Nutanix NCP-VDI cheat sheet

AHV is the native Nutanix hypervisor; ESXi and Hyper-V are also supported for Nutanix-hosted VDI, but Frame and most reference designs assume AHV.

Core stack: AOS (distributed storage fabric), AHV hypervisor, Prism Element (cluster) and Prism Central (multi-cluster), Flow networking/security, Files, and Objects.

Prism Central is required for categories, Calm blueprints, and multi-cluster management; Prism Element alone manages a single cluster.

Nutanix recommends sizing VDI via the VDI sizing tool or Sizer, using steady-state IOPS per desktop rather than peak boot IOPS.

Typical persistent VDI: 1 vCPU and 4-8 GB RAM per knowledge-worker desktop; graphics workloads need GPU passthrough or vGPU.

Nutanix clusters scale in 1-node increments (commonly 3-4 minimum for production); RF2 tolerates one node/disk failure, RF3 tolerates two.

Nutanix Frame is the DaaS control plane; Xi Frame is the hosted/cloud-delivered variant managed by Nutanix.

Nutanix does not require a separate SAN; storage is local to each node and distributed by the AOS storage fabric (DSF).

Frame delivers Windows desktops and apps from a browser; the Frame Platform runs on AHV, AWS, Azure, or GCP depending on the deployment.

Frame components: Frame Console (admin), Frame Gateway, Frame Guest Agent (installed in the image), and the Frame Streaming protocol.

Frame uses a pool model: each pool references a published image and defines instance type, capacity, and session/desktop mode.

Frame supports two session modes: Desktop (one user per VM) and Application (multiple users per VM, session host).

Frame autoscaling uses a min/max instance count with a buffer; idle instances are stopped to control cost.

Frame publishes images from a source VM snapshot; publishing creates a new image version and does not alter the source VM.

Frame requires outbound HTTPS (443) from the guest agent to Frame services; inbound ports are not opened to the internet.

Xi Frame is the Nutanix-managed service; self-hosted Frame can run on customer AHV clusters or public cloud accounts.

Session-host (RDS) mode shares one Windows Server OS across multiple users; VDI mode gives each user a dedicated Windows client OS VM.

RDS session hosts require the Remote Desktop Session Host role and a licensing server; per-user or per-device RDS CALs apply.

For multi-session Windows 10/11, use the Enterprise multi-session SKU; it requires the appropriate Microsoft licensing.

Golden-image VMs should be sysprep'd or use a Nutanix guest customization to assign unique SIDs and hostnames on clone.

Nutanix Guest Tools (NGT) provides guest-agent-based file restore, volume snapshot quiescing, and Prism visibility.

Set the VM's power policy and affinity rules to distribute desktops across hosts; anti-affinity prevents single-host hotspots.

For GPU desktops, configure vGPU profiles in AHV or passthrough a physical GPU; each profile has a fixed framebuffer allocation.

Disable Windows Update auto-reboot and set the time zone/keyboard in the golden image before publishing; changes after publishing require a new image.

AOS uses a distributed storage fabric with data locality; hot data is served from the local CVM on the host running the VM.

Capacity tiering: SSD/HDD hybrid or all-flash; the hot tier is SSD, the cold tier is HDD in hybrid configurations.

Boot storms are the dominant VDI IOPS spike; mitigate with image caching, linked clones, or Nutanix Frame/instant clones.

Nutanix Volumes presents iSCSI LUNs to external hosts; Nutanix Files provides SMB/NFS shares for profile and home directories.

AHV networking uses virtual switches and VLAN-backed networks; use a dedicated VLAN for VDI traffic to isolate broadcast domains.

Flow Network Security provides distributed microsegmentation; policies are applied per VM category, not per physical port.

Nutanix recommends 10 GbE or higher for VDI hosts; 25 GbE is common for dense VDI clusters.

Monitor CVM latency and storage controller IOPS in Prism; sustained high latency on the CVM indicates a storage or network bottleneck.

FSLogix is the recommended profile container for VDI; it mounts a VHDX per user and supports Office container for cached data.

FSLogix profile containers require a file share (Nutanix Files or SMB) with adequate IOPS and permissions for the user's SID.

App layering separates the base OS, apps, and user data; Nutanix supports FSLogix app masking and App Volumes-style layering on supported platforms.

Nutanix image management: create an image from a VM or ISO, then clone desktops from that image; images are versioned in Prism.

Golden-image lifecycle: patch base image, sysprep, create new image version, update the pool, then retire the old version.

Nutanix Frame image publishing creates an immutable image; roll back by republishing a prior image version.

Profile and home-directory shares should be on Nutanix Files or a dedicated VM, not on the CVM or the hypervisor host OS.

Use Nutanix Guest Tools for in-guest file restore and for quiesced snapshots before image updates.

Prism uses role-based access control (RBAC); roles are assigned to users/groups and scoped to projects or clusters.

Nutanix supports AD/LDAP authentication for Prism and Frame; local admin accounts should be rotated and restricted.

Flow Network Security enforces microsegmentation policies at the vNIC level, independent of the physical network.

Flow policies are defined by categories (e.g., 'VDI-Desktop') and applied to VMs matching those categories.

Data-at-rest encryption is supported via self-encrypting drives (SEDs) and Nutanix data-at-rest encryption (software-based).

Nutanix compliance: FIPS 140-2 validated crypto modules, Common Criteria, and support for HIPAA/PCI workloads with the right controls.

Audit logs in Prism Central record admin actions; forward them to a SIEM for compliance retention.

Frame enforces MFA for user access and supports SSO via SAML/OIDC identity providers.

Prism Element shows cluster health, alerts, and per-VM performance; Prism Central adds multi-cluster dashboards and analysis.

Nutanix Insights (or Prism Central analysis) surfaces best-practice findings and recommended upgrades.

LCM (Life Cycle Manager) automates AOS, AHV, firmware, and NCC upgrades; run NCC before and after upgrades.

Common VDI troubleshooting: boot storms (IOPS spike), profile load latency (FSLogix share IOPS), and CVM network saturation.

Check the CVM's storage latency and the host's network throughput when desktops feel slow; correlate with the time of day.

NCC (Nutanix Cluster Check) validates cluster health and flags configuration drift; run it as part of lifecycle operations.

Snapshot and clone operations should be scheduled off-peak; they consume storage IOPS and can affect VDI responsiveness.

Frame pool health is monitored in the Frame Console; check instance status, session count, and autoscaling events.