Nutanix Technology Champion - Nutanix Solution Architect

Julien DUMUR
Infrastructure in a Nutshell
Connecting a Palo Alto gateway to the OVHcloud RTvRack

In a previous article, we covered how to deploy and perform the basic configuration of a Palo Alto gateway to replace the basic gateway supplied with your OVHcloud Nutanix cluster.

I will now show you how to connect this gateway to the RTvRack supplied with your cluster to connect it to the internet.

Connecting the Gateway to the RTvRack

In “Network > Zones”, we start by creating a new “Layer3” zone, which we’ll call “WAN” for simplicity:

Creating the Layer3 WAN zone

You can also create one or more other zones to connect your other interfaces (e.g., an “INTERNAL” zone).

Next, in “Network > Interfaces,” edit the ethernet1/1 interface. If you’ve successfully created your VM on Nutanix, it will correspond to the WAN output interface. It will be a “Layer3” interface:

Layer3 ethernet1/1 interface in the WAN zone

On the “Config” tab, select the “default” Virtual Router and select the “WAN” security zone.

On the “IPv4” tab, add the available public IP address in the range provided to you by OVHcloud with your cluster, making sure to include a /32 mask at the end:

Public IPv4 address in /32 on ethernet1/1

You can find the network information for your public IP address on your OVHcloud account in “Hosted Private Cloud > Network > IP”:https://www.ovh.com/manager/#/dedicated/ip

Using the public IP address and its associated network mask, you can deduce:

The public IP address to assign to the WAN port of your gateway

The IP address of the WAN gateway

Example with the network 6.54.32.10/30:

Network address (not usable): 6.54.32.8
First address (public address of the PA-VM): 6.54.32.9
Last address: 6.54.32.10 (WAN gateway address)
Broadcast address: 6.54.32.11 (broadcast address)

Repeat the operation with the interface corresponding to the subnet of your Nutanix cluster, using the IP address of the gateway you specified when deploying your cluster.

However, make sure to set the mask corresponding to that of the network in which the interface is located as indicated in the documentation: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/configure-interfaces/layer-3-interfaces/configure-layer-3-interfaces#iddc65fa08-60b8-47b2-a695-2e546b4615e9.

In “Network > Virtual Routers”, edit the default router. You should find your “ethernet1/1” interface at a minimum, as well as any other interfaces you may have already configured:

Default Virtual Router with its interfaces

Then, in the “Static Routes” submenu, create a new route with a name that speaks to you, a destination of 0.0.0.0/0, select the “ethernet1/1” interface and as Next Hop the IP address of the public network gateway provided to you by OVHcloud:

Default static route to the OVHcloud gateway

Finally, go to the “Device > Setup > Services” tab and edit the “Service Route Configuration” option in “Services Features” to specify the output interface and the associated /32 IP address for some of the services:

PA-VM Service Route Configuration

The list of services to configure at a minimum is as follows:

  • DNS
  • External Dynamic Lists
  • NTP
  • Palo Alto Networks Services
  • URL Updates

You can validate and commit. Your PA-VM gateway is now communicating with the OVHcloud RTvRack. All that’s left is to finalize the configurations to secure the installation and create your firewall rules to allow your cluster to access the internet.

Read More
nutanix on ovhcloud hosted private cloud

In this article, I share my complete feedback on the complete reinstallation of a Nutanix cluster at OVHcloud.

Once logged in to the OVHcloud management interface, go to “Hosted Private Cloud”:

Hosted Private Cloud tab in the OVHcloud manager

In the left drop-down menu, click on the cluster you want to redeploy:

Selecting the Nutanix cluster in the OVHcloud manager

On the page that appears, click on “Redeploy my cluster”: 

Redeploy my cluster link in the OVHcloud manager

Click on “Continuer” :

Warning before redeploying the cluster

Automatic redeployment

The first option is to revert to the default settings provided by OVHcloud to completely reinstall the cluster in its basic configuration:

Redeploying with the initial configuration

A summary of the settings is displayed before you finally confirm the reinstallation of your cluster:

Technical summary before redeploying

Custom redeployment

You can fully customize your cluster’s IP network configuration during its installation phase. When choosing the cluster deployment method, select “Customize configuration” and click “Next”:

Choosing the custom configuration

Fill in the various fields with the information you want to assign to your cluster and click on “Redeploy”:

Node IP addressing strategy

RF2 replication factor and Erasure Coding

Prism Central, VIP, VLAN and gateway settings

Type “REDEPLOY” in the field provided and click “Confirm” to start the reinstallation procedure:

Confirming the redeployment by typing REDEPLOY

On your cluster’s overview page, a message indicates that cluster redeployment is in progress: 

Message showing the cluster redeployment in progress

All that’s left is to wait until the cluster is completely redeployed. All the basic configurations are already done, you just have to finalize the specific ones such as authentication, SMTP relay, monitoring, etc.

Read More
nutanix on ovhcloud

This is one of the operations I recommend performing on an OVHcloud cluster immediately after delivery: replacing the pre-deployed gateway that will allow your cluster to connect to the internet.

In this article, we’ll see how to deploy a Palo Alto PA-VM and how to perform its basic configuration so that it’s ready to be connected to the OVHcloud RTvRack (which will be the subject of another article).

Prerequisites

Here is the list of prerequisites for deployment:

Retrieving the PA-VM Image

The first step is to retrieve the qcow2 image, which will allow us to deploy the PA-VM on the Palo Alto site: https://support.paloaltonetworks.com/Updates/SoftwareUpdates/64685971

NOTE: You must have a registered account with them with the correct access rights; there is no “Community” or “Free” version.

Downloading PA-VM KVM images from Palo Alto support

VM Deployment

After transferring the newly downloaded image to the cluster, we create a VM with the following characteristics:

Creating the PA-GATEWAY VM in Prism Central

For VM sizing, I invite you to consult the documentation to adapt it to your context: https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/license-the-vm-series-firewall/vm-series-models/vm-series-system-requirements

The disk to add is the one downloaded in qcow2 format from the Palo Alto website.

Also select the subnets that will be connected to your gateway. The first interface you add will always be the PA-VM’s management interface, so make sure you select the correct subnet, which ideally will be a subnet dedicated to management interfaces. Your jump host VM must have an interface in this subnet to access the PA-VM’s web interface. Here, for example, is what I would recommend for configuring the interfaces:

Management

  • ethernet1/1 (subnet 0 created by default on the cluster, for the WAN output)
  • ethernet1/2 (internal subnet 1, often the one corresponding to your Nutanix infrastructure)
  • ethernet1/3 (internal subnet 2)
  • …

PA-VM disk, subnets and Legacy BIOS settings

It’s important to select “Legacy BIOS Mode” when creating the VM, otherwise it won’t boot!

Select “Use this VM as an Agent VM” so that it boots first.

Use this VM as an Agent VM option for the PA-VM

Validate the settings, the virtual machine is ready to be started.

Initializing the PA-VM

Start the VM and launch the console from the Nutanix interface. Wait while the operating system boots.

The first login is via the CLI with the following credentials:

  • Username: admin
  • Password: admin

The system will ask you to change the default password. Then switch to configuration mode:

configure

Next, configure the management IP in static mode:

set deviceconfig system type static

Configuring the management interface parameters:

set deviceconfig system ip-address <Firewall-IP> netmask <netmask> default-gateway <gateway-IP> dns-setting servers primary <DNS-IP>

At this point, the firewall can be accessed from the jump host’s web browser at: https://<Firewall-IP>

CAUTION: This only works if the jump host VM has an interface in the same subnet as the Management interface.

Don’t forget to commit, either from the web interface or from the command line:

commit

You can now continue the configuration on the web interface.

Basic PA-VM Configurations

Let’s start with the basic PA-VM configuration.

Device, Setup menu in the PA-VM web interface

On the web interface, in “Device > Setup”, edit the “General Settings” widget to enter at least the Hostname and the Timezone:

PA-VM General Settings

Then go to the “Services” tab and edit the “Services” widget to add DNS servers and NTP servers:

PA-VM DNS server settings

PA-VM NTP server settings

All that’s left is to commit the changes; the basic configuration of the Palo Alto gateway is complete.

I want to point out that this is a basic configuration, and there are many other configuration points to complete to ensure a perfectly configured and secure gateway that allows your cluster to access the internet, including authentication, password complexity, VPN, firewall rules, and more.

In a future article, we’ll see how to connect your Palo Alto PA-VM gateway to the OVHcloud RTvRack to allow your cluster to access the internet.

Read More
Nutanix on OVHcloud offering

More and more businesses are adopting multicloud infrastructures to benefit from flexibility, agility, and security. To meet this need, OVHcloud has partnered with Nutanix to offer optimized solutions for managing hybrid cloud solutions.

I invite you to discover the Nutanix offerings on OVHcloud and how they can help transform business infrastructures.

OVHcloud and Nutanix: A Strategic Collaboration

OVHcloud, a major European cloud provider, and Nutanix, a leader in hyperconverged solutions, are collaborating to offer high-performance, secure, and enterprise-grade services. This partnership aims to provide an integrated and secure cloud platform, allowing businesses to focus on their applications without worrying about managing the underlying infrastructure.

Diagram of the partnership between OVHcloud, Nutanix and service providers

Integrating Nutanix solutions into the OVHcloud cloud creates a simplified multi-cloud environment, offering IT teams greater flexibility. Customers can deploy their applications across hybrid and multi-cloud environments while benefiting from unified management, enhanced security, and reduced operational costs.

Nutanix solutions at OVHcloud

Nutanix offerings on OVHcloud include several essential services for businesses looking to modernize and simplify their infrastructure:

Nutanix Cloud Platform on OVHcloud: This platform provides a scalable and integrated cloud infrastructure with a Nutanix hyperconverged infrastructure (HCI) solution. It can run a variety of workloads, such as databases, productivity applications, and mission-critical applications, while ensuring high security and optimal performance.

HYCU Backup: OVHcloud also offers a backup solution for your Nutanix infrastructure through the HYCU Backup solution, a comprehensive backup software solution that is seamlessly integrated with Nutanix.

The advantages of OVHcloud’s Nutanix offerings

Adopting Nutanix offerings on OVHcloud offers several advantages:

Nutanix on OVHcloud benefits: ready-to-use HCI, scalability, hardware range, free public traffic

Simplicity and centralized management: Nutanix solutions provide a centralized management interface allowing IT teams to manage their resources in a multicloud environment without additional complexity.

Data sovereignty: OVHcloud complies with European data protection standards. Combined with Nutanix solutions, businesses benefit from high levels of security and enhanced access controls.

Licensing flexibility: All hardware and software licenses can be provided by OVHcloud, helping to eliminate complexity and hidden costs, or you can bring your own Nutanix license to facilitate the provisioning of OVHcloud resources.

Performance and scalability: Nutanix solutions on OVHcloud offer a high-performance and scalable infrastructure, adapted to the growing needs of businesses. With the flexibility of Nutanix solutions, businesses can easily adjust their resources as needed by adding nodes on demand to increase the hardware resources of their clusters.

Cost Reduction: Nutanix’s hyperconverged infrastructure reduces operational costs by simplifying infrastructure management and reducing the need for physical servers. OVHcloud customers can thus optimize their IT spending while benefiting from high performance.

Use cases: How do businesses benefit from Nutanix on OVHcloud offerings?

Nutanix on OVHcloud offerings are particularly suited for the following use cases:

Use cases: cloud migration, disaster recovery plan, on-demand elasticity, multi-tenant

Use cases reinforced by the options offered by OVHcloud:

OVHcloud options: HYCU, Veeam, Object Storage, KMS, OVHcloud Connect and additional IPs

Conclusion

Nutanix on OVHcloud offers a comprehensive solution for businesses looking to efficiently manage their multicloud infrastructures. By combining the performance of Nutanix solutions with the flexibility and security of OVHcloud, businesses can benefit from a scalable, high-performance infrastructure that complies with European regulations.

By adopting Nutanix on OVHcloud solutions, businesses can simplify their infrastructure, strengthen their security, optimize their costs, and focus on growth.

Add to this additional services such as KMS key management and the HYCU backup solution, and we clearly have a serious European competitor to Google Cloud, AWS, and Azure.

Read More