the initiator of the connection and thus
initializes the VPN tunnel.
Acceptor
: The local VPN gateway
accepts or rejects incoming connection requests from
other gateways.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
Remote Gateway
For a specific VPN connection, set the remote gateway as
Initiator or Acceptor when you configure the VPN connection on
the Remote Gateway.
VPN Gateway
Select the appropriate VPN Gateway as the remote gateway for
the VPN connection.
VTI Prefix - Remote Gateway
The VPN Tunnel Interface IP address with prefix for the local
gateway. Provide a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel Interface
IP address with prefix for the local gateway. The subnet for
this IP address must be a /30 subnet with two usable IP
addresses. One of the IP addresses is used for Local
Gateway. Use the other IP address for the Remote
Gateway.
Advanced Settings
Set the traffic route priority for the VPN connection. The
route priority uses Dynamic route priority because the priority
is dependent on the routing protocol configured in the VPN
gateway.
Route Priority - Dynamic Route Priority
Set the route priority as an integer number. The greater the
number, higher is the priority.
Click
Save
.
What to do next
The VPN connection you create is displayed in the
VPN
Connections
page.
Updating VPN Connection
About this task
You can update a VPN Connection using the
Update VPN Connection
dialog box.
You can open the
Update VPN Connection
dialog box. The
parameters in the
Update VPN Connection
dialog box are the same
as those in the
Create VPN Connection
dialog box.
Procedure
Select the VPN Connection you want to update on the
VPN
Connection
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update VPN Connection
dialog box.
Click
Save
.
Deleting a VPN Connection
About this task
To delete a VPN connection, do the following on the
VPN
Connection
page.
Procedure
Do one of the following.
Select the check box next to the name of the VPN connection and, in the
Actions
drop-down list, click
Delete
.
Click the name of the VPN connection and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
VPN Connection within Same Prism Central
You can connect two VPCs within the same Prism Central availability zone using a VPN
connection.
About this task
Assume that you have created two VPCs named
vpc-a
and
vpc-b
with overlay subnets named
subnet-a
and
subnet-b
.
To connect the two VPCs within the same Prism Central using a VPN connection, do the
following.
Procedure
Do the following for local gateways:
Create a local VPN gateway with dynamically assigned address for
vpc-a
, for example, named
local-vpn-a
. Note or write down the assigned
IP address.
Create a local VPN gateway with dynamically assigned address for
vpc-b
, for example, named
local-vpn-b
. Note or write down the assigned
IP address.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Do the following for remote gateways:
Create a remote VPN gateway with the IP address noted in 1.a for
vpc-a
, for example, named
remote-vpn-a
.
create a local VPN gateway with the IP address noted in 1.b for
vpc-b
, for example, named
remote-vpn-b
.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Create a VPN connection between
vpc-a
and
vpc-b
named, for example,
vpn-conn-a-to-b
.
Ensure that the VTI IP addresses for the local and remote gateways is unique
with /30 prefix.
Note:
The
VPN Tunnel Interface
IP address with
prefix for the local gateway. The subnet for this IP address must be a /30
subnet with two usable IP addresses. One of the IP addresses is used for
Local Gateway. Use the other IP address for the Remote
Gateway.
Ensure that you select
local-vpn-a
as the local gateway with
Connection Handshake
set as
Acceptor
.
Ensure that you select
remote-vpn-b
as the remote gateway.
Create a VPN connection between
vpc-b
and
vpc-a
named, for example,
vpn-conn-b-to-a
.
Ensure that the VTI IP addresses with /30 prefix for local and remote gateways
are the reverse (vice versa) of what you configured for the VPN connection in
previous step. For example, if in previous step you configured the VTI IP
addresses as 10.20.20.5/30 for local and 10.20.20.6/30 for remote then for VPN
connection in this step, configure 10.20.20.6/30 for local gateway and
10.20.20.5/30 for remote gateway respectively. These IP addresses do not need to
be reachable anywhere else in the network. However, ensure that these IP
addresses do not overlap with any other IP addresses assigned in the
network.
Ensure that you select
local-vpn-b
as the
local gateway with
Connection Handshake
set as
Initiator
.
Ensure that you select
remote-vpn-a
as the remote gateway.
Layer 2 Virtual Network Extension
You can extend a subnet between
on-prem
local and remote clusters or sites (Availability Zones or AZs) to support seamless application
migration between these clusters or sites.
Note:
One or more on-prem cluster or sites managed by one Prism Central instance is defined as
an Availability Zone or AZ. In this section, Availability Zone or AZ refers to and must be
understood as one or more on-prem clusters or sites managed by one Prism Central. Local AZ
refers to local on-prem clusters or sites managed by a Prism Central instance and
remote
AZ
refers
to another on-prem cluster or site managed by another Prism Central
instance.
With Layer 2 subnet extension, you can migrate a set of applications to the remote AZ while
retaining their network bindings such as IP address, MAC address, and default gateway. Since
the subnet extension mechanism allows VMs to communicate over the same broadcast domain, it
eliminates the need to re-architect the network topology, which could otherwise result in
downtime.
Layer 2 extension assumes that there are underlying existing layer 3 connectivity already
available between the Availability Zones. You can extend a subnet from a remote AZ to the
primary (Local) AZ (and other remote AZs in case of VTEP-based subnet extensions)
You can extend a Layer 2 subnet across two Nutanix AZs over either VPN or Virtual tunnel
End Point (VTEP). SeeLayer 2 Virtual Subnet Extension Over VPN.
You can extend a Layer 2 subnet between a Nutanix AZ and one or more non-Nutanix
datacenters only over VTEP. See Layer 2 Virtual Subnet Extension Over VTEP.
You can extend subnets for the following configurations.
IPAM Type.
Managed and unmanaged networks.
Subnet Type.
On-prem VLAN subnets and VPC subnets.
Traffic Type.
IPv4 unicast traffic and ARP.
On-prem Hypervisor.
AHV and ESXi
Note:
If your cluster is ESXi, use vCenter Server
to manually configure the port group attached to the subnet you want to extend. Set the
security settings,
Promiscuous mode
and
Forged
transmits
to
Accept
on the vSwitch as shown in the
following image.
Figure.
ESXi Host Port Group Configuration
Click to enlarge
Prerequisites for Setting Up Subnet Extension
Ensure the following before you configure Layer 2 subnet extension between your on-prem
AZs.
Ensure that the Prism Central versions support Layer 2 virtual subnet extension as
specified in the Release Notes. See
AOS Family Release Notes
and
Release Notes | Prism Central
as applicable.
See the
Prism Central
Upgrade and Installation Guidelines and Requirements
section of the
Acropolis Upgrade Guide
for instructions about how to upgrade a Prism
Central instance through the Prism Central web console.
Ensure that you pair the Prism Central at the local AZ with the Prism Central at the
remote AZ to use
Create Subnet Extension
wizard to extend a subnet
across the AZs and facilitate bidirectional communication between these clusters or sites.
Using paired availability zones it is possible to configure both VXLAN over VPN and VTEP
based subnet extension. You can also extend subnets using the manual gateway and
connection workflows instead of pairing the AZs.
See the Pairing AZs (Nutanix Disaster Recovery) for instructions about how
to pair the local and remote AZs.
Ensure that you set up a default static route with
0.0.0.0/0
prefix and
the External Network next hop for the VPC you use for any subnet extension. This allows
NTP and DNS access for the Network Gateway appliance.
Best Practices for Subnet Extension
Nutanix recommends the following configurations to allow IP address retention for VMs on
extended subnets.
When using Nutanix IPAM ensure the address ranges in the paired subnets are unique to
avoid conflict between VM IP addresses across extended subnets.
If the source and target sites use third-party IPAM, ensure that there are no
conflicting IP address assignments across the two sites.
Note:
If the source and target
sites use Nutanix IPAM, the Prism Central web console displays a message that indicates
an IP address conflict if one exists.
If connectivity between sites already provides encryption, consider using VTEP only
subnet extension to reduce encryption overhead.
Use the
Subnet Extension to a Third Party Data-Center
workflow in
the following scenarios
To extend a subnet to more than one other AZ. This is also known as point to
multi-point.
To extend subnets between clusters managed by the same Prism Central.
Subnet Extension Workflow
You can manage Layer 2 subnet extension on the
Subnet Extensions
tab
of the
Connectivity
page. Open the
Subnet
Extensions
by clicking the hamburger icon in the top-left corner of the
Dashboard
and then clicking
Connectivity
.
You can create point-to-point Layer 2 subnet extensions between two AZs over VPN or
VTEP by opening the
Create Subnet Extension Across Availability
Zones
dialog box. See Extending a Subnet Over VPN for
VPN-based extensions. See Extending a Subnet Across Availability Zones Over VTEP for
VTEP-based extensions.
You can create point-to-point or point-to-multipoint Layer 2 subnet extensions to third
party datacenters over VTEP by opening the
Create Subnet Extension To A Third
Party Data-Center
dialog box. See Extending a Subnet to Third Party Datacenters Over VTEP.
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
dialog box. The
Update
Subnet Extension Across Availability Zones
has the same parameters and
fields as the
Create Subnet Extension Across Availability Zones
dialog box. You can open the
Update Subnet Extension Across Availability
Zones
dialog box by:
Selecting the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
You can update a subnet extension that extends to multiple AZs or third party datacenters
using the
Update Subnet Extension To A Third Party Data-Center
dialog
box.
Update Subnet Extension To A Third Party Data-Center
dialog box
has the same parameters and fields as the
Create Subnet Extension To A Third Party
Data-Center
dialog box. You can open the
Update Subnet Extension To A
Third Party Data-Center
dialog box by:
Selecting the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
See Updating an Extended Subnet.
Layer 2 Virtual Subnet Extension Over VPN
Subnet extension using VPN allows seamless, secure migration to a new datacenter or for
disaster recovery. VPN based Layer 2 extension provides secure point to point connection to
migrate workloads between Availability Zones. Consider VTEP-only Subnet Extension without VPN
when encryption is not required.
Subnet extension using VPN is useful:
When the two Availability Zones (where the subnets to be extended belong) do not have any
underlying secure connectivity. For example, when connecting over the Internet, VPN (IPSec)
provides the necessary connectivity and encryption (security).
Sometimes when you need to move (lift-and-shift) workloads from a VLAN subnet to a VPC
subnet retaining the same VM IP addresses . You need connectivity from other subnets to
workloads that have already migrated to VPC. In such cases, VPN provides the Layer 3
connectivity and encryption between the VPC segment of extended subnet to other VLAN
subnets.
Prerequisites for Setting Up Subnet Extension Over VPN
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VPN gateway services and a VPN connection between local AZ and the remote AZ.
The subnet extension feature supports only the Nutanix VPN solution (not a third-party
VPN solution) at the both the local and remote AZs. See the Virtual Network Connections for instructions about how to upgrade the VPN gateway
VM at the local and remote clusters or sites.
Note:
Ensure that the VPN gateway version
is 5.0 or higher. See the Updating a Network Gateway section for
instructions about how to upgrade the network gateway at the local and remote sites.
Configure subnets with the same IP CIDR prefix at the source and target sites. For
example, if the IP prefix at one site is 30.0.0.0/24, the IP prefix at the other site must
also be 30.0.0.0/24. The network and mask must match at both AZs.
Configure distinct DHCP pools for the source and target sites with no IP address
overlap. Separate DHCP pools ensure no IP address conflicts occur for dynamically assigned
IP addresses between the two AZs.
Procure two free IP addresses, one from each subnet, for the Network Gateway in the
subnets to be extended. These IP addresses are configured as local IP address and remote
IP address for the subnet extension in the
Subnet Extension
wizard.
These two free IP addresses are the externally accessible IP addresses for the local
gateway, and the remote gateway. Those two usable IP addresses are already contained
inside the VPN connection and must not conflict with the following:
DHCP pools on any of the Availability Zones.
Gateway IP address on any of the Availability Zones.
IP addresses allocated to existing user VMs on any of the Availability Zones.
IP addresses used by Network Gateway Management NIC subnet (IP pool
100.64.1.0/24)
Limitation
To use subnet extension over a VPN, both sites must use the VPN service of the Nutanix
Network Gateway. Consider VTEP-only subnet extension to connect to non-Nutanix third party
sites.
Pairing AZs (Nutanix Disaster Recovery)
To replicate entities (protection policies, recovery plans, and recovery points) to
different on-prem AZs (AZs) bidirectionally, pair the AZs with each
other. To replicate entities to different Nutanix clusters at the same AZ bidirectionally,
you need not pair the AZs because the primary and the recovery Nutanix clusters are
registered to the same AZ (Prism Central). Without pairing the AZs, you cannot perform
DR to a different AZ.
About this task
To pair an on-prem AZ with another on-prem AZ, perform the following procedure at
either of the on-prem AZs.
Procedure
Log on to the Prism Central web console.
Click the hamburger icon at the top-left corner of the window. Go to
Administration
>
AZs
in the left pane.
Figure.
Pairing AZ
Click to enlarge
Click
Connect to AZ
.
Specify the following information in the
Connect to Availability
Zone
window.
Figure.
Connect to AZ
Click to enlarge
AZ Type
: Select
Physical Location
from the drop-down
list.
A physical location is an on-prem AZ (AZ). To pair
the on-prem AZ with Xi Cloud Services, select
XI
from the drop-down list, and enter the
credentials of your Xi Cloud Services account in step c and set
d.
IP Address for Remote PC
: Enter the IP address
of the recovery AZ Prism Central.
Username
: Enter the username of your recovery
AZ Prism Central.
Password
: Enter the password of your recovery
AZ Prism Central.
Click
Connect
.
Both the on-prem AZs are paired to each other.
Extending a Subnet Over VPN
The subnet extension allows VMs to communicate over the same broadcast domain to a
remote site or Availability Zone (AZ).
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VPN for information on prerequisites
and best practices for extending a subnet.
About this task
Perform the following procedure to extend a subnet from the on-prem site.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
>
Networking & Security
>
Connectivity
>
Subnet Extension
.
On the
Subnet Extension
page, select
Create Subnet Extension
>
Across Availability Zones
.
In the
Create Subnet Extension Across Availability Zones
dialog box, enter the necessary details as described in the table.
Figure.
Create Subnet Extension Across Availability Zones
Click to enlarge
Fields
Description
Values
Extend Subnet over a
Select the gateway service you want to use for the subnet
extension.
(VPN or VTEP)
Note:
Configure the following fields for the
Local
and the
Remote
sides of the dialog
box.
Availability Zone
(For Local) Local AZ is pre-selected default.
(For Remote)
Select the appropriate AZ from the drop-down list of
AZs.
(Local: Local AZ)
(Remote: Dropdown list of
AZs.)
Subnet Type
Select the type of subnet that you want to extend.
(VLAN or Overlay)
Cluster
Displayed if your selected VLAN subnet. Select the cluster
from the dropdown list of clusters.
(Name of cluster selected from dropdown list)
VPC
Displayed if your selected Overlay subnet. Select the
appropriate VPC from the dropdown list of VPCs.
(Name of VPC selected from dropdown list)
Subnet
Select the subnet that needs to be extended.
(Name of subnet selected from dropdown list)
(Network Information frame)
Displays the details of the VLAN or Overlay network that you
selected in the preceding fields.
(Network information)
Gateway IP Address/Prefix
Displays the gateway IP address for the subnet. This field is
already populated based on the subnet selected.
(IP Address)
(Local or Remote) IP Address
Enter a unique and available IP address that are externally
accessible IP addresses in
Local IP
Address
and
Remote IP
Address
.
(IP Address)
VPN Connection
Select the appropriate VPN Connection from the dropdown list
that Flow virtual networking must use for the subnet extension.
See Creating a VPN Connection for
instructions to create VPN connection.
(Name of VPN connection selected from the dropdown
list)
Click
Save
.
A successful subnet extension is listed on the
Subnet
Extension
dashboard. See .
Layer 2 Virtual Subnet Extension Over VTEP
Subnet extension using Virtual tunnel End Point (VTEP) allows seamless migration to new
datacenters or for disaster recovery. VTEP based Layer 2 extension provides
point-to-multipoint connections to migrate workloads from one Availability Zone to multiple
Availability Zones
without
encryption.
If you need security and encryption, consider using Subnet Extension over VPN.
Subnet extension using VTEP is useful:
When both subnets that need to be stretched are Nutanix subnets (managed or unmanaged).
VTEP provides an optimized workflow to stretch the two subnets.
When both subnets are connected over an existing private and secure link that does not
need additional encryption.
When one Nutanix subnet needs to be stretched across one or more non-Nutanix
networks,
sites, or datacenters.
Subnet
Extension with third-party VTEPs provides point-to-multipoint connectivity
to third party datacenters assuming that there is underlying
layer 3
connectivity between these VTEPs.
VTEP-based Layer 2 Subnet Extension provides the following advantages:
Layer 2 subnet extension from one AZ to multiple AZs.
Layer 2 subnet extension between Nutanix AZs and non-Nutanix third party VTEP-based
AZs.
The Remote VTEP Gateway is a set of endpoint IP addresses. You can add endpoint IP
addresses to an existing operational Remote VTEP Gateway without stopping the subnet
extension services. This on-the-fly addition enables you to extend the subnets to more AZs
than originally
planned, or
perform maintenance, without disrupting the running services or
configuring new remote VTEP gateways.
Prerequisite for Setting Up Subnet Extension Over VTEP
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VTEP local and remote gateway services on local and remote AZs. In case of
point-to-multipoint extension, ensure that you create local and remote VTEP gateways on
all the remote AZs that the subnet needs to be extended to.
For each
extended subnet within the same Network Gateway appliance
ensure
that you have unique VxLAN Network Identifiers (VNIs) that you can use for the VTEP subnet
extensions. VNI may be any number between 0 and 16777215.
Extending a Subnet Across Availability Zones Over VTEP
The subnet extension over VTEP allows VMs to communicate two Availability Zones (AZ)
without a VPN connection.
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VTEP for information on prerequisites and
best practices for extending a subnet.
About this task
To extend a subnet over VTEP across two availability zones (AZs), do the
following.
Procedure
Open the
Create Subnet Extension Across Availability Zones
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
Across Availability Zones
>
.
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
Across Availability Zones
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
Across Availability Zones
.
Figure.
Example of Create VTEP Extension Across AZs with VLAN Subnet
Click to enlarge
For
Extend Subnet over a
, select
VTEP
.
Enter or select the necessary values for the parameters in the
Local
and
Remote
(AZ)
sections as described in the table.
Parameters
Description and Value
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address.
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a
/24
subnet then provide the
gateway
IP address as
10.20.20.1/24
.
Note:
For
an
unmanaged network, enter the gateway IP
address of the created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the Network
Gateway appliance.
Remote IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the remote
Network Gateway appliance.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for information
about creating VTEP gateways.
Remote VTEP Gateway
Select the VTEP gateway you created on the remote AZ. See
Creating a Network Gateway for information
about creating VTEP gateways.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the local or
remote VTEP Gateways.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation requires
50. However, you can enter any valid MTU value for the network,
taking this overhead into account. For example, if the physical
network MTU and vs0 MTU are 1600 bytes, the Network Gateway MTU
can be set to 1492 to account for 108 bytes of overhead. Ensure
that the MTU value does not exceed the MTU of the AHV Host
interface and all the network interfaces between the local and
remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Extending a Subnet to Third Party Datacenters Over VTEP
The subnet extension over VTEP allows VMs to communicate with multiple remote sites
or Availability Zones (AZ) that may be third party (non-Nutanix) networks, or datacenters.
It also provides the flexibility of adding more remote AZs to the same VTEP-based extended
Layer 2 subnet. Examples of compatible VTEP gateways are switches from Cisco, Juniper,
Arista, and others that support plain VXLAN VTEP termination.
About this task
To extend a subnet over VTEP across multiple availability zones (AZs) or third party
datacenters, do the following.
Procedure
Open the
Create Subnet Extension To A Third Party
Data-Center
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
To A Third Party Data-Center
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
To A Third Party Data-Center
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
To A Third Party Data-Center
.
Figure.
Example of Create VTEP Extension To A Third Party Data-Center with
VLAN Subnet
Click to enlarge
Enter or select the necessary values for the parameters in the
Local
,
Remote
(AZ), and
Connection Properties
sections as described in the
table.
Parameters
Description and Value
Local
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a .24 subnet then provide the gatewway IP
address as
10.20.20.1/24
.
Note:
For
unmanaged network, enter the gateway IP address of the
created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a local VTEP gateway.
Remote
Remote VTEP Gateway
Select the remote VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a remote VTEP gateway.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the networks
that the Prism Central and Cluster are a part of.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation
requires 50. However, you can enter any valid MTU value for
the network, taking this overhead into account. For example,
if the physical network MTU and vs0 MTU are 1600 bytes, the
Network Gateway MTU can be set to 1492 to account for 108
bytes of overhead. Ensure that the MTU value does not exceed
the MTU of the AHV Host interface and all the network
interfaces between the local and remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Updating an Extended Subnet
The
Update Subnet Extension Across Availability Zones
dialog box has the
same parameters and fields as the
Create Subnet Extension Across Availability
Zones
dialog box.
About this task
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
or the
Update
Subnet Extension To A Third Party data center
dialog box. The
Update Subnet Extension Across Availability Zones
or the
Update Subnet Extension To A Third Party data center
dialog
box has the same parameters and fields as the
Create Subnet Extension
Across Availability Zones
or the
Create Subnet Extension To
A Third Party data center
dialog box, respectively.
Based on the type of the subnet extension that you want to modify, refer to the
following:
Procedure
Extending a Subnet Over VPN
Extending a Subnet Across Availability Zones Over VTEP
Extending a Subnet to Third Party Datacenters Over VTEP
Removing an Extended Subnet
Perform this procedure to remove the subnet extension.
About this task
This procedure deletes the extended subnet between the two Availability Zones (AZs)
or between one Nutanix AZ and one or more third party subnets. Deleting the subnet
extension does not automatically remove the network gateways or VPN connections that
may have automatically been created by the Subnet Extension wizard. You need to
separately delete these entities created automatically when the subnet was
extended.
Note:
Removing an extended subnet from a cluster or AZ (either source or target AZs)
automatically deletes the extended subnet from the corresponding source or target
AZs.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
.
This
Flow Networking Guide
describes how to enable and deploy Nutanix Flow
Networking on Prism Central.
Upgrading from EA Versions
If you have enabled the early access (EA) version of Flow Networking, disable it before
upgrading the Prism Central and enabling the general availability (GA) version of Flow
Networking.
Related Documentation
Links to Nutanix Support Portal software and documentation.
The
Nutanix Support
Portal
provides software download pages, documentation, compatibility, and other
information/
Documentation
Description
Release Notes | Flow Networking
Flow Networking Release Notes
Port Reference
Port Reference: See this page for details of ports that must be open in the
firewalls to enable Flow Networking to function.
Nutanix Security Guide
Prism Element and Prism Central security, cluster hardening, and
authentication.
AOS guides and release notes
Covers AOS Administration, Hyper-V Administration for Acropolis, Command
Reference, Powershell Cmdlets Reference, AOS Family Release Notes, and AOS
release-specific Release Notes
Acropolis Upgrade Guide
How to upgrade core and other Nutanix software.
AHV guides and release notes
Administration and release information about AHV.
Prism Central and Web Console guides and release notes
Administration and release information about Prism Central and Prism Element.
Flow Networking Overview
Enabled and administered from Prism Central, Flow Networking powers network virtualization to
offer a seamless network experience with enhanced security. It is disabled by default.
To enable and use Flow Networking, ensure that you log on to Prism Central as a local account
user with
Prism Admin
role. If you log on to Prism Central as a
non-local account (IDP-based) user or without
Prism Admin
role
privileges, then Prism Central does not allow you to enable or use Flow Networking. The task
is reported as
Failed
with a
User Denied Access
message.
Note:
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable Flow Networking to function. To see the ports and protocols used
Flow Networking, see Port Reference.
It is a software-defined network virtualization solution providing overlay capabilities for
the on-prem AHV clusters. It integrates tools to deploy networking features like Virtual
Private Cloud (VPC) and Virtual Private Network (VPN) to support flexible app-driven
networking that focuses on VMs and applications instead of virtual LANs and network
addresses.
After you enable it on Prism Central, Flow Networking delivers the following.
A simplified, Prism Central-based workflow that deploys the application-driven network
virtualization feature.
A secure multi-tenancy solution allowing per-tenant isolation using VPC-based network
segmentation and namespace isolation.
A secure VPN-based connectivity solution for multiple sites, with automated VPN bundle
upgrades.
NAT-based secure egress to external networks, with IP address retention and policy-based
routing.
Self-serve networking services using REST APIs.
Enhanced networking features for more effective disaster recovery.
Note:
You can enable
network segmentation on a Layer 2 extended virtual subnet that does not have a gateway.
For more information about Layer 2 subnet extensions, see Layer 2 Virtual Network Extension. For information about network
segmentation of an extended layer 2 subnet, see
Segmenting a Stretched L2 Network
for Disaster Recovery
in the
Securing Traffic through Network
Segmentation
section of the
Security Guide
.
Deployment Workflow
You can enable Flow Networking using a simple Prism Central driven workflow, which installs
the network controller. The network controller is a collection of containerized services
that run directly on the Prism Central VM(s). The network controller orchestrates all the
virtual networking operations.
Ensure that microservices infrastructure is enabled in
Prism Central Settings
>
Prism Central Management
. See
Prism Central Guide
for information about enabling
microservices infrastructure.
Enable Flow Networking in
Prism Central Settings
>
Advanced Networking
. It is disabled by default. See
Enabling Flow Networking
You can opt out of Flow networking by disabling the
Advanced
Networking
option subject to prerequisites to disable advanced networking.
See Disabling Flow Networking.
You can deploy Flow Networking in a dark site (a site that does not have Internet
access) environment. See the Deploying Flow Networking at a Dark Site topic
for more information.
You can upgrade the Flow networking controller. Nutanix releases an upgrade for the
Flow networking controller with AOS and Prism Central releases. See Upgrading Flow Networking.
See the
AOS Family Release Notes
and
Release Notes | Prism
Central
.
Flow networking allows you to create and manage virtual private clouds (VPCs) and
overlay subnets to leverage the underlying physical networks that connect clusters and
datacenters. See Virtual Private Cloud.
You can upgrade the network gateway version. Network gateway is used to create VPN or
VTEP gateways to connect subnets using VPN connections, or Layer 2 subnet extensions
over VPN or VTEP.
Flow Networking Architecture
The Flow Networking architecture uses a three-plane approach to simplify network
virtualization.
Prism Central provides the management plane, the network controller itself acts as the
control plane while the AHV nodes provide the data plane. This architecture provides a
strong foundation for Flow Networking. This architecture is depicted in the following
chart.
Figure.
Flow Networking Architecture
Click to enlarge
Deployment Scale
Flow Networking supports the following scale:
Entities
Scale
Virtual Private Clouds
500
Subnets
5,000
Ports
50,000
Floating IPs
2,000 per networking controller-enabled Prism Central.
Routing Policies
1,000 per Virtual Private Cloud.
10,000 per networking controller-enabled Prism Central.
Essential Concepts
VPC
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that
functions as a logically isolated virtual network. A VPC could be made up of one or
more subnets that are connected through a logical or virtual router. The IP addresses
within a VPC must be unique. However, IP addresses may overlap across VPCs. As VPCs
are provisioned on top of another IP-based infrastructure (connecting AHV nodes), they
are often referred to as the overlay networks. Tenants may spin up VMs and connect
them to one or more subnets within a VPC. Virtual Private Cloud (VPC) is a virtualized
network of resources that are specifically isolated from the rest of the resource
pool. VPC allows you to manage the isolated and secure virtual network with enhanced
automation and scaling. The isolation is done using network namespace techniques like
IP-based subnets or VLAN based networking.
VPC Subnets
You can use IP address-based subnets to network virtual machines within a VPC. A VPC
may use multiple subnets. VPC subnets use private IP address ranges. IP addresses
within a single VPC must be unique, in other words, IP addresses inside the same VPC
cannot be repeated. However, IP addresses can overlap across multiple VPCs. The
following figure shows two VPCs named Blue and Green. Each VPC has two subnets,
192.168.1.0/24 and 192.168.2.0/24, that are connected by a logical router. Each subnet
has a VM with an IP address assigned. The subnets and VM IP addresses overlap between
the two VPCs.
Figure.
VPC Subnet
Click to enlarge
The communication between VMs in the same subnets or different subnets in the same VPC
(also called East-West communication) is enabled using GEneric NEtwork Virtualization
Encapsulation (GENEVE). If a Prism Central manages multiple clusters, then the VMs that
belong to the same VPC could be deployed across different clusters. The virtual switch on
the AHV nodes provide distributed virtual switching and distributed virtual routing for all
VPCs.
The communication from a VM in a VPC to an endpoint outside the VPC (called external
communication or North-South communication) is enabled by an external network connection.
Such a connection may be secured using VPN. The following figure shows the logical
connectivity of the VPCs to the external network, and subsequently to the Internet.
Note:
You
must configure the default route (0.0.0.0/0) to the external subnet as the next hop for
connectivity outside the cluster (north-south connectivity).
Figure.
External Communication
Click to enlarge
External Subnets
Subnets outside a VPC are external subnets. External subnets may be subnets within
the deployment but not included in a specific VPC. External subnets may also be
subnets that connect to the endpoints outside the deployment such as another
deployment or site.
External subnets can be deployed with NAT or without NAT. You can add a maximum of
two external subnets - one external subnet with NAT and one external subnet without
NAT to a VPC. Both external subnets cannot be of the same type. For example, you
cannot add two external subnets, both with NAT. You can update an existing VPC
similarly.
Primary and Secondary IP Addresses for VMs
See VM IP Address Management.
SNAT and Floating IP Address
SNAT and Floating IP addresses are used only when you use NAT for an external
subnet.
In Source Network Address Translation (SNAT), the NAT router modifies the IP address
of the sender in IP packets. SNAT is commonly used to enable hosts with private
addresses to communicate with servers on the public Internet.
For VMs within the VPC to communicate with the rest of the deployment, the VPC must
be associated with an external network. In such a case, the VPC is assigned a unique
IP address, called the SNAT IP, from the subnet prefix of the external network. When
the traffic from a VM needs to be transmitted outside the VPC, the source IP address
of the VM, which is a private IP address, is translated to the SNAT IP address. The
reverse translation from SNAT IP to private IP address occurs for the return traffic.
Since the SNAT IP is shared by multiple VMs within a VPC, only the VMs within the VPC
can initiate connections to endpoints outside the VPC. The NAT gateway allows the
return traffic for these connections only. Endpoints outside the VPC cannot initiate
connections to VMs within a VPC.
In addition to the SNAT IP address, you can also request a Floating IP address — an
IP from the external subnet prefix that is assigned to a VM via the VPC that manages
the network of the VM. Unless the floating IP address is assigned to the private IP
address (primary or secondary IP address) of the VM, the floating IP address is not
reachable. When the VM transmits packets outside the VPC, the private IP of the VM is
modified to the Floating IP. The reverse translation occurs on the return traffic. As
the VM uses the Floating IP address, an endpoint outside the VPC can also initiate a
connection to the VM with the floating IP address.
The translation of the private IP addresses to Floating IP or SNAT IP address, and
vice versa, is performed in the hypervisor virtual switch. Therefore, the VM is not
aware of this translation. Floating IP translation may be performed on the hypervisor
that hosts the VM to which the floating IP is assigned to. However, SNAT translation
is typically performed in a centralized manner on a specific host.
NAT Gateway
NAT Gateways are used only when you use NAT for an external subnet.
Network Address Translation (NAT) is a process for modifying the source or
destination addresses in the headers of an IP packet while the packet is in transit.
In general, the sender and receiver applications are not aware that the IP packets are
being manipulated.
A NAT Gateway provides the entities inside an internal network with connectivity to
the Internet without exposing the internal network and its entities.
A NAT Gateway is:
A node or a AHV host. You need a host or a node to implement a NAT Gateway because
NAT gateways require operations like load balancing and routing that are
automatically performed by Flow Networking.
Connected to the internal network with an internal subnet based IP address and to
the external network with an externally-routable IP address.
The
externally-routable IP address may be an IP address from a private IP address
space or an RFC1918 address that is used as a NAT gateway. The NAT Gateway IP
address could be a static IP address or a DHCP assigned IP address.
Table 1.
NAT Gateway Failover Time
Event
Failover Time
Network controller stops on AHV
Up to 45 seconds.
Node reboot
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
not on the same node.
Up to 45 seconds.
Node power off:
When NAT Gateway and network controller MSP worker VMs are
on the same node.
Up to 300 seconds (5 minutes).
Static IP Address
A static IP address is a fixed IP address that is manually assigned to an interface
in a network. Static IP addresses provide stable routes that do not have to be updated
frequently in the routing table since the static routes generated using static IP
addresses do not need to be updated.
Usually in a large IP-based network (a network that uses IP addresses), a Dynamic
Host Configuration Protocol or DHCP server assigns IP addresses to interfaces of an
entity (using DHCP client service on the entity). However, some entities may require a
static IP address that can be reached (manual remote access or via VPN) quickly. A
static IP address can be reached quickly because the IP address is fixed, assigned
manually and is stored in the routing table for a long duration. For example, a
printer in an internal network would need a static IP address so that it can be
connected reliably. Static IP addresses can be used to generate static routes which
remain unchanged in routing tables, thus providing stable long-term connectivity to
the entity that has the static IP address assigned.
Static Route
Static routes are fixed routes that are created manually by the network
administrator. Static routes are more suited for small networks or subnets.
Irrespective of the size of a network, static routes may be required in a variety of
cases. For example, in VPCs where you use virtual private networks (VPNs) or Virtual
Tunnel End Point (VTEP) over VxLAN transport connections to manage secure connections,
you could use static routes for specific connections such as site-to-site connections
for disaster recovery. In such a case it is necessary to have a known reliable route
over which the disaster recovery operations can be performed smoothly. Static routes
are primarily used for:
Facilitating the easy maintenance of the routing table in small networks that are
not expected to grow.
Routing to and from other internal route or stub networks. A stub network or an
internal route network is a network accessed using a single route and the router has
only one neighbor.
Use as a default or backup route. Such a route is not expected to specifically
match any other route in the routing table.
In a network that is not constantly changing, static routes can provide faster and
more reliable services by avoiding the network overheads like route advertisement and
routing table updates for specific routes.
Overlay networks
You can create an IP-based Overlay subnet for a VPC. An Overlay network is a
virtualized network that is configured on top of an underlying virtual or physical
network. A special purpose multicast network can be created as an Overlay network
within an existing network. A peer-to-peer network or a VPN are also examples of
Overlay networks. An important assumption for an Overlay network is that the
underlying network is fully connected. Nutanix provides the capability to create
Overlay network-based VPCs.
Comparing Overlay with VLAN
See how overlay networks compare with VLAN networks. A virtual local area network or VLAN
network is a Layer 2 network that provides virtualized network segmentation solution. VLANs
route and balance traffic in a network based on MAC addresses, Protocols such as Ethernet,
ports or specific subnets. A VLAN creates a virtual Layer 3 network using Layer 2 addressing
by separating broadcast domains virtually or logically. A VLAN configured network behaves as
if the network is segmented using a physical layer 2 switch without implementing a layer 3
IP based subnet for the segmentation. VLAN traffic usually cannot traverse outside the
VLAN.
The main advantage that VLAN networks provide is that VLAN networks require only layer 2
(L2) connectivity. VLANs do not require any of the layer 3 (L3) Flow Networking
features.
Overlay networks can be laid on underlying physical network connections including VLAN
networks. Overlay networks provide the following advantages and constraints:
IP address namespace is decoupled from the physical network.
You can create, update or delete overlay networks without requiring any configurations
on the physical network and powering down the systems.
You can create overlay networks that can span across multiple clusters.
VLAN networks are necessary for Bootstrapping of Flow Networking.
Note:
Nutanix
recommends using VLAN0 as the default untagged (also called native) VLAN for a CVM and
AHV host. You can create VLANs for user VMs using the
Network
Configuration
page. You can use the
Create Virtual
Switch
dialog box from the
Network Configuration
page
to create virtual switches for the user VM VLANs.
AHV Networking VLAN and Flow Networking VLAN: VLAN backed subnets for external
connectivity are managed by the Flow Networking control plane. Traditional AHV VLAN IPAM
networks are managed by Acropolis. Do not configure the same VLAN as both a Flow
Networking external network and an AHV IPAM network, as this can lead to IP address
conflicts.
Traffic Behavior
Broadcast Traffic
When all the guest VMs belonging to a subnet are in the same AHV: Flow Networking
broadcasts the traffic to all guest VMs in the same subnet.
When some VMs belonging to a subnet are in other AHVs: Flow Networking tunnels the
traffic to only those AHVs which have endpoints in the same subnet.
In other words, Flow Networking broadcasts traffic to all the guest VMs in the same
subnet.
Unicast Traffic
Unicast traffic is traffic transmitted on a one-to-one basis between IP addresses and
ports. There is only one sender and one receiver for the traffic. Unicast traffic is
usually the most used form of traffic in any LAN network using Ethernet or IP
networking. Flow Networking transmits unicast traffic based on the networking policies
set.
Unknown Unicast Traffic
Flow Networking always drops unknown unicast traffic. It is not transmitted to any
guest VM within or outside the source AHV.
Multicast Traffic
Flow Networking transmits the traffic to the VMs in the multicast group within the
same subnet. If the VM is on another AHV, the destination AHV must have an endpoint in
the subnet.
Multicast Group
A multicast group is defined by an IP address (called a multicast IP address, usually
a Class D IP address) and a port number. Once a host has group membership, the host
will receive any data packets that are sent to that group defined by an IP
address/port number.
Prerequisites for Enabling Flow Networking
Make sure you meet these prerequisites before you enable Flow networking on Prism
Central.
Requirements
Important:
Prism Central protection and recovery does not protect or recover
Flow networking services.
You must have the following fulfilled to enable Flow networking:
Ensure that you log on to Prism Central as a local account user with
Prism
Admin
role. If you log on to Prism Central as a non-local account
(IDP-based) user or without
Prism Admin
role privileges, then
Prism Central does not allow you to enable or use Flow Networking. The task is reported
as
Failed
with a
User Denied Access
message.
Ensure that the Prism Central running Flow networking is hosted on an AOS cluster
running AHV.
The network controller has a dependency only on the AHV version.
Ensure that microservices infrastructure on Prism Central is enabled. See
Prism
Central Guide
for information about microservices infrastructure.
Choose the x-large PC VM size for Flow networking deployments. Small or large PC VMs
are not supported for Flow Networking.
If you are running a small or large Prism Central VMs, upgrade the Prism Central VM
resources to x-large PC VM. See
Acropolis Upgrade Guide
for procedure to
install an x-large Prism Central deployment.
Although Flow networking may be enabled on a single-node PC, Nutanix strongly
recommends that you deploy a three-node scale-out Prism Central for production
deployments. The availability of Flow networking service in Prism Central is critical
for performing operations on VMs that are connected to overlay networks. A three-node
scale-out Prism Central ensures that Flow networking continues to run even if one of the
nodes with a PCVM fails.
Prism Central VM registration. You cannot unregister the Prism Element cluster that is
hosting the Prism Central deployment where you have enabled Flow Networking. You can
unregister other clusters being managed by this Prism Central deployment.
Ensure that Microservices Infrastructure (CMSP) is enabled on Prism Central before you
enable Flow Networking. See the
Prism Central Guide
for more
information.
For the procedure to enable Microservices Infrastructure (including enable in dark
site), see
Enabling Micro Services Infrastructure
section in the
Prism Central Guide
.
Note:
When you configure microservices infrastructure, ensure that the DNS name you
configure for CMSP does not end with
test
. Flow networking does not support
test
as a top level domain. For example, the following are valid domain configurations:
my.cluster.domain
my.test.cluster.test.domain
However, the following are examples of domains that Flow networking does not support:
my.cluster.test
my.cluster.domain.test
Ensure that you have created a virtual IP address (VIP) for Prism Central. The
Acropolis Upgrade Guide
describes how to set the VIP for the Prism
Central VM. Once set, do not change this address.
Ensure connectivity:
Between Prism Central and its managed Prism Element clusters.
To the Internet for connectivity (not required for dark site) to:
ECR for Docker images
S3 storage for LCM portal
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
Prism Central backup, restore, and migration. You cannot perform these operations on
MSP-enabled Prism Central.
Nutanix recommends increasing the MTU to 9000 bytes on the virtual switch vs0 and
ensure that the physical networking infrastructure supports higher MTU values (jumbo
frame support). The recommended MTU range is 1600-9000 bytes.
Nutanix CVMs use the standard Ethernet MTU (maximum transmission unit) of 1,500 bytes
for all the network interfaces by default. The system advertises the MTU of 1442 bytes
to guest VMs using DHCP to account for the extra 58 bytes used by Generic Network
Virtualization Encapsulation (Geneve). However, some VMs ignore the MTU advertisements
in the DHCP response. Therefore, to ensure that Flow networking functions properly with
such VMs, enable jumbo frame support on the physical network and the default virtual
switch vs0.
If you cannot increase the MTU of the physical network, decrease the MTU of every VM in
a VPC to 1442 bytes in the guest VM console.
Note:
Do not change the MTU of the CVM.
Figure.
Sample Configurations with and without Higher MTU - VS0, CVM and UVMs
Click to enlarge
Requirements for Upgrades
The following applies to upgrades of Flow networking network controller
(
Advanced Networking
in
Prism Control
Settings
):
Ensure that the Prism Central host is running an AHV version compatible with the
networking controller upgrade version. If necessary, upgrade the AHV version using LCM to
the version compatible with the network controller upgrade version.
Note:
See Compatibility and Interoperability Matrix on
the Nutanix Support portal for AOS and Prism Central compatibility.
Ensure that all the AHV hosts in the AOS cluster are running the version compatible with
the network controller upgrade version.
The network controller upgrade fails if any of
the AHV hosts is running an incompatible version.
Limitations
Limitations for Flow networking are as follows.
Flow networking does not support Flow security for guest VMs.
You cannot configure rules for Flow security if a guest VM has any NICs connected to
VPCs.
Flow networking is supported only on AHV clusters. It is not supported on ESXi or
Hyper-V clusters.
Flow networking is not enabled on the new PE cluster registering with the Flow
networking-enable Prism Central if the Prism Element cluster has an incompatible AHV
version.
Flow networking does not support updating a VLAN-backed subnet as an external subnet.
You cannot enable the external connectivity option in the
Update
Subnet
dialog box. Therefore, you cannot modify an existing VLAN-backed
subnet to add external connectivity.
VLAN backed subnets for external connectivity are managed by the Flow networking
control plane. Traditional AHV VLAN IPAM networks are managed by acropolis.
Note:
Do not configure the same VLAN as both a Flow networking external network and an AHV
IPAM network, as this can lead to IP address conflicts.
Flow networking cannot be disabled if any external subnets and VPCs are in use. Delete
the external subnets and VPCs and then disable Flow Networking.
Disaster Recovery backup and migration: CMSP-enabled Prism Central does not support
disaster recovery backup and migration operations both as a source and target host.
Flow Networking Configurations
Enabling Flow Networking
Before you begin
Ensure tha microservices infrastructure is enabled on Prism Central. See
Enabling Micro Services Infrastructure
section in the
Prism
Central Guide
.
About this task
Before you proceed to enable Flow Networking by enabling the
Advanced
Networking
option, see Prerequisites for Enabling Flow Networking.
To enable Advanced Networking, go to
Prism Central Settings
>
Advanced Networking
and do the following.
Procedure
In the
Advanced Networking
pane, click
Enable
.
Ensure that the prerequisites specified on the pane are fulfilled.
Figure.
Enabling Flow Networking
Click to enlarge
Prism Central displays the deployment in-progress.
Figure.
Deployment Progress
Click to enlarge
Flow Networking is enabled.
Figure.
Flow Networking Status
Click to enlarge
Disabling Flow Networking
About this task
You can disable Flow Networking. However, the network controller cannot be disabled
if any external subnets and VPCs are in use. Delete the subnets and VPCs before you
disable advanced networking.
Note:
Flow Networking cannot be disabled if any external subnets and VPCs are in use.
Delete the external subnets and VPCs and then disable Flow Networking.
To disable Flow Networking, do the following.
Procedure
On the
Advanced Networking
page, click
Disable
.
Figure.
Click to enlarge
On the confirmation message box, click
Confirm
to
confirm disablement.
To exit without disabling the
Advanced Networking
controller, click
Cancel
.
Unregistering a PE from the PC
Before unregistering a Prism Element from PC, disable Flow Networking on that Prism
Element using network controller CLI (or atlas_cli).
About this task
When Flow Networking is enabled on a Prism Central, it propagates the capability to
participate in VPC networking to all the registered Prism Elements that are running
the required AHV version.
In cases where there are VMs on the Prism Element attached to the VPC network, or if
the Prism Element is used to host one or more of the external VLAN networks attached
to a VPC, Prism Central alerts you with a prompt. When being alerted about the
aforementioned conditions, close the CLI and make adequate configuration to resolve
the condition (for example, select a different cluster for the external VLAN network
and delete the VMs attached to the VPC network running on the Prism Element). After
making such configurations, execute the network controller CLI to disable Flow
Networking. If the command goes through successfully, it is safe to unregister the
Prism Element.
For example, in a deployment of three Prism Elements - PE1, PE2 and PE3 - registered
to the Flow Networking-enabled PC, you want to unregister PE3 from the PC. You must
first disable Flow Networking using the following steps:
Procedure
SSH to PE3.
Run the
ncli cluster info
or
ncli cluster
get-params
command to get the cluster parameters.
Copy the cluster UUID (For example: 017457d3-1012-465c-9c54-aa145f2da7d9) from
the displayed cluster parameters.
SSH to the Prism Central VM.
Open the network controller console by executing the
atlas_cli
command.
nutanix@cvm$ atlas_cli
<atlas>
Execute the
config.add_to_excluded_clusters <cluster
uuid>
command, providing the cluster UUID that you copied
earlier.
An example of the PC alert, for the condition that PE3 VM is attached to an
external network, is as follows:
<atlas> config.add_to_excluded_clusters 0005bf8d-2a7f-3b2e-0310-d8e34995511e
Cluster 0005bf8d-2a7f-3b2e-0310-d8e34995511e has 1 external subnet,
which will lose connectivity. Are you sure? (yes/no)
Note:
To enable Flow Networking on the cluster, execute the
config.remove_from_excluded_clusters <cluster
uuid>
command, providing the cluster UUID.
What to do next
To verify if Flow Networking is disabled or enabled, SSH to PE3 and run the
acli atlas_config.get
command.
The output displays the
enable_atlas_networking
parameter as
False
if Flow
Networking is disabled and as
True
if Flow Networking is enabled on
the Prism
Element.
You can upgrade the Flow networking controller (
Advanced Networking
Controller
in
Prism Central Settings
) using Life Cycle Manager
(LCM) on Prism Central.
Before you begin
See Prerequisites for Enabling Flow Networking.
In case of upgrading the Flow networking controller in a dark site, ensure that LCM
is configured to reach the local web server that hosts the dark site upgrade
bundles.
Note:
The network controller upgrade fails to start after the pre-check if one or more
clusters have Flow Networking enabled and are running an AHV version
incompatible with the new network controller upgrade version.
About this task
To upgrade the network controller using LCM, do the following.
Procedure
Choose one of the following ways to reach the LCM page:
Go to
Administration
>
LCM
>
Inventory
Click
Check for Updates
on the
Advanced
Networking
page.
Figure.
Check for Updates
Click to enlarge
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the LCM page under
Software
.
Go to
Updates
>
Software
. Select the
Advanced Networking Controller
version you want to upgrade to and click
Update
.
Figure.
Networking Controller version
Click to enlarge
Deploying Flow Networking at a Dark Site
About this task
Dark sites are primarily on-premises installations which do not have access to the
internet. Such sites are disconnected from the internet for a range of reasons
including security. To deploy Flow networking at such dark sites, you need to deploy
the dark site bundle at the site.
This dark site deployment procedure includes downloading and deploying MSP and the
network controller bundles.
Before you begin
See Prerequisites for Enabling Flow Networking.
You need access to the Nutanix Portal from an Internet-connected device to
download the following dark site bundles:
Note:
For dark site deployments, Nutanix provides a dark
site bundle, which has the Docker images (normally hosted on ECR) and the network
controller package (normally hosted on LCM portal). These dark site bundles can be
downloaded using an internet-connected system outside the dark site.
MSP dark site bundle: https://portal.nutanix.com/page/downloads/list > Microservices Platform (MSP)
Flow Networking network controller dark site bundle: See the
Flow
Networking Release Notes
for the link to download the dark
site bundle.
Network Gateway bundle: See the
Flow Networking Release
Notes
for the link to download the dark site bundle with
checksum text file. Also, see
KB-12393
.
To deploy Flow Networking at a dark site, do the following.
Procedure
Start a web server to host the dark site bundles and act as a source for the
LCM downloads, if one is not already created.
The web server can be a virtual machine on a cluster at the dark site. All
the Prism Central VMs at the dark
site must have access to this web server. This web server
is used when you deploy any dark site bundle including the network
controller darksite bundle.
For more information about the server installation, see:
Linux web server
Windows web server
In Prism Central, go to
Administration
>
LCM
>
Inventory
.
Alternatively, SSH into the Prim Central VM as an admin user and run the
following command.
Where <LCM-web-server-ip> is the IP address of the LCM web server and
release is the name of the directory where the packages were extracted.
For example,
admin@pcvm$ mspctl controller airgap enable
--url=http://10.48.111.33/release
. Here,
10.48.111.33
is the IP address of the LCM web server
and
release
is the name of the directory where the
packages were extracted.
Verify the configuration by running the following command:
nutanix@cvm$ mspctl controller airgap get
From a device that has public Internet access, click the Nutanix Compatibility Bundle link and
down the bundle. Transfer this bundle to the LCM web server and extract the
contents.
From a device that has public Internet access, Nutanix recommends that you
download and extract the latest MSP dark site bundle, transfer it to the LCM web
server, and extract the contents.
From a device that has public Internet access, download the Flow networking
dark site bundle (see Release Notes | Flow Networking for
download links). Transfer the bundle to the LCM web server.
Extract or unpack the Flow networking dark site bundle on the LCM web
server.
After unpacking, check if the system shows a directory path that includes the
following as per the example:
http://<LCM-web-server-ip>/release/builds/msp-builds/msp-services/464585393164.dkr.ecr.us-west-2.amazonaws.com/nutanix-msp/atlas-hermes/
.
Run the following command after unpacking to ensure that the file permissions
are not disrupted during the unpacking:
Linux.
chmod -R +r builds
Windows
NTFS.
$> takeown / R / F *
$> icacls <Build-file-path> /t /grant:F
This section provides information to assist troubleshooting of Flow Networking
deployments. This is in addition to the information that the "Prism Central Guide"
provides.
Audit Logs
Prism Central generates audit logs for all the flow networking activities like it
does for other activities on Prism Central. See
Audit Summary View
in the
Prism Central Guide
, for more information about Audit log.
Support Bundle Collection
To support troubleshooting for Flow Networking, you can collect logs.
To collect the logs, run the following commands on the Prism Central VM console:
msp
tag will collect logs from the services running on MSP
pods and persistent log volumes (application-level logs)
anc
tag will collect the support bundle, which includes
database dumps and OVN state
-O
flag adds tag-level options
msp_pod=true
collects logs from MSP service pods
On the PC, these logs can be found under
/var/log/containers
.
persistent=true
collects persistent log volumes
(application-level logs for ANC)
On the PC, these can be found under /var/log/ctrlog
kubectl_cmds=true
runs
kubectl
commands to
get the Kubernetes resource state
--duration
sets the duration from the present to collect
The command run generates a zip file at a location, for example:
/home/nutanix/data/logbay/bundles/<filename>.zip
Unzip the bundle and you'll find the
anc
logs under a directory
specific to your MSP cluster, the worker VM where the pod is running, and the logging
persistent volume of that pod. For example:
For more information about the task run, see the text file that the command generates
at a location, for
example:
/home/nutanix/data/logbay/taskdata/<taskID>/collection_result.txt
For more information about the
logbay collect
command, see the
Logbay Log Collection (Command Line)
topic in the
Nutanix Cluster
Check Guide
(NCC Guide).
Layer 2 Virtual Subnet Extension Alert
The
L2StretchLocalIfConflict
alert (Alert with Check ID
- 801109) may occur while performing Layer 2 virtual subnet extensions. See KB-10395
for more information about its resolution.
Network Gateway Upgrades
Nutanix deployment can detect and install upgrades for the onprem Nutanix Gateways.
For information about identifying the current Nutanix Gateway version, see Identifying the Gateway Version.
For onprem Nutanix Gateways, the upgrades need to be detected and installed on the respective
PC on which each Nutanix Gateway is installed.
For more information, see Detecting Upgrades for Gateways.
When PC detects the upgrades, it displays a banner on the
Gateways
tab
of the
Connectivity
page. The banner notifies you that a Gateway upgrade
is available after you have run LCM inventory. The table on the
Gateways
tab also displays an alert (exclamation mark) icon for the network gateways that the upgrade
applies to. The hover message for the icon informs you that an upgrade is available for that
Gateway.
Figure.
Upgrade Banner
Click to enlarge
For more information about the upgrade procedure, see Upgrading the PC-managed Onprem Nutanix VPN Gateways.
Identifying the Gateway Version
About this task
To identify the current Nutanix Gateway version, do the following:
Procedure
Click the hamburger icon and
Networking & Security
>
Connectivity
.
On the
Gateways
tab, click the Gateway name link text to open the
Gateway details page.
In the Gateway table, the VPN Gateway name is a clickable link text.
The
Gateway Version
is listed in the
Properties
widget.
Figure.
Gateway Version
Click to enlarge
Detecting Upgrades for Gateways
About this task
Prism Central can detect whether new Gateway upgrades are available, or not, for
Nutanix Gateways using LCM. You can then install the upgrade.
Procedure
Click the hamburger icon of
Dashboard
.
Click
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
Note:
Nutanix recommends that you select
Enable LCM Auto
Inventory
in the
LCM
page in Prism
Central to continuously detect new Gateway upgrades as soon as they are
available.
The upgrade notification banner is displayed on the
Gateways
page.
Upgrading the PC-managed Onprem Nutanix VPN Gateways
About this task
Perform upgrades of PC-managed Nutanix Gateways using the respective PC on which the
Gateway is created.
To upgrade the on-prem Nutanix Gateways, do the following:
Procedure
Log on to the Prism Central as the admin user and click the gear icon.
Go to
Administration
>
LCM
>
Inventory
.
Click
Perform Inventory
.
When you click
Perform Inventory
, the system scans the
registered Prism Central cluster for software versions that are running
currently. Then it checks for any available upgrades and displays the
information on the
LCM
page under
Software
.
Note:
Skip this step if you have enabled auto-inventory in the
LCM
page in Prism Central.
Go to
Updates
>
Software
. Select the
Gateway version you want to upgrade to and click
Update
.
LCM upgrades the Gateway version. This process takes sometime.
Network and Security View
The
Network and Security
category in the
Entities
Menu
expands on-click to display the following networking and security
entities that are configured for the registered clusters:
Subnets
: This dashboard displays the subnets and the operations
that you can perform on subnets.
Virtual Private Clouds
: This dashboard displays the VPCs and the
operations that you can perform on VPCs.
Floating IPs
: This dashboard displays a list of floating IP
addresses that you are using in the network. It allows you to request for floating IP
addresses from the free pool of I addresses available to the clusters managed by the
Prism Central instance.
Connectivity
: This dashboard allows you to manage the following
networking capabilities:
Gateways
: This tab provides a list of network gateways that
you have created and configured, and the operations you can perform on the network
gateways. You can check and upgrade the Gateway bundle in
Administration
>
LCM
>
Inventory
.
VPN Connections
: This tab provides a list of VPN connections
that you have created and configured, and the operations you can perform on VPN
connections.
Subnet Extensions
: This tab provides a list of subnets that
you have extended at the Layer 2 level using VPN (point-to-point over Nutanix VPN)
or VTEP (point-to-multi-point including third party).
Security Policies
: This dashboard provides a list of security
policies you configured using Flow Segmentation. For more information about Security
Policies, see the Flow Microsegmentation Guide.
See "Network Connections" section for information on how to configure network connections.
Subnets (Overlay IP subnets), Virtual private clouds, floating IPs, and Connectivity are
Flow Networking features. These features support flexible app-driven networking that focuses
on VMs and applications instead of virtual LANs and network addresses. Flow Networking
powers network virtualization to offer a seamless network experience with enhanced security.
It is disabled by default. It is a software-defined network virtualization solution
providing overlay capabilities for the on-premises AHV clusters.
Security policies drives the Flow Segmentation features for secure communications. See
Flow Microsegmentation Guide.
Subnets
Manage subnets in the
List
view of
Subnets
dashboard in the
Network and
Security
section.
To access the
Subnets
dashboard, select
Subnets
from the entities menu in Prism Central. The
Subnets
dashboard allows you to view information about the subnets configured for the registered
clusters.
Note:
This section describes the information and options that appear in the
Network
and Security
dashboard. See
Entity Exploring
for instructions on how
to view and organize that information in a variety of ways.
Figure.
Subnets Dashboard
Click to enlarge
The following table describes the fields that appear in the subnets list. A dash (-) is
displayed in a field when a value is not available or applicable.
Table 1.
Subnets Dashboard Fields
Parameter
Description
Values
Name
Displays the subnet name.
(subnet name)
External Connectivity
Displays whether or not the subnet has external connectivity
configured.
(Yes/No)
Type
Displays the subnet type.
VLAN
VLAN ID
Displays the VLAN identification number.
(ID number)
VPC
Displays the name of the VPC that the Subnet is used in.
(Name of VPC)
Virtual Switch
Displays the virtual switch that is configured for the VLAN you selected. The
default value is the default virtual switch
vs0
.
Note:
The virtual
switch name is displayed only if you add a VLAN ID in the VLAN ID
field.
(virtual switch name)
IP Prefix
Displays the IPv4 Address of the network with the prefix.
(IPv4 Address/Prefix)
Cluster
Displays the name of the cluster for which this subnet is configured.
(cluster name)
Hypervisor
Displays the hypervisor that the subnet is hosted on.
(Hypervisor)
To filter the list by network name, enter a string in the filter field. (Ignore the
Filters
pane as it is blank.)
To view focused fields in the List, select the focus parameter from the
Focus
drop down list. You can create your own customised focus
parameters by selecting
Add custom
from the drop down list and
selecting the necessary fields after providing a
Name
, in the
Subnet Columns
.
There is a
Network Config
action button to configure a new network
(see
Configuring Network Connections
The
Actions
menu appears when one or more networks are selected and
includes a
Manage Categories
option (see
Assigning a Category
).
Go to the
Subnets
list view by clicking
Network and Security
>
Subnets
on the left side-bar.
Figure.
Subnets Page
Click to enlarge
To view or select actions you can perform on a subnet, select the subnet and click the
Actions
dropdown.
Figure.
Subnet Actions
Click to enlarge
Table 2.
Subnet Actions
Action
Description
Update
Click this action to update the selected subnet. see Updating a Subnet in the Flow Networking
Guide.
Manage Extension
Click this action to create a subnet extension. A subnet extension allows VMs
to communicate over the same broadcast domain to a remote Xi availability zone (in
case of Xi-Leap based disaster recovery) via the extension.
Manage Categories
Click this action to associate the subnet with a category or change the
categories that the subnet is associated with.
Delete
Click this action to delete the selected subnet. See Deleting Subnets, Policies, or Routes in the
Flow Networking Guide
.
You can also filter the list of subnets by clicking the
Filters
option and selecting the filtering parameters.
Subnet Summary View
View the details of a subnet listed on the Subnets page.
To view the details of a subnet, click the name of the subnet on the subnet list view.
Figure.
Subnet Summary Page
Click to enlarge
The
Summary
page provides buttons for the actions you can perform on
the subnet, at the top of the page. Buttons for the following actions are available:
Update
,
Extend
,
Manage
Categories
, and
Delete
.
The subnet
Summary
page has the following widgets:
Widget Name
Information provided
Subnet Details
Provides the following:
Type
— Displays the type of network like VLAN or
Overlay.
VLAN ID
— Displays the VLAN ID. This parameter is
displayed only for VLAN networks.
VPC
— Displays the VPC name. This parameter is displayed
only for Overlay networks.
Cluster
— Displays the cluster that the VLAN network is
configured on. This parameter is displayed only for VLAN networks.
IP Prefix
— Displays the IP address prefix configured for
the network. This parameter is displayed for both VLAN and Overlay
networks.
IP Pool
Provides the IP address
Pool Range
assigned to the
network.
External Connectivity
Provides the following:
NAT
— Displays whether NAT is enabled or disabled for
VPCs connecting to the network. When you hover on the
Enabled
/
Disabled
status, the hover message displays details of VPCs connected to the external
subnet.
Associated VPCs
— Displays the VPCs associated with this
external subnet.
Virtual Private Clouds
You can manage Virtual Private Clouds (VPCs) on the
Virtual Private
Clouds
dashboard.
Go to the
Virtual Private Clouds
dashboard by clicking
Network and Security
>
Virtual Private Clouds
on the left side-bar.
Figure.
Virtual Private Clouds dashboard
Click to enlarge
You can configure the table columns for the VPC list table. The available column list
includes
Externally Routable IP Addresses
that provides address
space within the VPC that is reachable externally without NAT.. For the list of columns that
you can add to the list table, see Customizing the VPC List View.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
To view or select actions you can perform on a VPC, select the VPC and click the
Actions
drop down.
You can also filter the list of VPC by clicking the
Filters
option
and selecting the filtering parameters.
Customizing the VPC List View
About this task
You can customize the columns in the table. Click the
View by
drop down and select
+ Add custom
.
In the
Virtual Network Columns
dialog box, do the following.
Procedure
Enter a name for the view.
Select the columns you want displayed in the table.
During the column selection, the columns you select are moved under the
Selected Columns
list. The
Name
(of the VPC) column is the default column
already selected. You can add a maximum of 10 columns (including the
Name
column) to the
Selected
Column
list.
Figure.
Customizing Columns in VPC View
Click to enlarge
To arrange the order of the selected columns, hover on the column name and
click the up or down arrow button as appropriate.
Click
Save
.
VPC Details View
To view the details of a VPC, click the name of the VPC on the VPC list view.
The VPC details view has the following tabs:
Summary
Figure.
Summary Tab
Click to enlarge
The
Summary
tab provides the following panes:
DNS Servers
—Provides more information about the DNS Servers
used by the VPC.
External Connectivity
—Provides the name of the external
subnet, NAT Gateway host details, router/SNAT IP address and the IP address spaces or
ranges configured for the VPC.
Floating IP Addresses
—Provides details of the floating IP
addresses that the VPC uses.
Subnets
Figure.
Subnet Tab
Click to enlarge
The
Subnet
tab provides the following information for the
subnets:
Name
—Displays the name of the subnet.
IP Range
—Displays the IP address range configured for the
subnet.
DHCP IP Pool
—Displays the DHCP IP address pool configured for
the subnet.
Default Gateway IP
—Displays the IP address used as the
default gateway by the entities in the subnet.
Actions
—Displays the actionable links to
Edit
or
Delete
the subnet.
Policies
Figure.
Policies Tab
Click to enlarge
The
Policies
tab maps the following information about the
security-based traffic shaping policies you configure:
Priority
—The traffic priority.
Rule
—The
Allow
or
Deny
rule set for the priority.
Traffic
—The traffic type that the priority and rule should be
applied to.
Actions
—Actions you can take on the policy. You can perform
three actions:
Clear counters
,
Edit
the
policy or
Delete
the policy.
Routes
Figure.
Routes Tab
Click to enlarge
The
Routes
tab provides the following information about the
routes:
The VPC details view has the following configuration options for the VPC:
Update
: Use this option to update the VPC. For more information,
see Updating Virtual Private Cloud.
Add Subnet
: Use this option to add a subnet to the VPC. For more
information, see Creating a Subnet.
Create Static Routes
: Use this option to create a static route.
For more information, Creating Static Routes.
Update Static Routes
: Use this option to update static route
configurations that you already created. For more information, see Updating Static Routes.
Create Policy
: Use this option to create traffic policies in
addition to the pre-configured default policy. When you create a VPC, there is one default
policy that Advanced Networking creates for the VPC. This policy is pre-configured and
cannot be edited. For more information, see Creating a Policy.
Clear All Counters
: Allows you to clear all the counters for the
VPC.
Delete
: Allows you to delete the VPC. For more information, see
Deleting a Virtual Private Cloud.
Floating IPs
You can access floating IPs on the
Floating IPs
dashboard or list view in the
Network and Security
section.
For information about floating IP addresses and their role in Flow Networking, see SNAT and Floating IP Address.
Go to the
Floating IPs
dashboard by clicking
Network and Security
>
Floating IPs
on the left side-bar.
Figure.
Floating IPs dashboard
Click to enlarge
To view or select actions you can perform on a floating IP address assigned, select the
floating IP address and click the
Actions
drop down. The following
actions are available for a selected floating IP address:
Update—Assign or change the assignment of the floating IP address. You can assign the
floating IP address to a IP address such as a private IP address in a VPC or the primary
IP address of a VM or a secondary IP address created on a VM.
Delete—Delete the floating IP address. The deleted IP address returns to the IP address
pool as unused. Before you delete, ensure that it is not assigned to a private IP address
or a VM. Change the assignment to
None
if it is already assigned,
using the
Update
action.
Note:
Floating IP addresses are not reachable (Pings fail) unless you associate them to
primary or secondary IP addresses of VMs. For more information about assigning floating IP
addresses to secondary IP addresses of VMs, see
Assigning Secondary IP Addresses to Floating
IPs
.
To filter the list of floating IP address assignments, click the
Filters
option and select the appropriate filtering
parameters.
To request floating IP addresses, see Requesting Floating IPs.
Connectivity
You can access network Gateways, VPN connections and subnet extensions on the
Connectivity
dashboard.
Click
Network & Security
>
Connectivity
to see the
Connectivity
dashboard.
The
Connectivity
dashboard opens on the
Gateways
tab. To see the VPN connections, click the
VPN Connections
tab. To see
the subnets extended across AZs, click the
Subnet Extensions
tab.
Gateways Summary View
The Connectivity dashboard opens on the Gateways dashboard or summary view.
The
Gateway
dashboard provides a list of gateways created for the
clusters managed by the Prism Central.
The
Gateways
dashboard provides a
Create
Gateway
dropdown menu that lets you create a
Local
or a
Remote
gateway. You can create a local or remote gateway with
VPN
or
VTEP
service. For more information,
see Creating a Network Gateway.
You can select a gateway from the list (select the checkbox provided for the gateway) and
then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected gateway.
Figure.
Gateways dashboard
Click to enlarge
The
Gateway
summary list view provides the following details about
the gateway.
Table 1.
Gateway List Fields
Parameter
Description
Values
Name
Displays the name of the gateway.
(Name of gateway)
Type
Displays the gateway type.
(Local or Remote)
Service
Displays the service that the gateway uses.
(VPN or VTEP)
Service IP
Displays the IP address used by the service.
(IP address)
Status
Displays the operational status of the gateway.
(Up or Down)
Attachment Type/Vendor
Displays the type of subnet associated with the gateway.
(VLAN or Overlay-VPC name)
Connections
Displays the number of service connections (such as VPN connections) configured
and operational on the gateway.
(number)
You can click the name of a gateway to open the gateway details page that presents the
information about the gateway in widgets.
Gateway Details View
You can click the name of a gateway in the
Gateway
dashboard
list to open the gateway details page that presents the information about the gateway in
widgets.
The gateway details page displays the name of the gateway on the top left corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update
Gateway
page. See
Updating Gateways
for more information.
The
Delete
button allows you to delete the gateway. See
Deleting Gateways
for more information.
Figure.
Gateway Details View
Click to enlarge
The details about the gateway are organized in widgets as follows:
Table 1.
Gateway Details
Parameter
Description
Values
Properties widget
Type
Displays the gateway type.
(Local or Remote)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address)
Status
Displays the operational status of the gateway.
(Up or Down)
Gateway Version
Displays the version of the Nutanix gateway appliance deployed.
(Version)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Service Configuration
Service
Displays the service used by the gateway.
(VPN or VTEP)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
VPN Connections
Displays the total number of VPN connections associated with the
gateway.
(Number - actionable link. Click the link to open the VPN connection details
page for the associated VPN connection.)
View VPN Connections
Click this link to open the VPN Connections tab.
-
VPN Connections Summary View
The Connectivity dashboard allows you to open the VPN Connections dashboard or summary
view.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways between
which you want to create the VPN connection.
The
VPN Connections
dashboard provides a list of VPN connections
created for the clusters managed by the Prism Central.
The
VPN Connections
dashboard provides a
Create VPN
Connection
button that opens the
Create VPN Connection
.
For more information, see Creating a VPN Connection.
You can select a VPN connection from the list (select the checkbox provided for the VPN
connection) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected VPN
connection.
The
VPN Connections
summary list view provides the following details
about the VPN connection.
Figure.
VPN Connections dashboard
Click to enlarge
Table 1.
VPN Connections List Fields
Parameter
Description
Values
Name
Displays the name of the connection.
(gateway name)
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Local Gateway
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Remote Gateway
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
VPN Connections Details View
You can click the name of a VPN connection in the
VPN
Connections
dashboard list to open the VPN connection details page that presents
the information about the VPN connection in widgets.
The VPN connection details page displays the name of the VPN connection on the top left
corner.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update VPN
Connection
page. For more information, see Updating a VPN Connection.
The
Delete
button allows you to delete the VPN connection. For
more information, see Deleting a VPN Connection.
Figure.
VPN Connection Details
Click to enlarge
The details about the VPN connection are organized in widgets as follows:
Summary tab—See the
VPN Connection Summary Tab Details
table below.
Throughput tab—See the
VPN Connection Throughput Tab Details
table
below.
IPSec Logging tab—Provides logs for the IPSec tunnel.
Routing Protocol Logging tab—Provides logs for the routing protocol used in the VPN
connection.
Table 1.
VPN Connection Summary Tab Details
Parameter
Description
Values
VPN Connection widget
IPSec Status
Displays the connection status of IPSec tunnel.
(Connected or Not Connected)
EBGP Status
Displays the status of the EBGP gateway connection.
(Established or Not Established)
Dynamic Routing Priority
Displays the dynamic routing priority assigned to the connection for throughput
management. You can assign any value in the range of 100-1000. Flow networking
assigns the first VPN connection the value 500 by default. Thereafter, subsequent
VPN connections are assigned values decremented by 50. For example, the first
connections is assigned 500, then the second connection is assigned 450, the third
one 400 and so on.
(Number in the range of 100-1000. User assigned.)
Local Gateway Properties
Gateway Name
Displays the name of the local gateway used for the connection.
(Name of local gateway)
Type
Displays the type of gateway.
(Local)
Attachment Type
Displays the network entity like VLAN or VPC that the gateway is attached
to.
(VLAN or VPC)
VPC or Subnet (VLAN)
Displays the name of the attached VPC or VLAN subnet.
(Name of VLAN or VPC)
Tunnel IP
Displays the Tunnel IP address of the local gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
Internal Routing
Displays the type of routing associated with the gateway for internal traffic
routing.
(Static or eBGP with ASN)
Floating or Private IP Address
Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to
the gateway.
(IP Address that you assigned to the local gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
(Up or Down)
Cluster
Displays the name of the cluster on which the gateway is created.
(Cluster name)
Gateway VM
Displays the name of the VM on which the gateway is created.
(Name of VM - actionable link. Click the name-link to open the VM details page
of the gateway VM.)
Remote Gateway Properties
Gateway Name
Displays the name of the remote gateway used for the connection.
(Name of remote gateway)
Type
Displays the type of gateway.
(Remote)
Tunnel IP
Displays the Tunnel IP address of the remote gateway.
(IP Address)
Connection Type
Displays the connection type you selected while creating the VPN connection.
The connection type may be Initiator or Acceptor of a VPN connection between the
local and remote gateways. T
(Initiator or Acceptor)
External Routing
Displays the type of routing associated with the gateway for external traffic
routing.
(Static or eBGP with ASN)
ASN
Displays the ASN of the EBGP route. This information is only displayed if you
configured EBGP as the External Routing protocol.
(Number)
Vendor
Displays the name of the vendor of the gateway appliance at the remote
site.
(Name of vendor of gateway appliance)
External IP
Displays the IP address assigned to remote the gateway.
(IP Address that you assigned to the remote gateway with /30 prefix when you
configured the VPN connection.)
Status
Displays the operational status of the gateway.
-
Protocol Details
Service
Displays the service used by the gateway.
(VPN or VTEP)
Gateway Routes
Displays the status of the routes used by the gateways.
(Sent)
Subnet Extensions Summary View
The Connectivity dashboard opens on the Subnet Extensions dashboard or summary
view.
The
Subnet Extensions
dashboard provides a list of subnet extensions
created for the clusters managed by the Prism Central.
The
Subnet Extensions
dashboard provides a
Create Subnet
Extension
dropdown menu that lets you extend a subnet
Across
Availability Zones
or
To a Third Party Data Center
. You
can extend a subnet using
VPN
or
VTEP
service.
See Layer 2 Virtual Network Extension for more information.
You can select a subnet extension from the list (select the checkbox provided for the
subnet extension) and then perform an action provided in the
Actions
dropdown list. The
Actions
dropdown list allows you to
Update
or
Delete
the selected subnet
extension.
Figure.
Subnet Extensions dashboard
Click to enlarge
The
Subnet Extensions
summary list view provides the following
details about the gateway.
Table 1.
Subnet Extensions List Fields
Parameter
Description
Values
Name
Displays the name of the subnet extension.
(Name of subnet extension)
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Extension Over
Displays the service that the subnet extension uses.
(VPN or VTEP)
Extension Uses
Displays the name of the local network gateway that the subnet extension
uses.
(Name of local network gateway)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Remote Site
Displays the name of the remote network gateway that the subnet extension
uses.
(Name of remote network gateway)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
You can click the name of a subnet extension to open the subnet extension details page that
presents the information about the subnet extension in widgets.
Subnet Extensions Details View
You can click the name of a subnet extension in the
Subnet
Extensions
dashboard list to open the subnet extension details page that presents
the information about the subnet extension in widgets.
The subnet extension details page displays the name of the subnet extension on the top left
corner. It has two tabs -
Summary
and
Address
Table
. The
Summary
tab provides the information about the
subnet extension in widgets. The
Address Table
tab provides MAC Address
information only when the subnet extension uses VTEP service.
On the top right corner, the close button (X) allows you to close the details page.
The
Update
button opens the
Update Subnet
Extension
page. See Updating an Extended Subnet for more information.
The
Delete
button allows you to delete the subnet extension. See
Removing an Extended Subnet for more information.
Figure.
Subnet Extensions Details View - Address Table Tab for VPN-based Extension
Click to enlarge
Figure.
Subnet Extensions Details View - Address Table Tab for VTEP-based Extension
Click to enlarge
The details about the subnet extension are organized in two tabs. The
Summary
tab organizes the subnet extension details in the extended
widget as provided in the table. The
Address Table
tab provides
details about the MAC addresses in a list.
(For VLAN subnets only) Displays the VLAN ID of the VLAN subnet that is
extended.
(VLAN ID number)
VPC
(For Overlay subnets only) Displays the name of the VPC subnet that is
extended.
(Name of VPC)
Cluster
(For VLAN subnets only) Displays the cluster that the VLAN subnet belongs
to.
(Name of cluster)
IP Address Prefix
Displays the network IP address with prefix, of the VLAN subnet that is
extended.
(IP Address with prefix)
Virtual Switch
(For VLAN subnets only) Displays the virtual switch on which the VLAN subnet is
configured.
(Virtual Switch name such as vs0 or vs1)
IP Address Pools
Pool Range
Displays the range of IP addresses in the pool configured in the subnet that is
extended.
(IP address range)
(Interactive Graphic Pie Chart)
Displays a dynamic pie chart that displays the statistic you hover on. Displays
the following IP address statistics outside the pie chart, that you can hover on:
Total number of IP addresses available.
Used IP addresses in the subnets
Used IP addresses in the IP address pools
Free IP addresses in the subnets
Free IP addresses in the IP address pools
(IP Address statistics)
Subnet Extension
Subnet Extension (properties) - Common
Type
Displays the subnet extension type.
(
Across Availability Zones
or
To a Third
Party Data Center
)
Interface Status
Displays the status of the interface that is used by the subnet
extension.
(Connected or Down)
Connection Status
Displays the status of the connection that is created by the subnet extension.
Not Available
status indicates that Prism Central is unable
to ascertain the status.
(Not Available, Connected, or Disconnected)
Local IP Address
Displays the IP address that you entered in the
Local IP
Address
field while creating the subnet extension.
(IP Address)
Local Subnet
Displays the name of the local subnet that the subnet extension uses.
(Name of local subnet)
Subnet Extension (properties) - (Only for
Across Availability Zones
type)
Local Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the local AZ that is hosting the subnet that is extended.
(Name of the local Availability Zone)
Remote Availability Zone
(Only for
Across Availability Zones
type) Displays the
name of the remote AZ that the subnet is extended to.
(Name of the remote Availability Zone)
Remote Subnet
(Only for
Across Availability Zones
type) Displays the
name of the remote subnet that the subnet extension connects to.
(Name of remote subnet)
Remote IP Address
(Only for
Across Availability Zones
type) Displays the
IP address that you entered in the
Remote IP Address
field
while creating the subnet extension.
(IP Address)
Subnet Extension (properties) - (Only for
To a Third Party Data Center
type)
Local Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the local gateway used for the subnet extension.
(Name of local gateway)
Remote Gateway
(Only for
To a Third Party Data Center
type) Displays
the name of the remote gateway used for the subnet extension.
Note:
This section describes the information and options that appear in the security policies dashboard.
See Entity Exploring for instructions on how to view
and organize that information in a variety of ways.
See Flow Microsegmentation Guide for information
about how to create and apply security policies.
Figure.
Security Policies Dashboard
Click to enlarge
The following table describes the fields that appear in the security policies list. A dash
(-) is displayed in a field when a value is not available or applicable.
Table 1.
Security Policies List Fields
Parameter
Description
Values
Name
Displays the policy name. The policy is one of three types: application,
quarantine, or isolation.
(name), Application, Quarantine, Isolation
Purpose
Describes (briefly) the policy's purpose.
(text string)
Policy
Displays (high level) what the policy does.
(boxed text)
Status
Displays the current status of the policy (either applied currently or in
monitoring mode).
Applied, Monitoring
Last Modified
Displays the date the policy was last modified (or the creation date if the
policy has never been modified).
(date)
You can filter the security polices list based on several parameter values. The following
table describes the filter options available when you open the Security Policies view
Filter
pane. To apply a filter, select a parameter and check the
box of the desired value (or multiple values) you want to use as a filter. You can apply
filters across multiple parameters.
Table 2.
Filter Pane Fields
Parameter
Description
Values
Name
Filters on the item name. Select a condition from the pull-down list
(
Contains
,
Doesn't contain
,
Starts with
,
Ends with
, or
Equal to
) and enter a string in the field. It will return a
list of security policies that satisfy the name condition/string.
(policy name string)
Type
Filters on the policy type. Check the box for one or more of the policy types
(application, quarantine, isolation). It will limit the list to just those policy
types.
Application, Quarantine, Isolation
Status
Filters on the policy status. Check the box for applied or monitoring.
Applied, Monitoring
The security policies dashboard includes a
Create Security Policy
action button with a drop-down list to
Secure an Application
or
Isolation Environments
.
The
Actions
menu appears when one or more policies are selected. It
includes options to update, apply, monitor, and delete. The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Security Policy Details View
To access the details page for a security policy, click on the desired security policy name
in the list (see Security Policies Summary View).
The Security Policy details page includes the following:
The policy name appears in the upper left. You can switch from one policy to another by
selecting the policy name from the pull-down list.
The rule status appears below the name and indicates whether the policy is being applied
currently or is in monitoring mode.
Three columns appear that specify the Inbound policy (on the left), the affected
entities (in the middle), and the Outbound policy (on the right).
There are three action buttons (upper right).
Click the appropriate button to update, apply, monitor, or delete the policy (see
Nutanix Security Guide
for details). The available actions appear in
bold; other actions are grayed out. (For grayed out options, a tool tip explaining the
reason is provided.)
Click the question mark icon to open a help page in a separate tab or window.
Click the X icon to close the details page.
Figure.
Security Policy Details View: Monitoring Rule Example
Click to enlarge
Figure.
Security Policy Details View: Applied Rule Example
Click to enlarge
For more information about Security Policies, see Flow Microsegmentation Guide.
Virtual Private Cloud
A Virtual Private Cloud (VPC) is an independent and isolated IP address space that functions
as a logically isolated virtual network. A VPC could be made up of one or more subnets that
are connected through a logical or virtual router. The IP addresses within a VPC must be
unique. However, IP addresses may overlap across VPCs. As VPCs are provisioned on top of
another IP-based infrastructure (connecting AHV nodes), they are often referred to as the
overlay networks. Tenants may spin up VMs and connect them to one or more subnets within a
VPC.
Virtual Private Cloud (VPC) is a virtualized network of resources that are specifically
isolated from the rest of the resource pool. VPC allows you to manage the isolated and secure
virtual network with enhanced automation and scaling. The isolation is done using network
namespace techniques like IP-based subnets or VLAN based networking.
AHV provides the framework to deploy VPC on on-premises clusters using the following.
Advanced Networking subnets and DHCP management
Multiple uplink and bridge management via virtual switch (VS)
Virtual Private Network (VPN) gateways and connections
Flow Networking simplifies the deployment and configuration of overlay-based VPCs. It allows
you to quickly:
Create, update and delete VPCs.
Create, update and delete subnets within VPCs.
Note:
Create subnets as necessary when you
create VPCs.
Add network security policies and services.
Configure hybrid cloud connectivity with VPNs.
This section covers the concepts and procedures necessary to implement VPCs in the
network.
VM IP Address Management
Primary Address
The primary IP address is assigned to a VM during initialization when the cluster provides
any virtual NIC (NIC) to a VM.
Select
Assign Static IP
as the
Assignment
Type
to add a static IP address as primary IP address of the VM, when you
attach a subnet to a VM.
Select
Assign with DHCP
as the
Assignment
Type
to allow DHCP to dynamically assign an IP address to the VM.
Select
No Private IP
as the
Assignment
Type
if you do not want to assign an IP address to the vNIC of the VM.
For more information about attaching a subnet to a VM, see Creating a VM through Prism Central (AHV) in the
Prism Central Guide
.
Secondary IP Addresses (Overlay Networks only)
For your deployment, you may need to configure multiple (static) IP addresses to a single
NIC. These IP addresses (other than the primary IP address) are secondary IP addresses. A
secondary IP address can be permanently associated with a specific NIC or be changed to any
other NIC. The NIC ownership of a secondary IP address is important for security routing
policies.
Note:
You can configure secondary IP addresses only for VMs in an Overlay network.
You can configure secondary IP addresses to a NIC when you want to:
Associate multiple floating IP addresses with one VM without creating multiple NICs
(each with one primary IP address) for the VM. You can assign one floating IP address to
one secondary IP address that you create for the single NIC. For information about
floating IP addresses, see Requesting Floating IPs.
Run appliances, such as load balancers, that have multiple IP addresses on each
interface.
Host applications in a High Availability (HA) configuration where the ownership of IP
address moves from the active entity to the standby entity when the active entity goes
down.
Host applications in a clustered configuration where the ownership of IP address follows
the leader.
Host Nutanix Files service in a VPC as a case of clustered application.
Note:
In applications that use secondary IP addresses as virtual IP addresses and the NIC
ownership of the secondary IP address changes dynamically from one NIC to another,
configure the application to incorporate the ownership change in its settings or
configuration. If the applications do not incorporate these ownership changes, the VPCs
configured for such applications fail.
For information about configuring secondary IP addresses, see Creating Secondary IP Addresses.
IP Address Information
You can view the IP addresses configured on a VM by clicking the
See
More
link in the
IP Address
column in the VM
details view to open the
IP Address Information
box.
Note:
The
See More
link in the
IP Address
column in the VM details view and the
IP Address Information
box are
available only if the VM has any secondary IP addresses configured.
Figure.
IP Address Information
Click to enlarge
Creating Secondary IP Addresses
You can assign multiple secondary IP addresses to a single vNIC.
About this task
You can add multiple secondary IP addresses to the vNIC configured on a VM. Add the
secondary IP addresses to the vNIC in the
Create
VM
or the
Update
VM
page.
Procedure
Go to the
Networks
section.
Click the
Edit
icon for the subnet that you want to add
the secondary IP addresses from.
The
Update NIC
dialog box opens.
Check the
Add Secondary IPs
check box in the
Update NIC
dialog box.
Figure.
Add Secondary IP Addresses
Click to enlarge
Add a comma-separated list of the secondary IP addresses that you want to add
to the vNIC of the VM.
Note:
Ensure that the secondary IP addresses are within the same subnet that
the primary IP address of the
NIC
is from. The subnets are displayed in the
Private IP Assignment
section in the
Update NIC
dialog box.
Ensure that the secondary IP address is not the same as the IP address
provided in the
Private IP Assignment
field.
Click
Save
.
Click
Next
on the
Resources
and the
Management
tabs of the
Update VM
page.
If you need to make any other changes on the
Resources
and the
Management
tabs for any configurations other
than adding secondary IP addresses, make the changes and then click
Next
on these tabs.
Click
Launch VM
on the
Review
tab
after you review
What to do next
You can view the secondary IP addresses configured on the VM in the
IP
Address Information
box.
Assigning Secondary IP Addresses to Interfaces
Assign the secondary IP addresses to interfaces or subinterfaces on the
VM.
About this task
To assign the secondary IP addresses to virtual interfaces on the VM, do the
following on the VM details page:
Procedure
Click
Console
.
Log in as a root user.
Run the
ifconfig
command as follows:
root@host$ ifconfig <interface> <secondary ip address> <network mask>
Provide the following in the command:
Parameter
Description
<interface>
The interface of the VM such as eth0. You can provide
subinterfaces
such as eth0:1 and eth0:2.
<secondary IP address>
The secondary IP address that you created and want to
associate with the interface.
<network mask>
The network mask that is an expansion of the network prefix
of the network that the secondary IP address belongs to. For
example, if the secondary IP address belongs to 10.0.0.0/24 then
the network mask is 255.255.255.0.
Repeat the aforementioned steps for all the secondary IP addresses you want to
associate with interfaces on the VM.
Exit from the Console.
Assigning Secondary IP Addresses to Floating IPs
Assign the secondary IP addresses to floating IP addresses on the VM.
About this task
After you assign secondary IP addresses to interfaces or subinterfaces on the VM, you
can assign the secondary IP addresses to floating IP addresses that may be used for
external connectivity.
Do one of the following:
Procedure
Assign floating IP addresses when you request floating IP addresses in the
Assign Floating IPs
section of the
Request
Floating IP
dialog box.
To assign floating IP addresses while requesting for them, you must have the
secondary IP addresses configured and ready when you are requesting the floating
IP addresses.
Select the floating IP address you want to assign, in the
Floating
IPs
dashboard. Click the
Update
option in
the
Actions
drop-down menu.
Assign the secondary IP addresses you configured to the floating IP addresses
you have.
VPC Workflow
A virtual private cloud (VPC) can be deployed on Nutanix cluster infrastructure to manage
the internal and external networking requirements using Flow Networking. The workflow to
create a complete network based on VPC is described below.
Create a VPC—See Creating Virtual Private Cloud. See Updating Virtual Private Cloud to update a VPC you created.
Add Subnets to the VPC—See Creating a Subnet to create a
Subnet. See Updating a Subnet to update a subnet.
Attach the Subnet to VMs—See Attaching a Subnet to a Virtual Machine.
VPC Management
This section provides information and procedures that you need to manage virtual
private clouds using Flow networking.
Creating Virtual Private Cloud
About this task
You can create VPCs on the Virtual Private Clouds page. Go to the Virtual Private
Clouds page by clicking
Virtual Infrastructure
>
Networking
>
Virtual Private Clouds
.
To create a VPC, do the following.
Procedure
On the VPC dashboard, click
Create VPC
.
See Network and Security View for more information about the
VPC dashboard.
The
Create Virtual Private Cloud (VPC)
dialog box opens.
Figure.
Create Virtual Private Cloud
Click to enlarge
Provide the necessary values in respective fields in the
Create
Virtual Private Cloud (VPC)
dialog box.
Fields
Description and Values
Name
Provide a name for the VPC.
External Connectivity
This section takes you through configuration of the
parameters necessary for connectivity to the Internet or
clusters outside the VPC.
A subnet with external connectivity
(External Subnet) is required if the VPC needs to send
traffic to a destination outside of the VPC.
Note:
You
can add a maximum of two external subnets - one external
subnet with NAT and one external subnet without NAT to a
VPC. Both external subnets cannot be of the same type. For
example, you cannot add two external subnets, both with NAT.
You can update an existing VPC similarly.
Network
address translation (NAT) Gateways perform the required
IP-address translations required for external routing. You
can also have external connectivity without NAT.
External Subnet
Select an external subnet from the drop down list. By
associating the VPC with the external subnet you can provide
external connectivity to the VPC.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
Externally Routable IP Addresses
Provide IP addresses that are externally routable. Externally
routable IP addresses are IP addresses that within the VPC which
can communicate externally without NAT. These IP addresses are
used when an external subnet without NAT is used.
Domain Name Servers (DNS)
(Optional) DNS is advertised to Guest VMs via DHCP. This can
be overridden in the subnet configuration.
Click
+
Server IP
to add DNS server IPs under
IP Address
and click the check
mark.
You can
Edit
or
Delete
an IP address you added
using the options under
Actions
.
Click
Save
.
Requesting Floating IPs
About this task
Each VPN gateway requires a floating IP. If you do not provide one during the VPN
gateway creation, then Flow Networking automatically allocates a floating IP to a
VPN gateway. To provide floating IP during the VPN gateway creation, you can request
floating IPs and assign them to VMs.
You can view the allocated floating IPs on the
Floating IPs
page. Click
Networking
>
>
Floating IPs
.
To request a floating IP, do the following.
Procedure
Click the
Request Floating IP
button on the
Floating IPs
page.
On the
Request Floating IP
dialog box, provide the
information in the respective fields.
Figure.
Request and Assign Floating IPs
Click to enlarge
Note:
Uncheck the
Assign Floating IPs
box if you want to
assign the requested IP addresses after you receive it.
See Floating IPs for more
information.
Fields
Description and Values
External Subnet
Select a subnet that you configured with external
connectivity.
Number of Floating IPs
Enter the number of floating IPs you want. You can request a
maximum of 5 floating IP addresses.
Assign Floating IPs
Select this check box if you want to assign the floating IPs
to specific VMs in the table.
Based on the number you entered in the
Number of
Floating IPs
field, the system provides an
equivalent number of rows of
Search
VMs
and
IP
Address
in the table.
Under
Search VMs
, select the VM to
which you want to assign a floating IP address. Under
IP Address
, select the IP address
on the VM (primary or secondary IP address) to which you
want to assign the floating IP.
You can assign multiple floating IP addresses to multiple
secondary IP addresses that you can create on the NIC of the
VM.
For information about configuring secondary IP addresses, see
Creating Secondary IP Addresses.
Note:
Click
Save
.
What to do next
When you receive the floating IP address you requested, you can see it, assign it
(if not already assigned while requesting) or delete it in the
Floating
IPs
view.
Creating a Subnet
About this task
You can create subnets on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
and open the
Create Subnet
dialog box.
You can also open the
Create Subnet
dialog box from the VPC
details view by clicking the
Add Subnet
option.
To create a subnet, do the following.
Procedure
Click
Create Subnet
.
The
Create Subnet
dialog box opens. The following
figure displays the Create Subnet dialog box with all the options. These options
are displayed based on the values you select in the
Type
field.
Figure.
Create Subnet (With External Connectivity Disabled)
Click to enlarge
Figure.
Create Subnet (With External Connectivity Enabled)
Click to enlarge
Fields
Description and Values
Name
Provide a name for the subnet.
Type
Select the type of subnet you want to create.
You can create a
VLAN
subnet or an
Overlay
subnet.
VLAN ID
(VLAN subnet only) Enter the number of the
VLAN
.
Enter just the number in this field, for example 1 or 27.
Enter 0 for the native VLAN. The value is displayed as
vlan.1 or vlan.27 in the View pages.
Note:
Provision any single VLAN ID either in the AHV network
stack or in the Flow Networking (brAtlas) networking stack.
Do not use the same VLAN ID in both the stacks.
IP Address management
(Mandatory for Overlay type subnets) This section provides
the
Network IP Prefix
and
Gateway IP
fields for the subnet.
(Optional for VLAN type subnet) Check this box to display the
Network IP Prefix
and
Gateway IP
fields and configure the
IP address details.
Unchecking this box hides these fields. In this case, it is
assumed that this virtual LAN is managed outside the
cluster.
Note:
The
DHCP Settings
option is only
available for VLAN subnets if you select this
option.
DHCP Settings
(Optional for both VLAN and Overlay subnets) Check this box
to display fields for defining a domain.
Checking this box displays fields to specify DNS servers and
domains. Unchecking this box hides those fields.
See Settings the DHCP Options for more
information.
Cluster (VLAN subnet only)
(VLAN subnet only) This option is available only for
VLAN
subnet configuration. Select the
cluster that you want to assign to the subnet.
External Connectivity
(VLAN subnet
only) Turn on this toggle switch if you want use this
VLAN
subnet for external
connectivity.
Note:
Ensure that the externally routable IP addresses (subnets with external connectivity
without NAT) for different VPCs do not overlap.
Configure the routes for the external connectivity subnets with next hop as the Router or
SNAT IP address. Also configure the routes on the router for the return traffic to reach
the VPC. See
External Connectivity
panel in VPC Details View.
NAT
(Option under
External Connectivity
)
If you turn on the
External Connectivity
toggle switch, then you can choose whether to connect to
external networks with or without enabling NAT. Check the
NAT
check box to enable NAT for
external connectivity for VPCs.
Virtual Switch
(VLAN subnet only) Select the virtual switch that is
configured for the VLAN you selected. The default value is the
default virtual switch vs0. This option is displayed only if you
add a VLAN ID in the VLAN ID field.
VPC (Overlay subnet only)
Select the
Virtual Private Cloud (VPC)
that you want to assign to the subnet from the drop down
list.
You can create VPCs and assign them to
Overlay
subnets.
IP Address Pool
Defines a range of addresses for automatic assignment to
virtual NICs.
This field is optional for both
VLAN
and
Overlay
. For
VLAN
, this field is displayed
only if you select the
IP Address
Management
option.
Note:
Configure this field for
VLAN
or
Overlay
to complete the creation
of the VPC, if you do not need external connectivity for
this subnet. You must configure this field only if you need
external connectivity for this subnet.
Click the
Create Pool
button and enter
the following in the
Add IP Pool
page:
Enter the starting IP address of the range in the
Start Address
field.
Enter the ending IP address of the range in the
End Address
field.
Under
Actions
, click the check
mark to submit the starting and ending IP addresses
you entered.
Click the X mark to remove the entries.
Override DHCP Server
(VLAN subnet only) To configure a DHCP server, check the
Override DHCP Server
box and
enter an IP address in the
DHCP Server IP
Address
field.
See
Override DHCP Server (VLAN Only)
in Settings the DHCP Options for information
about this option.
Click
Save
.
Settings the DHCP Options
About this task
Selecting the
DHCP Settings
checkbox in
Create
Subnet
or
Update Subnet
allows you to configure
the DHCP options for the VMs within the subnet. When DHCP settings are configured
for a VM in a subnet and the VM is powered on, Flow Networking configures these
options on the VM automatically. If you do not configure the DHCP settings, then
these options are not available on the VM automatically when you power it on.
You can enable
DHCP Settings
when you create a subnet and
configure the
DHCP Settings
for the new subnet. You could also
update the DHCP Settings for an existing subnet.
DHCP Settings
is common to and is available on both the
Create Subnet
and the
Update Subnet
dialog boxes.
To configure the
DHCP Settings
, do the following in the
Create Subnet
or the
Update Subnet
dialog box:
Procedure
Provide the information in the
DHCP Settings
fields.
Figure.
DHCP Settings
Click to enlarge
Fields
Description and Values
Domain Name Servers
Provide a comma-separated list of DNS IP addresses.
Example: 8.8.8.8, 9.9.9.9
Domain Search
Enter the VLAN domain name. Use only the domain name
format.
Example: nutanix.com
TFTP Server Name
Enter a valid TFTP host server name of the TFTP server where
you host the host boot file. The IP address of the TFTP
server must be accessible to the virtual machines to
download a boot file.
Example: tftp_vlan103
Boot File Name
The name of the boot file that the VMs need to download from
the TFTP host server.
Example: boot_ahv2020xx
(Optional and for VLAN networks only) Check the
Override DHCP
Server
dialog box and enter an IP address in the
DHCP
Server IP Address
field.
You can configure a DHCP server using the
Override DHCP
Server
option only in case of VLAN networks.
The DHCP Server IP address (reserved IP address for the Acropolis DHCP
server) is visible only to VMs on this network and responds only to DHCP
requests. If this box is not checked, the DHCP Server IP Address field is
not displayed and the DHCP server IP address is generated automatically. The
automatically generated address is
network_IP_address_subnet.254
, or if the default
gateway is using that address,
network_IP_address_subnet.253
.
Usually the default DHCP server IP is configured as the last usable IP in the
subnet (For eg., its 10.0.0.254 for 10.0.0.0/24 subnet). If you want to use
a different IP address in the subnet as the DHCP server IP, use the override
option.
Attaching a Subnet to a Virtual Machine
About this task
To attach a subnet to a VM, go to the
Virtual Infrastructure
>
VM
>
List view
in Prism Central and do the following.
Procedure
Select the VM you want to attach a subnet to. Click
Actions
>
>
Update
.
In the
Update VM
dialog box, click
Add
NIC
.
Figure.
Click to enlarge
Provide the necessary information in the indicated fields in the
Create NIC
dialog box.
Select the
Subnet Name
from the drop down
list.
Select the
Network Connection State
as
Connected
or
Disconnected
.
The
Network Connection State
selection defines
the state of the connection after the NIC configuration is
implemented.
Select the
Assignment Type
.
You can select
Assign with DHCP
to assign a
DHCP based IP address to the VM.
You can select
Assign Static IP
to assign a
static IP address to the VM to reach the VM quickly from any
endpoint in the network such as a laptop.
Click
Add
.
Click
Save
on the
Update VM
dialog
box.
Creating a Policy
About this task
For Policy-based routing you need to create policies that route the traffic in the
network.
When you create a VPC, there is one default policy that Flow Networking creates for
the VPC. This policy is pre-configured with the Priority 1 and other default values
to
Deny
traffic flow and service (see the table of field
descriptions and values for this dialog box).
Note:
You cannot update or delete the
default policy.
Policies control the traffic flowing between subnets (inter-subnet
traffic).
Policies control the traffic flowing in and out of the VPC.
Policies do not control the traffic within a subnet (intra-subnet
traffic).
Figure.
Policy Tab
Click to enlarge
You can create
a traffic policy using the
Create Policy
dialog box. You can
open the
Create Policy
dialog box either from the VPC list view
or the VPC list view.
On the VPC list view, select the VPC you want to update and click
Create Policy
in the
Actions
drop down menu.
On the VPC details view, click the
Create Policy
option
in the
More
drop down menu.
To create a policy, do the following in the
Create Policy
dialog
box.
Procedure
Provide the necessary values in the respective fields.
Figure.
Create Policy
Click to enlarge
Fields
Description and Values
Value in Default Policy
Priority
The priority of the access list (ACL) determines which ACL is
processed first. Priority is indicated by an integer number. A
higher priority number indicates a higher priority.For example,
if two ACLs have priority numbers 100 and 70 respectively, the
ACL with priority 100 takes precedence over the ACl with
priority 70.
Note:
Click the
Understand
Priorities
link to see the
Understand Priorities
information box (see the image of this box below
this table).
1
Source
The source indicates the source IP or subnet for which you
want to manage traffic.
Source can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Source Subnet IP
with
prefix.
Any
Source Subnet IP
Only required if you selected the
Source
as
Custom
. Provide the subnet IP and
prefix that you want to designate as the source for the
policy. Use the CIDR notation format to provide the subnet
IP. For example, 10.10.10.0/24.
None
Destination
The destination is the destination IP or subnet for which you
want to set the priority.
Destination can be:
Any
: Indicates any IP
address.
External
: Indicates an IP
address that is outside the subnets configured for
the VPC.
Custom
: You can provide a
specific
Destination Subnet IP
with prefix.
Any
Destination Subnet IP
Only required if you selected the
Destination
as
Custom
.
None
Protocol
You can also set the priority configure policy for certain
protocols. You can select one of the following options:
Any
: Indicates any IP
address.
Protocol Number
: Provide an
integer number that indicates the protocol you want
to prioritize.
Provide the appropriate value in
the
Protocol Number
field.
TCP
UDP
ICMP
Protocol Number
This field is displayed only if you select
Protocol Number
as the value in
the
Protocol
field. The number you
provide must be the IANA designated number that indicates
respective protocol. See
IANA Protocol
Numbers
.
None
Action
Assign the appropriate action for implementation of the
policy.
Permit
: Permits traffic and
services based on the parameters set.
If the Permit rule is set to override a Drop rule,
then the Permit rule must be set in both the
directions to allow bidirectional communication
between the
Source
and
Destination
.
Deny
: Denies traffic and
service based on the parameters set.
Re-route
:Sends matching traffic
to the next-hop IP address specified by the
Reroute IP
. In case of
reroute, you need to provide an IP address that the
traffic needs to be re-routed to, in the
Reroute IP
field.
Permit
Figure.
Understanding Priorities
Click to enlarge
Click
Save
.
Creating Static Routes
About this task
You can create a static route using the
Create Static Routes
dialog box. You can open the
Create Static Routes
dialog box
either from the VPC list view or the VPC details view.
On the VPC list view, select the VPC and click
Create Static
Routes
in the Actions drop down menu.
On the VPC details view, click the
Create Static
Routes
option in the
More
drop down
menu.
Figure.
Create Static Routes
Click to enlarge
To create static route, do the following in the
Create Static
Routes
dialog box:
Procedure
Provide the necessary values in the respective fields.
Fields
Description and Values
Destination Prefix
Provide the IP address with prefix of the destination
subnet.
Next Hop Link
Select the next hop link from the drop down list. The next
hop link is the IP address that the traffic must be sent for the
static route you are configuring.
Add Prefix
You can create multiple static routes using this option.
Click this link to add another set of
Destination
Prefix
and
Next Hop Link
to configure another static route.
Click
Save
.
Updating Virtual Private Cloud
About this task
You can update a VPC using the
Update Virtual Private Cloud
(VPC)
dialog box. You can open the
Update Virtual Private
Cloud (VPC)
dialog box either from the VPC list view or the VPC
details view.
On the VPC list view, select the VPC you want to update and click
Update
in the
Actions
drop
down menu.
On the VPC details view, click the
Update
option.
The
Update Virtual Private Cloud (VPC)
dialog box is identical
to the
Create Virtual Private Cloud (VPC)
dialog box.
Figure.
Update VPC
Click to enlarge
For details about the parameters that you can update in the
Update Virtual
Private Cloud (VPC)
dialog box, see Creating Virtual Private Cloud.
Procedure
Update the parameters in the
Update Virtual Private Cloud
(VPC)
dialog box.
Click
Save
.
Updating a Subnet
About this task
You can update a subnet displayed on the
Subnets
page. Go to the
Subnets
page by clicking
Virtual Infrastructure
>
Networking
>
Subnets
and open the
Update Subnet
dialog box.
You can also open the
Update Subnet
dialog box from the VPC
dashboard for a specific VPC. Click the
Edit
option for the
subnet listed on the
Subnets
tab of the VPC dashboard.
The fields in the
Update Subnet
and the
Create
Subnet
dialog boxes are the same.
Note:
You cannot edit or update the
subnet type. For example, if the subnet type is already configured as
VLAN
, you cannot modify it to an
Overlay
type subnet.
To update a subnets, do the following.
Procedure
Select the subnet you want to update. Select
Actions
>
Update Subnet
.
Update the necessary values in the respective fields in the
Update
Subnet
dialog box.
Figure.
Update Subnet
Click to enlarge
The
Update Subnet
dialog box has the same fields as the
Create Subnet
dialog box. For details about the
fields and the values that can be updated in the
Update
Subnet
dialog box, see Creating a Subnet.
Click
Save
to ensure that the updates are saved in the
configuration.
Category Management
A category is a key-value pair that groups similar entities. Associating a policy with a
category ensures that the policy applies to all the entities in the group regardless of how
the group scales with time. For example, you can associate a group of VMs with the Department:
Marketing category, where Department is a category that includes a value Marketing along with
other values such as Engineering and Sales.
Currently, you can associate only VMs with a category. Categories are implemented in the same
way on on-premises Prism Central instances and in Xi Cloud Services. For information about
configuring categories, see the
Prism Central Guide
.
Updating a Policy
About this task
You can update a policy using the
Update Policy
dialog box. You
can open the
Update Policy
dialog box in two ways in the VPC
details view.
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
Note:
You cannot update or delete the default policy.
The
Update Policy
dialog box has the same parameters as the
Create Policy
dialog box.
For details about the parameters that you can update in the
Update
Policy
dialog box, see Creating a Policy.
Procedure
Update the parameters in the
Update Policy
dialog
box.
Click
Save
.
Updating Static Routes
About this task
You can update a static route using the
Update Static Routes
dialog box. You can open the
Update Static Routes
dialog box
either from the VPC list view or the VPC details view.
Note:
You must configure the default route (0.0.0.0/0) to the external subnet as the
next hop for connectivity outside the cluster (north-south connectivity).
On the VPC details view, select the VPC you want to update and click the
Update
option in the top menu.
On the VPC details view, click the
Edit
option provided
in the
Actions
menu for the selected VPC.
The
Update Static Routes
dialog box has the same parameters as
the
Create Static Routes
dialog box.
For details about the parameters that you can update in the
Update Static
Routes
dialog box, see Creating Static Routes.
Procedure
Update the parameters in the
Update Static Routes
dialog
box.
Click
Save
.
Deleting a Virtual Private Cloud
About this task
Prism Central
does not allow you to delete a VPC if the VPC is associated with any subnets and/or
VPNs. After you remove all the subnets or VPN associations from the VPC, delete the
VPC.
You can delete a VPC from the VPC list view or the VPC details view.
Procedure
Do one of the following.
To delete a VPC from the VPC list view, select the VPC you want to
delete and click
Delete
in the
Actions
drop down menu.
To delete a VPC from the VPC details view, click the VPC name to go to
the VPC details view and click the
Delete
option in
the
More
drop down menu.
In the confirmation dialog box, do the following.
Click
Delete
to delete the VPC.
Click
Cancel
to exit without deleting the
VPC.
Deleting Subnets, Policies or Routes
About this task
You can delete VPC entities such as subnets, policies or routes from the VPC details
page.
Note:
You cannot update or delete the default policy.
Do the following.
Procedure
Open the VPC details page and go to the respective tab like
Subnets
,
Policies
or
Routes
.
Click the
Delete
option provided for the selected entity
(subnet, policy or route respectively).
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Connections Management
This section covers the management of network gateways, VPN connections and Subnet
Extensions including operations like create, update and delete network gateways and VPN
connections, and extending subnets.
Network Gateway Management
You can create, update or delete network gateways that host one of VPN or VTEP service for
connections.
Creating a Network Gateway
About this task
VPN or s connect two networks together, and can be used in both VLAN and VPC networks
on AHV. In other words, you can extend the routing domain of a VLAN network or that
of a VPC using a VPN. Accordingly, VPN gateways can be configured using VLANs or
VPCs. You need VPN gateways on clusters to provide a gateway to the traffic between
on-premise clusters or remote sites.
You can create multiple VPN gateways for a VPC. Since a VPC is configured
only on a PC, the VPC is available to all the clusters registered to that PC.
A VPN gateway may be defined as a Local gateway or a Remote gateway based on where
the traffic needs to be routed.
To create a VPN gateway, do the following on the
Networking & Security
>
Connectivity
>
Gateways
page.
Procedure
Select
Local
or
Remote
in the
Create Gateway
drop-down menu.
If you select
Local
in the drop-down menu, the
Create Local Gateway
dialog box opens. If you select
Remote
in the drop-down menu, the
Create
Remote Gateway
dialog box opens.
Provide the necessary values in the respective fields as described in the
table.
For example, if you select
Local
in the drop-down menu,
then the
Create Local Gateway
dialog box opens. Provide the
necessary values in the respective fields as described in the table.
Figure.
Sample Create Local Gateway - VM Deployment
Click to enlarge
Figure.
Sample Create Local Gateway - VPN Service Configuration
Click to enlarge
Figure.
Sample Create Local Gateway - VTEP Service Configuration
Click to enlarge
Figure.
Sample Create Remote Gateway - VPN Gateway Service
Click to enlarge
Figure.
Sample Create Remote Gateway - VTEP Gateway Service
Click to enlarge
Table 1.
Local Gateway Fields
Fields
Description
Values
VM
Deployment
Name
Enter a name for the network gateway.
(Name)
Gateway Attachments
(for Local gateway type only) Select the gateway attachment
as
VPC
or
VLAN
.
The VPN VM is deployed on a VPC VM or a cluster that has the
selected VLAN respectively.
If you select
VPC
, then
VPC Attachment
is displayed.
VPC
is the default value for
the
Gateway Attachments
field. The
Gateway VM is deployed on the cluster and associated
with the VPC selected in the
VPC
Attachment
section.
VPC
attachment
mode provides the options of
eBGP and Static routing methods for external routing
(configured in the
External Routing
Configuration
section).
If you select
VLAN
, then the
VLAN Attachment
is displayed. The
Gateway VM is deployed on the cluster that has the VLAN
and the subnet specified in the
VLAN
Attachment
section.
VLAN
attachment
mode provides only the eBGP
routing method for external routing.
(VLAN or VPC)
Gateway VM Deployment - VPC
Attachment
Cluster
Select the cluster on which you want to deploy the Gateway VM
on.
(Name of the cluster)
VPC (If Gateway Attachment type is VPC)
Select the VPC configured on the selected cluster that you
want to use for the Gateway VM deployment.
(Name of the VPC selected)
Floating IP (Optional)
Select a floating IP for the network gateway configuration.
If you do not select a floating IP address then Prism
Central allocates a floating IP automatically. This
allocated floating IP is deleted when you delete the
gateway.
To request floating IPs and allocate them to subnets, see
Requesting Floating IPs
(IP address)
Gateway VM Deployment - VLAN
Attachment
Cluster
Select the Cluster, from the drop down list, on which you
want to deploy the Gateway VM on.
Note:
Only clusters with VLANs
are available in the list.
(Name of the cluster)
Subnet
Select the subnet you want to attach the Gateway VM to, from
the drop down list.
Note:
The list includes all the subnets you
created on the selected cluster.
After you select the
subnet, the details of the subnet are displayed in a box below
the
Subnet
field. The details include:
VLAN ID, IPAM type being Managed or Unmanaged, and Network
Address with Prefix.
(Name of the VLAN subnet)
Static IP Address for VPN Gateway VM
Enter the static IP address that the Gateway VM needs to
use.
(IP Address with Prefix)
Default Gateway IP
Enter the default gateway IP of the subnet for the Gateway
VM.
(IP Address)
Service
Configuration
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service Configuration -
External Routing Configuration (This section is available for
VLAN and VPC attachment types)
Routing Protocol
For
VPC
gateway attachments:
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
For
VLAN
gateway attachments:
External routing protocol is pre-set to
eBGP
. You cannot change
the routing protocol.
(Static or eBGP)
Redistribute Connected Routes (Applicable only if VLAN type
gateway attachment is selected)
(
VLAN
only) Select this checkbox to
enable the redistribution of connected routes into the
eBGP.
(Check mark or blank)
ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
eBGP Password
(For
eBGP
in
Local
gateway type only) Enter the
eBGP password for the eBGP route.
(Password: The password must be between 1 and 80 characters.
Password length: Minimum 1 and maximum 80
characters.
)
VPN Service Configuration -
Internal Routing Configuration (This section is available for
VLAN attachment type only.)
Routing Protocol (Between On-prem Gateway and On-prem
Router)
Select the
Routing Protocol
to be used
between on-premises Nutanix gateway and on-premises
router.
You can select:
Static
: Select this protocol
to provide a static route configuration for the VLAN
gateway.
OSPF
: Select this protocol to
provide an OSPF routing configuration for the VLAN
gateway.
iBGP
: Select this protocol to
provide a iBGP route configuration for the VLAN
gateway.
Note:
For iBGP, the ASN must be the same
between the Gateway appliance and the peer iBGP,
when iBGP is selected as the internal routing
protocol.
(Static or OSPF or iBGP)
+Add Prefix (Applicable to Static routing)
(For
Static
routing selected in
Routing Protocol
) Click this to
enter a
Local Prefix
and click the
check mark under
Actions
to add the
prefix.
If you click the X mark under
Actions
,
the local prefix you entered is not added.
The prefixes you add are advertised to all the connected
peers via eBGP.
The prefix must be a valid IP address with the host bits not
set.
You can add multiple local prefix IP addresses.
(prefix like /24)
Area ID (Applicable to OSPF protocol)
(OSPF only) Enter the OSPF area id in the IPv4 address
format.
Password Type
(OSPF only) Select the password type you want to set for the
OSPF route. The options are:
MD5
: Select this option to
encrypt the packets with MD5 hash that can be
decrypted with the MD5 password at the
destination.
Plain Text
: Select this option
to set a clear-text password.
None
: Select this if you do to
set an open route without password protection
Password
(OSPF only) Enter a password for the MD5 or Plain Text
password type you select in the
Password
Type
field.
For
MD5
: The password must be
1-16 characters long.
Characters allowed for OSPF passwords (MD5)
a-z
A-Z
0-9
For
Plain Text
: The password
must be 1-8 characters long.
Characters allowed for OSPF passwords (Plain text):
a-z.
Peer IP (for iBGP)
Enter the IP Address of the On-prem router used to exchange
routes with the network gateway.
(IP Address)
Password
Enter a password with 1-80 characters.
(Password)
VTEP Service Configurations
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Table 2.
Remote Gateway Fields
Fields
Description
Values
Name
Enter a name for the network gateway.
(Name)
Gateway Service
Select the gateway service you want to use for the
gateway.
(VPN or VTEP)
VPN Service
Configurations
Public IP Address
Enter the public IP address of the remote endpoint. If a
Floating IP is not selected, a new Floating IP is automatically
allocated for the Gateway. These allocated IP addresses are
deleted when the network gateway is deleted.
(IP Address)
Vendor
Select the vendor of the third party gateway
appliance.
(Name of Vendor)
External Routing
Protocol
Select
Static
for static routing.
Note:
You need to create static routes (see Creating Static Routes)
for external routing and attach the route to the VPC
selected in this configuration.
Select
eBGP
for eBGP based
external routing.
(Static or eBGP)
eBGP ASN (Only available if eBGP routing protocol is
selected)
(For
eBGP
only) Enter the ASN for your
on-prem gateway. If you do not have a BGP environment in
your on-prem site, you can choose any number. For example,
you can choose a number in the 1-65000 range.
Note:
Make sure that this ASN does not conflict with any of the
other on-premises BGP ASNs.
ASN must be distinct in case of eBGP.
(Number)
VTEP Service
Configurations
VTEP IP Address
Enter VTEP IP Addresses of the remote endpoints that you want
to create the gateway for. You can add IP addresses of multiple
endpoints in one remote gateway.
(Comma separated list of IP Addresses)
VxLAN (UDP) Port
The default value provided is 4789. Do not change
this.
(Number. Default value is 4789)
Click
Save
.
What to do next
The Gateway you create is displayed in the
Gateways
page.
Updating a Network Gateway
About this task
You can update a network gateway using the
Update Gateway
dialog
box.
You can open the
Update Gateway
dialog box. The parameters in
the
Update Gateway
dialog box are the same as those in the
Create Local Gateway
or
Create Remote
Gateway
dialog box.
Procedure
Select the gateway you want to update on
Gateways
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update Gateway
dialog
box.
You cannot modify some information. Such fields are greyed and in-actionable.
If you need to modify such information, consider creating a new gateway with the
updated parameters and deleting the current gateway.
Click
Save
.
Deleting a Network Gateway
About this task
If you want to delete a network gateway, you must first delete all the VPN
connections associated with the gateway and only then you can delete the network
gateway.
To delete a network gateway, do the following on the
Gateway
page.
Procedure
Do one of the following.
Select the check box next to the name of the gateway and, in the
Actions
drop-down list, click
Delete
.
Click the name of the gateway and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
Virtual Network Connections
Virtual Private Network
You can use the Nutanix VPN solution to set up VPN between your on-prem clusters, which
exist in distinct routing domains that are not directly connected. These distinct routing
domains could either be VPCs within the same cluster or remote clusters or sites.
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. Local VPN gateway can be
instantiated in a VPC context or a legacy VLAN context. Launching the VPN gateway within a
VPC allows stretching of the VPC. For example, in the figure, the Blue VPC is stretched
between two sites with a VPN.
Figure.
VPN Working
Click to enlarge
VPN connections are useful in connecting two points. You can connect two VPCs in the same
cluster using a VPN or VPCs in different clusters in the same site. However, VPN connection
can connect only one endpoint to another endpoint. Flow networking based VPN service allows
you to only connect two endpoints that use Nutanix VPN based gateway service.
Virtual Tunnel End Points Based Network Extensions
To connect one endpoint to multiple endpoints or third party (non Nutanix) networks, use
Virtual Tunnel End Point (VTEP) service based subnet extensions. For more information about
VTEP, see .
VPN Workflow
If you need to connect one Nutanix deployment in one site to another deployment in a
different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists
of a local VPN gateway, remote VPN gateway and VPN connection. You can configure multiple
VPN endpoints for a site.
Each endpoint must have configurations for a local VPN gateway, remote VPN gateway (pointer
information for the peer local VPN in the remote site endpoint) and a VPN connection
(connecting the two endpoints). Then, based on the VPN connection configuration as initiator
or acceptor, one endpoint initiates a tunnel and the endpoint at the other end accepts the
tunnel connection and, thus, establishes the VPN tunnel.
Gateways: Every VPN endpoint for each site consists of two VPN gateway configurations -
Local and Remote.
Local gateway is a VM that runs the VPN protocols (IKEv2, IPSec) and routing (BGP and
OSPF). Remote gateway is a pointer - database entry - that provides information about
the peer remote VPN endpoint. One of the key information contained in the remote gateway
is the source IP of the remote VPN endpoint. For security reasons, the local VPN gateway
will accept IKEv2 packets originating only from this Source IP.
VPN gateways are of the following types:
On premises Nutanix VPN Gateway: Represents the VPN gateway appliance at your
on-premises local or remote site if you are using the Nutanix VPN solution.
On premises Third Party Gateway: Represents the VPN gateway appliance at your
on-prem site if you are using your own VPN solution (provided by a third-party
vendor).
To configure third party VPN Gateways, see the relevant third party
documentation.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and
remote gateway. When you create a VPN connection, you need to select two gateways
between which you want to create the VPN connection.
VPN appliances perform the following:
Implementation of IKEv2 and IPSec protocols.
Routing: Between remote sites, Flow Networking advertises prefixes using eBGP.
Optionally it uses Static routing. Within a site, Flow Networking uses iBGP or OSPF to
share prefixes between the Nutanix VPN appliance and the edge router.
Prerequisites for VPN Configurations
General Requirements
Ensure that you have enabled Flow Networking with microservices Infrastructure.
Ensure that you have floating IP addresses when you create VPN gateways.
Flow Networking automatically allocates a floating IP to a VPN gateway if you do not
provide one during the VPN gateway creation. To provide floating IP during the VPN
gateway creation, you can request floating IPs. See Requesting Floating IPs.
Ensure that you have one of the following, depending on whether you are using iBGP or
OSPF:
Peer IP (for iBGP): The IP address of the router to exchange routes with the VPN
gateway VM.
Area ID (for OSPF): The OSPF area ID for the VPN gateway in the IP address format.
Ensure that you have the following details for the deployment of the VPN gateway
VM:
Public IP address of the VPN Gateway Device: A public WAN IP address that you want
the on-prem gateway to use to communicate with the Xi VPN gateway appliance.
Static IP Address: A static IP address that you want to allocate to the VPN gateway
VM. Use a floating IP address requested as the static IP address.
IP Prefix Length: The subnet mask in CIDR format of the subnet on which you want to
install the VPN gateway VM. You can use an overlay subnet used for a VPC and
assigned to the VM that you are using for the VPN gateway.
Default Gateway IP: The gateway IP address for the on-premise VPN gateway
appliance.
Gateway ASN: ASN must not be the same as any of your on-prem BGP ASNs. If you
already have a BGP environment in your on-prem site, the customer gateway is the ASN
for your organization. If you do not have a BGP environment in your on-prem site,
you can choose any number. For example, you can choose a number in the 65000
range.
Ports and Protocols
Nutanix deploys a number of ports and protocols in its software. ports that must be open in
the firewalls to enable Flow Networking to function. To see the ports and protocols used
Flow Networking, see Port Reference.
Endpoints and Terminations
The following endpoints and terminations occur in the course of Flow networking based
connections. For information about creating, updating or deleting VPN connections, see Connections Management.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
VPN Endpoint Behind a Network Address Translation or Firewall Device
In this scenario, the IPSec tunnel terminates behind a network address translation
(NAT) or firewall device. For NAT to work, open UDP ports 500 and 4500 in both
directions.
Figure.
VPN Endpoint Behind NAT or Firewall
Click to enlarge
Things to do in NAT
Things to do in on-prem VPN GW
Open UDP ports 500 and 4500 on both directions
Enable the business application policies to
Allow
the
commonly-used business application ports.
IPSec Terminates on the Firewall Device
In this scenario, you do not need to open the ports for NAT (500 and 4500).
However, enable the on-prem VPN gateway to allow the traffic from the PC subnet to
the advertised load balancer route where the Source port is any and the Destination
port may be in the range of 1024-1034.
The PC subnet refers to the subnet where your Prism Central is running.
Figure.
Tunnel Terminates on NAT or Firewall
Click to enlarge
Creating a VPN Connection
About this task
Create a VPN connection to establish a VPN IPSec tunnel between VPN gateways in your
on-prem site. Select the gateways between which you want to create the VPN
connection.
To create a VPN connection, do the following on the
Networking
>
VPN Connections
page.
Procedure
Click the
Create VPN Connection
button on the
VPN Connections
page.
In the
Create VPN Connection
dialog box, provide the
values in the respective fields.
Fields
Description and Values
Name
Enter a name for the connection.
VPN Connection
IPSec Secret
Enter a secret password for the IPSec connection. To see the
password, click
Show
. To hide the
password, click
Hide
.
Local Gateway
Select the connection parameters on the local gateway as
Initiator or Acceptor of VPN Tunnel connections.
VPN Gateway
Select the appropriate VPN Gateway as the local gateway for
the VPN connection
VTI Prefix - Local Gateway
Enter a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel
Interface
IP address with prefix for the local
gateway. The subnet for this IP address must be a /30 subnet
with two usable IP addresses. One of the IP addresses is
used for Local Gateway. Use the other IP address for the
Remote Gateway.
Connection Handshake
This defines the type of handshake that the connection must
use. There are two types of connection handshakes:
Initiator
: The local VPN gateway
acts as the initiator of the connection and thus
initializes the VPN tunnel.
Acceptor
: The local VPN gateway
accepts or rejects incoming connection requests from
other gateways.
Note:
In a VPN connection do not configure both the
gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If
you configure the local gateway as Initiator then configure the remote gateway as Acceptor
in one endpoint and vice-versa in the (other) remote endpoint.
Remote Gateway
For a specific VPN connection, set the remote gateway as
Initiator or Acceptor when you configure the VPN connection on
the Remote Gateway.
VPN Gateway
Select the appropriate VPN Gateway as the remote gateway for
the VPN connection.
VTI Prefix - Remote Gateway
The VPN Tunnel Interface IP address with prefix for the local
gateway. Provide a IPv4 Address with /<prefix>. Example:
10.25.25.2/30.
This is the
VPN Tunnel Interface
IP address with prefix for the local gateway. The subnet for
this IP address must be a /30 subnet with two usable IP
addresses. One of the IP addresses is used for Local
Gateway. Use the other IP address for the Remote
Gateway.
Advanced Settings
Set the traffic route priority for the VPN connection. The
route priority uses Dynamic route priority because the priority
is dependent on the routing protocol configured in the VPN
gateway.
Route Priority - Dynamic Route Priority
Set the route priority as an integer number. The greater the
number, higher is the priority.
Click
Save
.
What to do next
The VPN connection you create is displayed in the
VPN
Connections
page.
Updating VPN Connection
About this task
You can update a VPN Connection using the
Update VPN Connection
dialog box.
You can open the
Update VPN Connection
dialog box. The
parameters in the
Update VPN Connection
dialog box are the same
as those in the
Create VPN Connection
dialog box.
Procedure
Select the VPN Connection you want to update on the
VPN
Connection
.
Click
Update
in the
Actions
menu.
Update the required details in the
Update VPN Connection
dialog box.
Click
Save
.
Deleting a VPN Connection
About this task
To delete a VPN connection, do the following on the
VPN
Connection
page.
Procedure
Do one of the following.
Select the check box next to the name of the VPN connection and, in the
Actions
drop-down list, click
Delete
.
Click the name of the VPN connection and, in the details page, click
Delete
.
In the confirmation dialog box, do the following.
Click
Delete
to delete the entity.
Click
Cancel
to exit without deleting the
entity.
VPN Connection within Same Prism Central
You can connect two VPCs within the same Prism Central availability zone using a VPN
connection.
About this task
Assume that you have created two VPCs named
vpc-a
and
vpc-b
with overlay subnets named
subnet-a
and
subnet-b
.
To connect the two VPCs within the same Prism Central using a VPN connection, do the
following.
Procedure
Do the following for local gateways:
Create a local VPN gateway with dynamically assigned address for
vpc-a
, for example, named
local-vpn-a
. Note or write down the assigned
IP address.
Create a local VPN gateway with dynamically assigned address for
vpc-b
, for example, named
local-vpn-b
. Note or write down the assigned
IP address.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Do the following for remote gateways:
Create a remote VPN gateway with the IP address noted in 1.a for
vpc-a
, for example, named
remote-vpn-a
.
create a local VPN gateway with the IP address noted in 1.b for
vpc-b
, for example, named
remote-vpn-b
.
See Creating a Network Gateway for more information about
creating a VPN gateway.
Create a VPN connection between
vpc-a
and
vpc-b
named, for example,
vpn-conn-a-to-b
.
Ensure that the VTI IP addresses for the local and remote gateways is unique
with /30 prefix.
Note:
The
VPN Tunnel Interface
IP address with
prefix for the local gateway. The subnet for this IP address must be a /30
subnet with two usable IP addresses. One of the IP addresses is used for
Local Gateway. Use the other IP address for the Remote
Gateway.
Ensure that you select
local-vpn-a
as the local gateway with
Connection Handshake
set as
Acceptor
.
Ensure that you select
remote-vpn-b
as the remote gateway.
Create a VPN connection between
vpc-b
and
vpc-a
named, for example,
vpn-conn-b-to-a
.
Ensure that the VTI IP addresses with /30 prefix for local and remote gateways
are the reverse (vice versa) of what you configured for the VPN connection in
previous step. For example, if in previous step you configured the VTI IP
addresses as 10.20.20.5/30 for local and 10.20.20.6/30 for remote then for VPN
connection in this step, configure 10.20.20.6/30 for local gateway and
10.20.20.5/30 for remote gateway respectively. These IP addresses do not need to
be reachable anywhere else in the network. However, ensure that these IP
addresses do not overlap with any other IP addresses assigned in the
network.
Ensure that you select
local-vpn-b
as the
local gateway with
Connection Handshake
set as
Initiator
.
Ensure that you select
remote-vpn-a
as the remote gateway.
Layer 2 Virtual Network Extension
You can extend a subnet between
on-prem
local and remote clusters or sites (Availability Zones or AZs) to support seamless application
migration between these clusters or sites.
Note:
One or more on-prem cluster or sites managed by one Prism Central instance is defined as
an Availability Zone or AZ. In this section, Availability Zone or AZ refers to and must be
understood as one or more on-prem clusters or sites managed by one Prism Central. Local AZ
refers to local on-prem clusters or sites managed by a Prism Central instance and
remote
AZ
refers
to another on-prem cluster or site managed by another Prism Central
instance.
With Layer 2 subnet extension, you can migrate a set of applications to the remote AZ while
retaining their network bindings such as IP address, MAC address, and default gateway. Since
the subnet extension mechanism allows VMs to communicate over the same broadcast domain, it
eliminates the need to re-architect the network topology, which could otherwise result in
downtime.
Layer 2 extension assumes that there are underlying existing layer 3 connectivity already
available between the Availability Zones. You can extend a subnet from a remote AZ to the
primary (Local) AZ (and other remote AZs in case of VTEP-based subnet extensions)
You can extend a Layer 2 subnet across two Nutanix AZs over either VPN or Virtual tunnel
End Point (VTEP). SeeLayer 2 Virtual Subnet Extension Over VPN.
You can extend a Layer 2 subnet between a Nutanix AZ and one or more non-Nutanix
datacenters only over VTEP. See Layer 2 Virtual Subnet Extension Over VTEP.
You can extend subnets for the following configurations.
IPAM Type.
Managed and unmanaged networks.
Subnet Type.
On-prem VLAN subnets and VPC subnets.
Traffic Type.
IPv4 unicast traffic and ARP.
On-prem Hypervisor.
AHV and ESXi
Note:
If your cluster is ESXi, use vCenter Server
to manually configure the port group attached to the subnet you want to extend. Set the
security settings,
Promiscuous mode
and
Forged
transmits
to
Accept
on the vSwitch as shown in the
following image.
Figure.
ESXi Host Port Group Configuration
Click to enlarge
Prerequisites for Setting Up Subnet Extension
Ensure the following before you configure Layer 2 subnet extension between your on-prem
AZs.
Ensure that the Prism Central versions support Layer 2 virtual subnet extension as
specified in the Release Notes. See
AOS Family Release Notes
and
Release Notes | Prism Central
as applicable.
See the
Prism Central
Upgrade and Installation Guidelines and Requirements
section of the
Acropolis Upgrade Guide
for instructions about how to upgrade a Prism
Central instance through the Prism Central web console.
Ensure that you pair the Prism Central at the local AZ with the Prism Central at the
remote AZ to use
Create Subnet Extension
wizard to extend a subnet
across the AZs and facilitate bidirectional communication between these clusters or sites.
Using paired availability zones it is possible to configure both VXLAN over VPN and VTEP
based subnet extension. You can also extend subnets using the manual gateway and
connection workflows instead of pairing the AZs.
See the Pairing Availability Zones for instructions about how to pair the
local and remote AZs.
Ensure that you set up a default static route with
0.0.0.0/0
prefix and
the External Network next hop for the VPC you use for any subnet extension. This allows
NTP and DNS access for the Network Gateway appliance.
Best Practices for Subnet Extension
Nutanix recommends the following configurations to allow IP address retention for VMs on
extended subnets.
When using Nutanix IPAM ensure the address ranges in the paired subnets are unique to
avoid conflict between VM IP addresses across extended subnets.
If the source and target sites use third-party IPAM, ensure that there are no
conflicting IP address assignments across the two sites.
Note:
If the source and target
sites use Nutanix IPAM, the Prism Central web console displays a message that indicates
an IP address conflict if one exists.
If connectivity between sites already provides encryption, consider using VTEP only
subnet extension to reduce encryption overhead.
Use the
Subnet Extension to a Third Party Data-Center
workflow in
the following scenarios
To extend a subnet to more than one other AZ. This is also known as point to
multi-point.
To extend subnets between clusters managed by the same Prism Central.
Subnet Extension Workflow
You can manage Layer 2 subnet extension on the
Subnet Extensions
tab
of the
Connectivity
page. Open the
Subnet
Extensions
by clicking the hamburger icon in the top-left corner of the
Dashboard
and then clicking
Connectivity
.
You can create point-to-point Layer 2 subnet extensions between two AZs over VPN or
VTEP by opening the
Create Subnet Extension Across Availability
Zones
dialog box. See Extending a Subnet Over VPN for
VPN-based extensions. See Extending a Subnet Across Availability Zones Over VTEP for
VTEP-based extensions.
You can create point-to-point or point-to-multipoint Layer 2 subnet extensions to third
party datacenters over VTEP by opening the
Create Subnet Extension To A Third
Party Data-Center
dialog box. See Extending a Subnet to Third Party Datacenters Over VTEP.
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
dialog box. The
Update
Subnet Extension Across Availability Zones
has the same parameters and
fields as the
Create Subnet Extension Across Availability Zones
dialog box. You can open the
Update Subnet Extension Across Availability
Zones
dialog box by:
Selecting the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended across AZs in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
You can update a subnet extension that extends to multiple AZs or third party datacenters
using the
Update Subnet Extension To A Third Party Data-Center
dialog
box.
Update Subnet Extension To A Third Party Data-Center
dialog box
has the same parameters and fields as the
Create Subnet Extension To A Third Party
Data-Center
dialog box. You can open the
Update Subnet Extension To A
Third Party Data-Center
dialog box by:
Selecting the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button.
Clicking the subnet extended to third datacenters in the
Subnet
Extensions
and clicking the
Update
button on the
Summary
tab.
See Updating an Extended Subnet.
Layer 2 Virtual Subnet Extension Over VPN
Subnet extension using VPN allows seamless, secure migration to a new datacenter or for
disaster recovery. VPN based Layer 2 extension provides secure point to point connection to
migrate workloads between Availability Zones. Consider VTEP-only Subnet Extension without VPN
when encryption is not required.
Subnet extension using VPN is useful:
When the two Availability Zones (where the subnets to be extended belong) do not have any
underlying secure connectivity. For example, when connecting over the Internet, VPN (IPSec)
provides the necessary connectivity and encryption (security).
Sometimes when you need to move (lift-and-shift) workloads from a VLAN subnet to a VPC
subnet retaining the same VM IP addresses . You need connectivity from other subnets to
workloads that have already migrated to VPC. In such cases, VPN provides the Layer 3
connectivity and encryption between the VPC segment of extended subnet to other VLAN
subnets.
Prerequisites for Setting Up Subnet Extension Over VPN
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VPN gateway services and a VPN connection between local AZ and the remote AZ.
The subnet extension feature supports only the Nutanix VPN solution (not a third-party
VPN solution) at the both the local and remote AZs. See the Virtual Network Connections for instructions about how to upgrade the VPN gateway
VM at the local and remote clusters or sites.
Note:
Ensure that the VPN gateway version
is 5.0 or higher. See the Updating a Network Gateway section
of the
Nutanix Flow Networking Guide
for instructions about how to
upgrade the network gateway at the local and remote sites.
Configure subnets with the same IP CIDR prefix at the source and target sites. For
example, if the IP prefix at one site is 30.0.0.0/24, the IP prefix at the other site must
also be 30.0.0.0/24. The network and mask must match at both AZs.
Configure distinct DHCP pools for the source and target sites with no IP address
overlap. Separate DHCP pools ensure no IP address conflicts occur for dynamically assigned
IP addresses between the two AZs.
Procure two free IP addresses, one from each subnet, for the Network Gateway in the
subnets to be extended. These IP addresses are configured as local IP address and remote
IP address for the subnet extension in the
Subnet Extension
wizard.
These two free IP addresses are the externally accessible IP addresses for the local
gateway, and the remote gateway. Those two usable IP addresses are already contained
inside the VPN connection and must not conflict with the following:
DHCP pools on any of the Availability Zones.
Gateway IP address on any of the Availability Zones.
IP addresses allocated to existing user VMs on any of the Availability Zones.
IP addresses used by Network Gateway Management NIC subnet (IP pool
100.64.1.0/24)
Limitation
To use subnet extension over a VPN, both sites must use the VPN service of the Nutanix
Network Gateway. Consider VTEP-only subnet extension to connect to non-Nutanix third party
sites.
Pairing AZs (Nutanix Disaster Recovery)
To replicate entities (protection policies, recovery plans, and recovery points) to
different on-prem AZs (AZs) bidirectionally, pair the AZs with each
other. To replicate entities to different Nutanix clusters at the same AZ bidirectionally,
you need not pair the AZs because the primary and the recovery Nutanix clusters are
registered to the same AZ (Prism Central). Without pairing the AZs, you cannot perform
DR to a different AZ.
About this task
To pair an on-prem AZ with another on-prem AZ, perform the following procedure at
both the AZs.
Procedure
Log on to the Prism Central web console.
Click the hamburger icon at the top-left corner of the window. Go to
Administration
>
AZs
in the left pane.
Figure.
Pairing AZ
Click to enlarge
Click
Connect to AZ
.
Specify the following information in the
Connect to Availability
Zone
window.
Figure.
Connect to AZ
Click to enlarge
AZ Type
: Select
Physical Location
from the drop-down
list.
A physical location is an on-prem AZ (AZ). To pair
the on-prem AZ with Xi Cloud Services, select
XI
from the drop-down list, and enter the
credentials of your Xi Cloud Services account in step c and set
d.
IP Address for Remote PC
: Enter the IP address
of the recovery AZ Prism Central.
Username
: Enter the username of your recovery
AZ Prism Central.
Password
: Enter the password of your recovery
AZ Prism Central.
Click
Connect
.
Extending a Subnet Over VPN
The subnet extension allows VMs to communicate over the same broadcast domain to a
remote site or Availability Zone (AZ).
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VPN for information on prerequisites
and best practices for extending a subnet.
About this task
Perform the following procedure to extend a subnet from the on-prem site.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
>
Networking & Security
>
Connectivity
>
Subnet Extension
.
On the
Subnet Extension
page, select
Create Subnet Extension
>
Across Availability Zones
.
In the
Create Subnet Extension Across Availability Zones
dialog box, enter the necessary details as described in the table.
Figure.
Create Subnet Extension Across Availability Zones
Click to enlarge
Fields
Description
Values
Extend Subnet over a
Select the gateway service you want to use for the subnet
extension.
(VPN or VTEP)
Note:
Configure the following fields for the
Local
and the
Remote
sides of the dialog
box.
Availability Zone
(For Local) Local AZ is pre-selected default.
(For Remote)
Select the appropriate AZ from the drop-down list of
AZs.
(Local: Local AZ)
(Remote: Dropdown list of
AZs.)
Subnet Type
Select the type of subnet that you want to extend.
(VLAN or Overlay)
Cluster
Displayed if your selected VLAN subnet. Select the cluster
from the dropdown list of clusters.
(Name of cluster selected from dropdown list)
VPC
Displayed if your selected Overlay subnet. Select the
appropriate VPC from the dropdown list of VPCs.
(Name of VPC selected from dropdown list)
Subnet
Select the subnet that needs to be extended.
(Name of subnet selected from dropdown list)
(Network Information frame)
Displays the details of the VLAN or Overlay network that you
selected in the preceding fields.
(Network information)
Gateway IP Address/Prefix
Displays the gateway IP address for the subnet. This field is
already populated based on the subnet selected.
(IP Address)
(Local or Remote) IP Address
Enter a unique and available IP address that are externally
accessible IP addresses in
Local IP
Address
and
Remote IP
Address
.
(IP Address)
VPN Connection
Select the appropriate VPN Connection from the dropdown list
that Flow networking must use for the subnet extension. See
Creating a VPN Connection for
instructions to create VPN connection.
(Name of VPN connection selected from the dropdown
list)
Click
Save
.
A successful subnet extension is listed on the
Subnet
Extension
dashboard. See .
Layer 2 Virtual Subnet Extension Over VTEP
Subnet extension using Virtual tunnel End Point (VTEP) allows seamless migration to new
datacenters or for disaster recovery. VTEP based Layer 2 extension provides
point-to-multipoint connections to migrate workloads from one Availability Zone to multiple
Availability Zones
without
encryption.
If you need security and encryption, consider using Subnet Extension over VPN.
Subnet extension using VTEP is useful:
When both subnets that need to be stretched are Nutanix subnets (managed or unmanaged).
VTEP provides an optimized workflow to stretch the two subnets.
When both subnets are connected over an existing private and secure link that does not
need additional encryption.
When one Nutanix subnet needs to be stretched across one or more non-Nutanix
networks,
sites, or datacenters.
Subnet
Extension with third-party VTEPs provides point-to-multipoint connectivity
to third party datacenters assuming that there is underlying
layer 3
connectivity between these VTEPs.
VTEP-based Layer 2 Subnet Extension provides the following advantages:
Layer 2 subnet extension from one AZ to multiple AZs.
Layer 2 subnet extension between Nutanix AZs and non-Nutanix third party VTEP-based
AZs.
The Remote VTEP Gateway is a set of endpoint IP addresses. You can add endpoint IP
addresses to an existing operational Remote VTEP Gateway without stopping the subnet
extension services. This on-the-fly addition enables you to extend the subnets to more AZs
than originally
planned, or
perform maintenance, without disrupting the running services or
configuring new remote VTEP gateways.
Prerequisite for Setting Up Subnet Extension Over VTEP
See Layer 2 Virtual Network Extension for general
prerequisites to extend subnets.
Set up VTEP local and remote gateway services on local and remote AZs. In case of
point-to-multipoint extension, ensure that you create local and remote VTEP gateways on
all the remote AZs that the subnet needs to be extended to.
For each
extended subnet within the same Network Gateway appliance
ensure
that you have unique VxLAN Network Identifiers (VNIs) that you can use for the VTEP subnet
extensions. VNI may be any number between 0 and 16777215.
Extending a Subnet Across Availability Zones Over VTEP
The subnet extension over VTEP allows VMs to communicate two Availability Zones (AZ)
without a VPN connection.
Before you begin
See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VTEP for information on prerequisites and
best practices for extending a subnet.
About this task
To extend a subnet over VTEP across two availability zones (AZs), do the
following.
Procedure
Open the
Create Subnet Extension Across Availability Zones
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
Across Availability Zones
>
.
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
Across Availability Zones
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
Across Availability Zones
.
Figure.
Example of Create VTEP Extension Across AZs with VLAN Subnet
Click to enlarge
For
Extend Subnet over a
, select
VTEP
.
Enter or select the necessary values for the parameters in the
Local
and
Remote
(AZ)
sections as described in the table.
Parameters
Description and Value
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address.
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a
/24
subnet then provide the
gateway
IP address as
10.20.20.1/24
.
Note:
For
an
unmanaged network, enter the gateway IP
address of the created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the Network
Gateway appliance.
Remote IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
for the remote
Network Gateway appliance.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for information
about creating VTEP gateways.
Remote VTEP Gateway
Select the VTEP gateway you created on the remote AZ. See
Creating a Network Gateway for information
about creating VTEP gateways.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the local or
remote VTEP Gateways.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation requires
50. However, you can enter any valid MTU value for the network,
taking this overhead into account. For example, if the physical
network MTU and vs0 MTU are 1600 bytes, the Network Gateway MTU
can be set to 1492 to account for 108 bytes of overhead. Ensure
that the MTU value does not exceed the MTU of the AHV Host
interface and all the network interfaces between the local and
remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Extending a Subnet to Third Party Datacenters Over VTEP
The subnet extension over VTEP allows VMs to communicate with multiple remote sites
or Availability Zones (AZ) that may be third party (non-Nutanix) networks, or datacenters.
It also provides the flexibility of adding more remote AZs to the same VTEP-based extended
Layer 2 subnet. Examples of compatible VTEP gateways are switches from Cisco, Juniper,
Arista, and others that support plain VXLAN VTEP termination.
About this task
To extend a subnet over VTEP across multiple availability zones (AZs) or third party
datacenters, do the following.
Procedure
Open the
Create Subnet Extension To A Third Party
Data-Center
in one of the following ways:
On the
Subnet Extensions
tab, click
>
Create Subnet Extension
>
To A Third Party Data-Center
In the
Subnets
dashboard, select the subnet you want
to extend and click
Actions
>
Extend
>
To A Third Party Data-Center
In the
Subnets
dashboard, click the subnet you want
to extend. On the subnet details page, click
Extend
>
To A Third Party Data-Center
.
Figure.
Example of Create VTEP Extension To A Third Party Data-Center with
VLAN Subnet
Click to enlarge
Enter or select the necessary values for the parameters in the
Local
,
Remote
(AZ), and
Connection Properties
sections as described in the
table.
Parameters
Description and Value
Local
Availability Zone
Displays the name of the paired availability zone at the
local AZ.
Subnet Type
Select the type of the subnet - VLAN or Overlay that you are
extending.
Cluster
Select the name of the cluster in the local AZ that the
subnet is configured for.
Subnet
Select the name of the subnet at the local AZ for network.
The VLAN ID and the IPAM - managed or unmanaged are displayed in
the box below the
Subnet
field.
Gateway IP Address
Enter the gateway IP address of the subnet you want to
extend. Ensure that you provide the IP address in
<IP-address/network-prefix> format. for example the gateway
IP is 10.20.20.1 in a .24 subnet then provide the gatewway IP
address as
10.20.20.1/24
.
Note:
For
unmanaged network, enter the gateway IP address of the
created subnet.
Local IP Address
Enter a unique and available (unused) IP address from the
subnet provided in
Subnet
.
Local VTEP Gateway
Select the local VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a local VTEP gateway.
Remote
Remote VTEP Gateway
Select the remote VTEP gateway you created on the local AZ.
See Creating a Network Gateway for more
information about creating a remote VTEP gateway.
Connection
Properties
VxLAN Network Identifier (VNI)
Enter a unique number from the range 0-16777215 as VNI.
Ensure that this number is not reused anywhere in the networks
that the Prism Central and Cluster are a part of.
MTU
The default MTU is 1392 to account for 108 bytes of overhead
and the standard physical MTU of 1500 bytes. VPC Geneve
encapsulation requires 58 bytes and VXLAN encapsulation
requires 50. However, you can enter any valid MTU value for
the network, taking this overhead into account. For example,
if the physical network MTU and vs0 MTU are 1600 bytes, the
Network Gateway MTU can be set to 1492 to account for 108
bytes of overhead. Ensure that the MTU value does not exceed
the MTU of the AHV Host interface and all the network
interfaces between the local and remote AZs.
Click
Save
.
After the subnet is extended, the extension appears in the
Subnet Extensions
list view.
Updating an Extended Subnet
The
Update Subnet Extension Across Availability Zones
has the same
parameters and fields as the
Create Subnet Extension Across Availability Zones
dialog box.
About this task
You can update a subnet extension that extends across AZs using the
Update
Subnet Extension Across Availability Zones
or the
Update
Subnet Extension To A Third Party data center
dialog box. The
Update Subnet Extension Across Availability Zones
or the
Update Subnet Extension To A Third Party data center
dialog
box has the same parameters and fields as the
Create Subnet Extension
Across Availability Zones
or the
Create Subnet Extension To
A Third Party data center
dialog box, respectively.
Based on the type of the subnet extension that you want to modify, refer to the
following:
Procedure
Extending a Subnet Over VPN
Extending a Subnet Across Availability Zones Over VTEP
Extending a Subnet to Third Party Datacenters Over VTEP
Removing an Extended Subnet
About this task
Perform the following procedure to remove the subnet extension. This procedure
deletes the extended subnet between the two Availability Zones (AZs) or between one
Nutanix AZ and one or more third party subnets. Deleting the subnet extension does
not automatically remove the network gateways or VPN connections that may have
automatically been created by the Subnet Extension wizard. You need to separately
delete these entities created automatically when the subnet was extended.
Note:
Removing an extended subnet from a cluster or AZ (either source or target AZs)
automatically deletes the extended subnet from the corresponding source or target
AZs.
Procedure
Click the hamburger icon in the top-left corner of the
Dashboard
.
