AWS Networking and Connectivity for Nutanix Workloads
The NC2 network model
Each NC2 node is an EC2 bare-metal instance with an ENI. The node consumes multiple private IPs: AHV host, CVM, Prism, and service addresses. Plan subnet size for current nodes plus growth, because IP exhaustion is a common deployment failure. Security groups act as stateful virtual firewalls; NACLs are stateless and need both directions.
Connectivity patterns
- Management access: use a bastion, VPN, or Direct Connect. Do not expose Prism to 0.0.0.0/0.
- Hybrid: AWS Site-to-Site VPN, Direct Connect, or Transit Gateway for on-premises to VPC. VPC peering connects VPCs but is non-transitive.
- Outbound: NAT gateway or internet gateway for licensing, support, and updates if required.
- DNS: Route 53 private hosted zones or conditional forwarders so on-premises and NC2 resolve each other.
Worked example
An on-premises VM 10.1.1.10 must reach an NC2 VM 10.2.2.20. The VPC route table sends 10.1.0.0/16 to the VPN gateway; the on-premises router has a return route for 10.2.0.0/16. The security group on the NC2 VM allows TCP 443 from 10.1.0.0/16; the NACL allows 443 both directions and ephemeral ports. A DNS forwarder resolves the VM name. If any one of route, security group, NACL, or DNS is missing, the connection fails.
Traps
Overlapping CIDRs break peering; VPC peering does not transit to a third VPC; forgetting return routes; opening all ports because "it works"; assuming security groups are stateless.