NCM-MCI cheat sheet

Each Nutanix block is a 2U or 4U chassis holding up to four nodes; a cluster requires a minimum of three nodes (or one node plus a witness for ROBO edge configurations).

Nutanix supports three hypervisor choices: AHV (native, included), ESXi, and Hyper-V; AHV clusters can be mixed with ESXi nodes only via Prism Central management, not within a single cluster.

Cluster sizing uses the Nutanix Sizer: input VM count, vCPU/vRAM per VM, storage capacity, IOPS and working-set ratio; output is node model and count plus N+1 or N+2 resiliency headroom.

Replication factor 2 (RF2) tolerates one node or disk failure; RF3 tolerates two. RF2 requires at least three nodes; RF3 requires at least five.

A Nutanix cluster tolerates the failure of one node (RF2) with no data loss because each extent has two copies on distinct nodes; the metadata ring and Zeus leader re-elect automatically.

Capacity planning rule: usable capacity = raw capacity minus reserved metadata (about 5%) minus replication overhead; RF2 effectively halves raw disk capacity.

Network design must reserve a separate VLAN for backplane traffic (10 GbE or 25 GbE recommended); 1 GbE backplane is supported only for small edge clusters.

Prism Central can manage multiple clusters (Prism Element) across sites and hypervisors; a single Prism Central instance supports scale-out with multiple PC VMs behind a VIP.

Foundation (or the newer Deploy) is the imaging tool: it discovers nodes via IPMI/Redfish, assigns AHV or ESXi, sets cluster name, VIP, CVM IPs and subnet, then creates the cluster.

The cluster virtual IP (VIP) is the single management address for Prism Element; CVM IPs are per-node management addresses, and each node also has a hypervisor IP.

Prism Central deployment uses the deploy PC workflow from Prism Element or the Nutanix installers; the PC VM requires its own IP, VIP, and at least 4 vCPU and 16 GB RAM for small deployments.

Prism Central registration: a Prism Element cluster is added to PC via Register to Prism Central using the PC VIP and credentials; PC then manages it as a registered cluster.

Categories and projects are configured in Prism Central; projects scope VM ownership, quotas, and RBAC, while categories are key-value tags used for policy targeting.

Nutanix Cluster Check (NCC) runs health checks; results are viewed in Prism under Health or via ncc CLI on a CVM.

LCM (Life Cycle Manager) in Prism Element and Prism Central handles firmware and software upgrades, including AOS, AHV, NCC, and firmware bundles.

The default admin credentials must be changed on first login; Prism Element and Prism Central each maintain their own local user database plus optional directory integration.

AHV uses Open vSwitch (OVS) bridges: br0 is the management bridge, and each VLAN-backed network maps to an OVS bridge with a VLAN tag on the uplink.

A Nutanix VLAN-backed network is defined in Prism Element with a VLAN ID; VMs attach to that network and traffic is tagged on the host uplink.

Flow Network Security (FNS) is a distributed firewall enforced in the AHV host kernel via OVS; policies are defined as security policies with categories as targets.

Flow policy types: Application policies (allow/deny by category and port/protocol), Isolation policies (deny all except specified), and Quarantine policies.

Flow microsegmentation requires AHV; it is not available on ESXi or Hyper-V clusters managed by Prism Central.

Overlay networking in AHV uses VXLAN with a VNI per virtual network; overlay requires a VXLAN VTEP configuration on the host uplinks.

Flow Network Security policy enforcement order: quarantine > isolation > application; the most specific matching rule wins within a policy type.

Nutanix Flow also provides Flow Virtual Networking (VPC) for tenant-level overlay networks with route and NAT services on AHV.

AOS storage is a distributed log-structured file system: the Curator scans extents, Stargate serves I/O on each CVM, and Cassandra stores cluster metadata.

Data is written as extents (1 MB) grouped into vBlocks (4 MB) and vDisks; replication is per-extent across fault domains (nodes or blocks).

The metadata ring (Cassandra) is replicated three ways regardless of RF, so a cluster needs at least three nodes for metadata quorum.

Nutanix supports RF2 (two copies) and RF3 (three copies); RF is set per container and can be changed online.

Storage containers define RF, compression, deduplication, and erasure coding settings; a VM's vDisk lives in a container.

Erasure coding (EC-X) stripes data across four or more nodes to reduce capacity overhead versus RF2; EC requires a minimum of four nodes and is applied to cold data.

Nutanix Volumes (formerly Acropolis Block Services) exposes iSCSI block storage to external hosts from a vDisk.

Nutanix Files provides SMB/NFS shares backed by AOS; shares are hosted on FSVM VMs and support RF and EC policies.

Protection domains group VMs for snapshot and replication; a protection domain can be local-only or replicated to a remote cluster or cloud.

Async DR replicates snapshots to a remote site on a schedule; RPO equals the snapshot interval. Sync DR (Metro Availability) provides near-zero RPO between two clusters.

Metro Availability requires a stretched cluster or two clusters with low-latency links; it uses synchronous replication and a witness for quorum.

Snapshot schedules are defined per protection domain or per VM; retention is set by number of snapshots and can include hourly, daily, weekly, monthly tiers.

Nutanix snapshots are redirect-on-write and metadata-only; they consume capacity only as source data changes.

NearSync replication provides RPO measured in seconds (as low as 1 minute) between clusters, using a continuous replication stream.

Nutanix Mine and Nutanix Cloud Clusters extend backup to object storage; native backup targets include S3-compatible storage and Nutanix Objects.

Restore options: full VM clone from snapshot, in-place revert, and file-level restore via the guest agent or Prism file restore.

AHV VMs support virtIO devices for disk and network; the Nutanix Guest Tools (NGT) package enables file-level restore, VSS snapshots, and self-service restore.

A VM can have multiple vNICs attached to different VLAN-backed networks; the guest OS sees each as a separate interface.

VM categories (key-value pairs) drive policy targeting for Flow, protection domains, and Prism Central policies.

Prism Central Projects scope VM creation, quotas (vCPU, vRAM, storage), and role-based access for a set of users and categories.

VM templates and images are stored in the image service; images can be uploaded as qcow2, raw, or ISO and deployed to any cluster in PC.

AHV supports live migration of VMs between hosts; a host entering maintenance mode evacuates VMs automatically.

Affinity policies in Prism Central place or keep VMs together or apart across hosts for performance or HA.

Nutanix Guest Tools must be installed in the guest to enable VSS-consistent snapshots and self-service file restore.

Prism Element and Prism Central support local users, LDAP/Active Directory integration, and SAML SSO for identity.

Role-Based Access Control (RBAC) in Prism Central assigns roles (e.g., Prism Admin, Prism Viewer, Project Admin) to users or groups scoped to projects or categories.

A role is a set of privileges; a role mapping binds an AD group or user to a role and a scope (project or category).

Flow Network Security policies are enforced at the AHV host, so traffic between VMs on the same host is inspected without hairpinning.

Data-at-rest encryption (SED or software encryption) is configured per cluster; encryption keys are managed by the cluster or an external KMS.

Cluster Lockdown restricts CVM SSH access to a defined list of hosts and disables password login in favor of key-based access.

Audit logs in Prism Central record user actions; they can be exported to a syslog server for retention.

The default admin account should be replaced by named directory accounts; Prism Central supports multi-factor authentication via SAML identity providers.

Prism Element Analysis shows cluster IOPS, latency, and throughput; the default view is last hour with drill-down to 1-minute granularity.

The CVM's Stargate service handles I/O; high CVM CPU or network saturation is a common cause of VM latency.

NCC health checks flag issues such as disk failures, CVM memory pressure, and time drift; run NCC before and after upgrades.

ncli and acli are the CLI tools on the CVM for cluster and VM operations; Prism APIs (v2/v3) provide programmatic access.

Latency troubleshooting: check host CPU ready time, storage controller latency, network drops on the backplane, and disk rebuild activity.

Rebuilds after a node failure consume cluster resources; performance degrades until rebuild completes, which depends on cluster size and data volume.

AHV host memory overcommit can cause swapping; monitor CVM memory (reserved) separately from guest memory.

Log collection: use the logbay or Prism log collector to gather CVM and host logs for support cases.

Prism Central manages multiple Prism Element clusters across on-prem, edge, and public cloud (NC2 on AWS/Azure) from a single pane.

Nutanix Calm (now part of Prism Central) provides blueprints for application provisioning with multi-tier VM and cloud resources.

Nutanix Cloud Clusters (NC2) runs AOS/AHV on AWS or Azure bare-metal, managed by Prism Central.

The Prism v3 API uses REST with JSON; authentication uses basic auth or API keys, and endpoints are under /api/nutanix/v3/.

Life Cycle Manager (LCM) performs one-click upgrades of AOS, AHV, firmware, and NCC; it also inventories available versions.

Nutanix Objects provides S3-compatible object storage on AOS; it can be a backup target for protection domains.

Automation options: Prism APIs, Nutanix Calm, Ansible modules (nutanix.ncp collection), and Terraform provider for Nutanix.

Prism Central scale-out adds PC VMs behind a VIP; the PC deployment must be sized for the number of managed clusters and VMs.