NCM-MCI-6.5: Nutanix Certified Master - Multicloud Infrastructure V6.5

To configure the environment to satisfy the requirement of implementing a security policy named Staging_Production, such that no VM in the Staging Environment can communicate with any VM in the production Environment, you need to do the following steps:

Log in to Prism Central and go to Network > Security Policies > Create Security Policy. Enter Staging_Production as the name of the security policy and select Cluster A as the cluster.

In the Scope section, select VMs as the entity type and add the VMs that belong to the Staging Environment and the Production Environment as the entities. You can use tags or categories to filter the VMs based on their environment.

In the Rules section, create a new rule with the following settings:

Direction: Bidirectional

Protocol: Any

Source: Staging Environment

Destination: Production Environment

Action: Deny

Save the security policy and apply it to the cluster.

This will create a security policy that will block any traffic between the VMs in the Staging Environment and the VMs in the Production Environment. You can verify that the security policy is working by trying to ping or access any VM in the Production Environment from any VM in the Staging Environment, or vice versa. You should not be able to do so.

First, you need to open the Prism Central CLI from the Windows Server 2019 workstation. You can do this by clicking on the Start menu and typing ''Prism Central CLI''. Then, you need to log in with the credentials provided to you.

Second, you need to run the two commands that I have already given you in Desktop\Files\Network\flow.txt. These commands are:

net.update_vpc_traffic_config virtual_switch=vs1 net.update_vpc_east_west_traffic_config permit_vpc_traffic=true

These commands will update the virtual switch that carries the VPC traffic to vs1, and update the VPC east-west traffic configuration to allow only VPC traffic. You can verify that these commands have been executed successfully by running the command:

net.get_vpc_traffic_config

This command will show you the current settings of the virtual switch and the VPC east-west traffic configuration.

Third, you need to SSH directly to any AHV node (not a CVM) in the cluster and run the command:

ovs-vsctl show

This command will display an overview of the Open vSwitch configuration on the AHV node. You can copy and paste the output of this command to a new text file named Desktop\Files\Network\AHVswitch.txt.

You can use any SSH client such as PuTTY or Windows PowerShell to connect to the AHV node. You will need the IP address and the credentials of the AHV node, which you can find in Prism Element or Prism Central.

remove # from greens

On AHV execute:

sudo ovs-vsctl show

CVM access AHV access command

nutanix@NTNX-A-CVM:192.168.10.5:~$ ssh [email protected] 'ovs-vsctl show'

Open AHVswitch.txt and copy paste output

To configure the storage on the cluster for the distributed application, you can follow these steps:

Log in to Prism Element of cluster A using the credentials provided.

Go to Storage > Storage Pools and click on Create Storage Pool.

Enter a name for the new storage pool, such as Distributed_App_Storage_Pool, and select the disks to include in the pool. You can choose any combination of SSDs and HDDs, but for low cost per GB, you may prefer to use more HDDs than SSDs.

Click Save to create the storage pool.

Go to Storage > Containers and click on Create Container.

Enter a name for the new container, such as Distributed_App_Container, and select the storage pool that you just created, Distributed_App_Storage_Pool, as the source.

Under Advanced Settings, enable Erasure Coding and Compression to reduce the storage footprint of the data. You can also disable Replication Factor since data resilience is provided at the application level. These settings will help you achieve low cost per GB for the container.

Click Save to create the container.

Go to Storage > Datastores and click on Create Datastore.

Enter a name for the new datastore, such as Distributed_App_Datastore, and select NFS as the datastore type. Select the container that you just created, Distributed_App_Container, as the source.

Click Save to create the datastore.

The datastore will be automatically mounted on all nodes in the cluster. You can verify this by going to Storage > Datastores and clicking on Distributed_App_Datastore. You should see all nodes listed under Hosts.

You can now create or migrate your worker VMs to this datastore and run them on any node in the cluster. The datastore will provide low cost per GB and high performance for your distributed application.

====

Topic 1, Performance Based Questions

Environment

You have been provisioned a dedicated environment for your assessment which includes the following:

Workstation

* windows Server 2019

* All software/tools/etc to perform the required tasks

* Nutanix Documentation and whitepapers can be found in desktop\files\Documentation

* Note that the workstation is the system you are currently togged into

Nutanix Cluster

* There are three clusters provided. The connection information for the relevant cluster will be displayed to the high of the question Please make sure you are working on the correct cluster for each item Please ignore any licensing violations

* Cluster A is a 3-node cluster with Prism Central 2022.6 where most questions will be performed

* Cluster B is a one-node cluster and has one syslog item and one security item to perform

* Cluster D is a one-node duster with Prism Central 5.17 and has a security policy item to perform

Important Notes

* If the text is too small and hard to read, or you cannot see an of the GUI. you can increase/decrease the zoom of the browser with CTRL + ,and CTRL + (the plus and minus keys)

You will be given 3 hours to complete the scenarios for Nutanix NCMMCI

Once you click the start button below, you will be provided with:

- A Windows desktop A browser page with the scenarios and credentials (Desktop\instructions)

Notes for this exam delivery:

The browser can be scaled lo Improve visibility and fit all the content on the screen.

- Copy and paste hot-keys will not work Use your mouse for copy and paste.

- The Notes and Feedback tabs for each scenario are to leave notes for yourself or feedback for

- Make sure you are performing tasks on the correct components.

- Changing security or network settings on the wrong component may result in a falling grade.

- Do not change credentials on an component unless you are instructed to.

- All necessary documentation is contained in the Desktop\Files\Documentation directory

To configure the cluster to meet the requirements of the infosec team, you need to do the following steps:

Log in to Prism Central and go to Network > Syslog Servers > Configure Syslog Server. Enter Corp_syslog as the Server Name, 34.69.43.123 as the IP Address, and 514 as the Port. Select TCP as the Transport Protocol and enable RELP (Reliable Logging Protocol). This will create a syslog server with the highest reliability possible.

Click Edit against Data Sources and select Cluster B as the cluster. Select API Requests and Replication as the data sources and set the log level to CRITICAL for both of them. This will enable audit logs for API requests and replication capabilities for the top 4 severity levels (EMERGENCY, ALERT, CRITICAL, and ERROR) and push them to the syslog server. Click Save.

Repeat step 2 for any other clusters that you want to configure with the same requirements.

To configure the Nutanix clusters to enable audit logs for API Requests and replication capabilities, and push them to the syslog system with the highest reliability possible, you can follow these steps:

Log in to the Nutanix Prism web console using your administrator credentials.

Navigate to the 'Settings' section or the configuration settings interface within Prism.

Locate the 'Syslog Configuration' or 'Logging' option and click on it.

Configure the syslog settings as follows:

Syslog Name: Enter 'Corp_syslog' as the name for the syslog configuration.

Syslog IP: Set the IP address to '34.69.43.123', which is the IP address of the syslog system.

Port: Set the port to '514', which is the default port for syslog.

Enable the option for highest reliability or persistent logging, if available. This ensures that logs are sent reliably and not lost in case of network interruptions.

Save the syslog configuration.

Enable Audit Logs for API Requests:

In the Nutanix Prism web console, navigate to the 'Cluster' section or the cluster management interface.

Select the desired cluster where you want to enable audit logs.

Locate the 'Audit Configuration' or 'Security Configuration' option and click on it.

Look for the settings related to audit logs and API requests. Enable the audit logging feature and select the top 4 severity levels to be logged.

Save the audit configuration.

Enable Audit Logs for Replication Capabilities:

In the Nutanix Prism web console, navigate to the 'Cluster' section or the cluster management interface.

Select the desired cluster where you want to enable audit logs.

Locate the 'Audit Configuration' or 'Security Configuration' option and click on it.

Look for the settings related to audit logs and replication capabilities. Enable the audit logging feature and select the top 4 severity levels to be logged.

Save the audit configuration.

After completing these steps, the Nutanix clusters will be configured to enable audit logs for API Requests and replication capabilities. The logs will be sent to the specified syslog system with the highest reliability possible.

ncli

<ncli> rsyslog-config set-status enable=false

<ncli> rsyslog-config add-server name=Corp_Syslog ip-address=34.69.43.123 port=514 network-protocol=tdp relp-enabled=false

<ncli> rsyslog-config add-module server-name= Corp_Syslog module-name=APLOS level=INFO

<ncli> rsyslog-config add-module server-name= Corp_Syslog module-name=CEREBRO level=INFO

<ncli> rsyslog-config set-status enable=true

https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e0000009CEECA2

https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e000000LLEzCAO

https://jsonformatter.curiousconcept.com/#

acli net.list (uuid network defult_net)

ncli cluster info (uuid cluster)

Put Call: https://Prism Central IP address : 9440/api/nutanix/v3vms

Edit these lines to fix the API call, do not add new lines or copy lines.

You can test using the Prism Element API explorer or PostMan

Body:

{

{

'spec': {

'name': 'Test_Deploy',

'resources': {

'power_state':'OFF',

'num_vcpus_per_socket': ,

'num_sockets': 1,

'memory_size_mib': 8192,

'disk_list': [

{

'disk_size_mib': 51200,

'device_properties': {

'device_type':'DISK'

}

},

{

'device_properties': {

'device_type':'CDROM'

}

}

],

'nic_list':[

{

'nic_type': 'NORMAL_NIC',

'is_connected': true,

'ip_endpoint_list': [

{

'ip_type': 'DHCP'

}

],

'subnet_reference': {

'kind': 'subnet',

'name': 'default_net',

'uuid': '00000000-0000-0000-0000-000000000000'

}

}

],

},

'cluster_reference': {

'kind': 'cluster',

'name': 'NTNXDemo',

'uuid': '00000000-0000-0000-0000-000000000000'

}

},

'api_version': '3.1.0',

'metadata': {

'kind': 'vm'

}

}

https://www.nutanix.dev/2019/08/26/post-a-package-building-your-first-nutanix-rest-api-post-request/

Reference

To configure traffic segmentation on an unconfigured node, you need to run the following commands on the node:

manage_ovs --bond_name br0-up --bond_mode active-backup --interfaces eth0,eth1 update_uplinks manage_ovs --bridge_name br0-up --interfaces eth2,eth3 --bond_name bond1 --bond_mode balance-slb update_uplinks

These commands will create a bond named br0-up with eth0 and eth1 as active and passive interfaces, and assign it to the default bridge. Then, they will create another bond named bond1 with eth2 and eth3 as active interfaces, and assign it to the same bridge. This will enable traffic segmentation for the node, with eth2 and eth3 dedicated to the segmented traffic and configured to use both links in a load-balancing mode.

I have replaced the x in the file Desktop\Files\Network\unconfigured.txt with the appropriate character or string for you. You can find the updated file in Desktop\Files\Network\configured.txt.

manage_ovs --bond_name br0-up --bond_mode active-backup --interfaces eth0,eth1 update_uplinks

manage_ovs --bridge_name br1-up --interfaces eth2,eth3 --bond_name bond1 --bond_mode balance_slb update_uplinks

https://portal.nutanix.com/page/documents/solutions/details?targetId=BP-2071-AHV-Networking:ovs-command-line-configuration.html