Nutanix Technology Champion - Nutanix Solution Architect

Julien DUMUR
Infrastructure in a Nutshell

Tech and Lab

Nutanix AHV: Modifying VLANs on the Cluster

Published: 21 January 2025
Written by Julien D.
No comments
Categories: Network, Nutanix AHV EN, Nutanix EN
Modifying VLANs on a Nutanix AHV cluster

Sometimes and for various reasons, it is necessary to configure the VLAN directly at the level of our Nutanix cluster, in particular to ensure network segmentation.

Use case

Having had a little time for myself during the Christmas holidays, I set about resuming the configuration of my local network in order to isolate my Nutanix lab from my internal network.

To do this, I had to reconfigure my Ubiquiti equipment in order to:

  • create VLAN 84 at the Dream Machine Pro level
  • propagate VLAN 84 on the 24-port switch then on the 5-port switch on which the cluster is connected

Changing the VLAN on AHV

Before starting the modifications, I start by checking the network configuration of my host:

[root@NTNX-5e8f7308-A ~]# ovs-vsctl list port br0
_uuid : b76f885d-59b2-4153-99d3-27605a729ab8
bond_active_slave : []
bond_downdelay : 0
bond_fake_iface : false
bond_mode : []
bond_updelay : 0
cvlans : []
external_ids : {}
fake_bridge : false
interfaces : [17e8b0de-2ef5-4f6f-b253-94a766ec9603]
lacp : []
mac : []
name : br0
other_config : {}
protected : false
qos : []
rstp_statistics : {}
rstp_status : {}
statistics : {}
status : {}
tag : 0
trunks : []
vlan_mode : []

The output of the command shows us that there is no tag on my host. We will fix this with the following command:

[root@NTNX-5e8f7308-A ~]# ovs-vsctl set port br0 tag=84

The command “ovs-vsctl set port br0 tag=” allows me to tag my host interface with the VLAN ID that I have dedicated to my Nutanix network. We then check that the configuration is applied:

[root@NTNX-5e8f7308-A ~]# ovs-vsctl show
Bridge br0
    Port vnet4
        tag: 0
        Interface vnet4
    Port br0-up
        Interface eth4
        Interface eth0
        Interface eth5
        Interface eth2
        Interface eth1
        Interface eth3
    Port br0.u
        Interface br0.u
            type: patch
            options: {peer=br.dmx.d.br0}
    Port br0
        tag: 84
        Interface br0
            type: internal
    Port br0-dhcp
        Interface br0-dhcp
            type: vxlan
            options: {key="1", remote_ip="192.168.84.200"}
    Port br0-arp
        Interface br0-arp
            type: vxlan
            options: {key="1", remote_ip="192.168.5.2"}
    Port vnet2
        Interface vnet2
ovs_version: "2.14.8"

We can now see that the VLAN is configured on my host, we must now do the configuration on the CVM side…

Configuring the VLAN on the CVM

We start by checking the network configuration of our CVM:

[root@NTNX-5e8f7308-A ~]# ovs-vsctl show
    Bridge br0
        Port br0-up
            Interface eth4
            Interface eth0
            Interface eth5
            Interface eth2
            Interface eth1
            Interface eth3
        Port br0-arp
            Interface br0-arp
                type: vxlan
                options: {key="1", remote_ip="192.168.5.2"}
        Port br0.u
            Interface br0.u
                type: patch
                options: {peer=br.dmx.d.br0}
        Port vnet5
            Interface vnet5
        Port br0
            tag: 84
            Interface br0
                type: internal
        Port br0-dhcp
            Interface br0-dhcp
                type: vxlan
                options: {key="1", remote_ip="192.168.84.200"}
        Port vnet2
            Interface vnet2
    ovs_version: "2.14.8"

Here we can see that my network interface does not have any vlan information. So I proceed to configure the VLAN ID by connecting to my CVM and then typing the command

change_cvm_vlan VLANID
nutanix@NTNX-5e8f7308-A-CVM:192.168.84.200:~$ change_cvm_vlan 84
This operation will perform a network restart. Please enter [y/yes] to proceed or any other key to cancel: y
Changing vlan tag to 84
Replacing external NIC in CVM, old XML:
<interface type="bridge">
      <mac address="52:54:00:8e:69:bc" />
      <source bridge="br0" />
      <virtualport type="openvswitch">
        <parameters interfaceid="356e3bf3-5700-4131-b1b2-4fa65195a6e2" />
      </virtualport>
      <target dev="vnet0" />
      <model type="virtio" />
      <driver name="vhost" queues="4" />
      <alias name="ua-1decc31c-2764-416a-b509-d54ecd1a684f" />
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x0" />
    </interface>

        new XML:
<interface type="bridge">
      <mac address="52:54:00:8e:69:bc" />
      <model type="virtio" />
      <driver name="vhost" queues="4" />
      <address type="pci" domain="0x0000" bus="0x00" slot="0x03" function="0x0" />
    <source bridge="br0" /><virtualport type="openvswitch" /><vlan><tag id="84" /></vlan></interface>

CVM external NIC successfully updated.
Performing a network restart

We now check the CVM network configuration to verify that the tag has been configured correctly:

[root@NTNX-5e8f7308-A ~]# ovs-vsctl show
    Bridge br0
        Port br0-up
            Interface eth4
            Interface eth0
            Interface eth5
            Interface eth2
            Interface eth1
            Interface eth3
        Port br0-arp
            Interface br0-arp
                type: vxlan
                options: {key="1", remote_ip="192.168.5.2"}
        Port br0.u
            Interface br0.u
                type: patch
                options: {peer=br.dmx.d.br0}
        Port vnet5
            tag: 84
            Interface vnet5
        Port br0
            tag: 84
            Interface br0
                type: internal
        Port br0-dhcp
            Interface br0-dhcp
                type: vxlan
                options: {key="1", remote_ip="192.168.84.200"}
        Port vnet2
            Interface vnet2
    ovs_version: "2.14.8"

My CVM is now on VLAN 84. All I have to do now is repeat these operations on all my nodes and then check that everything works properly.

WARNING: the change_cvm_vlan command has a known bug in 6.8 with AHV 20230302.100173 that causes the VLAN ID not to be preserved when repeating the host: https://portal.nutanix.com/page/documents/kbs/details?targetId=kA0VO0000002uJ30AI

Read More

Presentation of my Nutanix Homelab

Published: 30 September 2024
Written by Julien D.
No comments
Categories: Community Edition EN, Nutanix EN, State of the Lab EN, Tech and Lab
My Nutanix homelab

This is a question I am regularly asked: “with which cluster do you perform your tests for your articles?”. So here is what my Nutanix homelab looks like…

My network infrastructure

Before talking about my Nutanix cluster, I will present my home infrastructure that I installed 4 years ago when the house was built.

I based my network infrastructure on Ubiquiti brand equipment. The hardware is very good, silent, robust, easy to use… but for the configuration it is really very particular and we are very far from what we are used to practicing on a daily basis in a data center.

So I set up:

a Ubiquiti Dream Machine Pro for the entire network / filtering part with

  • 2 SFP+ 10Gb ports
  • 8 1Gb ports
Ubiquiti Dream Machine Pro and its ports

a Ubiquiti USW Pro 24 PoE switch which has

  • 2 10Gb SFP+ ports
  • 24 1Gb PoE ports
Ubiquiti USW Pro 24 PoE switch

Ubiquiti Flex switches in various parts of the home

Ubiquiti Flex switch

My internet access is currently a Free connection which relies on the Freebox Delta and which offers me a theoretical speed of 10Gb/s:

Freebox Delta ports

On the program:

  • a 10Gb fiber arrival
  • 4 RJ45 ports in 1Gb (B, C, D, E)
  • 1 SFP+ 10Gb port (F)

A well-stocked box to allow latency-free Internet access.

The network topology therefore looks like this:

Home network topology from the Freebox to the switches

As you can see, no professional type infrastructure at home so if you only have consumer type equipment, don’t hesitate to get started, it will do the trick.

My Nutanix cluster

My Nutanix cluster is nothing exceptional, it is quite old hardware since it is based on an Intel S2600WTTR chassis that was launched by the manufacturer in 2016!

Link to the technical sheet: https://www.intel.fr/content/www/fr/fr/products/sku/88281/intel-server-board-s2600wttr/specifications.html

I recovered it in a previous professional experience, the cluster had a hardware failure that the administration did not want to deal with given the age of the hardware and the fact that the existing infrastructure was being replaced by brand new Nutanix clusters.

Kitten lying on the Intel homelab server

I carried out the repair at my own expense so that the server would be operational again. In terms of the physical installation, the cluster is not allowed to stay in the house (due to noise), so it is in the garage, installed in an unconventional way:

Homelab server mounted under a shelf in the garage

The hardware configuration of my cluster is as follows:

  • 2 Intel Xeon E5-2640 v4 @ 2.4Ghz processors
  • 384 Gb of RAM
  • 1 120Gb SDD for the OS
  • 4 800Gb SAS SDDs
  • 6 1.6Tb SAS HDDs
  • 2 10Gb RJ45 network ports

This hardware configuration allows me to have disk redundancy. This is not the ideal scenario but it is already much better than no redundancy at all. The amount of CPU / RAM allows me to run a large number of virtual machines without any performance degradation:

Prism Element dashboard of the THE_LAB cluster

If I had to make a hardware change to my cluster, I think I would opt for a 10Gb fiber network card in order to have a 10Gb connection from one end of the chain to the other Internet > Router > Firewall > Switch > Cluster.

The cluster is now installed with a Nutanix CE 2.1 in the latest versions available:

Software versions installed on the Nutanix CE 2.1 cluster

This allows me to test the latest features, to perform configuration tests and it also serves as a support for writing all the blog articles, each subject covered being obviously tested on the Lab before publication.

Although the Lab is essential for writing my articles, I do not leave it on permanently because it consumes a significant amount of electricity as I already mentioned in one of my previous articles.

That’s my infrastructure, hoping that it makes you want to get started and set up your own Nutanix CE cluster.

Read More

Nutanix AHV : SSH keys and cluster lockdown

Published: 17 April 2024
Written by Julien D.
No comments
Categories: Nutanix AHV EN, Nutanix EN, Security
SSH keys and Cluster Lockdown on Nutanix AHV

It’s in Nutanix’s roadmap! Password authentication is in the sights of the publisher who intends to put an end to it and warn its users via an informational alert:

Prism alert: the cluster is using password based SSH access

The objective is to gradually switch clients to SSH key authentication in order to impose it in a future version of its hypervisor.

Creating SSH keys

Supported SSH encryption algorithms are:

  • AES128-CTR
  • AES192-CTR
  • AES256-CTR

If you already have such a key pair, you can proceed directly to cluster integration.

To create an SSH key pair, we will need a tool like PuttyGen.

PuTTYgen window to generate an SSH key pair

Click “Generate” and move the mouse cursor over the window. Then indicate a passphrase then save the public key and the private key.

WARNING: be sure to use a strong, non-predictable passphrase.

Passphrase and key saving in PuTTYgen

We must now integrate the public key into the cluster.

Integration of the public key on the cluster

To integrate your public key into your cluster, connect to the Prism interface and go to “Settings > Cluster Lockdown”

Cluster Lockdown menu in Prism settings

Click on “New Public Key”, give it a name, paste the public key content and validate.

Adding a public key with New Public Key

At this stage, classic password authentication and SSH key authentication are both active and functional, it is time to test.

Testing and activation of the cluster lockdown feature

First, we will test authentication via SSH key. Don’t panic, whatever happens, even if the SSH connection via the keys does not work after activating the cluster lockdown, you can always backtrack via the Prism interface.

Configure your favorite SSH connection tools, integrate your private key then launch a connection to your Nutanix cluster. First, enter the login you want to use, here I chose “nutanix”:

SSH login to the CVM with a public key and passphrase prompt

Then enter the passphrase that you configured when creating your SSH key. Validate, you are now connected to your cluster via your SSH key without having to use the password for the “nutanix” account.

Now let’s deactivate password authentication by returning to the “Settings > Cluster Lockdown” menu. Uncheck the “Enable Remote Login with Password” box:

Enable Remote Login with Password box unchecked

Try logging in again using the “nutanix” account and the usual password and notice that you can no longer log in with this method:

Password-based SSH login refused

Try with your private key and the associated passphrase :

Successful SSH login with the private key

Your cluster is now SSH accessible only via the SSH key system. If there are several administrators working on the server, don’t forget to repeat the operation for each of them.

Important point: remember to keep your private keys in a safe place and use a strong passphrase.

Official documentation

The Nutanix official documentation: https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Security-Guide-v6_7:mul-security-cluster-lockdown-pc-t.html

Read More

Nutanix AHV – Add subnet to your cluster

Published: 22 January 2024
Written by Julien D.
No comments
Categories: Community Edition EN, Network, Nutanix AHV EN, Nutanix EN
Adding a subnet to a Nutanix AHV cluster

To be able to deploy a virtual machine on your Nutanix cluster and have it reachable on your network, you will need to start by configuring the network(s) on your cluster.

Creating a network using Prism Element

Under Prism Element, in the “Settings > Network Configuration” menu is the list of all existing networks on the cluster, click on “Create Subnet”:

Network Configuration in Prism Element with Create Subnet

Then enter your network information, namely the name and vlan ID:

Create Subnet form with name, virtual switch and VLAN ID

If you do not have a DHCP server, you can let Nutanix manage the addressing of the network created using the “Enable IP address management” option:

Enable IP address management option

You will then need to complete all the options that would normally have been delivered by a traditional DHCP server:

Subnet DHCP settings and IP address pools

Click “Save” once the settings are correct. Repeat for each VLAN you need on your infrastructure.

Creating a network using Prism Central

In Prism Central, network management is carried out in “Network & Security > Subnets”:

Subnets list in Prism Central Network and Security

To add a new network, click “Create Subnet”:

Create Subnet form in Prism Central

It is then a form similar to that of Prism Element that must be completed by activating, or not, the “IP Address Management” option if you wish to leave the management of your addressing to Nutanix.

Official Nutanix documentation

Link to official documentation: https://portal.nutanix.com/page/documents/solutions/details?targetId=BP-2071-AHV-Networking:bp-ahv-network-management.html

Read More

Sad Servers : Troubleshoot and make a sad server happy!

Published: 7 November 2023
Written by Julien D.
No comments
Categories: Linux
Sad Servers, Linux troubleshooting scenarios

Do you want to improve your Linux diagnostics or kill time while waiting for your infrastructure to reboot? I have the solution !

Sad Servers

The Sad Servers site offers diverse and varied scenarios that will confront you with problems to resolve. Everything happens in the browser, no need for special software other than your usual browser.

sadservers

On the program, a “sick” server that you will have to take care of in as little time as possible. Be careful, although some scenarios may seem simple at first glance, a solid knowledge of Linux commands will greatly help you in your task.

How it works ?

Well it’s very simple, you select your scenario, you read the pitch, you start the console (allow 50 to 60s for the VM to start) and you can start to diagnose!

A help system is present if you no longer know what to do to resolve the current problem.

A perfect way to review your Linux commands and acquire/perfect your problem resolution skills.

The site: https://sadservers.com/

Read More

Unifi : switch adoption issues

Published: 6 March 2023
Written by Julien D.
No comments
Categories: Network
Ubiquiti switch adoption in Unifi

Recently, my Ubiquiti USW-Pro-24-PoE switch had some connection issues with my Unifi console.

Read More

Hardening a SSH Server

Published: 28 December 2022
Written by Julien D.
No comments
Categories: Linux, Security
Hardening an SSH server

An SSH access is a privileged entry point for hackers. Today I am offering you a guide that will allow you to strengthen the security of your SSH accesses, to reduce the attack surface, in order to make them much more difficult to attack.

Read More