KB at your finger tips

This is one stop global knowledge base where you can learn about all the products, solutions and support features.

Storage and Backups-Nutanix

File Analytics Guide

Files 2.2

Last updated: 2022-06-14

File Analytics

File Analytics provides data and statistics on the operations and contents of a file server.

Once deployed, Files adds an File Analytics VM to the Files cluster. A single File Analytics VM supports all file servers in the cluster; however, you must enable File Analytics separately for each file server. Data on the File Analytics VM is protected, and is kept in a separate volume group.

Once you deploy File Analytics, a new File Analytics link appears on the file server actions bar. You can access File Analytics through this link for any file server where it is enabled.

Display Features

The File Analytics web console consists of display features:

Main menu bar : The main menu bar appears at the top of every page of the File Analytics web console. The main menu bar includes the following display features:

Dashboard tab : View widgets that present data on file trends, distribution, and operations.
Audit Trails tab : Search for a specific user or file and view various widgets to audit activity.
Anomalies tab : Create anomaly policies and view anomaly trends.
Status icon : Check the file system scan status.
File server drop-down : View the name of the file server for which data is displayed.
Settings drop-down : Manage File Analytics and configure settings.
Health icon : Check the health of File Analytics.
Admin dropdown : Collect logs and view the current File Analytics version.

Deployment Requirements

Meet the following requirements prior to deploying File Analytics.

Ensure that you have performed the following tasks and your Files deployment meets the following specifications.

Assign the file server administrator role to an Active Directory (AD) user, see Managing Roles in the Nutanix Files Guide .
Log on as the Prism admin user to deploy the File File Analytics server.
Configure a VLAN with one dedicated IP address for File Analytics, or you can use an IP address from an existing Files external network. This IP address must have connectivity to AD, the control VM (CVM), and Files. See "Configuring a Virtual Network For Guest VM Interfaces" in the Prism Web Console Guide.
Note: Do not install File Analytics on the Files internal network.
(optional) Assign the file server administrator role to an LDAP user, see Managing Roles in the Nutanix Files Guide .
Ensure that all software components meet the supported configurations and system limits, see the File Analytics Release Notes .

Network Requirements

Open the required ports and ensure that your firewall allows bi-directional Internet Control Message Protocol (ICMP) traffic between the FAVM and CVMs.

The Port Reference provides detailed port information for Nutanix products and services, including port sources and destinations, service descriptions, directionality, and protocol requirements.

In addition to meeting the File Analytics network requirements, ensure to meet Nutanix Files port requirements as described in the Port Reference .

Limitations

File Analytics has the following limitations.

Note: Depending on data set size, file count, and workload type, enabling File Analytics can affect the performance of Nutanix Files. High latency is more common with heavy file-metadata operations (directory and file creation, deletion, permission changes, and so on). To minimize the impact on performance, ensure that the host has enough CPU and memory resources to handle the File Analytics VM (FAVM), file servers, and guest VMs (if any).

Only Prism admin users can deploy Analytics. Active Directory (AD) users and AD users mapped to Prism admin roles cannot deploy File Analytics.
Analytics analyzes data from 1 month up to 1 year based on the configuration. Analytics automatically deletes data beyond the defined configuration.
Note: After surpassing the 750 million audit event threshold, Analytics archives the oldest events. Archived audit events do not appear in the Analytics UI.
You cannot deploy or decommission Analytics when a file server has high-availability (HA) mode enabled.
You cannot use network segmentation for Nutanix Volumes with File Analytics.
If file server DNS or IP changes, File Analytics does not automatically reconfigure.
File Analytics does not collect metadata for files on Kerberos authenticated NFS v4.0 shares.
If File Analytics is running on a one-node file server, you cannot upgrade using the Life Cycle Manager (LCM)
File Analytics does not support hard links.
You cannot enable File Analytics on a file server clone.
You cannot move File Analytics to another storage container.
File Analytics creates an unprotected Prism and an unprotected file server user for integration purposes. Do not delete these users.
The legacy file blocking policy has an upper limit of 300 ransomware extensions.
Note: For higher limits, it is recommended to use Nutanix Data Lens.

Administration

Overview of administrative processes for File Analytics.

As an admin, you have the privileges to perform administrative tasks for File Analytics. To add a file server admin user, see Managing Roles in the Nutanix Files Guide . The topics in this chapter describe the basics for administering your File Analytics environment. For advanced administrative options, refer to the File Analytics Options chapter.

Deploying File Analytics

Follow this procedure to deploy the File Analytics server.

Before you begin

Ensure that your environment meets all requirements prior to deployment, see Deployment Requirements.

Procedure

Deploying the File Analytics server.

Go to Support Portal > Downloads > File Analytics .
Download the File Analytics QCOW2 and JSON files.
Log on to Prism with the user name and password of the Prism administrator.

Note: An Active Directory (AD) user or an AD user mapped to a Prism admin role cannot deploy File Analytics.
In Prism, go to the File Server view and click the Deploy File Analytics action link.

Figure. File Analytics
Click to enlarge
Review the File Analytics requirements and best practices in the Pre-Check dialog box.
In the Deploy File Analytics Server dialog box, do the following in the Image tab.
- Under Available versions , select one of the available File Analytics versions. (continue to step 8.).
- Install by uploading installation binary files (continue to next step).
Upload installation files.
1. In the Upload binary section, click upload the File Analytics binary to upload the File Analytics JSON and QCOW files.
  
  Figure. Upload Binary Link Click to enlarge
2. Under File Analytics Metadata File (.Json) , click Choose File to choose the downloaded JSON file.
3. Under File Analytics Installation Binary (.Qcow2) click Choose File to choose the downloaded QCOW file.
  
  Figure. Upload Binary Files Click to enlarge
4. Click Upload Now after choosing the files.
Click Next .
In the VM Configuration tab, do the following in the indicated fields:
1. Name : Enter a name for the File Analytics VM (FAVM).
2. Server Size : Select either the small or large configuration. Large file servers require larger configurations for the FAVM. By default File Analytics selects the large configuration.
3. Storage Container: select a storage container from the drop-down.
  The drop-down only displays file server storage containers.
4. Network List : Select a VLAN.
  
  Note: If the selected network is unmanaged , enter more network details in the Subnet Mask , Default Gateway IP , and IP Address fields as indicated.
  
  Note: The FAVM must use the client-side network.
Click Deploy .
In the main menu drop-down, select the Tasks view to monitor the deployment progress.

Results

Once deployment is complete, File Analytics creates an FAVM, CVM, and a new Files user to make REST API calls. Do not delete the CVM, FAVM, or the REST API user. A new Manage File Analytics link appears in the Prism Element File Server view.

Enabling File Analytics

Steps for enabling File Analytics after deployment or disablement.

About this task

Attention: Nutanix recommends enabling File Analytics during off-peak hours.

Follow these steps to enable File Analytics after disabling the application.

Note: File Analytics saves all previous configurations.

Procedure

In the File Server view in Prism , select the target file server.
(skip to step 3 if you are re-enabling a file server) click Manage roles to add a file server admin user, see Managing Roles in the Nutanix Files Guide .
In the File Server view, select the target file server and click File Analytics in the tabs bar.
(Skip to step 5 if you are not re-enabling a disabled instance of File Analytics) to re-enable File Analytics, click Enable File Analytics in the message bar.

Figure. Enabling File Analytics Link Click to enlarge

The Enable File Analytics dialog-box appears. Skip the remaining steps.
In the Data Retention field, select a data retention period. The data retention period refers to the length of time File Analytics retains audit events.
In the Authentication section, enter the credentials as indicated:

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. (For SMB users only) In the SMB section, do the following in the indicated fields to provide SMB authentication details:
  - Active Directory Realm Name : Confirm the AD realm name for the file server.
  - Username : Enter the AD username for the file server administrator, see File Analytics Prerequisites .
  - Password : Enter the AD user password for the file server administrator.
2. (For NFS users only) In the NFS Authentication section, do the following in the indicated fields to provide NFS authentication details:
  - LDAP Server URI : Enter the URI of the LDAP server.
  - Base DN : Enter the base DN for the LDAP server.
  - Password : Enter the LDAP user password for the file server administrator.
Click to enlarge
Click Enable .

Results

After enablement, File Analytics performs a one-time file system scan to pull metadata information. The duration of the scan varies depending on the protocol of the share. There is no system downtime during the scan.

Example

Scanning 3–4 million NFS files or 1 million SMB files takes about 1 hour.

Disabling File Analytics

About this task

Follow the steps as indicated to disable File Analytics.

Procedure

In File Analytics click the gear icon > Disable File Analytics .
In the dialog-box, click Disable .
Disabling File Analytics disables data collection. The following message banner appears.
```
 File Analytics is disabled on the server. Enable File Analytics to start collecting data again or Delete File Analytics Data. 
```

What to do next

To delete data, click the Delete File Analytics Data link in the banner described in Step 2.

Launching File Analytics

About this task

Do the following to launch File Analytics.

Procedure

From the Prism views drop-down, select the File Server view.
Select the target file server from the entity tab.
Click the File Analytics action button below the entity table.

Figure. Launch File Analytics Click to enlarge

File Analytics VM Management

To update an File Analytics VM (FAVM), refer to the sizing guidelines in the File Analytics release notes and follow the steps in the VM Management topic of the Prism Web Console Guide .

Removing File Analytics VMs

Remove a File Analytics VM (FAVM) by disabling it and deleting it from the cluster in Prism.

About this task

Follow the steps as indicated to remove an FAVM.

Note: Do not delete an FAVM using the CLI, as this operation does not decommission the FAVM.

Procedure

Disable File Analytics on all file servers in the cluster, see Disabling File Analytics.
In the File Server view in Prism Element, do the following:
1. In the top actions bar, click Manage File Analytics .
2. Click Delete to remove the FAVM.
When you delete an FAVM, you also delete all of your File Analytics configurations and audit data stored on the FAVM.

Updating Credentials

About this task

Follow the steps as indicated to update authentication credentials for LDAP or Active Directory.

Procedure

Click gear icon > Update AD/LDAP Configuration .
To update Active Directory credentials, do the following in the indicated fields (otherwise move on to the next step).

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. Active Directory Realm Name: confirm or replace the realm name.
2. Username: confirm or replace the username.
3. Password: type in the new password.
To update NFS configuration, do the following (otherwise move on to the next step).
1. LDAP Server URI: confirm or replace the server URI.
2. Base DN: confirm or replace the base distinguished name (DN).
3. Bind DN (Optional): confirm or replace the bind distinguished name (DN).
4. Password: type in the new password.
Click Save .

Managing Deleted Share/Export Audits

Manage the audit data of delete shares and exports.

About this task

By default, File Analytics retains deleted share and export data. The dashboard widgets do not account for data of deleted shares and exports. The deleted marker appears adjacent to deleted shares and exports in audit trails. The Manage Share/Export Audit data window displays a list of deleted shares and exports.

Follow the directions as indicated to delete audit data for the deleted share or export.

Note: You cannot restore the deleted audit data of a deleted share or export.

Procedure

Click the gear icon > Manage Deleted Share/Export Audit .
Check the box adjacent to the share or export name.
Click Delete .
In the confirmation window, click Delete to confirm the deletion of data.
In the Manage Deleted Share/Export Audit , a progress bar displays the progress of the deletion process next to the share name. File Analytics considers data deletion of a deleted share a low-priority task, which may take several hours to finish.

Upgrades

Perform File Analytics upgrades using the Life Cycle Manager feature in Prism Element.

Before you upgrade File Analytics, ensure that you are running a compatible version of AOS and Files. Refer to File Analytics release notes for compatibility details. You can upgrade both AOS and Files through Prism Element, see AOS Upgrade in the Prism Web Console Guide .

To upgrade File Analytics, perform inventory and updates using the Life-Cycle Manager (LCM), see the Life Cycle Manager Guide for instructions on performing inventory and updates. LCM cannot upgrade File Analytics when the protection domain (PD) for the File Analytics VM (FAVM) includes any other entities.

Note: The File Analytics UI is not accessible during upgrades.

During the upgrade process, File Analytics takes a snapshot of the volume group (VG) that contains File Analytics data. If issues occur during an upgrade, File Analytics restores the FAVM to the pre-upgrade state. If the volume group is protected and is part a protection domain, the File Analytics creates a snapshot and sets the expiry time to 30 days. If the volume group is not protected, File Analytics creates a snapshot and deletes the snapshot after completing the upgrade successfully. If any errors occur, the system keeps the snapshot for 30 days to troubleshoot the issue.

Upgrade File Analytics at a Dark Site

Upgrade File Analytics at a dark site using the Life-Cycle Manager (LCM).

About this task

Before you begin

You need a local web server reachable by your Nutanix clusters to host the LCM repository.

Procedure

From a device that has public Internet access, go to Nutanix Portal > Downloads > Tools & Firmware .
1. Download the tar file lcm_dark_site_version.tar.gz .
2. Transfer lcm_dark_site_version.tar.gz to your local web server and untar into the release directory.
From a device that has public Internet access, go to the Nutanix portal and select Downloads > File Analytics .
1. Download the following files.
  - file_analytics_dark_site_version.tar.gz
  - nutanix_compatibility.tgz
  - nutanix_compatibility.tgz.sign
2. Transfer file_analytics_dark_site_version.tar.gz to your local web server and untar into the release directory.
3. Transfer the nutanix_compatibility.tgz and nutanix_compatibility.tgz.sign files to your local web server (overwrite existing files as needed).
Log on to Prism Element.
Click Home > LCM > > Settings .
1. In the Fetch updates from field, enter the path to the directory where you extracted the tar file on your local server. Use the format http://webserver_IP_address/release .
2. Click Save .
  You return to the Life Cycle Manager.
3. In the LCM sidebar, click Inventory > Perform Inventory .
4. Update the LCM framework before trying to update any other component.
  The LCM sidebar shows the LCM framework with the same version as the file you downloaded.

Dashboard

The Dashboard tab displays data on the operational trends of a file server.

Dashboard View

The Dashboard tab is the opening screen that appears after launching File Analytics from Prism. The dashboard displays widgets that present data on file trends, distribution, and operations.

Table 1. Dashboard Widgets
Tile Name	Description	Intervals
Capacity Trend	Displays capacity trends for the file server including capacity added, capacity removed, and net changes. Clicking an event period widget displays the Capacity Trend Details view.	Seven days, the last 30 days, or the last 1 year.
Data Age	Displays the percentage of data by age.	Less than 3 months, 3–6 months, 6–12 months, and > 12 months.
Anomaly Alerts	Displays alerts for configured anomalies, see Configuring Anomaly Detection.
Permission Denials	Displays users who have had excessive permission denials and the number of denials. Clicking a user displays audit details, see Audit Trails - Users for more.	[user id], [number of permission denials]
File Distribution by Size	Displays the number of files by file size. Provides trend details for top 5 files.	Less than 1 MB, 1–10 MB, 10–100 MB, 100 MB to 1 GB, greater than 1 GB).
File Distribution by Type	Displays the space taken up by various applications and file types. The file type is determined by the file extension. See the File Types table for more details.	MB or GB
File Distribution by Type Details view	Displays a trend graph of the top 5 file types. File distribution details include file type, current space used, current number of file, and change in space for the last 7 or 30 days. Clicking View Details displays the File Distribution by Type view.	Daily size trend for top 5 files (GB), file type (see File Type table), current space used (GB), current number of files (numeric), change in last 7 or 30 days (GB).
Top 5 active users	Lists the users who have accessed the most files and number of operations the user performed for the specified period. When there are more than 5 active users, the more link provides details on the top 50 users. Clicking the user name displays the audit view for the user, see Audit Trails - Users for more.	24 hours, 7 days, 1 month, or 1 year.
Top 5 accessed files	Lists the 5 most frequently accessed files. Clicking more provides details on the top 50 files. Clicking the file name displays the audit view details for the file, see Audit Trails - Files for more.	Twenty-four hours, 7 days, 1 month, or 1 year.
Files Operations	Displays the distribution of operation types for the specified period including a count for each operation type and the total sum of all operations. Operations include: create, delete, read, write, rename, permission changed, set attribute, symlink, permission denied, permission denied (file blocking). Clicking an operation displays the File Operation Trend view.	Twenty-four hours, 7 days, 1 month, or 1 year.

Capacity Trend Details

Clicking an event period in the Capacity Trend widget displays the Capacity Trend Details view for that period. The view includes three tabs Share/Export , Folder , and Category . Each tab includes columns detailing entity details: Name . Net Capacity Change, Capacity Added, and Capacity Removed.

Table 2. Capacity Trend Details
Category	Supported File Type
Name	Name of share/export, folder, or category.
Net Capacity Change	The total difference between capacity at the beginning and the end of the specified period.
Share Name (for folders only)	The name of the share or export that the folder belongs to.
Capacity Added	Total added capacity for the specified period.
Capacity Removed	Total removed capacity for the specified period.

File Distribution by Type Details

Clicking View Details for the File Distribution by Type widget displays granular details of file distribution, see the File Types table below for details.

Clicking View Details on the File Distribution by Type widget displays the File Distribution by Type dashboard.

Table 3. Details of File Distribution Parameters
Category	Supported File Type
File Type	Name of file type
Current Space Used	Space capacity occupied by the file type
Current Number of Files	Number of files for the file type
Change (In Last 30 Days)	The increase in capacity over a 30 day period of time for the specified file type .

Table 4. File Types
Category	Supported File Type
Archives	.cab, .gz, .rar, .tar, .z, .zip
Audio	.aiff, .au, .mp3, .mp4, .wav, .wma
Backups	.bak, .bkf, .bkp
CD/DVD Images	.img, .iso, .nrg
Desktop Publishing	.qxd
Email Archives	.pst
Hard Drive images	.tib, .gho, .ghs
Images	.bmp, .gif, .jpg, .jpeg, .pdf .png, .psd, .tif, .tiff,
Installers	.msi, .rpm
Log Files	.log
Lotus Notes	.box, .ncf, .nsf, .ns2, .ns3, .ns4, .ntf
MS Office Documents	.accdb, .accde, .accdt, .accdr, .doc, .docx, .docm, .dot, .dotx, .dotm, .xls, .xlsx, .xlsm, .xlt, .xltx, .xltm, .xlsb, .xlam, .ppt, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .mdb
System Files	.bin, .dll, .exe
Text Files	.csv, .pdf, .txt
Video	.avi, mpg, .mpeg, .mov, .m4v
Disk Image	.hlog, .nvram, .vmdk, .vmx, .vmxf, .vmtm, .vmem, .vmsn, .vmsd

File Operation Trend

Clicking an operation type in the File Operations widget displays the File Operation Trend view. The File Operation Trend view breaks down the specified period into smaller intervals, and displays the number of occurrences of the operation during each interval.

A graph displays the number of times the specified operation took place over time.

Table 5. File Operation Trend View Parameters
Category	Description
Operation Type	A drop-down option to specify the operation type. See Files Operations in the Dashboard Widgets table for a list of operation types.
Last (time period)	A drop-down option to specify the period for the file operation trend.
File operation trend graph	The x-axis displays shorter intervals for the specified period. The y-axis displays the number of operations trend over the extent of the intervals.

Managing File Categories

File Analytics uses the file category configuration to classify file extensions.

About this task

The capacity widget in the dashboard uses the category configuration to calculate capacity details.

Procedure

Click gear icon > Manage File Category .
To create a new category, click + New Category . (Otherwise, move on to step 3).
1. In the Category column, name the category.
2. In the Extensions column, specify file extensions for the category.
To delete an existing category, click the x icon next to the category. (Otherwise, move on to step 4)
To modify an existing category, click the pencil icon next to the category and modify the specified file extensions.
Click save .

Health

The Health dashboard displays dynamically updated health information about each File File Analytics component.

The Health dashboard includes the following details:

Data Summary Data summary of all file servers with File Analytics enabled.
Host Memory Percent of used memory on the File Analytics VM (FAVM).
Host CPU Usage Percent of CPU used by the FAVM.
Storage Summary Amount of storage space used on the File Analytics data disk or FAVM disk.
Overall Health Overall health of File Analytics components.
Data Server Summary Data server usage by component.

The Health page dashboard includes tiles that dynamically update to indicate the health of relevant entities.

Anomalies

Data panes in the Anomalies tab display data and trends for configured anomalies.

The Anomalies tab provides options for creating anomaly policies and displays dashboards for viewing anomaly trends.

Note: Configure an SMTP server to send anomaly alerts, see Configuring an SMTP Server

You can configure anomalies for the following operations:

Creating files and directories
Deleting files and directories
Permission changes
Permission denials
Renaming files and directories
Reading files and directories

Define anomaly rules by the specifying the following conditions:

Users exceed an operation count threshold
Users exceed an operation percentage threshold

Meeting the lower operation threshold triggers an anomaly.

Consider a scenario where you have 1 thousand files, the operation count threshold defined as 10, and the operation percentage threshold defined as 10%. The count threshold takes precedence, as 10% of 1 thousand is 100, which is greater than the count threshold of 10.

The Anomalies dashboard displays anomaly trends.

Table 1. Anomalies Data Pane Descriptions
Pane Name	Description	Values
Anomaly Trend	Displays the number of anomalies per day or per month.	Last 7 days, Last 30 days, Last 1 year
Top Users	Displays the users with the most anomalies and the number of anomalies per user.	Last 7 days, Last 30 days, Last 1 year
Top Folders	Displays the folders with the most anomalies and the number of anomalies per folder.	Last 7 days, Last 30 days, Last 1 year
Operation Anomaly Types	Displays the percentage of occurrences per anomaly type.	Last 7 days, Last 30 days, Last 1 year

Anomaly Details

Clicking an anomaly bar in the Anomaly Trend graph displays the Anomaly Details view.

Table 2. Anomalies Details View Total Results Table
Column	Description
Anomaly Type	The configured anomaly type. Anomaly types not configured do not show up in the table.
Total User Count	The number of users that have performed the operation causing the specified anomaly during the specified time range.
Total Folder Count	The numbers of folders in which the anomaly occurred during the specified time range.
Total Operation Count	Total number of anomalies for the specified anomaly type that occurred during the specified time range.
Time Range	The time range for which the total user count, total folder count, and total operation count are specified.

Table 3. Anomalies Details View Users/Folders Table
Column	Description
Username or Folders	Indicates the entity for the operation count. Selecting the Users tab indicates operation count for specific users, and selecting the Folders tab indicates the operation count for specific folders.
Operation count	The total number of operations causing anomalies for the selected user or folder during the time period for the bar in the Anomaly Trend graph.

Configuring Anomaly Detection

Steps for configuring anomaly rules.

About this task

Configure an SMTP server for File Analytics to send anomaly alerts, see Configuring an SMTP Server. To create an anomaly rule, do the following.

Procedure

In the File Analytics web console, click the gear icon > Define Anomaly Rules. .
In the Anomaly Email Recipients field, enter a comma-separated list of email recipients for all anomaly alerts and data.

Note: File Analytics sends anomaly alerts and data to recipients whenever File Analytics detects an anomaly.
To configure a new anomaly, do the following in the indicated fields:
1. Events : Select a rule for the anomaly from one of the following:
  - Permission changed
  - Permission denied
  - Delete
  - Create
  - Rename
  - Read
  The event defines the scenario type for the anomaly.
2. Minimum Operations % : Enter a percentage value for the minimum threshold.
  File Analytics calculates the minimum operations percentage based on the number of files. For example, if there are 100 files, and you set the minimum operations percentage to 5, five operations within the scan interval would trigger an anomaly alert.
3. Minimum Operation Count : Enter a value for a minimum operation threshold.
  File Analytics triggers an anomaly alert after meeting the threshold.
4. User : Choose if the anomaly rule is applicable for All Users or an Individual user.
5. Type: the type determines the interval.
  The interval determines how far back File Analytics monitors the anomaly.
6. Interval : Enter a value for the detection interval.
7. (optional) Actions : Click the pencil icon to update an anomaly rule. Click the x icon to delete an existing rule.
Figure. Anomaly Configuration Fields Click to enlarge
Click Save .

Configuring an SMTP Server

File Analytics uses a simple mail transport protocol (SMTP) server to send anomaly alerts.

About this task

To configure an SMTP server, do the following:

Procedure

In the File Analytics web console, click the gear icon > SMTP Configuration .
In the SMTP Configuration window, enter the indicated details in the following fields:
1. Hostname Or IP Address : Enter a fully qualified domain name or IP address for the SMTP server.
2. Port : Enter the port to use.
  The standard SMTP ports are 25 (encrypted), 587 (TLS), and 465 (SSL).
3. Security Mode : Enter the desired security mode from the dropdown list.
  The options are:
  - NONE (unencrypted)
  - STARTTLS (TTL encryption)
  - SSL (SSL encryption)
4. (If security mode is "NONE" go to step f.)
5. User Name enter a user name for logging into the SMTP server. Depending on the authentication method, the user name may require a domain.
6. Password enter password.
7. From Email Address: enter the email address from which File Analytics will send the anomaly alerts.
8. Recipient Email Address: enter a recipient email address to test the SMTP configuration.
Figure. SMTP Configuration Click to enlarge
Click Save .

Audit Trails

Use audit trails to look up operation data for a specific user, file, folder, or client.

The Audit Trails tab includes Files , Folders , Users , and Client IP options for specifying the audit type. Use the search bar for specifying the specific entity for the audit (user, folder, file, or client IP).

The results table presents details for entities that match the search criteria. Clicking the entity name (or client IP number) takes you to the Audit Trails dashboard for the target entity.

View Audit Trails

Audit a user, file, client, or folder.

About this task

Procedure

Click the Audit Trails tab.
Select the Files , Folders , Users , or Client IP option.
Enter the audit trails target into the search bar.
Click Search .
To display audit results in the Audit Trails window, click the entity name (or client IP number).

Audit Trails - Users

Details for client IP Audit Trails.

Audit Trails Search - Users

When you search by user in the Audit Trails tab, search results display the following information in a table.

User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

A table displays user search results for the query.

Audit Details Page - Users

Clicking View Audit displays the Audit Details page, which shows the following audit information for the selected user.

A User Events graph displays various operations the user performed during the selected period and the percentage of time each operation has occurred per total operations during the specified period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Remove Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
- The filter bar , above the User Events graph, displays the filters in use.
- Use the From and To fields to filter by date.
The Results table displays operation-specific information. See more details below.
The Reset Filters button removes all filters.

User Events table displays event rates for various operations performed by the user.

The Results table provides granular details of the audit results. The following data is displayed for every event.

User Name
User IP Address
Operation
Operation Date
Target File

Click the gear icon for options to download the data as an xls, csv, or JSON file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

The results table displays a detailed view of the audit data.

Audit Trails - Folders

Dashboard details for folder audits.

The following information displays when you search by file in the Audit Trails tab.

Folder Name
Folder Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

The Audit Details page shows the following audit information for the selected folder.

A Folder Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Select All
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Remove Directory
  - Rename
  - Set Attribute
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Files

Dashboards details for file audit.

Audit Trails for Files

When you search by file in the Audit Trails tab, the following information displays:

File Name
File Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

A table displays file search results for the query.

Note: File Analytics does not support regular-expression (RegEx) based search.

The Audit Details page shows the following audit information for the selected file.

A File Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Close File
  - Create File
  - Delete
  - Make Directory
  - Open
  - Read
  - Rename
  - Set Attribute
  - Write
  - Symlink
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

File Events table displays event rates for various operations for the file.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

Username
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Client IP

Dashboard details for client IP Audit Trails.

Audit Trails Search - Client IP

When you search by client IP in the Audit Trails tab, search results display the following information in a table.

Client IP
User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

A table displays IP search results for the query

The Audit Details page shows the following audit information for the selected client.

A User Events graph displays various operations performed on the client during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Removed Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
  - Permission Denied (File Blocking)
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Operation
Target File
Operation Date

Click the gear icon for an option to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

File Analytics Options

You can get more insight into the usage and contents of files on your system by configuring and updating File Analytics features and settings. Some options include scanning the files on your file server on demand, updating data retention, and configuring data protection.

Updating Data Retention

The data retention period determines how long File Analytics retains event data.

About this task

Follow the steps as indicated to configure data retention.

Procedure

In File Analytics, click gear icon > Update Data Retention .
In the Data Retention Period drop-down, select the period for data retention.
Click Update .

Scanning the File System

Once enabled, File Analytics scans the metadata of all files and shares on the system. You can perform an on-demand scan of shares in your file system.

About this task

To scan shares, perform the following task:

Procedure

In File Analytics, click the gear icon .
In the drop-down list, click Scan File System .

Figure. Scan File System Option Click to enlarge
In the list of shares, select the target shares for the scan.

Figure. Select Scan Targets Click to enlarge
Click Scan .
The status of the share is In Progress . Once the scan is complete, the status changes to Completed .

Blacklisting

Blacklist users, file extensions, and client IPs.

About this task

Use the blacklisting feature to block audit events from being performed on specified file extensions or by specified users and clients.

Procedure

Click the gear icon > Define Blacklisting Rules .
Click the pencil icon in the user, file extension, or client IP row.
Add a comma separated list of entities that you want blocked.
Click save in the updated row.

Data Protection

Configure File Analytics disaster recovery (DR) using Prism Element.

File Analytics only supports async disaster recovery. File Analytics does not support NearSync and metro availability.

Create an async protection domain, configure a protection domain schedule, and configure remote site mapping. The remote site must have symmetric configurations to the primary site. The remote site must also deploy File Analytics to restore a File Analytics VM (FAVM).

The Data Protection section in the Prism Web Console Guide provides more detail on the disaster recovery process.

Configuring Disaster Recovery

To set up disaster recovery for File Analytics, create an async protection domain, configure a protection domain schedule, and configure remote site mapping.

About this task

By default, the File Analytics volume group resides on the same container that hosts vDisks for Nutanix Files.

Procedure

If you have not done so already, configure a remote site for the local cluster.
See the Configuring a Remote Site (Physical Cluster) topic in the Prism Web Console Guide for this procedure.
Create an async DR protection domain for the File Analytics volume group as the entity. The volume group name is File_Analytics_VG .
See Configuring a Protection Domain (Async DR) in the Prism Web Console Guide .
In the Schedule tab, click the New Schedule button to add a schedule.
Add a schedule, as File Analytics does not provide a default schedule. See Creating a Protection Domain Schedule (Files) Nutanix Files Guide.
Configure local and remote container mapping.
See the Configuring Disaster Recovery (Files) section in the Nutanix Files Guide for steps to configure mapping between local and remote containers.
Create a protection domain schedule.
See Creating a Protection Domain Schedule (Files) in the Nutanix Files Guide .

Activating Disaster Recovery

Recover a File Analytics VM (FAVM) after a planned or unplanned migration to the remote site.

About this task

Perform the following tasks on the remote site.

Procedure

Fail over to the protection domain for disaster recovery activation.
See the Failing Over a Protection Domain topic in the Prism Web Console Guide .
Fail back the protection domain to the primary site.
See the Failing Back a Protection Domain topic in the Prism Web Console Guide .

Deploying File Analytics on a Remote Site

Deploy a File Analytics VM (FAVM) after a planned or unplanned (disaster) migration to the remote site.

About this task

To perform disaster recovery, deploy and enable File Analytics on the remote site. Restore the data using a snapshot of the volume group from the primary FAVM.

Before you begin

Ensure that the Nutanix Files and AOS versions match the versions on the remote and primary sites.

About this task

Run the following commands from the command prompt inside the FAVM.

Procedure

Deploy a new File Analytics instance on the remote site, see Deploying File Analytics.

Caution: Do not enable File Analytics.
The remote site requires an iSCSI data service IP address to configure the FAVM on the remote site. This procedure deploys a new volume group File_Analytics_VG and deletes it in a subsequent step.
On the remote site, create a volume group by restoring the snapshot of the File_Analytics_VG .
See Restoring an Entity from a Protection Domain in the Prism Web Console Guide . For the How to Restore step, use the Create new entities option, and specify a name in the Volume Group Name Prefix field. The restored volume group name format is prefix -File_Analytics_VG.
In the Storage Table view, go to the Volumes tab.
1. Copy the target IQN prefix from the Volume Group Details column.
  
  Tip: Click the tooltip to see the entire IQN prefix.
To configure the FAVM on the remote, follow these steps:

Caution: If the IP address of the File Analytics VM has changed on the remote site, contact Nutanix Support before proceeding.
1. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
2. To discover all storage devices accessed by the FAVM, run the following commands.
```
nutanix@favm$  sudo blkid 
```
3. Copy the cvm.config file to the temporary files directory.
```
nutanix@favm$ cd /mnt/containers/config/common_config/
nutnix@avm$ sudo cp cvm.config /tmp
```
4. Stop the File Analytics services.
```
nutanix@favm$  sudo systemctl stop monitoring
```
```
nutanix@favm$  docker stop $(docker ps -q)
```
```
nutanix@favm$  sudo systemctl stop docker
```
5. Unmount and log off from all iSCSI targets.
```
nutnix@avm$ sudo umount /mnt
```
```
nutnix@avm$ sudo /sbin/iscsiadm -m node -u
```
6. Remove the disconnected target records from the discoverydb mode of the FAVM.
```
nutanix@favm$  sudo /sbin/iscsiadm -m node –o delete
```
7. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
```
  The output does not show the /dev/sdb device.
8. Get the File Analytics Linux client iSCSI initiator name.
```
nutanix@favm$  sudo cat /etc/iscsi/initiatorname.iscsi
```
  The output displays the initiator name.
```
InitiatorName=iqn.1991-05.com.redhat:8ef967b5b8f
```
9. Copy the iSCSI initiator name.
10. Remove the iSCSI initiator name from the client whitelist of the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
11. Whitelist the AVM client on the cloned volume group prefix -File_Analytics_VG using the iSCSI initiator name of the AVM client.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
12. Let the Analytics initiator discover the cluster and its volume groups.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode discovery --type sendtargets --portal  data_services_IP_address:3260
```
  Clicking the Nutanix cluster name in Prism displays cluster details including the data service IP address. The output displays the restored iSCSI target from step 2.
13. Connect to the volume target by specifying IQN prefix.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode node --targetname iqn_name --portal data_services_IP_address:3260,1 --login
```
14. Restart the FAVM to restart the iSCSI host adapters, which allows the discovery of the attached volume group.
```
nutanix@favm$  sudo reboot
```
15. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
16. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
  The FAVM discovers the attached iSCSI volume group and assigns to the /dev/sdb device.
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
/dev/sdb: UUID="30749ab7-58e7-437e-9a09-5f6d9619e85b" TYPE="ext4"
```
17. Delete the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
18. Rename the restored volume group prefix -File_Analytics_VG to File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
19. Create a backup of the cvm.config file.
```
nutanix@favm$ cd /mnt/containers/config/common_config/
nutanix@favm$ mv cvm.config cvm_bck.config
```
20. Copy the cvm.config file from the /tmp directory to /common_config/ on the FAVM.
```
nutanix@favm$ cd /tmp
nutanix@favm$ mv cvm.config /mnt/containers/config/common_config/
```
21. Reconfigure the password of the user on Prism for internal FAVM operations. Specify a passphrase for new password . File Analytics uses the password only for internal communication between Prism and the FAVM. You must issue the same command twice.
```
nutanix@favm$ sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
 --password='new password' --local_update
```
```
nutanix@favm$  sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
--password='new password' --prism_user=admin --prism_password='Prism admin password'
```
22. In File Analytics, go to gear icon > Scan File System to check if a file system scan can be initiated.
  
  Note: If you receive errors, disable and re-enable File Analytics, see "Disabling File Analytics" and "Enabling File Analytics."

File Analytics Guide

Files 3.1

Product Release Date: 2022-04-05

Last updated: 2022-11-04

File Analytics

File Analytics provides data and statistics on the operations and contents of a file server.

Once deployed, Nutanix Files adds a File Analytics VM (FAVM) to the Files cluster. A single File Analytics VM supports all file servers in the cluster; however, you must enable File Analytics separately for each file server. File Analytics protects data on the FAVM, which is kept in a separate volume group.

Once you deploy File Analytics, a new File Analytics link appears on the file server actions bar. Use the link to access File Analytics on any file server that has File Analytics enabled.

Note: File Analytics supports dual NIC configuration for segmented networks. Contact Nutanix Support for assistance.

Display Features

The File Analytics web console consists of display features:

Main menu bar : The main menu bar appears at the top of every page of the File Analytics web console. The main menu bar includes the following display features:

Dashboard tab : View widgets that present data on file trends, distribution, and operations, see Dashboard.
Audit Trails tab : Search for a specific user or file and view various widgets to audit activity, see Audit Trails.
Anomalies tab : Create anomaly policies and view anomaly trends, see Anomalies.
Ransomware tab : Configure ransomware protection and self-service restore (SSR) snapshots, see Ransomware Protection.
Warning: Ransomware protection helps detect potential ransomware. Nutanix does not recommend using the File Analytics ransomware feature as an all-encompassing ransomware solution.
Reports tab : Create custom reports or use pre-canned report templates, see Reports.
Status icon : Check the file system scan status.
File server drop-down : View the name of the file server for which data is displayed.
Settings drop-down : Manage File Analytics and configure settings, see Administration and File Analytics Options.
Health icon : Check the health of File Analytics, see Health.
Admin dropdown : Collect logs and view the current File Analytics version.

Deployment Requirements

Meet the following requirements prior to deploying File Analytics.

Ensure that you have performed the following tasks and your Files deployment meets the following specifications.

Assign the file server administrator role to an Active Directory (AD) user, see Managing Roles in the Nutanix Files Guide .
Log on as the Prism admin user to deploy the File Analytics server.
Configure a VLAN with one dedicated IP address for File Analytics, or you can use an IP address from an existing Files external network. This IP address must have connectivity to AD, the control VM (CVM), and Files. See "Configuring a Virtual Network For guest VM Interfaces" in the Prism Web Console Guide.
Note: Do not install File Analytics on the Files internal network.
(optional) Assign the file server administrator role to an LDAP user, see Managing Roles in the Nutanix Files Guide .
Ensure that all software components meet the supported configurations and system limits, see the File Analytics Release Notes .

Network Requirements

Open the required ports, and ensure that your firewall allows bi-directional Internet Control Message Protocol (ICMP) traffic between the FAVM and CVMs.

The Port Reference provides detailed port information for Nutanix products and services, including port sources and destinations, service descriptions, directionality, and protocol requirements.

In addition to meeting the File Analytics network requirements, ensure to meet Nutanix Files port requirements as described in the Port Reference .

Limitations

File Analytics has the following limitations.

Only Prism admin can deploy File Analytics.
File Analytics analyzes data from daily up to 1 year based on the configuration. File Analytics automatically deletes data beyond the defined configuration.
Note: After surpassing the audit event threshold, as specified in File Analytics Release Notes , Analytics archives the oldest events. Archived audit events do not appear in the Analytics UI.
You cannot deploy or decommission File Analytics when a file server has high-availability (HA) mode enabled.
You cannot use network segmentation for Nutanix Volumes with File Analytics.
If file server DNS or IP changes, File Analytics does not automatically reconfigure.
File Analytics does not collect metadata for files on Kerberos authenticated NFS v4.0 shares.
File Analytics does not support hard links.
You cannot enable File Analytics on a file server clone.
You cannot move File Analytics to another storage container.
File Analytics creates an unprotected Prism and an unprotected file server user for integration purposes. Do not delete these users.
The legacy file blocking policy has an upper limit of 300 ransomware extensions.
Note: For higher limits, it is recommended to use Nutanix Data Lens.
File Analytics does not support the following operations for graceful shutdown:
- AHV: power cycle, power off
- ESXi: power off, reset
File Analytics log collection from CVM fails with dual NIC setup.
File Analytics does not collect metadata information on shares, offline shares, and encrypted shares.
Teardown of File Analytics fails in case of dual NIC setup.

Administration

Overview of administrative processes for File Analytics.

As an admin, you have the required permissions for performing File Analytics administrative tasks. To add a file server admin user, see Managing Roles in the Nutanix Files Guide . The topics in this chapter describe the basics for administering your File Analytics environment. For advanced administrative options, refer to the File Analytics Options chapter.

Role-based Access Control for File Analytics

Prism Element supports role-based access control (RBAC) that allows you to configure and provide customized access to the users based on their assigned roles.

Note: Log in to File Analytics with local user created on Prism Central is not supported.

From the Prism Element dashboard, you can assign a set of predefined built-in roles (system roles) roles to users or user groups. File Analytics support the following built-in roles (system roles) that are defined by default:

Note: Only administrators (Super Admin or a Prism Admin in Prism Element) can create roles for File Analytics.

- Viewer : Allows users with view-only access to the information and cannot perform any administrative (create or modify) tasks.
- Cluster and User Admin : Allows users to view information, perform administrative tasks, and to create and modify operations.
For more information on Role Based Access Control, refer to the Controlling User Access (RBAC) , Built-in Role Management , Configuring Role Mapping , and Managing Local User Accounts sections in the Security Guide .

Deploying File Analytics

Follow this procedure to deploy the File Analytics server.

Before you begin

Ensure that your environment meets all requirements prior to deployment, see Deployment Requirements.

Procedure

Deploying the File Analytics server.

Go to Support Portal > Downloads > File Analytics .
Download the File Analytics QCOW2 and JSON files.
Log on to Prism with the user name and password of the Prism administrator.

Note: An Active Directory (AD) user or an AD user mapped to a Prism admin role cannot deploy File Analytics.
In Prism, go to the File Server view and click the Deploy File Analytics action link.

Figure. File Analytics
Click to enlarge
Review the File Analytics requirements and best practices in the Pre-Check dialog box.
In the Deploy File Analytics Server dialog box, do the following in the Image tab.
- Under Available versions , select one of the available File Analytics versions. (continue to step 8.).
- Install by uploading installation binary files (continue to next step).
Upload installation files.
1. In the Upload binary section, click upload the File Analytics binary to upload the File Analytics JSON and QCOW files.
  
  Figure. Upload Binary Link Click to enlarge
2. Under File Analytics Metadata File (.Json) , click Choose File to choose the downloaded JSON file.
3. Under File Analytics Installation Binary (.Qcow2) click Choose File to choose the downloaded QCOW file.
  
  Figure. Upload Binary Files Click to enlarge
4. Click Upload Now after choosing the files.
Click Next .
In the VM Configuration tab, do the following in the indicated fields:
1. Name : Enter a name for the File Analytics VM (FAVM).
2. Server Size : Select either the small or large configuration. Large file servers require larger configurations for the FAVM. By default File Analytics selects the large configuration.
3. Storage Container: select a storage container from the drop-down.
  The drop-down displays the storage containers.
  Note: From AOS 5.15.3 version onward, the drop-down displays all storage containers. For earlier AOS versions, the drop-down only displays file server storage containers.
4. Network List : Select a VLAN.
  
  Note: If the selected network is unmanaged , enter more network details in the Subnet Mask , Default Gateway IP , and IP Address fields as indicated.
  
  Note: The FAVM must use the client-side network.
  
  Note: For ESXi, do not use the Controller VM (CVM) backplane network. The CVM backplane network is not supported and any later upgrade operations might fail.
Click Deploy .
In the main menu drop-down, select the Tasks view to monitor the deployment progress.

Results

Once deployment is complete, File Analytics creates an FAVM, CVM, and a new Files user to make REST API calls. Do not delete the CVM, FAVM, or the REST API user.

Enabling File Analytics

Steps for enabling File Analytics after deployment or disablement.

About this task

Attention: Nutanix recommends enabling File Analytics during off-peak hours.

Follow these steps to enable File Analytics after disabling the application.

Note: File Analytics saves all previous configurations.

Procedure

In the File Server view in Prism , select the target file server.
(skip to step 3 if you are re-enabling a file server) click Manage roles to add a file server admin user, see Managing Roles in the Nutanix Files Guide .
In the File Server view, select the target file server and click File Analytics in the tabs bar.
(Skip to step 5 if you are not re-enabling a disabled instance of File Analytics) to re-enable File Analytics, click Enable File Analytics in the message bar.

Figure. Enabling File Analytics Link Click to enlarge

The Enable File Analytics dialog-box appears. Skip the remaining steps.
In the Data Retention field, select a data retention period. The data retention period refers to the length of time File Analytics retains audit events.
In the Authentication section, enter the credentials as indicated:

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. (For SMB users only) In the SMB section, do the following in the indicated fields to provide SMB authentication details:
  - Active Directory Realm Name : Confirm the AD realm name for the file server.
  - Username : Enter the AD username for the file server administrator, see File Analytics Prerequisites .
  - Password : Enter the AD user password for the file server administrator.
2. (For NFS users only) In the NFS Authentication section, do the following in the indicated fields to provide NFS authentication details:
  - LDAP Server URI : Enter the URI of the LDAP server.
  - Base DN : Enter the base DN for the LDAP server.
  - Password : Enter the LDAP user password for the file server administrator.
Click to enlarge
Click Enable .

Results

Example

Scanning 3–4 million NFS files or 1 million SMB files takes about 1 hour.

Disabling File Analytics

About this task

Follow the steps as indicated to disable File Analytics.

Procedure

In File Analytics click the gear icon > Disable File Analytics .
In the dialog-box, click Disable .
Disabling File Analytics disables data collection. The following message banner appears.
```
 File Analytics is disabled on the server. Enable File Analytics to start collecting data again or Delete File Analytics Data. 
```

What to do next

To delete data, click the Delete File Analytics Data link in the banner described in Step 2.

Launching File Analytics

About this task

Do the following to launch File Analytics.

Procedure

From the Prism views drop-down, select the File Server view.
Select the target file server from the entity tab.
Click the File Analytics action button below the entity table.

Figure. Launch File Analytics Click to enlarge

File Analytics VM Management

To update a File Analytics VM (FAVM), refer to the sizing guidelines in the File Analytics release notes and follow the steps in the VM Management topic of the Prism Web Console Guide .

Removing File Analytics VMs

Remove a File Analytics VM (FAVM) by disabling it and deleting it from the cluster in Prism.

About this task

Follow the steps as indicated to remove an FAVM.

Note: Do not delete an FAVM using the CLI, as this operation does not decommission the FAVM.

Procedure

Disable File Analytics on all file servers in the cluster, see Disabling File Analytics.
In the File Server view in Prism Element, do the following:
1. In the top actions bar, click Manage File Analytics .
2. Click Delete to remove the FAVM.
When you delete an FAVM, you also delete all of your File Analytics configurations and audit data stored on the FAVM.

Updating Credentials

About this task

Follow the steps as indicated to update authentication credentials for LDAP or Active Directory.

Procedure

Click gear icon > Update AD/LDAP Configuration .
To update Active Directory credentials, do the following in the indicated fields (otherwise move on to the next step).

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. Active Directory Realm Name: confirm or replace the realm name.
2. Username: confirm or replace the username.
3. Password: type in the new password.
To update NFS configuration, do the following (otherwise move on to the next step).
1. LDAP Server URI: confirm or replace the server URI.
2. Base DN: confirm or replace the base distinguished name (DN).
3. Bind DN (Optional): confirm or replace the bind distinguished name (DN).
4. Password: type in the new password.
Click Save .

Managing Deleted Share/Export Audits

Manage the audit data of delete shares and exports.

About this task

By default, File Analytics retains deleted share and export data. The dashboard widgets do not account for data of deleted shares and exports. The deleted marker appears next to deleted shares and exports in audit trails. The Manage Share/Export Audit data window displays a list of deleted shares and exports.

Follow the directions as indicated to delete audit data for the deleted share or export.

Note: You cannot restore the deleted audit data of a deleted share or export.

Procedure

Click the gear icon > Manage Deleted Share/Export Audit .
Check the box next to the share or export name.
Click Delete .
In the confirmation window, click Delete to confirm the deletion of data.
In the Manage Deleted Share/Export Audit , a progress bar displays the progress of the deletion process next to the share name. File Analytics considers data deletion of a deleted share a low-priority task, which can take several hours to finish.

Changing an FAVM Password

Steps for updating the password of a File Analytics VM (FAVM).

About this task

Context for the current task

Procedure

Log on to an FAVM with SSH.
Change the nutanix password.
```
nutanix@fsvm$ sudo passwd nutanix
```
Respond to the prompts, providing the current and new nutanix user password.
```
Changing password for user nutanix.
Old Password:
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
```
Note:
The password must meet the following complexity requirements:
- At least 8 characters long
- At least 1 lowercase letter
- At least 1 uppercase letter
- At least 1 number
- At least 1 special character
- At least 4 characters difference from the old password
- Should not be among the last 10 passwords

Upgrades

Perform File Analytics upgrades using the Life Cycle Manager feature in Prism Element.

Before you proceed with the FA upgrade, ensure you meet the following:

Have a compatible version of AOS and Files.
Refer to File Analytics release notes for compatibility details. You can upgrade both AOS and Files through Prism Element, see AOS Upgrade in the Prism Web Console Guide .
Check the health page of File Analytics to confirm if the overall health is green. See Health.
The protection domain (PD) for the File Analytics VM (FAVM) should not include any other entities.

To upgrade File Analytics, perform inventory and updates using the Life-Cycle Manager (LCM), see the Life Cycle Manager Guide for instructions on performing inventory and updates.

Note: The File Analytics UI is not accessible during upgrades.

Upgrade File Analytics at a Dark Site

Upgrade File Analytics at a dark site using the Life-Cycle Manager (LCM).

About this task

Before you begin

You need a local web server reachable by your Nutanix clusters to host the LCM repository.

Procedure

From a device that has public Internet access, go to Nutanix Portal > Downloads > Tools & Firmware .
1. Download the tar file lcm_dark_site_version.tar.gz .
2. Transfer lcm_dark_site_version.tar.gz to your local web server and untar into the release directory.
From a device that has public Internet access, go to the Nutanix portal and select Downloads > File Analytics .
1. Download the following files.
  - file_analytics_dark_site_version.tar.gz
  - nutanix_compatibility.tgz
  - nutanix_compatibility.tgz.sign
2. Transfer file_analytics_dark_site_version.tar.gz to your local web server and untar into the release directory.
3. Transfer the nutanix_compatibility.tgz and nutanix_compatibility.tgz.sign files to your local web server (overwrite existing files as needed).
Log on to Prism Element.
Click Home > LCM > > Settings .
1. In the Fetch updates from field, enter the path to the directory where you extracted the tar file on your local server. Use the format http://webserver_IP_address/release .
2. Click Save .
  You return to the Life Cycle Manager.
3. In the LCM sidebar, click Inventory > Perform Inventory .
4. Update the LCM framework before trying to update any other component.
  The LCM sidebar shows the LCM framework with the same version as the file you downloaded.

Dashboard

The Dashboard tab displays data on the operational trends of a file server.

Dashboard View

The Dashboard tab is the opening screen that appears after launching File Analytics for a specific file server. The dashboard displays widgets that present data on file trends, distribution, and operations.

Note: Widgets refresh hourly.

Table 1. Dashboard Widgets
Tile Name	Description	Intervals
Capacity trend	Displays capacity trends for the file server including capacity added, capacity removed, and net changes. Clicking an event period widget displays the Capacity Trend Details view.	7 days, the last 30 days, or the last 1 year.
Data age	Displays the percentage of data by age. Data age determines the data heat, including: hot, warm, and cold.	Default intervals are as follows: Hot data – accessed within the last week. Warm data – accessed within 2 to 4 weeks. Cold data – accessed 4 weeks ago or later.
Permission denials	Displays users who have had excessive permission denials and the number of denials. Clicking a user displays audit details, see Audit Trails - Users for more.	[user id], [number of permission denials]
File distribution by size	Displays the number of files by file size. Provides trend details for top 5 files.	Less than 1 MB, 1–10 MB, 10–100 MB, 100 MB to 1 GB, greater than 1 GB).
File distribution by type	Displays the space taken up by various applications and file types. The file extension determines the file type. See the File types table for more details.	MB or GB
File distribution by type details view	Displays a trend graph of the top 5 file types. File distribution details include file type, current space used, current number of files, and change in space for the last 7 or 30 days. Clicking View Details displays the File Distribution by Type view.	Daily size trend for top 5 files (GB), file type (see the "File Type" table), current space used (GB), current number of files (numeric), change in last 7 or 30 days (GB).
Top 5 active users	Lists the users who have accessed the most files and number of operations the user performed for the specified period. When there are more than 5 active users, the more link provides details on the top 50 users. Clicking the user name displays the audit view for the user, see Audit Trails - Users for more.	24 hours, 7 days, 1 month, or 1 year.
Top 5 accessed files	Lists the 5 most frequently accessed files. Clicking more provides details on the top 50 files. Clicking the file name displays the audit view details for the file, see Audit Trails - Files for more.	24 hours, 7 days, 1 month, or 1 year.
Files operations	Displays the distribution of operation types for the specified period, including a count for each operation type and the total sum of all operations. Operations include: create, delete, read, write, rename, permission changed, set attribute, symlink, permission denied, permission denied (file blocking). Clicking an operation displays the File Operation Trend view.	24 hours, 7 days, 1 month, or 1 year.

Capacity Trend Details

Clicking an event period in the Capacity Trend widget displays the Capacity Trend Details view for that period. The view includes three tabs Share/Export , Folder , and Category . Each tab includes columns detailing entity details: Name . Net capacity change, capacity added, and capacity removed.

Table 2. Capacity Trend Details
Category	Supported File Type
Name	Name of share/export, folder, or category.
Net capacity change	The total difference between capacity at the beginning and the end of the specified period.
Share name (for folders only)	The name of the share or export that the folder belongs to.
Capacity added	Total added capacity for the specified period.
Capacity removed	Total removed capacity for the specified period.

File Distribution by Type Details

Clicking View Details for the File Distribution by Type widget displays granular details of file distribution, see the File Types table for details.

Table 3. Details of File Distribution Parameters
Category	Supported File Type
File type	Name of file type
Current space used	Space capacity occupied by the file type
Current number of files	Number of files for the file type
Change (in last 30 days)	The increase in capacity over a 30-day period for the specified file type

Table 4. File Types
Category	Supported File Type
Archives	.cab, .gz, .rar, .tar, .z, .zip
Audio	.aiff, .au, .mp3, .mp4, .wav, .wma
Backups	.bak, .bkf, .bkp
CD/DVD images	.img, .iso, .nrg
Desktop publishing	.qxd
Email archives	.pst
Hard drive images	.tib, .gho, .ghs
Images	.bmp, .gif, .jpg, .jpeg, .pdf .png, .psd, .tif, .tiff,
Installers	.msi, .rpm
Log Files	.log
Lotus notes	.box, .ncf, .nsf, .ns2, .ns3, .ns4, .ntf
MS Office documents	.accdb, .accde, .accdt, .accdr, .doc, .docx, .docm, .dot, .dotx, .dotm, .xls, .xlsx, .xlsm, .xlt, .xltx, .xltm, .xlsb, .xlam, .ppt, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .mdb
System files	.bin, .dll, .exe
Text files	.csv, .pdf, .txt
Video	.avi, mpg, .mpeg, .mov, .m4v
Disk image	.hlog, .nvram, .vmdk, .vmx, .vmxf, .vmtm, .vmem, .vmsn, .vmsd

File Operation Trend

Table 5. File Operation Trend View Parameters
Category	Description
Operation type	A drop-down option to specify the operation type. See Files Operations in the Dashboard Widgets table for a list of operation types.
Last (time period)	A drop-down option to specify the period for the file operation trend.
File operation trend graph	The x-axis displays shorter intervals for the specified period. The y-axis displays the number of operations trend over the extent of the intervals.

Health

The Health dashboard displays dynamically updated health information about each file server component.

The Health dashboard includes the following details:

Data Summary Data summary of all file servers with File Analytics enabled.
Host Memory Percent of used memory on the File Analytics VM (FAVM).
Host CPU Usage Percent of CPU used by the FAVM.
Storage Summary Amount of storage space used on the File Analytics data disk or FAVM disk.
Overall Health Overall health of File Analytics components.
Data Server Summary Data server usage by component.

Data Age

The Data Age widget in the dashboard provides details on data heat.

Share-level data is displayed to provide details on share capacity trends. There are three levels of data heat:

Hot – frequently accessed data (last accessed within the last week).
Warm – infrequently accessed data (last accessed within the last 2 to 4 weeks).
Cold – rarely accessed data (last accessed longer than 4 weeks ago).

You can configure the definitions for each level of data heat rather than using the default values. See Configuring Data Heat Levels.

Configuring Data Heat Levels

Update the values that constitute different data heat levels.

Procedure

In the Data Age widget, click Explore .
Click Edit Data Age Configuration .
Do the following in the Hot Data section:
1. In the entry field next to Older Than , enter an integer.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Do the following in the Warm Data section to configure two ranges :
1. In the first entry field, enter an integer to configure the first range.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
3. In the second entry field, enter an integer to configure the second range.
4. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Do the following in the Cold Data section to configure four ranges :
1. In the first entry field, enter an integer to configure the first range.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
3. In the second entry field, enter an integer to configure the second range.
4. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
5. In the 3rd entry field, enter an integer to configure the 3rd range.
6. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
7. (optional) In the 4th entry field, enter an integer to configure the 4th range.
8. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Click Apply .

Note: The new values do not affect the already calculated heat statistics. File Analytics uses the updated values for future heat calculations.

Anomalies

Data panes in the Anomalies tab display data and trends for configured anomalies.

The Anomalies tab provides options for creating anomaly policies and displays dashboards for viewing anomaly trends.

You can configure anomalies for the following operations:

Creating files and directories
Deleting files and directories
Permission changes
Permission denials
Renaming files and directories
Reading files and directories

Define anomaly rules by the specifying the following conditions:

Users exceed an operation count threshold
Users exceed an operation percentage threshold

Meeting the lower operation threshold triggers an anomaly.

Table 1. Anomalies Data Pane Descriptions
Pane Name	Description	Values
Anomaly Trend	Displays the number of anomalies per day or per month.	Last 7 days, Last 30 days, Last 1 year
Top Users	Displays the users with the most anomalies and the number of anomalies per user.	Last 7 days, Last 30 days, Last 1 year
Top Folders	Displays the folders with the most anomalies and the number of anomalies per folder.	Last 7 days, Last 30 days, Last 1 year
Operation Anomaly Types	Displays the percentage of occurrences per anomaly type.	Last 7 days, Last 30 days, Last 1 year

Anomaly Details

Clicking an anomaly bar in the Anomaly Trend graph displays the Anomaly Details view.

Table 2. Anomalies Details View Total Results Table
Column	Description
Anomaly Type	The configured anomaly type. Anomaly types not configured do not show up in the table.
Total User Count	The number of users that have performed the operation causing the specified anomaly during the specified time range.
Total Folder Count	The numbers of folders in which the anomaly occurred during the specified time range.
Total Operation Count	Total number of anomalies for the specified anomaly type that occurred during the specified time range.
Time Range	The time range for which the total user count, total folder count, and total operation count are specified.

Table 3. Anomalies Details View Users/Folders Table
Column	Description
Username or Folders	Indicates the entity for the operation count. Selecting the Users tab indicates operation count for specific users, and selecting the Folders tab indicates the operation count for specific folders.
Operation count	The total number of operations causing anomalies for the selected user or folder during the time period for the bar in the Anomaly Trend graph.

Configuring Anomaly Detection

Steps for configuring anomaly rules.

About this task

To create an anomaly rule, do the following.

Note: Configure an SMTP server for File Analytics to send anomaly alerts, see Configuring an SMTP Server.

Procedure

In the File Analytics web console, click the gear icon > Define Anomaly Rules. .
In the Anomaly Email Recipients field, enter a comma-separated list of email recipients for all anomaly alerts and data.

Note: File Analytics sends anomaly alerts and data to recipients whenever File Analytics detects an anomaly.
To configure a new anomaly, do the following in the indicated fields:
1. Events : Select a rule for the anomaly from one of the following:
  - Permission changed
  - Permission denied
  - Delete
  - Create
  - Rename
  - Read
  The event defines the scenario type for the anomaly.
2. Minimum Operations % : Enter a percentage value for the minimum threshold.
  File Analytics calculates the minimum operations percentage based on the number of files. For example, if there are 100 files, and you set the minimum operations percentage to 5, five operations within the scan interval would trigger an anomaly alert.
3. Minimum Operation Count : Enter a value for a minimum operation threshold.
  File Analytics triggers an anomaly alert after meeting the threshold.
4. User : Choose if the anomaly rule is applicable for All Users or an Individual user.
5. Type: the type determines the interval.
  The interval determines how far back File Analytics monitors the anomaly.
6. Interval : Enter a value for the detection interval.
7. (optional) Actions : Click the pencil icon to update an anomaly rule. Click the x icon to delete an existing rule.
Figure. Anomaly Configuration Fields Click to enlarge
Click Save .

Configuring an SMTP Server

File Analytics uses a simple mail transport protocol (SMTP) server to send anomaly alerts.

About this task

To configure an SMTP server, do the following:

Procedure

In the File Analytics web console, click the gear icon > SMTP Configuration .
In the SMTP Configuration window, enter the indicated details in the following fields:
1. Hostname Or IP Address : Enter a fully qualified domain name or IP address for the SMTP server.
2. Port : Enter the port to use.
  The standard SMTP ports are 25 (encrypted), 587 (TLS), and 465 (SSL).
3. Security Mode : Enter the desired security mode from the dropdown list.
  The options are:
  - NONE (unencrypted)
  - STARTTLS (TTL encryption)
  - SSL (SSL encryption)
4. (If security mode is "NONE" go to step f.)
5. User Name enter a user name for logging into the SMTP server. Depending on the authentication method, the user name may require a domain.
6. Password enter password.
7. From Email Address: enter the email address from which File Analytics will send the anomaly alerts.
8. Recipient Email Address: enter a recipient email address to test the SMTP configuration.
Figure. SMTP Configuration Click to enlarge
Click Save .

Audit Trails

Use audit trails to look up operation data for a specific user, file, folder, or client.

The results table presents details for entities that match the search criteria. Clicking the entity name (or client IP number) takes you to the Audit Trails dashboard for the target entity.

View Audit Trails

Audit a user, file, client, or folder.

About this task

Follow the steps as indicated.

Procedure

Click the Audit Trails tab.
Select the Files , Folders , Users , or Client IP option.
Enter the audit trails target into the search bar.
Click Search .
To display audit results in the Audit Trails window, click the entity name (or client IP number).

Audit Trails - Users

Details for client IP Audit Trails.

Audit Trails Search - Users

When you search by user in the Audit Trails tab, search results display the following information in a table.

User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

Audit Details Page - Users

Clicking View Audit displays the Audit Details page, which shows the following audit information for the selected user.

A User Events graph displays various operations the user performed during the selected period and the percentage of time each operation has occurred per total operations during the specified period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Remove Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
- The filter bar , above the User Events graph, displays the filters in use.
- Use the From and To fields to filter by date.
The Results table displays operation-specific information. See more details below.
The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. The following data is displayed for every event.

User Name
User IP Address
Operation
Operation Date
Target File

Click the gear icon for options to download the data as an xls, csv, or JSON file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Folders

Dashboard details for folder audits.

The following information displays when you search by file in the Audit Trails tab.

Folder Name
Folder Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

The Audit Details page shows the following audit information for the selected folder.

A Folder Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Select All
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Remove Directory
  - Rename
    
    Note: Rename operation shows both change of name and change of path for specific file or folder.
  - Set Attribute
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Files

Dashboards details for file audit.

Audit Trails for Files

When you search by file in the Audit Trails tab, the following information displays:

File Name
File Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

Note:

File Analytics does not support regular expression (RegEx) based search.
Up to 500 million files with latest 3 months of audit data is supported for a file server.

The Audit Details page shows the following audit information for the selected file.

A File Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Close File
  - Create File
  - Delete
  - Make Directory
  - Open
  - Read
  - Rename
    
    Note: Rename operation shows both change of name and change of path for specific file or folder.
  - Set Attribute
  - Write
  - Symlink
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

Username
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Client IP

Dashboard details for client IP Audit Trails.

Audit Trails Search - Client IP

When you search by client IP in the Audit Trails tab, search results display the following information in a table.

Client IP
User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

The Audit Details page shows the following audit information for the selected client.

A User Events graph displays various operations performed on the client during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Removed Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
  - Permission Denied (File Blocking)
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Operation
Target File
Operation Date

Click the gear icon for an option to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Ransomware Protection

Ransomware protection for your file server.

Caution: Ransomware protection helps detect potential ransomware. Nutanix does not recommend using the File Analytics ransomware feature as an all-encompassing ransomware solution.

File Analytics scans files for ransomware in real time and notifies you in the event of a ransomware attack once you configure email notifications.

Using a curated a list of over 250 signatures that frequently appear in ransomware files, the Nutanix Files file blocking mechanism identifies and blocks files with ransomware extensions from carrying out malicious operations. You can modify the list by manually adding or removing signatures.

Note: Removing curated blocked signatures can prevent File Analytics from blocking some ransomware files.

File Analytics also monitors shares for self-service restore (SSR) policies and identifies shares that do not have SSR enabled in the ransomware dashboard. You can enable SSR through the ransomware dashboard.

Ransomware Protection Features

The ransomware dashboard includes panes for managing ransomware protection and self-service restore (SSR).

Ransomware Dashboard

The ransomware dashboard includes two main sections:

The SSR Status pane for viewing, enabling, and managing SSR, see Enabling SSR.
The Vulnerabilities (Infection Attempts) pane for viewing total vulnerabilities, vulnerable shares, malicious clients, and top recent ransomware attempts.
- Clicking on the number of total vulnerabilities provides a detailed view of recent vulnerabilities.
- Clicking on the number of vulnerable shares provides a detailed view of vulnerable shares.
- Clicking on the number of malicious clients provides a detailed view of malicious clients.
Click Settings , to enable and configure ransomware protection, see Enabling Ransomware Protection and Configuring Ransomware Protection.
Click Download (.csv) to download a list of blocked ransomware signatures.

Enabling Ransomware Protection

Enable ransomware protection on your file server.

About this task

Procedure

Go to dropdown menu > Ransomware .
In the message banner, click Enable Ransomware Protection .
(optional) Click Configure SMTP to Add Recipients.

Note: This option appears only if you have not configured a simple mail transfer protocol (SMTP) server, see Configuring an SMTP Server.
Under Ransomware Email Recipients , add at least one email address. If there is a ransomware attack, File Analytics sends a notification to the specified email address.

Figure. Enable Ransomware Click to enlarge
Click Enable .
See Configuring Ransomware Protection for configuration steps.

Configuring Ransomware Protection

Configure ransomware protection on file servers.

About this task

Do the following to add signature to the blocked extension list.

Procedure

Go to dropdown menu > Ransomware > > Settings .
(optional) Under Search for blocked File Signatures , enter ransomware signatures in the *. (signature) format.
1. Note: You can also remove ransomware signatures.
  To check that the signature has been blocked, click Search .
2. If the signature has not been blocked, click Add to Block List .
Figure. Click to enlarge
(optional) To download a list of blocked ransomware signatures, click Download (.csv) .
(optional) Under Ransomware Email Recipients , add a comma separated list of email addresses. If there is a ransomware attack, File Analytics sends a notification to the specified email addresses.
(optional) To disable the ransomware protection feature, click Disable Ransomware Protection .

Enabling SSR

Enable self-service restore on shares identified by File Analytics.

About this task

File Analytics scans shares for SSR policies.

Procedure

Go to dropdown menu > Ransomware .
Click Enable SSR on Prism .
Check the box next to the shares for which to enable SSR.

Figure. Enable SSR on Shares Click to enlarge
Click Enable SSR .

Reports

Generate a report for entities on the file server.

Create a report with custom attribute values or use one of the File Analytics pre-canned report templates. To create a custom report, specify the entity, attributes (and operators for some attributes), attribute values, column headings, and the number of columns. Pre-canned reports define most of the attributes and headings based on the entity and template that you choose.

The Reports dashboard displays a table or previously generated reports. You can rerun existing reports rather than creating a template. After creating a report, you can download it as a JSON or CSV file.

Reports Dashboard

The reports dashboard includes options to create, view, and download reports.

The Reports dashboard includes options to create a report, download reports as a JSON, download reports as a CSV, rerun reports, and delete reports.

The reports table includes columns for the report name, status, last run, and actions.

Clicking Create a new report takes you to the report creation screen, which includes a Report builder and a Pre-canned Reports Templates tabs. The tabs include report options and filters for report configuration.

Both tabs include the following elements:

The Define Report Type section includes an Entity drop-down menu to select an entity.
The Define Filters section includes an Attribute drop-down menu and an option to add more attributes by clicking + Add filter .
The Add/remove columns in this report in your report section displays default columns. Clicking the columns field lets you add addition columns to the report. Clicking the x next to the column name removes it from the report.
The Define number of maximum rows in this report section includes a Count section to specify the number of rows in the report.

Table 1. Report Builder – Filter Options
Entity	Attributes (filters)	Operator	Value	Column
Events	event_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	audit_path (object path) audit_objectname (object name) audit_operation (operation) audit_machine_name (source of operation) audit_event_date (event date in UTC) audit_username (user name)
Events	Event_operation	N/A	file_write file_read file_create file_delete rename directory_create directory_delete SecurityChange (permission change) set_attr sym_link
Files	Category	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	object_name (file name) share_UUID (share name) object_owner_name (owner name) object_size_logical (size) file_type (extension) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) fileserver_protocol object_ID (file id) object_last_operation_name (last operation) audit_username (last operation user object_last_operation_name (last operation) file_path (file path)
	Extensions	N/A	(type in value)
	Deleted	N/A	Last (number of days from 1 to 30) days
	creation_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
	access_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
	Size	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(number) (file size) File size options: B KB MB GB TB
Folders	Deleted	N/A	Last (number of days from 1 to 30) days	object_name (Dir name) object_owner_name (owner name) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) object_last_operation_name (last operation) audit_username (last operation user) File server protocol object_ID (file id) file_path (Dir path)
Folders	creation_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
Users	last_event_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	user_login_name (user name) Last operation last_event_date (access date in UTC) last_operation_audit_path

Table 2. Pre-Canned Reports – Filters
Entity	Pre-canned report template	Columns
Events	PermissionDenied events Permission Denied (file blocking) events	audit_path (object path) audit_objectname (object name) audit_operation (operation) audit_machine_name (source of operation) audit_event_date (event date in UTC) audit_username (user name)
Files	Largest Files Oldest Files Files not accessed for last 1 year Files accessed in last 30 days	object_name (file name) share_UUID (share name) object_owner_name (owner name) object_size_logical (size) file_type (extension) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) fileserver_protocol object_ID (file id) object_last_operation_name (last operation) audit_username (last operation user object_last_operation_name (last operation) file_path (file path)
Users	Top owners with space consumed Top active users All users	user_login_name (user name) Last operation last_event_date (access date in UTC) last_operation_audit_path

Creating a Custom Report

Create a custom report by defining the entity, attribute, filters, and columns.

About this task

Follow the steps as indicated.

Procedure

Go to dropdown menu > Reports .
Click Create a new report .
In the Report Builder tab, do the following:
1. In the Define Report Type section, select an entity from the drop-down menu.
2. In the Define Filters section, select an attribute from the attributes dropdown.
3. Under Value , specify the values for the attribute (some attributes also require to specify an operator in the Operator field).
4. (optional) click + Add filter to add more attributes.
5. In the Add/Remove column in this report section, click x for the columns you want to remove.
6. In the Define maximum number of rows in this report section, type in , or use the - and + buttons, to specify the number of rows in your report. This value indicates the number of records in the report.
Click Run Preview .
The Report Preview section populates.
Click Generate report .
1. Select either the CSV or JSON option.

Create a Pre-Canned Report

Use one of the pre-canned File Analytics templates for your report.

Procedure

Go to dropdown menu > Reports .
Click Create a new report .
In the Pre-Canned Reports Templates tab, do the following:
1. In the Define Report Type section, select an entity from the drop-down menu.
2. In the Define Filters section, select an attribute from the attributes dropdown.
3. In the Add/Remove column in this report section, click x for the columns you want to remove.
4. In the Define maximum number of rows in this report section, type in, or use the - and + buttons, to specify the number of rows in your report. This value indicates the number of records in the report.
Click Run Preview .
The Report Preview section populates.
Click Generate report .
1. Select either the CSV or JSON option.

File Analytics Options

Updating Data Retention

The data retention period determines how long File Analytics retains event data.

About this task

Follow the steps as indicated to configure data retention.

Procedure

In File Analytics, click gear icon > Update Data Retention .
In the Data Retention Period drop-down, select the period for data retention.
Click Update .

Scanning the File System

Once enabled, File Analytics scans the metadata of all files and shares on the system. You can perform an on-demand scan of shares in your file system.

About this task

To scan shares, perform the following task.

Procedure

In File Analytics, click the gear icon .
In the drop-down list, click Scan File System .
In the list of shares, select the target shares for the scan.

Figure. Select Scan Targets Click to enlarge
Click Scan .
The status of the share is In Progress . Once the scan is complete, the status changes to Completed .

Deny List

Deny users, file extensions, and client IP addresses.

About this task

Use the Deny feature to block audit events from being performed on specified file extensions or by specified users and clients.

Note: Files with no extension cannot be denied.

Procedure

Click the gear icon > Define Rules for Deny List .
Click the pencil icon in the Client IPs , File Extensions , Users row.
Add a comma separated list of entities that you want blocked.
Click the done icon in the updated row, and then click Close .

Managing File Categories

File Analytics uses the file category configuration to classify file extensions.

About this task

The capacity widget in the dashboard uses the category configuration to calculate capacity details.

Procedure

Click gear icon > Manage File Category .
To create a category, click + New Category . (Otherwise, move on to step 3).
1. In the Category column, name the category.
2. In the Extensions column, specify file extensions for the category.
To delete an existing category, click the x icon next to the category. (Otherwise, move on to step 4)
To modify an existing category, click the pencil icon next to the category and modify the specified file extensions.
Click Save .

Data Protection

Configure File Analytics disaster recovery (DR) using Prism Element.

File Analytics only supports async disaster recovery. File Analytics does not support NearSync and metro availability.

The Data Protection section in the Prism Web Console Guide provides more detail on the disaster recovery process.

Configuring Disaster Recovery

To set up disaster recovery for File Analytics, create an async protection domain, configure a protection domain schedule, and configure remote site mapping.

About this task

By default, the File Analytics volume group resides on the same container that hosts vDisks for Nutanix Files.

Procedure

If you have not done so already, configure a remote site for the local cluster.
See the Configuring a Remote Site (Physical Cluster) topic in the Prism Web Console Guide for this procedure.
Create an async DR protection domain for the File Analytics volume group as the entity. The volume group name is File_Analytics_VG .
See Configuring a Protection Domain (Async DR) in the Prism Web Console Guide .
In the Schedule tab, click the New Schedule button to add a schedule.
Add a schedule, as File Analytics does not provide a default schedule. See Creating a Protection Domain Schedule (Files) Nutanix Files Guide.
Configure local and remote container mapping.
See the Configuring Disaster Recovery (Files) section in the Nutanix Files Guide for steps to configure mapping between local and remote containers.
Create a protection domain schedule.
See Creating a Protection Domain Schedule (Files) in the Nutanix Files Guide .

Activating Disaster Recovery

Recover a File Analytics VM (FAVM) after a planned or unplanned migration to the remote site.

About this task

Perform the following tasks on the remote site.

Procedure

Fail over to the protection domain for disaster recovery activation.
See the Failing Over a Protection Domain topic in the Prism Web Console Guide .
Fail back the protection domain to the primary site.
See the Failing Back a Protection Domain topic in the Prism Web Console Guide .

Deploying File Analytics on a Remote Site (AHV)

Deploy a File Analytics VM (FAVM) after a planned or unplanned (disaster) migration to the remote site.

About this task

To perform disaster recovery, deploy and enable File Analytics on the remote site. Restore the data using a snapshot of the volume group from the primary FAVM.

Before you begin

Ensure that the Nutanix Files and AOS versions match the versions on the remote and primary sites.

About this task

Run the following commands from the command prompt inside the FAVM.

Procedure

Deploy a new File Analytics instance on the remote site, see Deploying File Analytics.

Caution: Do not enable File Analytics.
The remote site requires an iSCSI data service IP address to configure the FAVM on the remote site. This procedure deploys a new volume group File_Analytics_VG and deletes in a subsequent step.
On the remote site, create a volume group by restoring the snapshot of the File_Analytics_VG .
See Restoring an Entity from a Protection Domain in Data Protection and Recovery with Prism Element . For the How to Restore step, use the Create new entities option, and specify a name in the Volume Group Name Prefix field. The restored volume group name format is prefix -File_Analytics_VG.
To configure the FAVM on the remote, follow these steps:

Caution: If the IP address of the File Analytics VM has changed on the remote site, contact Nutanix Support before proceeding.
1. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
2. To discover all storage devices accessed by the FAVM, run the following commands.
```
nutanix@favm$  sudo blkid 
```
3. Copy the cvm.config file to the temporary files directory.
```
nutanix@favm$ cd /mnt/containers/config/common_config /tmp
```
4. Stop the File Analytics services.
```
nutanix@favm$  sudo systemctl stop monitoring
```
```
nutanix@favm$  docker stop $(docker ps -q)
```
```
nutanix@favm$  sudo systemctl stop docker
```
5. Unmount the volume group.
```
nutnix@avm$ sudo umount /mnt
```
6. Detach the volume group File_Analytics_VG from the FAVM.
  See the "Managing a VM (AHV)" topic in the Prism Web Console Guide .
7. Attach the cloned volume group prefix -File_Analytics_VG to the FAVM.
  See "Managing a VM (AHV)" in the Prism Web Console Guide .
8. Restart the AVM to discover the attached volume group.
```
nutanix@avm$ sudo reboot 
```
9. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
10. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
```
  The FAVM discovers the attached volume group and assigns to the /dev/sdb device.
11. Delete the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
12. Rename the restored volume group prefix -File_Analytics_VG to File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
13. Create a backup of the cvm.config file.
```
nutanix@favm$ mv /mnt/containers/config/common_config/cvm.config \
/mnt/containers/config/common_config/cvm_bck.config
```
14. Copy the cvm.config file from the /tmp directory to /common_config/ on the FAVM.
```
nutanix@favm$ mv /tmp/cvm.config /mnt/containers/config/common_config/
```
15. Reconfigure the password of the user on Prism for internal FAVM operations. Specify a passphrase for new password . File Analytics uses the password only for internal communication between Prism and the FAVM. You must issue the same command twice.
```
nutanix@favm$ sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
 --password='new password' --local_update
```
```
nutanix@favm$  sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
--password='new password' --prism_user=admin --prism_password='Prism admin password'
```
16. In File Analytics, go to gear icon > Scan File System to check if a file system scan can be initiated.
  
  Note: If you receive errors, disable and re-enable File Analytics, see "Disabling File Analytics" and "Enabling File Analytics."

Deploying File Analytics on a Remote Site (ESXi)

Deploy a File Analytics VM (FAVM) after a planned or unplanned (disaster) migration to the remote site.

About this task

To perform disaster recovery, deploy and enable File Analytics on the remote site. Restore the data using a snapshot of the volume group from the primary FAVM.

Before you begin

Ensure that the Nutanix Files and AOS versions match the versions on the remote and primary sites.

About this task

Run the following commands from the command prompt inside the FAVM.

Procedure

Deploy a new File Analytics instance on the remote site, see Deploying File Analytics.

Caution: Do not enable File Analytics.
The remote site requires an iSCSI data service IP address to configure the FAVM on the remote site. This procedure deploys a new volume group File_Analytics_VG and deletes in a subsequent step.
On the remote site, create a volume group by restoring the snapshot of the File_Analytics_VG .
See Restoring an Entity from a Protection Domain in Data Protection and Recovery with Prism Element . For the How to Restore step, use the Create new entities option, and specify a name in the Volume Group Name Prefix field. The restored volume group name format is prefix -File_Analytics_VG.
In the Storage Table view, go to the Volumes tab.
1. Copy the target IQN prefix from the Volume Group Details column.
  
  Tip: Click the tooltip to see the entire IQN prefix.
To configure the FAVM on the remote, follow these steps:

Caution: If the IP address of the File Analytics VM has changed on the remote site, contact Nutanix Support before proceeding.
1. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
2. To discover all storage devices accessed by the FAVM, run the following commands.
```
nutanix@favm$  sudo blkid 
```
3. Copy the cvm.config file to the temporary files directory.
```
nutanix@favm$ cd /mnt/containers/config/common_config/ /tmp
```
4. Stop the File Analytics services.
```
nutanix@favm$  sudo systemctl stop monitoring
```
```
nutanix@favm$  docker stop $(docker ps -q)
```
```
nutanix@favm$  sudo systemctl stop docker
```
5. Unmount and log off from all iSCSI targets.
```
nutnix@avm$ sudo umount /mnt
```
```
nutnix@avm$ sudo /sbin/iscsiadm -m node -u
```
6. Remove the disconnected target records from the discoverydb mode of the FAVM.
```
nutanix@favm$  sudo /sbin/iscsiadm -m node –o delete
```
7. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
```
  The output does not show the /dev/sdb device.
8. Get the File Analytics Linux client iSCSI initiator name.
```
nutanix@favm$  sudo cat /etc/iscsi/initiatorname.iscsi
```
  The output displays the initiator name.
```
InitiatorName=iqn.1991-05.com.redhat:8ef967b5b8f
```
9. Copy the iSCSI initiator name.
10. Remove the iSCSI initiator name from the client whitelist of the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
11. Whitelist the AVM client on the cloned volume group prefix -File_Analytics_VG using the iSCSI initiator name of the AVM client.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
12. Let the Analytics initiator discover the cluster and its volume groups.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode discovery --type sendtargets --portal  data_services_IP_address:3260
```
  Clicking the Nutanix cluster name in Prism displays cluster details including the data service IP address. The output displays the restored iSCSI target from step 2.
13. Connect to the volume target by specifying IQN prefix.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode node --targetname iqn_name --portal data_services_IP_address:3260,1 --login
```
14. Restart the FAVM to restart the iSCSI host adapters, which allows the discovery of the attached volume group.
```
nutanix@favm$  sudo reboot
```
15. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
16. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
  The FAVM discovers the attached iSCSI volume group and assigns to the /dev/sdb device.
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
/dev/sdb: UUID="30749ab7-58e7-437e-9a09-5f6d9619e85b" TYPE="ext4"
```
17. Delete the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
18. Rename the restored volume group prefix -File_Analytics_VG to File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
19. Create a backup of the cvm.config file.
```
nutanix@favm$ mv /mnt/containers/config/common_config/cvm.config \
/mnt/containers/config/common_config/cvm_bck.config
```
20. Copy the cvm.config file from the /tmp directory to /common_config/ on the FAVM.
```
nutanix@favm$ mv /tmp/cvm.config /mnt/containers/config/common_config/
```
21. Reconfigure the password of the user on Prism for internal FAVM operations. Specify a passphrase for new password . File Analytics uses the password only for internal communication between Prism and the FAVM. You must issue the same command twice.
```
nutanix@favm$ sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
 --password='new password' --local_update
```
```
nutanix@favm$  sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
--password='new password' --prism_user=admin --prism_password='Prism admin password'
```
22. In File Analytics, go to gear icon > Scan File System to check if a file system scan can be initiated.
  
  Note: If you receive errors, disable and re-enable File Analytics, see "Disabling File Analytics" and "Enabling File Analytics."

Read article

File Analytics Guide

Files 3.2

Product Release Date: 2022-09-07

Last updated: 2022-11-04

File Analytics

File Analytics provides data and statistics on the operations and contents of a file server.

Once you deploy File Analytics, a new File Analytics link appears on the file server actions bar. Use the link to access File Analytics on any file server that has File Analytics enabled.

Note: File Analytics supports dual NIC configuration for segmented networks. Contact Nutanix Support for assistance.

Display Features

The File Analytics web console consists of display features:

Main menu bar : The main menu bar appears at the top of every page of the File Analytics web console. The main menu bar includes the following display features:

Dashboard tab : View widgets that present data on file trends, distribution, and operations, see Dashboard.
Audit Trails tab : Search for a specific user or file and view various widgets to audit activity, see Audit Trails.
Anomalies tab : Create anomaly policies and view anomaly trends, see Anomalies.
Ransomware tab : Configure ransomware protection and self-service restore (SSR) snapshots, see Ransomware Protection.
Warning: Ransomware protection helps detect potential ransomware. Nutanix does not recommend using the File Analytics ransomware feature as an all-encompassing ransomware solution.
Reports tab : Create custom reports or use pre-canned report templates, see Reports.
Status icon : Check the file system scan status.
File server drop-down : View the name of the file server for which data is displayed.
Settings drop-down : Manage File Analytics and configure settings, see Administration and File Analytics Options.
Health icon : Check the health of File Analytics, see Health.
Admin dropdown : Collect logs and view the current File Analytics version.

Deployment Requirements

Meet the following requirements prior to deploying File Analytics.

Ensure that you have performed the following tasks and your Files deployment meets the following specifications.

Assign the file server administrator role to an Active Directory (AD) user, see Managing Roles in the Nutanix Files Guide .
Log on as the Prism admin user to deploy the File Analytics server.
Configure a VLAN with one dedicated IP address for File Analytics, or you can use an IP address from an existing Files external network. This IP address must have connectivity to AD, the control VM (CVM), and Files. See "Configuring a Virtual Network For guest VM Interfaces" in the Prism Web Console Guide.
Note: Do not install File Analytics on the Files internal network.
(optional) Assign the file server administrator role to an LDAP user, see Managing Roles in the Nutanix Files Guide .
Ensure that all software components meet the supported configurations and system limits, see the File Analytics Release Notes .

Network Requirements

Open the required ports, and ensure that your firewall allows bi-directional Internet Control Message Protocol (ICMP) traffic between the FAVM and CVMs.

The Port Reference provides detailed port information for Nutanix products and services, including port sources and destinations, service descriptions, directionality, and protocol requirements.

In addition to meeting the File Analytics network requirements, ensure to meet Nutanix Files port requirements as described in the Port Reference .

Limitations

File Analytics has the following limitations.

Only Prism admin can deploy File Analytics.
File Analytics analyzes data from daily up to 1 year based on the configuration. File Analytics automatically deletes data beyond the defined configuration.
Note: After surpassing the audit event threshold, as specified in File Analytics Release Notes , Analytics archives the oldest events. Archived audit events do not appear in the Analytics UI.
You cannot deploy or decommission File Analytics when a file server has high-availability (HA) mode enabled.
You cannot use network segmentation for Nutanix Volumes with File Analytics.
If file server DNS or IP changes, File Analytics does not automatically reconfigure.
File Analytics does not collect metadata for files on Kerberos authenticated NFS v4.0 shares.
File Analytics does not support hard links.
You cannot enable File Analytics on a file server clone.
You cannot move File Analytics to another storage container.
File Analytics creates an unprotected Prism and an unprotected file server user for integration purposes. Do not delete these users.
The legacy file blocking policy has an upper limit of 300 ransomware extensions.
Note: For higher limits, it is recommended to use Nutanix Data Lens.
File Analytics does not support the following operations for graceful shutdown:
- AHV: power cycle, power off
- ESXi: power off, reset
File Analytics log collection from CVM fails with dual NIC setup.
File Analytics does not collect metadata information on shares, offline shares, and encrypted shares.
Teardown of File Analytics fails in case of dual NIC setup.

Administration

Overview of administrative processes for File Analytics.

Role-based Access Control for File Analytics

Prism Element supports role-based access control (RBAC) that allows you to configure and provide customized access to the users based on their assigned roles.

Note: Log in to File Analytics with local user created on Prism Central is not supported.

Note: Only administrators (Super Admin or a Prism Admin in Prism Element) can create roles for File Analytics.

- Viewer : Allows users with view-only access to the information and cannot perform any administrative (create or modify) tasks.
- Cluster and User Admin : Allows users to view information, perform administrative tasks, and to create and modify operations.
For more information on Role Based Access Control, refer to the Controlling User Access (RBAC) , Built-in Role Management , Configuring Role Mapping , and Managing Local User Accounts sections in the Security Guide .

Deploying File Analytics

Follow this procedure to deploy the File Analytics server.

Before you begin

Ensure that your environment meets all requirements prior to deployment, see Deployment Requirements.

Procedure

Deploying the File Analytics server.

Go to Support Portal > Downloads > File Analytics .
Download the File Analytics QCOW2 and JSON files.
Log on to Prism with the user name and password of the Prism administrator.

Note: An Active Directory (AD) user or an AD user mapped to a Prism admin role cannot deploy File Analytics.
In Prism, go to the File Server view and click the Deploy File Analytics action link.

Figure. File Analytics
Click to enlarge
Review the File Analytics requirements and best practices in the Pre-Check dialog box.
In the Deploy File Analytics Server dialog box, do the following in the Image tab.
- Under Available versions , select one of the available File Analytics versions. (continue to step 8.).
- Install by uploading installation binary files (continue to next step).
Upload installation files.
1. In the Upload binary section, click upload the File Analytics binary to upload the File Analytics JSON and QCOW files.
  
  Figure. Upload Binary Link Click to enlarge
2. Under File Analytics Metadata File (.Json) , click Choose File to choose the downloaded JSON file.
3. Under File Analytics Installation Binary (.Qcow2) click Choose File to choose the downloaded QCOW file.
  
  Figure. Upload Binary Files Click to enlarge
4. Click Upload Now after choosing the files.
Click Next .
In the VM Configuration tab, do the following in the indicated fields:
1. Name : Enter a name for the File Analytics VM (FAVM).
2. Server Size : Select either the small or large configuration. Large file servers require larger configurations for the FAVM. By default File Analytics selects the large configuration.
3. Storage Container: select a storage container from the drop-down.
  The drop-down displays the storage containers.
  Note: From AOS 5.15.3 version onward, the drop-down displays all storage containers. For earlier AOS versions, the drop-down only displays file server storage containers.
4. Network List : Select a VLAN.
  
  Note: If the selected network is unmanaged , enter more network details in the Subnet Mask , Default Gateway IP , and IP Address fields as indicated.
  
  Note: The FAVM must use the client-side network.
  
  Note: For ESXi, do not use the Controller VM (CVM) backplane network. The CVM backplane network is not supported and any later upgrade operations might fail.
Click Deploy .
In the main menu drop-down, select the Tasks view to monitor the deployment progress.

Results

Once deployment is complete, File Analytics creates an FAVM, CVM, and a new Files user to make REST API calls. Do not delete the CVM, FAVM, or the REST API user.

Enabling File Analytics

Steps for enabling File Analytics after deployment or disablement.

About this task

Attention: Nutanix recommends enabling File Analytics during off-peak hours.

Follow these steps to enable File Analytics after disabling the application.

Note: File Analytics saves all previous configurations.

Procedure

In the File Server view in Prism , select the target file server.
(skip to step 3 if you are re-enabling a file server) click Manage roles to add a file server admin user, see Managing Roles in the Nutanix Files Guide .
In the File Server view, select the target file server and click File Analytics in the tabs bar.
(Skip to step 5 if you are not re-enabling a disabled instance of File Analytics) to re-enable File Analytics, click Enable File Analytics in the message bar.

Figure. Enabling File Analytics Link Click to enlarge

The Enable File Analytics dialog-box appears. Skip the remaining steps.
In the Data Retention field, select a data retention period. The data retention period refers to the length of time File Analytics retains audit events.
In the Authentication section, enter the credentials as indicated:

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. (For SMB users only) In the SMB section, do the following in the indicated fields to provide SMB authentication details:
  - Active Directory Realm Name : Confirm the AD realm name for the file server.
  - Username : Enter the AD username for the file server administrator, see File Analytics Prerequisites .
  - Password : Enter the AD user password for the file server administrator.
2. (For NFS users only) In the NFS Authentication section, do the following in the indicated fields to provide NFS authentication details:
  - LDAP Server URI : Enter the URI of the LDAP server.
  - Base DN : Enter the base DN for the LDAP server.
  - Password : Enter the LDAP user password for the file server administrator.
Click to enlarge
Click Enable .

Results

Example

Scanning 3–4 million NFS files or 1 million SMB files takes about 1 hour.

Disabling File Analytics

About this task

Follow the steps as indicated to disable File Analytics.

Procedure

In File Analytics click the gear icon > Disable File Analytics .
In the dialog-box, click Disable .
Disabling File Analytics disables data collection. The following message banner appears.
```
 File Analytics is disabled on the server. Enable File Analytics to start collecting data again or Delete File Analytics Data. 
```

What to do next

To delete data, click the Delete File Analytics Data link in the banner described in Step 2.

Launching File Analytics

About this task

Do the following to launch File Analytics.

Procedure

From the Prism views drop-down, select the File Server view.
Select the target file server from the entity tab.
Click the File Analytics action button below the entity table.

Figure. Launch File Analytics Click to enlarge

File Analytics VM Management

To update a File Analytics VM (FAVM), refer to the sizing guidelines in the File Analytics release notes and follow the steps in the VM Management topic of the Prism Web Console Guide .

Removing File Analytics VMs

Remove a File Analytics VM (FAVM) by disabling it and deleting it from the cluster in Prism.

About this task

Follow the steps as indicated to remove an FAVM.

Note: Do not delete an FAVM using the CLI, as this operation does not decommission the FAVM.

Procedure

Disable File Analytics on all file servers in the cluster, see Disabling File Analytics.
In the File Server view in Prism Element, do the following:
1. In the top actions bar, click Manage File Analytics .
2. Click Delete to remove the FAVM.
When you delete an FAVM, you also delete all of your File Analytics configurations and audit data stored on the FAVM.

Updating Credentials

About this task

Follow the steps as indicated to update authentication credentials for LDAP or Active Directory.

Procedure

Click gear icon > Update AD/LDAP Configuration .
To update Active Directory credentials, do the following in the indicated fields (otherwise move on to the next step).

Note: AD passwords for the file server admin cannot contain the following special characters: comma (,), single quote ('), double quote ("). Using the special characters in passwords prevents File Analytics from performing file system scans.
1. Active Directory Realm Name: confirm or replace the realm name.
2. Username: confirm or replace the username.
3. Password: type in the new password.
To update NFS configuration, do the following (otherwise move on to the next step).
1. LDAP Server URI: confirm or replace the server URI.
2. Base DN: confirm or replace the base distinguished name (DN).
3. Bind DN (Optional): confirm or replace the bind distinguished name (DN).
4. Password: type in the new password.
Click Save .

Managing Deleted Share/Export Audits

Manage the audit data of delete shares and exports.

About this task

Follow the directions as indicated to delete audit data for the deleted share or export.

Note: You cannot restore the deleted audit data of a deleted share or export.

Procedure

Click the gear icon > Manage Deleted Share/Export Audit .
Check the box next to the share or export name.
Click Delete .
In the confirmation window, click Delete to confirm the deletion of data.
In the Manage Deleted Share/Export Audit , a progress bar displays the progress of the deletion process next to the share name. File Analytics considers data deletion of a deleted share a low-priority task, which can take several hours to finish.

Changing an FAVM Password

Steps for updating the password of a File Analytics VM (FAVM).

About this task

Context for the current task

Procedure

Log on to an FAVM with SSH.
Change the nutanix password.
```
nutanix@fsvm$ sudo passwd nutanix
```
Respond to the prompts, providing the current and new nutanix user password.
```
Changing password for user nutanix.
Old Password:
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
```
Note:
The password must meet the following complexity requirements:
- At least 8 characters long
- At least 1 lowercase letter
- At least 1 uppercase letter
- At least 1 number
- At least 1 special character
- At least 4 characters difference from the old password
- Should not be among the last 10 passwords

Upgrades

Perform File Analytics upgrades using the Life Cycle Manager feature in Prism Element.

Before you proceed with the FA upgrade, ensure you meet the following:

Have a compatible version of AOS and Files.
Refer to File Analytics release notes for compatibility details. You can upgrade both AOS and Files through Prism Element, see AOS Upgrade in the Prism Web Console Guide .
Check the health page of File Analytics to confirm if the overall health is green. See Health.
The protection domain (PD) for the File Analytics VM (FAVM) should not include any other entities.

To upgrade File Analytics, perform inventory and updates using the Life-Cycle Manager (LCM), see the Life Cycle Manager Guide for instructions on performing inventory and updates.

Note: The File Analytics UI is not accessible during upgrades.

Upgrade File Analytics at a Dark Site

Upgrade File Analytics at a dark site using the Life-Cycle Manager (LCM).

About this task

Before you begin

You need a local web server reachable by your Nutanix clusters to host the LCM repository.

Procedure

From a device that has public Internet access, go to Nutanix Portal > Downloads > Tools & Firmware .
1. Download the tar file lcm_dark_site_version.tar.gz .
2. Transfer lcm_dark_site_version.tar.gz to your local web server and untar into the release directory.
From a device that has public Internet access, go to the Nutanix portal and select Downloads > File Analytics .
1. Download the following files.
  - file_analytics_dark_site_version.tar.gz
  - nutanix_compatibility.tgz
  - nutanix_compatibility.tgz.sign
2. Transfer file_analytics_dark_site_version.tar.gz to your local web server and untar into the release directory.
3. Transfer the nutanix_compatibility.tgz and nutanix_compatibility.tgz.sign files to your local web server (overwrite existing files as needed).
Log on to Prism Element.
Click Home > LCM > > Settings .
1. In the Fetch updates from field, enter the path to the directory where you extracted the tar file on your local server. Use the format http://webserver_IP_address/release .
2. Click Save .
  You return to the Life Cycle Manager.
3. In the LCM sidebar, click Inventory > Perform Inventory .
4. Update the LCM framework before trying to update any other component.
  The LCM sidebar shows the LCM framework with the same version as the file you downloaded.

Dashboard

The Dashboard tab displays data on the operational trends of a file server.

Dashboard View

Note: Widgets refresh hourly.

Table 1. Dashboard Widgets
Tile Name	Description	Intervals
Capacity trend	Displays capacity trends for the file server including capacity added, capacity removed, and net changes. Clicking an event period widget displays the Capacity Trend Details view.	7 days, the last 30 days, or the last 1 year.
Data age	Displays the percentage of data by age. Data age determines the data heat, including: hot, warm, and cold.	Default intervals are as follows: Hot data – accessed within the last week. Warm data – accessed within 2 to 4 weeks. Cold data – accessed 4 weeks ago or later.
Permission denials	Displays users who have had excessive permission denials and the number of denials. Clicking a user displays audit details, see Audit Trails - Users for more.	[user id], [number of permission denials]
File distribution by size	Displays the number of files by file size. Provides trend details for top 5 files.	Less than 1 MB, 1–10 MB, 10–100 MB, 100 MB to 1 GB, greater than 1 GB).
File distribution by type	Displays the space taken up by various applications and file types. The file extension determines the file type. See the File types table for more details.	MB or GB
File distribution by type details view	Displays a trend graph of the top 5 file types. File distribution details include file type, current space used, current number of files, and change in space for the last 7 or 30 days. Clicking View Details displays the File Distribution by Type view.	Daily size trend for top 5 files (GB), file type (see the "File Type" table), current space used (GB), current number of files (numeric), change in last 7 or 30 days (GB).
Top 5 active users	Lists the users who have accessed the most files and number of operations the user performed for the specified period. When there are more than 5 active users, the more link provides details on the top 50 users. Clicking the user name displays the audit view for the user, see Audit Trails - Users for more.	24 hours, 7 days, 1 month, or 1 year.
Top 5 accessed files	Lists the 5 most frequently accessed files. Clicking more provides details on the top 50 files. Clicking the file name displays the audit view details for the file, see Audit Trails - Files for more.	24 hours, 7 days, 1 month, or 1 year.
Files operations	Displays the distribution of operation types for the specified period, including a count for each operation type and the total sum of all operations. Operations include: create, delete, read, write, rename, permission changed, set attribute, symlink, permission denied, permission denied (file blocking). Clicking an operation displays the File Operation Trend view.	24 hours, 7 days, 1 month, or 1 year.

Capacity Trend Details

Clicking an event period in the Capacity Trend widget displays the Capacity Trend Details view for that period. The view includes three tabs Share/Export , Folder , and Category . Each tab includes columns detailing entity details: Name . Net capacity change, capacity added, and capacity removed.

Table 2. Capacity Trend Details
Category	Supported File Type
Name	Name of share/export, folder, or category.
Net capacity change	The total difference between capacity at the beginning and the end of the specified period.
Share name (for folders only)	The name of the share or export that the folder belongs to.
Capacity added	Total added capacity for the specified period.
Capacity removed	Total removed capacity for the specified period.

File Distribution by Type Details

Clicking View Details for the File Distribution by Type widget displays granular details of file distribution, see the File Types table for details.

Table 3. Details of File Distribution Parameters
Category	Supported File Type
File type	Name of file type
Current space used	Space capacity occupied by the file type
Current number of files	Number of files for the file type
Change (in last 30 days)	The increase in capacity over a 30-day period for the specified file type

Table 4. File Types
Category	Supported File Type
Archives	.cab, .gz, .rar, .tar, .z, .zip
Audio	.aiff, .au, .mp3, .mp4, .wav, .wma
Backups	.bak, .bkf, .bkp
CD/DVD images	.img, .iso, .nrg
Desktop publishing	.qxd
Email archives	.pst
Hard drive images	.tib, .gho, .ghs
Images	.bmp, .gif, .jpg, .jpeg, .pdf .png, .psd, .tif, .tiff,
Installers	.msi, .rpm
Log Files	.log
Lotus notes	.box, .ncf, .nsf, .ns2, .ns3, .ns4, .ntf
MS Office documents	.accdb, .accde, .accdt, .accdr, .doc, .docx, .docm, .dot, .dotx, .dotm, .xls, .xlsx, .xlsm, .xlt, .xltx, .xltm, .xlsb, .xlam, .ppt, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .mdb
System files	.bin, .dll, .exe
Text files	.csv, .pdf, .txt
Video	.avi, mpg, .mpeg, .mov, .m4v
Disk image	.hlog, .nvram, .vmdk, .vmx, .vmxf, .vmtm, .vmem, .vmsn, .vmsd

File Operation Trend

Table 5. File Operation Trend View Parameters
Category	Description
Operation type	A drop-down option to specify the operation type. See Files Operations in the Dashboard Widgets table for a list of operation types.
Last (time period)	A drop-down option to specify the period for the file operation trend.
File operation trend graph	The x-axis displays shorter intervals for the specified period. The y-axis displays the number of operations trend over the extent of the intervals.

Health

The Health dashboard displays dynamically updated health information about each file server component.

The Health dashboard includes the following details:

Data Summary Data summary of all file servers with File Analytics enabled.
Host Memory Percent of used memory on the File Analytics VM (FAVM).
Host CPU Usage Percent of CPU used by the FAVM.
Storage Summary Amount of storage space used on the File Analytics data disk or FAVM disk.
Overall Health Overall health of File Analytics components.
Data Server Summary Data server usage by component.

Data Age

The Data Age widget in the dashboard provides details on data heat.

Share-level data is displayed to provide details on share capacity trends. There are three levels of data heat:

Hot – frequently accessed data (last accessed within the last week).
Warm – infrequently accessed data (last accessed within the last 2 to 4 weeks).
Cold – rarely accessed data (last accessed longer than 4 weeks ago).

You can configure the definitions for each level of data heat rather than using the default values. See Configuring Data Heat Levels.

Configuring Data Heat Levels

Update the values that constitute different data heat levels.

Procedure

In the Data Age widget, click Explore .
Click Edit Data Age Configuration .
Do the following in the Hot Data section:
1. In the entry field next to Older Than , enter an integer.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Do the following in the Warm Data section to configure two ranges :
1. In the first entry field, enter an integer to configure the first range.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
3. In the second entry field, enter an integer to configure the second range.
4. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Do the following in the Cold Data section to configure four ranges :
1. In the first entry field, enter an integer to configure the first range.
2. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
3. In the second entry field, enter an integer to configure the second range.
4. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
5. In the 3rd entry field, enter an integer to configure the 3rd range.
6. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
7. (optional) In the 4th entry field, enter an integer to configure the 4th range.
8. In the dropdown, choose a value for Week(s) , Month(s) , or Year(s) .
Click Apply .

Note: The new values do not affect the already calculated heat statistics. File Analytics uses the updated values for future heat calculations.

Anomalies

Data panes in the Anomalies tab display data and trends for configured anomalies.

The Anomalies tab provides options for creating anomaly policies and displays dashboards for viewing anomaly trends.

You can configure anomalies for the following operations:

Creating files and directories
Deleting files and directories
Permission changes
Permission denials
Renaming files and directories
Reading files and directories

Define anomaly rules by the specifying the following conditions:

Users exceed an operation count threshold
Users exceed an operation percentage threshold

Meeting the lower operation threshold triggers an anomaly.

Table 1. Anomalies Data Pane Descriptions
Pane Name	Description	Values
Anomaly Trend	Displays the number of anomalies per day or per month.	Last 7 days, Last 30 days, Last 1 year
Top Users	Displays the users with the most anomalies and the number of anomalies per user.	Last 7 days, Last 30 days, Last 1 year
Top Folders	Displays the folders with the most anomalies and the number of anomalies per folder.	Last 7 days, Last 30 days, Last 1 year
Operation Anomaly Types	Displays the percentage of occurrences per anomaly type.	Last 7 days, Last 30 days, Last 1 year

Anomaly Details

Clicking an anomaly bar in the Anomaly Trend graph displays the Anomaly Details view.

Table 2. Anomalies Details View Total Results Table
Column	Description
Anomaly Type	The configured anomaly type. Anomaly types not configured do not show up in the table.
Total User Count	The number of users that have performed the operation causing the specified anomaly during the specified time range.
Total Folder Count	The numbers of folders in which the anomaly occurred during the specified time range.
Total Operation Count	Total number of anomalies for the specified anomaly type that occurred during the specified time range.
Time Range	The time range for which the total user count, total folder count, and total operation count are specified.

Table 3. Anomalies Details View Users/Folders Table
Column	Description
Username or Folders	Indicates the entity for the operation count. Selecting the Users tab indicates operation count for specific users, and selecting the Folders tab indicates the operation count for specific folders.
Operation count	The total number of operations causing anomalies for the selected user or folder during the time period for the bar in the Anomaly Trend graph.

Configuring Anomaly Detection

Steps for configuring anomaly rules.

About this task

To create an anomaly rule, do the following.

Note: Configure an SMTP server for File Analytics to send anomaly alerts, see Configuring an SMTP Server.

Procedure

In the File Analytics web console, click the gear icon > Define Anomaly Rules. .
In the Anomaly Email Recipients field, enter a comma-separated list of email recipients for all anomaly alerts and data.

Note: File Analytics sends anomaly alerts and data to recipients whenever File Analytics detects an anomaly.
To configure a new anomaly, do the following in the indicated fields:
1. Events : Select a rule for the anomaly from one of the following:
  - Permission changed
  - Permission denied
  - Delete
  - Create
  - Rename
  - Read
  The event defines the scenario type for the anomaly.
2. Minimum Operations % : Enter a percentage value for the minimum threshold.
  File Analytics calculates the minimum operations percentage based on the number of files. For example, if there are 100 files, and you set the minimum operations percentage to 5, five operations within the scan interval would trigger an anomaly alert.
3. Minimum Operation Count : Enter a value for a minimum operation threshold.
  File Analytics triggers an anomaly alert after meeting the threshold.
4. User : Choose if the anomaly rule is applicable for All Users or an Individual user.
5. Type: the type determines the interval.
  The interval determines how far back File Analytics monitors the anomaly.
6. Interval : Enter a value for the detection interval.
7. (optional) Actions : Click the pencil icon to update an anomaly rule. Click the x icon to delete an existing rule.
Figure. Anomaly Configuration Fields Click to enlarge
Click Save .

Configuring an SMTP Server

File Analytics uses a simple mail transport protocol (SMTP) server to send anomaly alerts.

About this task

To configure an SMTP server, do the following:

Procedure

In the File Analytics web console, click the gear icon > SMTP Configuration .
In the SMTP Configuration window, enter the indicated details in the following fields:
1. Hostname Or IP Address : Enter a fully qualified domain name or IP address for the SMTP server.
2. Port : Enter the port to use.
  The standard SMTP ports are 25 (encrypted), 587 (TLS), and 465 (SSL).
3. Security Mode : Enter the desired security mode from the dropdown list.
  The options are:
  - NONE (unencrypted)
  - STARTTLS (TTL encryption)
  - SSL (SSL encryption)
4. (If security mode is "NONE" go to step f.)
5. User Name enter a user name for logging into the SMTP server. Depending on the authentication method, the user name may require a domain.
6. Password enter password.
7. From Email Address: enter the email address from which File Analytics will send the anomaly alerts.
8. Recipient Email Address: enter a recipient email address to test the SMTP configuration.
Figure. SMTP Configuration Click to enlarge
Click Save .

Audit Trails

Use audit trails to look up operation data for a specific user, file, folder, or client.

The results table presents details for entities that match the search criteria. Clicking the entity name (or client IP number) takes you to the Audit Trails dashboard for the target entity.

View Audit Trails

Audit a user, file, client, or folder.

About this task

Follow the steps as indicated.

Procedure

Click the Audit Trails tab.
Select the Files , Folders , Users , or Client IP option.
Enter the audit trails target into the search bar.
Click Search .
To display audit results in the Audit Trails window, click the entity name (or client IP number).

Audit Trails - Users

Details for client IP Audit Trails.

Audit Trails Search - Users

When you search by user in the Audit Trails tab, search results display the following information in a table.

User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

Audit Details Page - Users

Clicking View Audit displays the Audit Details page, which shows the following audit information for the selected user.

A User Events graph displays various operations the user performed during the selected period and the percentage of time each operation has occurred per total operations during the specified period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Remove Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
- The filter bar , above the User Events graph, displays the filters in use.
- Use the From and To fields to filter by date.
The Results table displays operation-specific information. See more details below.
The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. The following data is displayed for every event.

User Name
User IP Address
Operation
Operation Date
Target File

Click the gear icon for options to download the data as an xls, csv, or JSON file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Folders

Dashboard details for folder audits.

The following information displays when you search by file in the Audit Trails tab.

Folder Name
Folder Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

The Audit Details page shows the following audit information for the selected folder.

A Folder Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operations include:
  - Select All
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Remove Directory
  - Rename
    
    Note: Rename operation shows both change of name and change of path for specific file or folder.
  - Set Attribute
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Files

Dashboards details for file audit.

Audit Trails for Files

When you search by file in the Audit Trails tab, the following information displays:

File Name
File Owner Name
Share Name
Parent Folder
Last Operation
Last Operation By
Last Operation Date
Action

Note:

File Analytics does not support regular expression (RegEx) based search.
Up to 500 million files with latest 3 months of audit data is supported for a file server.

The Audit Details page shows the following audit information for the selected file.

A File Events graph displays various operations performed on the file during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Close File
  - Create File
  - Delete
  - Make Directory
  - Open
  - Read
  - Rename
    
    Note: Rename operation shows both change of name and change of path for specific file or folder.
  - Set Attribute
  - Write
  - Symlink
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

Username
Client IP
Operation
Operation Date

Click the gear icon for options to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Audit Trails - Client IP

Dashboard details for client IP Audit Trails.

Audit Trails Search - Client IP

When you search by client IP in the Audit Trails tab, search results display the following information in a table.

Client IP
User Name
Domain
Last Operation
Last Operation On
Share Name
Operation Date
Action

The Audit Details page shows the following audit information for the selected client.

A User Events graph displays various operations performed on the client during the selected period, and the percentage of time each operation has occurred per total operations during that period.
- The Filter by operations dropdown contains operation filters, which you can use to filter the audit by operation type. Operation types include:
  - Create File
  - Delete
  - Make Directory
  - Permission Changed
  - Permission Denied
  - Read
  - Removed Directory
  - Rename
  - Set Attribute
  - Write
  - Symlink
  - Permission Denied (File Blocking)
- A filter bar , above the File Events graph displays the filters in use.
- Use the From and to fields to filter by date.
The Results table displays operation-specific details.
- The Reset Filters button removes all filters.

The Results table provides granular details of the audit results. File Analytics displays the following data for every event.

User Name
Operation
Target File
Operation Date

Click the gear icon for an option to download the data as a CSV file.

Note: The maximum limitation of downloading events to CSV and JSON format is 10,000.

Ransomware Protection

Ransomware protection for your file server.

Caution: Ransomware protection helps detect potential ransomware. Nutanix does not recommend using the File Analytics ransomware feature as an all-encompassing ransomware solution.

File Analytics scans files for ransomware in real time and notifies you in the event of a ransomware attack once you configure email notifications.

Caution: Removing curated blocked signatures may prevent File Analytics from blocking some ransomware files.

Ransomware Protection Features

The ransomware dashboard includes panes for managing ransomware protection and self-service restore (SSR).

Ransomware Dashboard

The ransomware dashboard includes two main sections:

The SSR Status pane for viewing, enabling, and managing SSR, see Enabling SSR.
The Vulnerabilities (Infection Attempts) pane for viewing total vulnerabilities, vulnerable shares, malicious clients, and top recent ransomware attempts.
- Clicking on the number of total vulnerabilities provides a detailed view of recent vulnerabilities.
- Clicking on the number of vulnerable shares provides a detailed view of vulnerable shares.
- Clicking on the number of malicious clients provides a detailed view of malicious clients.
Click Settings , to enable and configure ransomware protection, see Enabling Ransomware Protection and Configuring Ransomware Protection.
Click Download (.csv) to download a list of blocked ransomware signatures.

Enabling Ransomware Protection

Enable ransomware protection on your file server.

About this task

Procedure

Go to dropdown menu > Ransomware .
In the message banner, click Enable Ransomware Protection .
(optional) Click Configure SMTP to Add Recipients.

Note: This option appears only if you have not configured a simple mail transfer protocol (SMTP) server, see Configuring an SMTP Server.
Under Ransomware Email Recipients , add at least one email address. If there is a ransomware attack, File Analytics sends a notification to the specified email address.

Figure. Enable Ransomware Click to enlarge
Click Enable .
See Configuring Ransomware Protection for configuration steps.

Configuring Ransomware Protection

Configure ransomware protection on file servers.

About this task

Do the following to add signature to the blocked extension list.

Procedure

Go to dropdown menu > Ransomware > > Settings .
(optional) Under Search for blocked File Signatures , enter ransomware signatures in the *. (signature) format.
1. Note: You can also remove ransomware signatures.
  To check that the signature has been blocked, click Search .
2. If the signature has not been blocked, click Add to Block List .
Figure. Click to enlarge
(optional) To download a list of blocked ransomware signatures, click Download (.csv) .
(optional) Under Ransomware Email Recipients , add a comma separated list of email addresses. If there is a ransomware attack, File Analytics sends a notification to the specified email addresses.
(optional) To disable the ransomware protection feature, click Disable Ransomware Protection .

Enabling SSR

Enable self-service restore on shares identified by File Analytics.

About this task

File Analytics scans shares for SSR policies.

Procedure

Go to dropdown menu > Ransomware .
Click Enable SSR on Prism .
Check the box next to the shares for which to enable SSR.

Figure. Enable SSR on Shares Click to enlarge
Click Enable SSR .

Reports

Generate a report for entities on the file server.

Reports Dashboard

The reports dashboard includes options to create, view, and download reports.

The Reports dashboard includes options to create a report, download reports as a JSON, download reports as a CSV, rerun reports, and delete reports.

The reports table includes columns for the report name, status, last run, and actions.

Both tabs include the following elements:

The Define Report Type section includes an Entity drop-down menu to select an entity.
The Define Filters section includes an Attribute drop-down menu and an option to add more attributes by clicking + Add filter .
The Add/remove columns in this report in your report section displays default columns. Clicking the columns field lets you add addition columns to the report. Clicking the x next to the column name removes it from the report.
The Define number of maximum rows in this report section includes a Count section to specify the number of rows in the report.

Table 1. Report Builder – Filter Options
Entity	Attributes (filters)	Operator	Value	Column
Events	event_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	audit_path (object path) audit_objectname (object name) audit_operation (operation) audit_machine_name (source of operation) audit_event_date (event date in UTC) audit_username (user name)
Events	Event_operation	N/A	file_write file_read file_create file_delete rename directory_create directory_delete SecurityChange (permission change) set_attr sym_link
Files	Category	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	object_name (file name) share_UUID (share name) object_owner_name (owner name) object_size_logical (size) file_type (extension) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) fileserver_protocol object_ID (file id) object_last_operation_name (last operation) audit_username (last operation user object_last_operation_name (last operation) file_path (file path)
	Extensions	N/A	(type in value)
	Deleted	N/A	Last (number of days from 1 to 30) days
	creation_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
	access_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
	Size	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(number) (file size) File size options: B KB MB GB TB
Folders	Deleted	N/A	Last (number of days from 1 to 30) days	object_name (Dir name) object_owner_name (owner name) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) object_last_operation_name (last operation) audit_username (last operation user) File server protocol object_ID (file id) file_path (Dir path)
Folders	creation_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)
Users	last_event_date	equal_to greater_than greater_than_equal_to less_than less_than_equal_to	(date)	user_login_name (user name) Last operation last_event_date (access date in UTC) last_operation_audit_path

Table 2. Pre-Canned Reports – Filters
Entity	Pre-canned report template	Columns
Events	PermissionDenied events Permission Denied (file blocking) events	audit_path (object path) audit_objectname (object name) audit_operation (operation) audit_machine_name (source of operation) audit_event_date (event date in UTC) audit_username (user name)
Files	Largest Files Oldest Files Files not accessed for last 1 year Files accessed in last 30 days	object_name (file name) share_UUID (share name) object_owner_name (owner name) object_size_logical (size) file_type (extension) object_creation_date (creation date in UTC) last_event_date (access date in UTC) share_UUID (share name) fileserver_protocol object_ID (file id) object_last_operation_name (last operation) audit_username (last operation user object_last_operation_name (last operation) file_path (file path)
Users	Top owners with space consumed Top active users All users	user_login_name (user name) Last operation last_event_date (access date in UTC) last_operation_audit_path

Creating a Custom Report

Create a custom report by defining the entity, attribute, filters, and columns.

About this task

Follow the steps as indicated.

Procedure

Go to dropdown menu > Reports .
Click Create a new report .
In the Report Builder tab, do the following:
1. In the Define Report Type section, select an entity from the drop-down menu.
2. In the Define Filters section, select an attribute from the attributes dropdown.
3. Under Value , specify the values for the attribute (some attributes also require to specify an operator in the Operator field).
4. (optional) click + Add filter to add more attributes.
5. In the Add/Remove column in this report section, click x for the columns you want to remove.
6. In the Define maximum number of rows in this report section, type in , or use the - and + buttons, to specify the number of rows in your report. This value indicates the number of records in the report.
Click Run Preview .
The Report Preview section populates.
Click Generate report .
1. Select either the CSV or JSON option.

Create a Pre-Canned Report

Use one of the pre-canned File Analytics templates for your report.

Procedure

Go to dropdown menu > Reports .
Click Create a new report .
In the Pre-Canned Reports Templates tab, do the following:
1. In the Define Report Type section, select an entity from the drop-down menu.
2. In the Define Filters section, select an attribute from the attributes dropdown.
3. In the Add/Remove column in this report section, click x for the columns you want to remove.
4. In the Define maximum number of rows in this report section, type in, or use the - and + buttons, to specify the number of rows in your report. This value indicates the number of records in the report.
Click Run Preview .
The Report Preview section populates.
Click Generate report .
1. Select either the CSV or JSON option.

File Analytics Options

Updating Data Retention

The data retention period determines how long File Analytics retains event data.

About this task

Follow the steps as indicated to configure data retention.

Procedure

In File Analytics, click gear icon > Update Data Retention .
In the Data Retention Period drop-down, select the period for data retention.
Click Update .

Scanning the File System

Once enabled, File Analytics scans the metadata of all files and shares on the system. You can perform an on-demand scan of shares in your file system.

About this task

To scan shares, perform the following task.

Procedure

In File Analytics, click the gear icon .
In the drop-down list, click Scan File System .
In the list of shares, select the target shares for the scan.

Figure. Select Scan Targets Click to enlarge
Click Scan .
The status of the share is In Progress . Once the scan is complete, the status changes to Completed .

Deny List

Deny users, file extensions, and client IP addresses.

About this task

Use the Deny feature to block audit events from being performed on specified file extensions or by specified users and clients.

Note: Files with no extension cannot be denied.

Procedure

Click the gear icon > Define Rules for Deny List .
Click the pencil icon in the Client IPs , File Extensions , Users row.
Add a comma separated list of entities that you want blocked.
Click the done icon in the updated row, and then click Close .

Managing File Categories

File Analytics uses the file category configuration to classify file extensions.

About this task

The capacity widget in the dashboard uses the category configuration to calculate capacity details.

Procedure

Click gear icon > Manage File Category .
To create a category, click + New Category . (Otherwise, move on to step 3).
1. In the Category column, name the category.
2. In the Extensions column, specify file extensions for the category.
To delete an existing category, click the x icon next to the category. (Otherwise, move on to step 4)
To modify an existing category, click the pencil icon next to the category and modify the specified file extensions.
Click Save .

Data Protection

Configure File Analytics disaster recovery (DR) using Prism Element.

File Analytics only supports async disaster recovery. File Analytics does not support NearSync and metro availability.

The Data Protection section in the Prism Web Console Guide provides more detail on the disaster recovery process.

Configuring Disaster Recovery

To set up disaster recovery for File Analytics, create an async protection domain, configure a protection domain schedule, and configure remote site mapping.

About this task

By default, the File Analytics volume group resides on the same container that hosts vDisks for Nutanix Files.

Procedure

If you have not done so already, configure a remote site for the local cluster.
See the Configuring a Remote Site (Physical Cluster) topic in the Prism Web Console Guide for this procedure.
Create an async DR protection domain for the File Analytics volume group as the entity. The volume group name is File_Analytics_VG .
See Configuring a Protection Domain (Async DR) in the Prism Web Console Guide .
In the Schedule tab, click the New Schedule button to add a schedule.
Add a schedule, as File Analytics does not provide a default schedule. See Creating a Protection Domain Schedule (Files) Nutanix Files Guide.
Configure local and remote container mapping.
See the Configuring Disaster Recovery (Files) section in the Nutanix Files Guide for steps to configure mapping between local and remote containers.
Create a protection domain schedule.
See Creating a Protection Domain Schedule (Files) in the Nutanix Files Guide .

Activating Disaster Recovery

Recover a File Analytics VM (FAVM) after a planned or unplanned migration to the remote site.

About this task

Perform the following tasks on the remote site.

Procedure

Fail over to the protection domain for disaster recovery activation.
See the Failing Over a Protection Domain topic in the Prism Web Console Guide .
Fail back the protection domain to the primary site.
See the Failing Back a Protection Domain topic in the Prism Web Console Guide .

Deploying File Analytics on a Remote Site (AHV)

Deploy a File Analytics VM (FAVM) after a planned or unplanned (disaster) migration to the remote site.

About this task

To perform disaster recovery, deploy and enable File Analytics on the remote site. Restore the data using a snapshot of the volume group from the primary FAVM.

Before you begin

Ensure that the Nutanix Files and AOS versions match the versions on the remote and primary sites.

About this task

Run the following commands from the command prompt inside the FAVM.

Procedure

Deploy a new File Analytics instance on the remote site, see Deploying File Analytics.

Caution: Do not enable File Analytics.
The remote site requires an iSCSI data service IP address to configure the FAVM on the remote site. This procedure deploys a new volume group File_Analytics_VG and deletes in a subsequent step.
On the remote site, create a volume group by restoring the snapshot of the File_Analytics_VG .
See Restoring an Entity from a Protection Domain in Data Protection and Recovery with Prism Element . For the How to Restore step, use the Create new entities option, and specify a name in the Volume Group Name Prefix field. The restored volume group name format is prefix -File_Analytics_VG.
To configure the FAVM on the remote, follow these steps:

Caution: If the IP address of the File Analytics VM has changed on the remote site, contact Nutanix Support before proceeding.
1. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
2. To discover all storage devices accessed by the FAVM, run the following commands.
```
nutanix@favm$  sudo blkid 
```
3. Copy the cvm.config file to the temporary files directory.
```
nutanix@favm$ cd /mnt/containers/config/common_config /tmp
```
4. Stop the File Analytics services.
```
nutanix@favm$  sudo systemctl stop monitoring
```
```
nutanix@favm$  docker stop $(docker ps -q)
```
```
nutanix@favm$  sudo systemctl stop docker
```
5. Unmount the volume group.
```
nutnix@avm$ sudo umount /mnt
```
6. Detach the volume group File_Analytics_VG from the FAVM.
  See the "Managing a VM (AHV)" topic in the Prism Web Console Guide .
7. Attach the cloned volume group prefix -File_Analytics_VG to the FAVM.
  See "Managing a VM (AHV)" in the Prism Web Console Guide .
8. Restart the AVM to discover the attached volume group.
```
nutanix@avm$ sudo reboot 
```
9. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
10. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
```
  The FAVM discovers the attached volume group and assigns to the /dev/sdb device.
11. Delete the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
12. Rename the restored volume group prefix -File_Analytics_VG to File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
13. Create a backup of the cvm.config file.
```
nutanix@favm$ mv /mnt/containers/config/common_config/cvm.config \
/mnt/containers/config/common_config/cvm_bck.config
```
14. Copy the cvm.config file from the /tmp directory to /common_config/ on the FAVM.
```
nutanix@favm$ mv /tmp/cvm.config /mnt/containers/config/common_config/
```
15. Reconfigure the password of the user on Prism for internal FAVM operations. Specify a passphrase for new password . File Analytics uses the password only for internal communication between Prism and the FAVM. You must issue the same command twice.
```
nutanix@favm$ sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
 --password='new password' --local_update
```
```
nutanix@favm$  sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
--password='new password' --prism_user=admin --prism_password='Prism admin password'
```
16. In File Analytics, go to gear icon > Scan File System to check if a file system scan can be initiated.
  
  Note: If you receive errors, disable and re-enable File Analytics, see "Disabling File Analytics" and "Enabling File Analytics."

Deploying File Analytics on a Remote Site (ESXi)

Deploy a File Analytics VM (FAVM) after a planned or unplanned (disaster) migration to the remote site.

About this task

To perform disaster recovery, deploy and enable File Analytics on the remote site. Restore the data using a snapshot of the volume group from the primary FAVM.

Before you begin

Ensure that the Nutanix Files and AOS versions match the versions on the remote and primary sites.

About this task

Run the following commands from the command prompt inside the FAVM.

Procedure

Deploy a new File Analytics instance on the remote site, see Deploying File Analytics.

Caution: Do not enable File Analytics.
The remote site requires an iSCSI data service IP address to configure the FAVM on the remote site. This procedure deploys a new volume group File_Analytics_VG and deletes in a subsequent step.
On the remote site, create a volume group by restoring the snapshot of the File_Analytics_VG .
See Restoring an Entity from a Protection Domain in Data Protection and Recovery with Prism Element . For the How to Restore step, use the Create new entities option, and specify a name in the Volume Group Name Prefix field. The restored volume group name format is prefix -File_Analytics_VG.
In the Storage Table view, go to the Volumes tab.
1. Copy the target IQN prefix from the Volume Group Details column.
  
  Tip: Click the tooltip to see the entire IQN prefix.
To configure the FAVM on the remote, follow these steps:

Caution: If the IP address of the File Analytics VM has changed on the remote site, contact Nutanix Support before proceeding.
1. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
2. To discover all storage devices accessed by the FAVM, run the following commands.
```
nutanix@favm$  sudo blkid 
```
3. Copy the cvm.config file to the temporary files directory.
```
nutanix@favm$ cd /mnt/containers/config/common_config/ /tmp
```
4. Stop the File Analytics services.
```
nutanix@favm$  sudo systemctl stop monitoring
```
```
nutanix@favm$  docker stop $(docker ps -q)
```
```
nutanix@favm$  sudo systemctl stop docker
```
5. Unmount and log off from all iSCSI targets.
```
nutnix@avm$ sudo umount /mnt
```
```
nutnix@avm$ sudo /sbin/iscsiadm -m node -u
```
6. Remove the disconnected target records from the discoverydb mode of the FAVM.
```
nutanix@favm$  sudo /sbin/iscsiadm -m node –o delete
```
7. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
```
  The output does not show the /dev/sdb device.
8. Get the File Analytics Linux client iSCSI initiator name.
```
nutanix@favm$  sudo cat /etc/iscsi/initiatorname.iscsi
```
  The output displays the initiator name.
```
InitiatorName=iqn.1991-05.com.redhat:8ef967b5b8f
```
9. Copy the iSCSI initiator name.
10. Remove the iSCSI initiator name from the client whitelist of the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
11. Whitelist the AVM client on the cloned volume group prefix -File_Analytics_VG using the iSCSI initiator name of the AVM client.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
12. Let the Analytics initiator discover the cluster and its volume groups.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode discovery --type sendtargets --portal  data_services_IP_address:3260
```
  Clicking the Nutanix cluster name in Prism displays cluster details including the data service IP address. The output displays the restored iSCSI target from step 2.
13. Connect to the volume target by specifying IQN prefix.
```
nutanix@favm$  sudo /sbin/iscsiadm --mode node --targetname iqn_name --portal data_services_IP_address:3260,1 --login
```
14. Restart the FAVM to restart the iSCSI host adapters, which allows the discovery of the attached volume group.
```
nutanix@favm$  sudo reboot
```
15. Log on to the FAVM with SSH.
  
  Tip: See KB 1661 for default credential details.
16. Discover all storage devices accessed by the FAVM.
```
nutanix@favm$  sudo blkid
```
  The FAVM discovers the attached iSCSI volume group and assigns to the /dev/sdb device.
```
/dev/sr0: UUID="2019-06-11-12-18-52-00" LABEL="cidata" TYPE="iso9660" 
/dev/sda1: LABEL="_master-x86_64-2" UUID="b1fb6e26-a782-4cf7-b5de-32941cc92722" TYPE="ext4"
/dev/sdb: UUID="30749ab7-58e7-437e-9a09-5f6d9619e85b" TYPE="ext4"
```
17. Delete the deployed volume group File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
18. Rename the restored volume group prefix -File_Analytics_VG to File_Analytics_VG.
  See the "Modifying a Volume Group" topic in the Prism Web Console Guide .
19. Create a backup of the cvm.config file.
```
nutanix@favm$ mv /mnt/containers/config/common_config/cvm.config \
/mnt/containers/config/common_config/cvm_bck.config
```
20. Copy the cvm.config file from the /tmp directory to /common_config/ on the FAVM.
```
nutanix@favm$ mv /tmp/cvm.config /mnt/containers/config/common_config/
```
21. Reconfigure the password of the user on Prism for internal FAVM operations. Specify a passphrase for new password . File Analytics uses the password only for internal communication between Prism and the FAVM. You must issue the same command twice.
```
nutanix@favm$ sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
 --password='new password' --local_update
```
```
nutanix@favm$  sudo python /opt/nutanix/analytics/bin/reset_password.py --user_type=prism \
--password='new password' --prism_user=admin --prism_password='Prism admin password'
```
22. In File Analytics, go to gear icon > Scan File System to check if a file system scan can be initiated.
  
  Note: If you receive errors, disable and re-enable File Analytics, see "Disabling File Analytics" and "Enabling File Analytics."

Read article

Flow Microsegmentation Guide

Flow Microsegmentation 5.20

Product Release Date: 2021-05-17

Last updated: 2022-12-13

Security Policies

Traditional data centers use firewalls to implement security checks at the perimeter—the points at which traffic enters and leaves the data center network. Such perimeter firewalls are effective at protecting the network from external threats. However, they offer no protection against threats that originate from within the data center and spread laterally, from one compromised machine to another.

The problem is compounded by virtualized workloads changing their network configurations and hosts as they start, stop, and migrate frequently. For example, IP addresses and MAC addresses can change as applications are shut down on one host and started on another. Manual enforcement of security policies through traditional firewalls, which rely on network configurations to inspect traffic, cannot keep up with these frequent changes and are error-prone.

Network-centric security policies also require the involvement of network security teams that have intimate knowledge of network configuration in terms of VLANs, subnets, and other network entities.

Nutanix Flow includes a policy-driven security framework that inspects traffic within the data center. The framework works as follows:

Security policies inspect traffic that originates and terminates within a data center and help eliminate the need for additional firewalls within the data center.
The framework uses a workload-centric approach instead of a network-centric approach. Therefore, it can scrutinize traffic to and from VMs no matter how their network configurations change and where they reside in the data center. The workload-centric, network-agnostic approach also enables the virtualization team to implement these security policies without having to rely on network security teams.
Security policies are applied to categories (a logical grouping of VMs) and not to the VMs themselves. Therefore, it does not matter how many VMs are started up in a given category. Traffic associated with the VMs in a category is secured without administrative intervention, at any scale.
Prism Central offers a visualization-based approach to configuring policies and monitoring the traffic to which a given policy applies.
Using Prism Central, you can configure syslog monitoring by forwarding Flow logs to an external syslog server. See Configuring Syslog Monitoring in the Prism Central Guide for details.

Note: Nutanix Flow supports only AHV hypervisor; security policies can not be applied to VMs running on other hypervisors.

Types of Policies

The types of policies in Prism Central and their use cases are described here.

Table 1. Types of Policies
Policy Type	Use Case
Application Security Policy	Use an application security policy when you want to secure an application by specifying allowed traffic sources and destinations. This method of securing an application is typically called application ring fencing . For example, use an application security policy when you want to allow only those VMs in the categories `department: engineering` and `department: customersupport` (the allowed sources) to communicate with an issue tracking tool in the category `AppType: IssueTracker` (the secured application), and you want the issue tracking tool to be able to send traffic only to an integrated customer relationship management application in the category `AppType: CRM` . The secured application itself can be divided into tiers by the use of categories (the built-in AppTier category). For example, you can divide the issue tracking tool into web, application, and database tiers and configure tier-to-tier rules. For more information, see Application Security Policy Configuration.
Isolation Environment Policy	Use an isolation environment policy when you want to block all traffic, regardless of direction, between two groups of VMs identified by their category. VMs within a group can communicate with each other. For example, use an isolation environment policy when you want to block all traffic between VMs in the category `Environment: sandbox` and VMs in the category `Environment: production` , and you want to allow all the VMs within each of those categories to communicate with each other. For more information, see Isolation Environment Policy Configuration.
Quarantine Policy	Use a quarantine policy when you want to isolate a compromised or infected VM and optionally want to subject it to forensics. For more information, see Quarantine Policy Configuration.

VDI Policy	Use a VDI policy when you want to secure your VDI environment. For more information, see VDI Policy Configuration

Security Policy Model

Application-centricity

The security policy model uses an application-centric policy language instead of the more complex, traditional network-centric policy language. Configuring an application security policy involves specifying which VMs belong to the application you want to protect and then identifying the entities or networks, in the inbound and outbound directions, with which you want to allow communication.

All the entities in an application security policy are identified by the categories to which they belong and not by their IP address, VLAN, or other network attributes. After a VM is associated with a category and the category is specified in a security policy, traffic associated with the VM is monitored even if it migrates to another network or changes its IP address.

The default options for allowing traffic on the inbound and outbound directions are also inherently application centric. For application security policies, the default option for inbound traffic is Allowed List , which means that Allowed List is usually the recommended option for inbound traffic. The default option can be changed to Allow All traffic. The default option in the outbound direction allows the application to send traffic to all destinations, but you can configure a destination Allowed List if desired.

For forensic quarantine policies, the default option in both directions is Allowed List , but you can Allow All traffic in both directions. For strict quarantine policies, no traffic is allowed in either direction.

All the VMs within a category can communicate with each other. For example, in a tiered application, regardless of how you configure tier-to-tier rules, the VMs within a given tier can communicate with each other.

Whitelist-Based Policy Expression

An application security policy is expressed in terms of the categories and subnets with which you want the application to communicate and therefore, by extension, the traffic you want to allow. A more granular policy expression can be achieved by specifying which protocols and ports can be used for communication.

Any category or subnet that is not in the allowed list is blocked. You cannot specify the categories and subnets you want to block because the number of such entities are typically much larger and grow at a much higher rate than the categories and subnets with which an application should be allowed to communicate. Expressing a policy in terms of allowed traffic results in a smaller, tighter policy configuration that can be modified, monitored, and controlled more easily.

Enforcement Modes

All policies, whether associated with securing an application, isolating environments, or quarantining VMs, can be run in the following modes:

Monitor Mode: Allows all traffic, including traffic that is not allowed by the policy. This mode enables you to visualize both allowed and disallowed traffic and fine-tune the policy before applying it.
Enforce Mode: Blocks all traffic that is not allowed by the policy.

You can switch a policy between these two modes as many times as you want.

Automated Enforcement

A policy uses categories to identify the VMs to which it must apply. This model allows the automatic enforcement of a policy to VMs regardless of their number and network attributes. Connectivity between Prism Central and a registered AHV cluster is required only when creating and modifying policies, or when changing the mode of operation (applied or monitoring) of a policy. Policies are applied to the VMs in a cluster even if the cluster temporarily loses network connectivity with the Prism Central instance with which it is registered. New policies and changes are applied to the cluster when connectivity is restored.

Priorities Between Policies

Prism Central does not provide a way for you to specify priorities between policies of a single type. For example, you cannot prioritize one security policy over another. There is no limit to the number of inbound and outbound rules that you can add to a security policy, allowing you to define all of an application's security requirements in a single policy. This makes priorities between policies unnecessary.

However, priorities exist between the different policy types. Quarantine policies have the highest priority followed by isolation environment policies, and application security policies, in that order. The VDI Policy takes the last precedence, for example, if an application security is protecting a VM, it cannot simultaneously be protected with the VDI policy.

Isolation environment rules take precedence over application security rules, so make sure that isolation environment policies and application security policies are not in conflict. An isolation environment rule and an application security rule are said to be in conflict if they apply to the same traffic (a scenario that is encountered when VMs in one of the categories in the isolation environment send traffic to an application in the other category, and some or all of that traffic is either allowed or disallowed by the application security policy). The effect that an isolation environment policy has on a conflicting application security policy depends on the mode in which the isolation environment policy is deployed, and is as follows:

If the isolation environment policy is in the applied mode, it blocks all traffic to the application, including the traffic that is allowed by the application security policy.
If the isolation environment policy is in the monitoring mode, it allows all traffic to the application, including any traffic that is disallowed by the application security policy.

Requirements

The Security Policies feature has the following requirements:

The feature is supported only on AHV clusters running AOS 5.6 or later and AHV version 20170830.115 or later.
The Prism Central instance must be hosted on one of the AHV clusters registered with it. The AHV cluster that hosts the Prism Central instance must be running AOS 5.6 or later.
The host must have at least 1 GB of additional memory for each Prism Central VM hosted on it.
If you are running a Prism Central scale-out instance, all the VMs in the Prism Central cluster must be powered on.
The AHV hosts must be allowed to communicate with the Prism Central VMs over TCP port 9446. Keeping the port open enables the hosts to send the Prism Central VMs connection tracking data. Prism Central uses that data to show network flows.
Flow supports only TCP, UDP, or ICMP traffic.

Caution:

When Flow is enabled, a Kafka container is automatically created on the cluster where Prism Central is hosted. The container is used to store data that is required for flow visualization to work and must not be deleted.
Cross cluster live migration of guest VMs that are part of Flow security policy is not supported.
Security Policies are not supported for VMs that are on the advanced networking stack. An alert is raised for VMs that are part of both VPC and Flow policy, and Flow policies are not enforced for VMs on VPCs.
Overlapping or conflicting policy configuration is not supported and might cause unintended interruption of network services.

Enabling Microsegmentation

Microsegmentation is disabled by default. Before you can configure and use application security policies, isolation environment policies, and quarantine policies, you must enable the feature. The feature requires a Flow license. If you have not installed a Flow license, you can try the feature for a period of 60 days. After this period expires, you will be required to install the license to continue using the feature.

About this task

To enable microsegmentation, do the following:

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select Prism Central Settings to display the Settings page.
Click Microsegmentation from the Settings menu (on the left).
The Enable Microsegmentation dialog box is displayed.
To determine whether the registered clusters are capable of supporting microsegmentation, do the following:
1. Click View Cluster Capability , and then review the results of the capability checks that Prism Central performed on the registered clusters.
2. Click Back .
Select the Enable Microsegmentation check box.
Click OK .

Disabling Microsegmentation

Prism Central web console provides you the ability to disable the microsegmentation feature.

About this task

To disable microsegmentation, do the following:

Procedure

Log on to the Prism Central web console.
Click the gear icon in the main menu and then select Microsegmentation in the Settings page.

Figure. Settings Page - Disabling Microsegmentation Click to enlarge
Click Disable Microsegmentation .
A confirmation message appears.

Figure. Microsegmentation - Confirmation message Click to enlarge
Click Disable to confirm disabling the microsegmentation feature.

Built-In Categories for Security Policies

Prism Central includes built-in categories that you can use in application security policies and isolation policies. It also includes a built-in category for quarantining VMs.

Table 1. Built-In Categories
Category	Description
AppTier	Add values for the tiers in your application (such as web, application_logic, and database) to this category and use the values to divide the application into tiers when configuring a security policy.
AppType	Associate the VMs in your application with the appropriate built-in application type such as Exchange and Apache_Spark. You can also update the category to add values for applications not listed in this category.
Environment	Add values for environments that you want to isolate from each other and then associate VMs with the values.
Quarantine	Add a VM to this category when you want to quarantine the VM. You cannot modify this category. The category has the following values: Strict Use this value when you want to block all inbound and outbound traffic. Forensic Use this value when you want to block all inbound and outbound traffic except the traffic to and from categories that contain forensic tools.
ADGroup	This category is managed by ID Based Security (ID Firewall). Each ADGroup value represents an imported group from Active Directory. To add or remove values to use in Flow policies use the ID Based Security configuration page ( Prism Central Settings > Flow > ID Based Security ). The category values may be used in VDI policies, see VDI Policy Configuration for details.
ADGroup:Default	This category is applied to the VDI VMs of the AD group when the VM inclusion criteria is set and allows you to apply a default set of rules for the VDI VMs (without the requirement of user logons).

Service

Service is a group of protocol-port combination. You can use any of the default services or create a custom service. The ability to use the service entities in the policy creation workflow reduces any manual configuration error and enables reusability of available entities.

To create or update a custom service, see Creating a Service.
To view the list of available services (built-in and custom services), go to Policies > Security > Services .

Creating a Service

About this task

To create a custom service, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security > Services .
Click Create Service .

Figure. Create Service Tab Click to enlarge
Enter a name and description for the service.
Select the Protocol from the drop-down menu and enter the port number or port range in the Port field.
You can add multiple protocol-port combinations in a single service. To add more protocol-port combination, click Add Row and specify the required values.
Click Save to save the service.

Address

Address is a way to group one or many IP addresses or ranges. You can create an address entity and use that address entity while creating policies. The ability to use the addresses in the policy creation workflow reduces any manual configuration error and enables reusability of available entities.

To create or update an Address, see Creating an Address.
To view the list of available services (built-in and custom services), go to Policies > Security > Address .

Creating an Address

About this task

To create an Address, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security > Addresses .
Click Create Address .

Figure. Create Address Tab Click to enlarge
Enter a name and description for the address.
Enter the IP address or a IP range in the Subnet field.
You can add multiple subnets in a single address entity. To add more subnets, click Add Row and specify the required values.
Click Save to save the service.

Application Security Policy Configuration

Creating an Application Security Policy

Before you begin

Create the categories you need and associate the VMs that you want to protect with those categories. You might be required to create categories for the following purposes. Some categories or category values are required while others are optional:
- Every security policy must be associated with a value in the AppType category, so make sure that you update the AppType category with appropriate values if the built-in values do not work for you. For information about this category and its values, see Category Management in the Prism Central Guide .
- If you need to apply the policy to an application in a specific environment (for example, development, test, or production) or an application at a specific location, create the category you need and apply it to the application. Prism Central includes a built-in Environment category that you can use or update with values of your own. You can also create your own categories.
- If you want to specify categories for traffic sources and destinations instead of allowing all inbound and outbound traffic, create those categories and apply them to the traffic sources and destinations.
- If you want to divide the application into tiers in a security policy, add tiers to the AppTier category. The AppTier category has a built-in default value, but you can update the category to add values of your choice.
For information about categories and their values, see Category Management in the Prism Central Guide .
Security policy configuration might require more time than the default session timeout allows you. You might want to increase the session timeout so that you do not lose a configuration that is left unattended while you perform associated tasks such as referring to this documentation. For more information, see Modifying UI Settings in the Prism Web Console Guide .

About this task

To secure an application, do the following:

Procedure

In the Security Policies dashboard, click Create Security Policy , and then click Secure an Application .
The Create App Security Policy page is displayed.
On the Define Policy tab, do the following in the indicated fields, and then click Next :

Figure. Define Policy Tab Click to enlarge
1. Name : Enter a name for the security policy.
2. Purpose : Describe the purpose of the security policy.
3. Secure This App : Select the type of application that you want to secure.
  The Secure This App list displays available values in the AppType category. It uses the format AppType : value , where value represents a type of application. Every application that you want Prism Central to secure must be associated with a value from the built-in AppType category. The AppType category includes values for frequently encountered applications, such as Exchange and Hadoop. The AppType category also includes a built-in default value that you can use if your application cannot be associated with one of the other built-in values. You can also update the AppType category to add a value of your choice. For information about categories and their values, see Category Management .
4. If you want to filter the VMs by an additional category, select Filter the app type by category , and then enter the name of the category in the text box that is displayed.
  This option enables you to apply the policy to an additional category. For example, if you are configuring a policy for an application in the category AppType: Exchange , this option enables you to further restrict the policy to specific locations (such as Location: US and Location: EU ) or environments (such as Environment: Production , Environment: Development , and Environment: Test ).
5. Optionally, in the Advanced Configuration section, select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
  
  Note: If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
6. Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide .
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
In the Securing an App dialog box, review the schematic that illustrates the flow of traffic through a secured app, and then click OK, Got it!
The Secure Application tab is displayed. The schematic on this tab can be divided into three areas of configuration: the Inbound side, (for adding traffic source allowlist), the application at the center (for configuring inbound, outbound, and tier-to-tier rules), and the Outbound side (for adding traffic destination allowlist).
Figure. Secure Application Tab Click to enlarge
On the Secure Application tab, do the following, and then click Next :
1. On the application at the center of the tab, do the following in the indicated fields:
  - If you want to divide the application into tiers (such as a web tier, an application tier, and a database tier) and configure tier-to-tier rules, first configure the application as described in this step, and then configure inbound and outbound rules. This approach ensures that the individual tiers are available when you want to configure inbound and outbound rules at the tier level. Skip this step if you want to treat the application as a single entity in the security policy.
    To divide your application into tiers and create tier-to-tier rules, do the following:
    1. On the application, click Set Rules on App Tiers, Instead .
      Note: After you click Set Rules on App Tiers, Instead , the link text, Set rules on the whole app, instead , is displayed in its place. Click Set rules on the whole app, instead if you want to discard the tiered configuration and return to configuring rules on the application as a whole.
    2. Click Add Tier , and then select a tier.
      Repeat this step to add as many tiers as you require. The following figure shows an application with a web tier, an application tier, and a database tier:
      
      Figure. Tiered Application Click to enlarge
    3. To delete a tier, pause over the tier you want to delete and click the delete button that is displayed.
    4. Click Set Rules Within App .
      Note: When configuring tier-to-tier rules, two modes are made available to you through the buttons Set Rules to & from App and Set Rules Within App . The Set Rules to & from App option enables you to add application tiers and to specify allowed inbound and outbound traffic. The Set Rules Within App option enables you to specify tier-to-tier rules within the application. These buttons enable you to switch between the two modes.
    5. Click each tier in the application and click Yes or No to specify whether or not you want to allow the VMs in the tier to communicate with each other.
    6. Configure a tier-to-tier rule as follows:
      
      Click the source tier (for example, if the tiers are WebTier and AppTier and you want to configure a tier-to-tier rule from WebTier to AppTier, click the source tier, WebTier).
      
      Click the plus sign that is displayed on the destination tier (in this example, click the destination tier, AppTier). The Create Tier to Tier Rule dialog box
      
      Enter a description for the rule.
      Note: The policy rule description is captured in the policy hitlog data.
      
      Policy hitlog must be enabled
      
      Rule description is added to the hitlog only for allowed traffic
      
      In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
      
      Click Save .
      
      Configure tier-to-tier rules for as many source and destination tiers as you want.
2. To add traffic sources, on the Inbound side of the Secure Application tab, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic from all sources.
    - Whitelist Only : Allows traffic only if the traffic originates from entities on the security policy's source allowlist. This option is the default option. If this option is selected, you must also configure the source allowlist by clicking Add Source .
  - Click Add Source , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic only if that traffic originates from entities that are in the selected category.
      
      Subnet/IP : Allows traffic only if that traffic originates from entities that are in the selected subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Source . Add as many categories or subnets as you want to allow.
    Each entry in this list represents a stream of inbound traffic.
3. To add traffic destinations, on the Outbound side, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic to all destinations. This option is the default option.
    - Whitelist Only : Allows traffic only if the traffic is destined for entities on the security policy's destination allowlist. If this option is selected, you must also configure the destination allowlist by clicking Add Destination .
  - Click Add Destination , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic only if that traffic is destined for entities in the selected category.
      
      Subnet/IP : Allows traffic only if that traffic is destined for entities in the selected subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Destination . Add as many categories or subnets as you want to allow.
    Each entry in this list represents a stream of outbound traffic.
  - To specify the protocols that you want to allow from each stream of inbound and outbound traffic, do the following:
    1. If you added application tiers and configured tier-to-tier rules, first click Set Rules to & from App .
    2. Click the traffic source or traffic destination (a category or subnet if you have configured a allowlist or All Sources if you have chosen to allow all sources) for which you want to create a rule.
    3. Click the plus icon that appears on the application (if you are treating the application as a single entity) or application tier (if you have divided the application into tiers). The Create Inbound Rule or Create Outbound Rule dialog box appears.
    4. Enter a description for the rule.
    5. In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
    6. Click Save .
After you configure a rule, a dotted line appears between the two endpoints of the rule. Point to the dotted line to show the list of ports that the rule allows.
On the Review tab, review the security policy configuration, and then do one of the following:
- If you want to apply the configuration, click Apply Now .
  Applying a security policy enforces the security policy on the application, and traffic from entities that are not defined as sources in the policy is blocked.
- If you want to save the configuration and monitor how the security policy works, click Save and Monitor .
  When a policy is in the monitoring state, the application continues to receive all traffic, but disallowed traffic is highlighted on the monitoring page. Traffic is not blocked until the policy is enforced.
  
  Note: A policy that you have chosen to save and monitor can be applied from the policy update page.

Modifying an Application Security Policy

About this task

To modify a security policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Application Security Policy.

Applying an Application Security Policy

Applying a security policy enforces the security policy on the application, and any traffic from sources that are not allowed is blocked.

About this task

To apply a security policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring an Application Security Policy (Visualizing Network Flows)

About this task

When a policy is in the monitoring state, the application continues to receive all traffic, but disallowed traffic is highlighted on the monitoring page. Traffic is not blocked until the policy is applied.

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .
Allowed network flows and disallowed network flows are shown on the monitoring page, as shown in the following figure. Allowed flows are depicted with a blue dotted line and disallowed network flows are depicted with a red dotted line:
Figure. Monitoring Page for an Application Security Policy Click to enlarge
To show a preview of the network flow in a tooltip, pause over the dotted line that depicts the network flow in the diagram.
A tooltip similar to the following is displayed. The tooltip shows a graph for each connection:
Figure. Tooltip Showing a Preview of the Network Flow Click to enlarge
To see a graph of a network flow, click the dotted line that depicts the network flow in the visualization.
A more detailed graph of the network flows is displayed, as shown in the following figure:
Figure. Network Flows Graph Click to enlarge
To block unwanted flows, click Update , and then update the policy. For information about updating an application security policy, see Modifying an Application Security Policy.
To apply the policy, click Apply .
Applying a policy enforces the policy and traffic from sources that are not allowed is blocked.

Deleting an Application Security Policy

About this task

To delete an application security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to delete.
You can select multiple policies and delete them all at once.
Click Delete in the Actions menu.

Isolation Environment Policy Configuration

An isolation environment identifies two groups of VMs by category, and it blocks communications between the groups.

You can also specify an additional category to restrict the scope of the isolation environment to that category.

For example, consider that you have an application category with values app1 and app2 and that you have associated some VMs with application: app1 and some VMs with application: app2 . Also, consider that these same VMs are distributed between two sites, and have accordingly been associated with values site1 and site2 in a category named location ( location: site1 and location: site2 ).

In this example, you might want to block communications between the VMs in the two locations. Additionally, you might want to restrict the scope of the policy to VMs in category application: app1 . In other words, app1 VMs in site1 cannot communicate with app1 VMs in site2 . The following diagram illustrates the desired outcome. The red connectors illustrate blocked traffic. The green connectors illustrate allowed traffic.

You can configure an isolation policy for this by creating the following categories and isolation policy in Prism Central:

Table 1. Sample Configurations For Categories and the Isolation Policy
Entity	Values
Categories	Name : `application` Values : `app1` and `app2`
Categories	Name : `location` Values : `site1` and `site2`
Isolation Policy	Name : `eng_isolation_policy_across_sites` Description : Isolate engineering VMs across sites Isolate This Category : `location: site1` From This Category : `location: site2` Apply the isolation only within a subset of the data center : `application: app1`

Layer 2 Isolation

Flow supports Layer 2 isolation to enable filtering of the layer 2 packets across all isolated entities. When an isolation policy is applied between two category-based VM groups, all ingress and egress traffic (broadcast, unknown-unicast, and multicast traffic) is dropped at the destination VM group.

Note:

If VMs are part of both isolation policy and quarantine policy, the quarantine policy takes priority of processing over the isolation policy. For example, if VMs with category app1 are isolated from VMs with category app2 using an isolation policy, the traffic between these VM groups are not dropped if the VM groups are also part of a quarantine forensic policy that allows communication between these VMs. In this case, since the quarantine forensics policy matches the VMs, and this policy allows the traffic, the isolation policy is not enforced.
IPv6 traffic between isolated VMs is blocked by default with the introduction of layer 2 isolation.

Creating an Isolation Environment Policy

An isolation environment policy identifies two groups of VMs and blocks communications between the groups. The two groups are identified by category. You can specify an additional category to restrict the scope of the policy to that category.

About this task

To create an isolation environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), click Create Security Policy , and then click Isolate Environments .
The Create Isolation Policy page is displayed.
Figure. Create Isolation Policy Click to enlarge
Do the following in the indicated fields:
- Name : Enter a name for the isolation policy.
- Purpose : Describe the purpose of the isolation policy.
- Isolate this category : Type the name of one of the two categories that you want to isolate from each other.
  Matching names appear in a list as you type. You can click the name of the category you want.
- From this category : Type the name of other category.
- Apply the isolation only within a subset of the data center . If you want to restrict the scope of the policy to a specific category of VMs, select this check box, type the name of the category in the text box, and select the category from the list of matches.
  If you isolate VMs in category Environment: Production from VMs in category Environment: Staging , and you restrict the scope of the policy to VMs in the category Environment: Dev , Prism Central applies the isolation policy to the following groups:
  - VMs that are in both Environment: Production and Environment: Dev
  - VMs that are in both Environment: Staging and Environment: Dev .
- IPv6 Traffic . Optionally, in the Advanced Configuration section, select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
- Policy Hit Logs . Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules. You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide .
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
Do one of the following:
- Click Apply Now to apply the isolation environment.
- Click Save and Monitor to save the configuration and place the isolation environment in the monitoring mode.
You can switch between the monitoring and applied states by selecting the isolation environment on the Security Policies page and clicking the appropriate option in the Actions menu.

Modifying an Isolation Environment Policy

About this task

To modify an isolation environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the isolation policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Isolation Environment Policy.

Applying an Isolation Environment Policy

Applying an isolation environment policy enforces the policy on the specified categories, and any traffic between the categories is blocked.

About this task

Note: Changing the state of an isolation environment policy affects the functioning of any conflicting application security policies. For more information, see Priorities Between Policies.

To apply an isolation environment policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring an Isolation Environment Policy (Visualizing Network Flows)

About this task

The VMs in the two categories in an isolation environment policy are allowed to communicate with each other when the policy is in the monitoring state. Traffic is blocked only during the time the policy is applied.

Note: Changing the state of an isolation environment policy affects the functioning of any conflicting application security policies. For more information, see Priorities Between Policies.

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .
The monitoring page shows the flows between the two categories.
To view information about a particular network flow, pause over the flow.
A tooltip similar to the following is displayed:
Figure. Monitoring Page for an Isolation Environment Policy Click to enlarge

Deleting an Isolation Environment Policy

About this task

To delete an isolation environment policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to delete.
You can select multiple policies to delete them all at once.
Click Delete in the Actions menu.

Quarantine Policy Configuration

Prism Central includes a built-in quarantine policy that enables you to perform the following tasks:

Completely isolate an infected VM that must not have any traffic associated with it.
Isolate an infected VM but specify a set of forensic tools that can communicate with the VM.

For these use cases, Prism Central includes built-in categories that are included in the built-in quarantine policy.

Prism Central also enables you to monitor the quarantine policy before applying it.

The quarantine policy cannot be deleted.

Configuring the Quarantine Policy

In the built-in quarantine policy, you specify categories that can communicate with VMs that have been added to the Quarantine: Forensics category.

About this task

To configure the quarantine policy, do the following;

Procedure

In the Security Policies dashboard, select Quarantine , and then click Update in the Actions menu.
Optionally, in the Advanced Configuration under the Define Policy tab, do the following.
1. Select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default. You can configure the allow option for both Forensic and Strict modes.
2. Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow, see Configuring Syslog Monitoring in the Prism Central Guide for details. You can enable the policy hit log option for both Forensic and Strict modes.
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
On the Add Forensic Tools tab, do the following, and then click Next :
1. To specify the categories that contain forensic tools, on the Inbound and Outbound sides of the policy diagram, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic associated with all sources or destinations.
    - Whitelist Only : Allows traffic only if the traffic is associated with the categories and subnets on the allowlist. This option is the default option. If this option is selected, you must also configure the allowlist by clicking Add Source or Add Destination .
  - Click Add Source or Add Destination , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic to or from the specified category.
      
      Subnet/IP : Allows traffic to or from the specified subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Source or Add Destination . Add as many categories or subnets as you want to allow.
2. To specify the protocols and ports over which the forensic tools can communicate with the VMs in the forensic category, do the following:
  - 1. On the Inbound and Outbound sides of the policy diagram, click a category or subnet (if you have configured a allowlist) or All Sources (if you have chosen to allow all sources) for which you want to create a rule.
    2. Click the plus icon that appears on the Quarantine: Forensic category. The Create Inbound Rule or Create Outbound Rule dialog box
    3. Enter a description for the rule.
      Note: The policy rule description is captured in the policy hitlog data.
      
      Policy hitlog must be enabled
      
      Rule description is added to the hitlog only for allowed traffic
    4. In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
    5. Click Save .
After you configure a rule, a dotted line appears between the two endpoints of the rule. Point to the dotted line to show the list of ports that the rule allows.
On the Review tab, do one of the following:
- Click Apply Now to apply the quarantine policy.
- Click Save and Monitor to save the configuration and place the quarantine policy in the monitoring mode.
You can switch between the monitoring and applied states by selecting Quarantine on the Security Policies page and clicking the appropriate option in the Actions menu.

Quarantining a VM

You quarantine a VM by adding the VM to a quarantine category.

About this task

To add an infected VM to a quarantine category, do the following:

Procedure

In the VMs dashboard List tab (see VMs Summary View in the Prism Central Guide ), select the infected VM, click Actions , and then click Quarantine VMs .
Under Quarantine Method, click one of the following options:
- Strict. Isolates the VM from all traffic. No exceptions can be made for forensics.
- Forensic. Isolates the VM from all traffic except traffic from categories specified in the built-in quarantine policy. The allowed categories contain forensic tools that enable you to perform forensics on the VM.
For VMs added to the strict quarantine, a red icon is displayed in the name column.
Click Quarantine .

Removing a VM from the Quarantine

About this task

To remove a VM from the quarantine, do the following:

Procedure

In the VMs dashboard List tab (see VMs Summary View in the Prism Central Guide ), select the VM that you want to remove from the quarantine, click Actions , and then click Unquarantine VMs .
You can select multiple VMs and remove them from the quarantine in a single step.
In the Unquarantine VMs dialog box, click Unquarantine .

VDI Policy Configuration

The VDI Policy is based on identity-based categorization of the VDI VMs using Active Directory group membership. Configuring VDI policy includes adding an Active Directory domain that is used for the ID firewall ( ID Based Security ) and configuring a service account for the domain.

ID Based Security

ID firewall is an extension to Flow that allows you to write security policies based on users and groups in an Active Directory domain in which your VDI VMs are attached. When using ID firewall, you can import groups from Active Directory into Prism Central as categories (in the category key ADGroup), and then write policies around these categories, just as you would for any other category. A new type of policy has been added for this purpose - the VDI Policy . ID firewall takes care of automatically placing VDI VMs in the appropriate categories on detecting user logons into the VM hosted on Nutanix infrastructure associated with Prism Central, thus allowing user and group based enforcement of Flow policies.

See Configuring Active Directory Domain Services to import user groups for identity-based security policies.
See Creating a VDI Policy to create a VDI policy.
See Default VDI Policy configuration to define a default VDI policy.

Note:

It is recommended to disable credential caching on VDI VMs for Flow ID Firewall. The Flow ID Firewall checks the domain controller events for logon attempts. If the VM connection to the domain controller is not available, a user is able to logon (if credential caching enabled) but no event is generated on the domain controller inhibiting the ID Firewall to detect the logon.
To disable credential caching, see Interactive logon: Number of previous logons to cache (in case domain controller is not available) on Microsoft documentation website.
A basic assumption of VDI Policies is that a single end-user is logged on to each desktop VM at a point in time. As a result, if multiple users log into a single desktop VM at once, the security posture of the VM may change in unpredictable ways. Please ensure that for predictable behavior, only one user is logged into desktop VMs at a time.

Creating a VDI Policy

ID firewall integrates Nutanix Flow with Microsoft Active Directory (AD), such that the groups in the AD can be imported into Prism Central as categories. These imported categories can then be used in the VDI policy as target groups, inbound traffic, and outbound traffic. Prism Central automatically places VMs inside the imported AD group categories when user logons are detected on VMs that are part of the Active Directory domain and also present on Nutanix managed clusters, thus applying security policies based on user group membership.

Before you begin

Note:

Flow ID firewall is supported only for AHV host compatible with AOS version 5.17 and above and Prism Central version 5.17 and above.
Flow ID firewall does not detect user logoffs. The policy applied to a VM is kept applied until next user logon on the same VM.
VMs with an AppType category assignment do not get categorized by ID Based Security .
You can use the Default VDI Policy to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Since a VM user can be a member of multiple ADGroups that are mapped into Prism Central from Active Directory, when a user logs on, a VM may be placed in multiple ADGroups at once. This is the correct behavior, and the policy applied to the VM will be a union of the respective combination of inbounds and outbounds across all ADGroups the VM is placed into.

If not already available, configure an Active Directory domain that is used for ID firewall, see Configuring Active Directory Domain Services.
Configure a service account with required configuration for the Active Directory domain, see Configure Service Account for ID Firewall.

About this task

To secure a VDI environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ) and click Create Security Policy . Select Secure VDI Groups (VDI Policy) and click Create .
You can create only one VDI policy for securing applications through ID Firewall.

The Define Policy page is displayed.
On the Define Policy tab, do the following in the indicated fields, and then click Next :
1. The Policy Name and Purpose fields are auto-populated.
2. Select either Include all VMs or Include VMs by name as the VDI VM Filter .
You can use the VDI VM Filter for the following scenarios.
- Include VMs by name - Select Include VMs by name and enter the matching criteria in the VM Name Contains field. Select the Assign matching VMs to an optional default category (ADGroup:Default) check-box to to apply a default posture to the VMs, see Default VDI Policy for details. Optionally, select the Keep the default category upon user logon check-box to preserve the default category even after user logon.
  Note:
  - Assign ADGroup categories only when the VM matches the filter criteria, otherwise ADGroups apply to all VMs where a logon is detected.
  - VMs with an AppType category assigned is never categorized with an ADGroup.
  - While updating the VDI policy, if inclusion criteria is changed to exclude and then re-include previously included VMs (that were previously logged on and categorized), upon re-inclusion the previous categories will not be applied; consecutively, a new logon must occur for the VM for categories to apply.
- Include all VMs - Select Include all VMs to include all the VMs in the AD group in the policy. Note that non-VDI VMs will also be included in the policy if Include all VMs option is selected.
1. Optionally, in the Advanced Configuration section, select the Allow option to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
  
  Note: If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
2. Optionally, turn on the Policy Hit Logs option to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow, see "Configuring Syslog Monitoring" in the Prism Central Guide for details.
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
In the Secure AD Groups tab, do the following in the indicated fields and click Next .
1. For Inbound Traffic , click + Add Source and enter the category or subnets that the VDI group can receive the traffic from, as the source.
2. For each VDI ADGroup , click +Add AD Group to select the AD groups (categorized VDI VMs) that you want to secure. You can click Import all AD Groups to add all imported ADGroup categories to the VDI policy.
3. For Outbound Traffic , click + Add Destination and enter the category or subnets that the VDI group can send the traffic to, as the destination.\
  
  Note: If you have not used the default VDI option in Step 2b , ensure that you add all of your Active Directory domain controllers as part of this step, using either categories or subnets, for each ADGroup.
Figure. Secure AD Groups Tab Click to enlarge
Do one of the following:
- Click Apply Now to apply the VDI Policy.
- Click Save and Monitor to save the configuration.
You can switch between the monitoring and applied states on the Security Policies page and clicking the appropriate option in the Actions menu.

Default VDI Policy

The Default VDI policy feature allows you to apply a default set of rules as defined by the desktop administrator for VDI VMs and users. There are two primary use cases for Default VDI Policy ( ADGroup:Default ).

To ensure that a VDI VM is secure even before a user logs on to the VDI VM.
To enable access to common network resources without the need to add the resources to every tier of a VDI policy.

You can define a default VDI policy at the time of creating a new VDI policy, or by updating any existing VDI policy. See Step 2b of the VDI Policy Configuration topic for details.

Configuring Active Directory Domain Services

Active Directory Domain Services configuration is used to import user groups for identity based security policies.

Before you begin

Microsegmentation must be enabled to be able to use the ID Firewall feature, see Enabling Microsegmentation.
You must allow WMI access from Prism Central to all the Active Directory Domain Controllers in your network firewall and Active Directory firewall.
Active Directory Requirements:
- Minimum supported domain functional level in Active Directory is Windows Server 2008 R2.
- ID Firewall checks the membership of Security Groups only, Distribution Groups are not supported.
- NTP must be configured on Active Directory and Prism Central.
- DNS must be configured on Prism Central if you want to use host name for domain controllers.

About this task

To configure an Active Directory domain, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select Prism Central Settings to display the Settings page.
Click ID Based Security from the Settings menu (on the left).
The ID Based Security page is displayed. This page allows you to Add New Domain or use an Existing AD .
If you select Use Existing AD in step 3, do the following in the indicated fields:
1. Click the Manually Add Domain Controller button, then click + Domain Controller .
2. Enter the IP Address or Host Name of the domain controllers that you want to monitor for user logons events. You must add all the domain controllers associated with your Active Directory manually.
  
  Click + and add each domain controller individually, then click the blue check mark icon to save.
  
  Note: DNS must be configured on Prism Central for the host name option to work.
If you select Add New Domain in step 3, a set of fields is displayed. Do the following in the indicated fields:
1. Name : Enter a directory name.
  
  This is a name you choose to identify this entry; it need not be the name of an actual directory.
2. Domain : Enter the domain name.
  
  Enter the domain name in DNS format, for example, nutanix.com .
3. Directory URL : Enter the LDAP address of the directory, including the port number.
4. Service Account Username : Enter the service account user name in the user_name@domain.com format that you want Prism Central to use to detect logons and query user and group information from Active Directory.
  
  Caution: Do not use the Domain Admin account as the service account considering the security best practices. Create a new domain user and grant it required permissions as described in Configure Service Account for ID Firewall.
  
  A service account is a special user account that an application or service uses to interact with the Active Directory. Enter your Active Directory service account credentials in this (username) and the following (password) field.
  
  Note: Ensure that you update the service account credentials here whenever the service account password changes or when a different service account is used.
5. Service Account Password : Enter the service account password.
6. When all the fields are correct, click the Save button (lower right).
  
  ID Firewall uses the service account for ID based security with additional requirements, see Configure Service Account for ID Firewall.
Once saved, the Referenced AD Groups section is displayed. You can add a new user group by clicking + Add User Group and edit the auto-generated Category Value . After the active directory configuration is complete, you can create the VDI Policy, see Creating a VDI Policy
Optionally, click Add Inclusion Criteria under Manage the VM Inclusion Criteria to specify which VMs are assigned to AD Group categories upon user logon based on VM name.

Note: It is recommend that users add inclusion criteria if at all possible to prevent any unintended categorizations.

Note: The VMs with AppType category assigned cannot be categorized by ID Based Security.

Configure Service Account for ID Firewall

Active Directory service account in Prism Central is used for connectivity with the Active Directory domain services. ID Firewall also uses the same service account for ID based security.

To configure a service account for ID firewall, do the following.

Create a new user in the Active Directory.
Add the user to the Distributed COM Users group and the Event Log Readers domain groups.
Start the dcomcnfg.exe utility and go to Component Services > Computers > My Computer > DCOM Config .
Right-click on Windows Management and Instrumentation and select Properties from the menu.
Switch to Security tab, select Customize option in the Access Permissions section and then click Edit .
Add the user and grant Local Access and Remote Access permissions to the user. Click OK to confirm changes.
Run the WMIMGMT.msc command to start Windows Management Instrumentation snap-in.
Right-click on WMI control (local) and select Properties from the menu.
Switch to Security tab and expand Root tree.
Select CIMV2 in the expanded tree and click Security .
Go to Advanced > Add > Principal and enter the user name.
Change scope by selecting This namespace and subnamespaces in the Applies to drop-down menu.
Click the check-box to grant the Enable Account and Remote Enable permissions. Click OK to confirm changes.
Restart the winmgmt service.
```
C:\> net stop winmgmt 
C:\> net start winmgmt
```
Alternatively, reboot the domain controller.
Repeat step 3 to step 14 on every domain controller.

Modifying the VDI Policy

About this task

To modify the VDI policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating a VDI Policy.

Applying the VDI Policy

Applying the VDI policy enforces the policy on the specified categories (VDI AD groups), and any traffic between the categories is blocked.

About this task

To apply the VDI policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring the VDI Policy

About this task

The VMs in VDI AD Groups in the VDI policy are allowed to communicate with each other when the policy is in the monitoring state. Traffic is blocked only during the time the policy is applied.

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard, select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .

Deleting the VDI Policy

About this task

To delete the VDI policy, do the following:

Procedure

In the Security Policies dashboard, select the VDI policy.
Click Delete in the Actions menu.

Applying Filtering and Grouping to a Security Policy

You can apply different types of filters to view results based on properties like source , destination, category, ports, and more. You can also group related rule attributes together for easier visualization of connection flows. Grouping and Filtering work together to provide an intuitive view for the security policy.

About this task

To apply filtering and grouping to a security policy, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security . The Policies page is displayed.
Click any policy to view the inbound, application, and outbound configuration.
To view specific rule properties, do one of the following.
- In the Search box, search for the required string using the default All filter.
- Click the filter drop-down menu to search the policy based on any of the following filter types.
  
  Category
  
  search category name and value
  
  Address
  
  search address and subnet IP address
  
  Subnet IP
  
  search subnet IP address
  
  Service
  
  search service name
  
  Rule Description
  
  search rule description
  
  Ports (TCP/UDP)
  
  search TCP/UDP ports and services
  
  ICMP
  
  search ICMP ports and services
Figure. Filtering Policies Click to enlarge
To group related rule entities together, click the group icon.
The group option organizes related rule attributes like subnet IP, categories, and service in distinct boxes. Also, the connection flows for all the entities in a group are displayed as a single connection flow. To view all the entities belonging to a group, click the down-arrow icon to expand the group.
Figure. Filtering Policies Click to enlarge

Exporting and Importing Security Policies

Prism Central allows you to export and import security policies for the following security administration aspects.

Have a snapshot of a working security configuration so that system can be restored to the desired state when needed.
Ability to apply security policies as templates. This scenario is useful in ROBO environments (disaster recovery deployments) where the datacenters are being managed by multiple Prism Central instances.

Exporting Security Policies

To export or import security policy, do the following in the Security Policies dashboard.

Note: For VDI policy, the inclusion criteria and default VDI category settings are not included in the export process. You must set these manually after an import if required.

Click the Export & Import drop down menu.
To export the security policies, select Export Security Policy . The security policies binary file is downloaded.
To import any previously exported security policies binary file, select Import Security Policy , then click Browse to select the binary file. Click Import . The security policies are imported.
Note: Existing policies are overridden with new policies. Policies that are not part of this import are deleted.

Read article

Flow Microsegmentation Guide

Flow Microsegmentation 6.5

Product Release Date: 2022-07-25

Last updated: 2022-12-14

Security Policies

Network-centric security policies also require the involvement of network security teams that have intimate knowledge of network configuration in terms of VLANs, subnets, and other network entities.

Nutanix Flow includes a policy-driven security framework that inspects traffic within the data center. The framework works as follows:

Security policies inspect traffic that originates and terminates within a data center and help eliminate the need for additional firewalls within the data center.
The framework uses a workload-centric approach instead of a network-centric approach. Therefore, it can scrutinize traffic to and from VMs no matter how their network configurations change and where they reside in the data center. The workload-centric, network-agnostic approach also enables the virtualization team to implement these security policies without having to rely on network security teams.
Security policies are applied to categories (a logical grouping of VMs) and not to the VMs themselves. Therefore, it does not matter how many VMs are started up in a given category. Traffic associated with the VMs in a category is secured without administrative intervention, at any scale.
Prism Central offers a visualization-based approach to configuring policies and monitoring the traffic to which a given policy applies.
Using Prism Central, you can configure syslog monitoring by forwarding Flow logs to an external syslog server. For details, see Configuring Syslog Monitoring in the Prism Central Guide .

Note: Nutanix Flow supports only AHV hypervisor; security policies can not be applied to VMs running on other hypervisors.

Types of Policies

The types of policies in Prism Central and their use cases are described here.

Table 1. Types of Policies
Policy Type	Use Case
Application Security Policy	Use an application security policy when you want to secure an application by specifying allowed traffic sources and destinations. This method of securing an application is typically called application ring fencing . For example, use an application security policy when you want to allow only those VMs in the categories `department: engineering` and `department: customersupport` (the allowed sources) to communicate with an issue tracking tool in the category `AppType: IssueTracker` (the secured application), and you want the issue tracking tool to be able to send traffic only to an integrated customer relationship management application in the category `AppType: CRM` . The secured application itself can be divided into tiers by the use of categories (the built-in AppTier category). For example, you can divide the issue tracking tool into web, application, and database tiers and configure tier-to-tier rules. For more information, see Application Security Policy Configuration.
Isolation Environment Policy	Use an isolation environment policy when you want to block all traffic, regardless of direction, between two groups of VMs identified by their category. VMs within a group can communicate with each other. For example, use an isolation environment policy when you want to block all traffic between VMs in the category `Environment: sandbox` and VMs in the category `Environment: production` , and you want to allow all the VMs within each of those categories to communicate with each other. For more information, see Isolation Environment Policy Configuration.
Quarantine Policy	Use a quarantine policy when you want to isolate a compromised or infected VM and optionally want to subject it to forensics. For more information, see Quarantine Policy Configuration.

VDI Policy	Use a VDI policy when you want to secure your VDI environment. For more information, see VDI Policy Configuration

Security Policy Model

Application-centricity

Whitelist-Based Policy Expression

Enforcement Modes

All policies, whether associated with securing an application, isolating environments, or quarantining VMs, can be run in the following modes:

Monitor Mode: Allows all traffic, including traffic that is not allowed by the policy. This mode enables you to visualize both allowed and disallowed traffic and fine-tune the policy before applying it.
Enforce Mode: Blocks all traffic that is not allowed by the policy.

You can switch a policy between these two modes as many times as you want.

Automated Enforcement

Priorities Between Policies

If the isolation environment policy is in the applied mode, it blocks all traffic to the application, including the traffic that is allowed by the application security policy.
If the isolation environment policy is in the monitoring mode, it allows all traffic to the application, including any traffic that is disallowed by the application security policy.

Requirements

The Security Policies feature has the following requirements:

The feature is supported only on AHV clusters running AOS 5.6 or later and AHV version 20170830.115 or later.
The Prism Central instance must be hosted on one of the AHV clusters registered with it. The AHV cluster that hosts the Prism Central instance must be running AOS 5.6 or later.
The host must have at least 1 GB of additional memory for each Prism Central VM hosted on it.
If you are running a Prism Central scale-out instance, all the VMs in the Prism Central cluster must be powered on.
The AHV hosts must be allowed to communicate with the Prism Central VMs over TCP port 9446. Keeping the port open enables the hosts to send the Prism Central VMs connection tracking data. Prism Central uses that data to show network flows.
Flow supports only TCP, UDP, or ICMP traffic.

Caution:

When Flow is enabled, a Kafka container is automatically created on the cluster where Prism Central is hosted. The container is used to store data that is required for flow visualization to work and must not be deleted.
Cross cluster live migration of guest VMs that are part of Flow security policy is not supported.
Security Policies are not supported for VMs that are on the advanced networking stack. An alert is raised for VMs that are part of both VPC and Flow policy, and Flow policies are not enforced for VMs on VPCs.
Overlapping or conflicting policy configuration is not supported and might cause unintended interruption of network services.

Enabling Microsegmentation

Before you begin

Ensure that you meet Microsegmentation requirements.

About this task

To enable microsegmentation, do the following:

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select Prism Central Settings to display the Settings page.
Click Microsegmentation from the Settings menu (on the left).
The Enable Microsegmentation dialog box is displayed.
To determine whether the registered clusters are capable of supporting microsegmentation, do the following:
1. Click View Cluster Capability , and then review the results of the capability checks that Prism Central performed on the registered clusters.
2. Click Back .
Select the Enable Microsegmentation check box.
Click OK .

Disabling Microsegmentation

Prism Central web console provides you the ability to disable the microsegmentation feature.

About this task

To disable microsegmentation, do the following:

Procedure

Log on to the Prism Central web console.
Click the gear icon in the main menu and then select Microsegmentation in the Settings page.

Figure. Settings Page - Disabling Microsegmentation Click to enlarge
Click Disable Microsegmentation .
A confirmation message appears.

Figure. Microsegmentation - Confirmation message Click to enlarge
Click Disable to confirm disabling the microsegmentation feature.

Built-in Categories for Security Policies

Prism Central includes built-in categories that you can use in application security policies and isolation policies. It also includes a built-in category for quarantining VMs.

Table 1. Built-In Categories
Category	Description
AppTier	Add values for the tiers in your application (such as web, application_logic, and database) to this category and use the values to divide the application into tiers when configuring a security policy.
AppType	Associate the VMs in your application with the appropriate built-in application type such as Exchange and Apache_Spark. You can also update the category to add values for applications not listed in this category.
Environment	Add values for environments that you want to isolate from each other and then associate VMs with the values.
Quarantine	Add a VM to this category when you want to quarantine the VM. You cannot modify this category. The category has the following values: Strict Use this value when you want to block all inbound and outbound traffic. Forensic Use this value when you want to block all inbound and outbound traffic except the traffic to and from categories that contain forensic tools.
ADGroup	This category is managed by ID Based Security (ID Firewall). Each ADGroup value represents an imported group from Active Directory. To add or remove values to use in Flow policies use the ID Based Security configuration page ( Prism Central Settings > Flow > ID Based Security ). The category values may be used in VDI policies, see VDI Policy Configuration for details.
ADGroup:Default	This category is applied to the VDI VMs of the AD group when the VM inclusion criteria is set and allows you to apply a default set of rules for the VDI VMs (without the requirement of user logons).

Services

To create or update a custom service, see Creating a Service.
To view the list of available services (built-in and custom services), go to Policies > Security > Services .

Creating a Service

About this task

To create a custom service, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security > Services .
Click Create Service .

Figure. Create Service Tab Click to enlarge
Enter a name and description for the service.
Select the Protocol from the drop-down menu and enter the port number or port range in the Port field.
You can add multiple protocol-port combinations in a single service. To add more protocol-port combination, click Add Row and specify the required values.
Click Save to save the service.

Addresses

Address is a way to group one or many IP addresses or ranges. You can create an address entity and use that address entity while creating policies. The ability to use the addresses in the policy creation work flow reduces any manual configuration error and enables reusability of available entities.

To create or update an Address, see Creating an Address.
To view the list of available services (built-in and custom services), go to Policies > Security > Address .

Creating an Address

About this task

To create an Address, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security > Addresses .
Click Create Address .

Figure. Create Address Tab Click to enlarge
Enter a name and description for the address.
Enter the IP address or a IP range in the Subnet field.
You can add multiple subnets in a single address entity. To add more subnets, click Add Row and specify the required values.
Click Save to save the service.

Application Security Policy Configuration

Creating an Application Security Policy

Before you begin

Create the categories you need and associate the VMs that you want to protect with those categories. You might be required to create categories for the following purposes. Some categories or category values are required while others are optional:
- Every security policy must be associated with a value in the AppType category, so make sure that you update the AppType category with appropriate values if the built-in values do not work for you. For information about this category and its values, see Category Details View in the Prism Central Guide .
- If you need to apply the policy to an application in a specific environment (for example, development, test, or production) or an application at a specific location, create the category you need and apply it to the application. Prism Central includes a built-in Environment category that you can use or update with values of your own. You can also create your own categories.
- If you want to specify categories for traffic sources and destinations instead of allowing all inbound and outbound traffic, create those categories and apply them to the traffic sources and destinations.
- If you want to divide the application into tiers in a security policy, add tiers to the AppTier category. The AppTier category has a built-in default value, but you can update the category to add values of your choice.
For information about categories and their values, see Category Management in the Prism Central Guide .
Security policy configuration might require more time than the default session timeout allows you. You might want to increase the session timeout so that you do not lose a configuration that is left unattended while you perform associated tasks such as referring to this documentation. For more information, see Modifying UI Settings (Prism Central) in the Prism Central Guide .

About this task

To secure an application, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), click Create Security Policy , and then click Secure an Application .
The Create App Security Policy page is displayed.
On the Define Policy tab, do the following in the indicated fields, and then click Next :

Figure. Define Policy Tab Click to enlarge
1. Name : Enter a name for the security policy.
2. Purpose : Describe the purpose of the security policy.
3. Secure This App : Select the type of application that you want to secure.
  The Secure This App list displays available values in the AppType category. It uses the format AppType : value , where value represents a type of application. Every application that you want Prism Central to secure must be associated with a value from the built-in AppType category. The AppType category includes values for frequently encountered applications, such as Exchange and Hadoop. The AppType category also includes a built-in default value that you can use if your application cannot be associated with one of the other built-in values. You can also update the AppType category to add a value of your choice. For information about categories and their values, see Category Management in the Prism Central Guide .
4. If you want to filter the VMs by an additional category, select Filter the app type by category , and then enter the name of the category in the text box that is displayed.
  This option enables you to apply the policy to an additional category. For example, if you are configuring a policy for an application in the category AppType: Exchange , this option enables you to further restrict the policy to specific locations (such as Location: US and Location: EU ) or environments (such as Environment: Production , Environment: Development , and Environment: Test ).
5. Optionally, in the Advanced Configuration section, select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
  
  Note: If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
6. Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide .
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
In the Securing an App dialog box, review the schematic that illustrates the flow of traffic through a secured app, and then click OK, Got it!
The Secure Application tab is displayed. The schematic on this tab can be divided into three areas of configuration: the Inbound side, (for adding traffic source allowlist), the application at the center (for configuring inbound, outbound, and tier-to-tier rules), and the Outbound side (for adding traffic destination allowlist).
Figure. Secure Application Tab Click to enlarge
On the Secure Application tab, do the following, and then click Next :
1. On the application at the center of the tab, do the following in the indicated fields:
  - If you want to divide the application into tiers (such as a web tier, an application tier, and a database tier) and configure tier-to-tier rules, first configure the application as described in this step, and then configure inbound and outbound rules. This approach ensures that the individual tiers are available when you want to configure inbound and outbound rules at the tier level. Skip this step if you want to treat the application as a single entity in the security policy.
    To divide your application into tiers and create tier-to-tier rules, do the following:
    1. On the application, click Set Rules on App Tiers, Instead .
      Note: After you click Set Rules on App Tiers, Instead , the link text, Set rules on the whole app, instead , is displayed in its place. Click Set rules on the whole app, instead if you want to discard the tiered configuration and return to configuring rules on the application as a whole.
    2. Click Add Tier , and then select a tier.
      Repeat this step to add as many tiers as you require. The following figure shows an application with a web tier, an application tier, and a database tier:
      
      Figure. Tiered Application Click to enlarge
    3. To delete a tier, pause over the tier you want to delete and click the delete button that is displayed.
    4. Click Set Rules Within App .
      Note: When configuring tier-to-tier rules, two modes are made available to you through the buttons Set Rules to & from App and Set Rules Within App . The Set Rules to & from App option enables you to add application tiers and to specify allowed inbound and outbound traffic. The Set Rules Within App option enables you to specify tier-to-tier rules within the application. These buttons enable you to switch between the two modes.
    5. Click each tier in the application and click Yes or No to specify whether or not you want to allow the VMs in the tier to communicate with each other.
    6. Configure a tier-to-tier rule as follows:
      
      Click the source tier (for example, if the tiers are WebTier and AppTier and you want to configure a tier-to-tier rule from WebTier to AppTier, click the source tier, WebTier).
      
      Click the plus sign that is displayed on the destination tier (in this example, click the destination tier, AppTier). The Create Tier to Tier Rule dialog box
      
      Enter a description for the rule.
      Note: The policy rule description is captured in the policy hitlog data.
      
      Policy hitlog must be enabled
      
      Rule description is added to the hitlog only for allowed traffic
      
      In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
      
      Click Save .
      
      Configure tier-to-tier rules for as many source and destination tiers as you want.
2. To add traffic sources, on the Inbound side of the Secure Application tab, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic from all sources.
    - Whitelist Only : Allows traffic only if the traffic originates from entities on the security policy's source allowlist. This option is the default option. If this option is selected, you must also configure the source allowlist by clicking Add Source .
  - Click Add Source , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic only if that traffic originates from entities that are in the selected category.
      
      Subnet/IP : Allows traffic only if that traffic originates from entities that are in the selected subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Source . Add as many categories or subnets as you want to allow.
    Each entry in this list represents a stream of inbound traffic.
3. To add traffic destinations, on the Outbound side, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic to all destinations. This option is the default option.
    - Whitelist Only : Allows traffic only if the traffic is destined for entities on the security policy's destination allowlist. If this option is selected, you must also configure the destination allowlist by clicking Add Destination .
  - Click Add Destination , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic only if that traffic is destined for entities in the selected category.
      
      Subnet/IP : Allows traffic only if that traffic is destined for entities in the selected subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Destination . Add as many categories or subnets as you want to allow.
    Each entry in this list represents a stream of outbound traffic.
  - To specify the protocols that you want to allow from each stream of inbound and outbound traffic, do the following:
    1. If you added application tiers and configured tier-to-tier rules, first click Set Rules to & from App .
    2. Click the traffic source or traffic destination (a category or subnet if you have configured a allowlist or All Sources if you have chosen to allow all sources) for which you want to create a rule.
    3. Click the plus icon that appears on the application (if you are treating the application as a single entity) or application tier (if you have divided the application into tiers). The Create Inbound Rule or Create Outbound Rule dialog box appears.
    4. Enter a description for the rule.
    5. In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
    6. Click Save .
After you configure a rule, a dotted line appears between the two endpoints of the rule. Point to the dotted line to show the list of ports that the rule allows.
On the Review tab, review the security policy configuration, and then do one of the following:
- If you want to apply the configuration, click Apply Now .
  Applying a security policy enforces the security policy on the application, and traffic from entities that are not defined as sources in the policy is blocked.
- If you want to save the configuration and monitor how the security policy works, click Save and Monitor .
  When a policy is in the monitoring state, the application continues to receive all traffic, but disallowed traffic is highlighted on the monitoring page. Traffic is not blocked until the policy is enforced.
  
  Note: A policy that you have chosen to save and monitor can be applied from the policy update page.

Modifying an Application Security Policy

About this task

To modify a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Application Security Policy.

Applying an Application Security Policy

Applying a security policy enforces the security policy on the application, and any traffic from sources that are not allowed is blocked.

About this task

To apply a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring an Application Security Policy (Visualizing Network Flows)

About this task

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .
Allowed network flows and disallowed network flows are shown on the monitoring page, as shown in the following figure. Allowed flows are depicted with a blue dotted line and disallowed network flows are depicted with a red dotted line:
Figure. Monitoring Page for an Application Security Policy Click to enlarge
To show a preview of the network flow in a tooltip, pause over the dotted line that depicts the network flow in the diagram.
A tooltip similar to the following is displayed. The tooltip shows a graph for each connection:
Figure. Tooltip Showing a Preview of the Network Flow Click to enlarge
To see a graph of a network flow, click the dotted line that depicts the network flow in the visualization.
A more detailed graph of the network flows is displayed, as shown in the following figure:
Figure. Network Flows Graph Click to enlarge
To block unwanted flows, click Update , and then update the policy. For information about updating an application security policy, see Modifying an Application Security Policy.
To apply the policy, click Apply .
Applying a policy enforces the policy and traffic from sources that are not allowed is blocked.

Deleting an Application Security Policy

About this task

To delete an application security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to delete.
You can select multiple policies and delete them all at once.
Click Delete in the Actions menu.

Isolation Environment Policy Configuration

An isolation environment identifies two groups of VMs by category, and it blocks communications between the groups.

You can also specify an additional category to restrict the scope of the isolation environment to that category.

You can configure an isolation policy for this by creating the following categories and isolation policy in Prism Central:

Table 1. Sample Configurations For Categories and the Isolation Policy
Entity	Values
Categories	Name : `application` Values : `app1` and `app2`
Categories	Name : `location` Values : `site1` and `site2`
Isolation Policy	Name : `eng_isolation_policy_across_sites` Description : Isolate engineering VMs across sites Isolate This Category : `location: site1` From This Category : `location: site2` Apply the isolation only within a subset of the data center : `application: app1`

Layer 2 Isolation

Note:

If VMs are part of both isolation policy and quarantine policy, the quarantine policy takes priority of processing over the isolation policy. For example, if VMs with category app1 are isolated from VMs with category app2 using an isolation policy, the traffic between these VM groups are not dropped if the VM groups are also part of a quarantine forensic policy that allows communication between these VMs. In this case, since the quarantine forensics policy matches the VMs, and this policy allows the traffic, the isolation policy is not enforced.
IPv6 traffic between isolated VMs is blocked by default with the introduction of layer 2 isolation.

Creating an Isolation Environment Policy

About this task

To create an isolation environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), click Create Security Policy , and then click Isolate Environments .
The Create Isolation Policy page is displayed.
Figure. Create Isolation Policy Click to enlarge
Do the following in the indicated fields:
- Name : Enter a name for the isolation policy.
- Purpose : Describe the purpose of the isolation policy.
- Isolate this category : Type the name of one of the two categories that you want to isolate from each other.
  Matching names appear in a list as you type. You can click the name of the category you want.
- From this category : Type the name of other category.
- Apply the isolation only within a subset of the data center . If you want to restrict the scope of the policy to a specific category of VMs, select this check box, type the name of the category in the text box, and select the category from the list of matches.
  If you isolate VMs in category Environment: Production from VMs in category Environment: Staging , and you restrict the scope of the policy to VMs in the category Environment: Dev , Prism Central applies the isolation policy to the following groups:
  - VMs that are in both Environment: Production and Environment: Dev
  - VMs that are in both Environment: Staging and Environment: Dev .
- IPv6 Traffic . Optionally, in the Advanced Configuration section, select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
- Policy Hit Logs . Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules. You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide for details.
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
Do one of the following:
- Click Apply Now to apply the isolation environment.
- Click Save and Monitor to save the configuration and place the isolation environment in the monitoring mode.
You can switch between the monitoring and applied states by selecting the isolation environment on the Security Policies page and clicking the appropriate option in the Actions menu.

Modifying an Isolation Environment Policy

About this task

To modify an isolation environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the isolation policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating an Isolation Environment Policy.

Applying an Isolation Environment Policy

Applying an isolation environment policy enforces the policy on the specified categories, and any traffic between the categories is blocked.

About this task

Note: Changing the state of an isolation environment policy affects the functioning of any conflicting application security policies. For more information, see Priorities Between Policies.

To apply an isolation environment policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring an Isolation Environment Policy (Visualizing Network Flows)

About this task

Note: Changing the state of an isolation environment policy affects the functioning of any conflicting application security policies. For more information, see Priorities Between Policies.

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .
The monitoring page shows the flows between the two categories.
To view information about a particular network flow, pause over the flow.
A tooltip similar to the following is displayed:
Figure. Monitoring Page for an Isolation Environment Policy Click to enlarge

Deleting an Isolation Environment Policy

About this task

To delete an isolation environment policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to delete.
You can select multiple policies to delete them all at once.
Click Delete in the Actions menu.

Quarantine Policy Configuration

Prism Central includes a system defined quarantine policy that enables you to perform the following tasks:

Completely isolate an infected VM that must not have any traffic associated with it.
Isolate an infected VM but specify a set of forensic tools that can communicate with the VM.

For these use cases, Prism Central includes built-in categories that are included in the system defined quarantine policy.

Note: You cannot create a quarantine policy. However, you can modify existing (system defined) quarantine policy.

Prism Central also enables you to monitor the quarantine policy before applying it.

The quarantine policy cannot be deleted.

Configuring the Quarantine Policy

In the built-in quarantine policy, you specify categories that can communicate with VMs that have been added to the Quarantine: Forensics category.

About this task

To configure the quarantine policy, do the following;

Procedure

In the Security Policies dashboard, select Quarantine , and then click Update in the Actions menu.
Optionally, in the Advanced Configuration under the Define Policy tab, do the following.
1. Select the Allow radio button to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default. You can configure the allow option for both Forensic and Strict modes.
2. Optionally, click the toggle button against Policy Hit Logs to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide . You can enable the policy hit log option for both Forensic and Strict modes.
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
On the Add Forensic Tools tab, do the following, and then click Next :
1. To specify the categories that contain forensic tools, on the Inbound and Outbound sides of the policy diagram, do the following:
  - From the drop-down list, select one of the following options:
    - Allow All : Allows traffic associated with all sources or destinations.
    - Whitelist Only : Allows traffic only if the traffic is associated with the categories and subnets on the allowlist. This option is the default option. If this option is selected, you must also configure the allowlist by clicking Add Source or Add Destination .
  - Click Add Source or Add Destination , and then do the following:
    1. Select one of the following options from the drop-down list:
      
      Category : Allows traffic to or from the specified category.
      
      Subnet/IP : Allows traffic to or from the specified subnet.
      
      Addresses : Allows traffic only if the traffic originates from the entities that are in the selected address.
    2. Enter the value (category name or subnet) in the text box, and then click Add .
      When entering the name of a category, a list of matching names is displayed, and you can select the name you want to specify. The subnet mask must be specified in the CIDR format.
    3. To add another category or subnet, click Add Source or Add Destination . Add as many categories or subnets as you want to allow.
2. To specify the protocols and ports over which the forensic tools can communicate with the VMs in the forensic category, do the following:
  - 1. On the Inbound and Outbound sides of the policy diagram, click a category or subnet (if you have configured a allowlist) or All Sources (if you have chosen to allow all sources) for which you want to create a rule.
    2. Click the plus icon that appears on the Quarantine: Forensic category. The Create Inbound Rule or Create Outbound Rule dialog box
    3. Enter a description for the rule.
      Note: The policy rule description is captured in the policy hitlog data.
      
      Policy hitlog must be enabled
      
      Rule description is added to the hitlog only for allowed traffic
    4. In Service Details , click Allow all traffic to allow all types of traffic or click Select a service to choose any default or custom service.
    5. Click Save .
After you configure a rule, a dotted line appears between the two endpoints of the rule. Point to the dotted line to show the list of ports that the rule allows.
On the Review tab, do one of the following:
- Click Apply Now to apply the quarantine policy.
- Click Save and Monitor to save the configuration and place the quarantine policy in the monitoring mode.
You can switch between the monitoring and applied states by selecting Quarantine on the Security Policies page and clicking the appropriate option in the Actions menu.

Quarantining a VM

You quarantine a VM by adding the VM to a quarantine category.

About this task

To add an infected VM to a quarantine category, do the following:

Procedure

In the VMs dashboard List tab (see VMs Summary View in the Prism Central Guide ), select the infected VM, click Actions , and then click Quarantine VMs .
Under Quarantine Method, click one of the following options:
- Strict. Isolates the VM from all traffic. No exceptions can be made for forensics.
- Forensic. Isolates the VM from all traffic except traffic from categories specified in the built-in quarantine policy. The allowed categories contain forensic tools that enable you to perform forensics on the VM.
For VMs added to the strict quarantine, a red icon is displayed in the name column.
Click Quarantine .

Removing a VM from the Quarantine

About this task

To remove a VM from the quarantine, do the following:

Procedure

In the VMs dashboard List tab (see VMs Summary View in the Prism Central Guide ), select the VM that you want to remove from the quarantine, click Actions , and then click Unquarantine VMs .
You can select multiple VMs and remove them from the quarantine in a single step.
In the Unquarantine VMs dialog box, click Unquarantine .

VDI Policy Configuration

ID Based Security

See Configuring Active Directory Domain Services to import user groups for identity-based security policies.
See Creating a VDI Policy to create a VDI policy.
See Default VDI Policy configuration to define a default VDI policy.

Note:

It is recommended to disable credential caching on VDI VMs for Flow ID Firewall. The Flow ID Firewall checks the domain controller events for logon attempts. If the VM connection to the domain controller is not available, a user is able to logon (if credential caching enabled) but no event is generated on the domain controller inhibiting the ID Firewall to detect the logon.
To disable credential caching, see Interactive logon: Number of previous logons to cache (in case domain controller is not available) on Microsoft documentation website.
A basic assumption of VDI Policies is that a single end-user is logged on to each desktop VM at a point in time. As a result, if multiple users log into a single desktop VM at once, the security posture of the VM may change in unpredictable ways. Please ensure that for predictable behavior, only one user is logged into the desktop VMs at a time.

Creating a VDI Policy

Before you begin

Note:

Flow ID firewall is supported only for AHV host compatible with AOS version 5.17 and above and Prism Central version 5.17 and above.
Flow ID firewall does not detect user logoffs. The policy applied to a VM is kept applied until next user logon on the same VM.
VMs with an AppType category assignment do not get categorized by ID Based Security .
You can use the Default VDI Policy to apply a default set of rules for the VDI VMs (without the requirement of user logons).
Since a VM user can be a member of multiple ADGroups that are mapped into Prism Central from Active Directory, when a user logs on, a VM may be placed in multiple ADGroups at once. This is the correct behavior, and the policy applied to the VM will be a union of the respective combination of inbounds and outbounds across all ADGroups the VM is placed into.

If not already available, configure an Active Directory domain that is used for ID firewall, see Configuring Active Directory Domain Services.
Configure a service account with required configuration for the Active Directory domain, see Configure Service Account for ID Firewall.

About this task

To secure a VDI environment, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ) and click Create Security Policy . Select Secure VDI Groups (VDI Policy) and click Create .
You can create only one VDI policy for securing applications through ID Firewall.

The Define Policy page is displayed.
On the Define Policy tab, do the following in the indicated fields, and then click Next :
1. The Policy Name and Purpose fields are auto-populated.
2. Select either Include all VMs or Include VMs by name as the VDI VM Filter .
You can use the VDI VM Filter for the following scenarios.
- Include VMs by name - Select Include VMs by name and enter the matching criteria in the VM Name Contains field. Select the Assign matching VMs to an optional default category (ADGroup:Default) check-box to to apply a default posture to the VMs, see Default VDI Policy for details. Optionally, select the Keep the default category upon user logon check-box to preserve the default category even after user logon.
  Note:
  - Assign ADGroup categories only when the VM matches the filter criteria, otherwise ADGroups apply to all VMs where a logon is detected.
  - VMs with an AppType category assigned is never categorized with an ADGroup.
  - While updating the VDI policy, if inclusion criteria is changed to exclude and then re-include previously included VMs (that were previously logged on and categorized), upon re-inclusion the previous categories will not be applied; consecutively, a new logon must occur for the VM for categories to apply.
- Include all VMs - Select Include all VMs to include all the VMs in the AD group in the policy. Note that non-VDI VMs will also be included in the policy if Include all VMs option is selected.
1. Optionally, in the Advanced Configuration section, select the Allow option to allow IPv6 traffic . The policy rules apply to IPv4 traffic only and all IPv6 traffic is blocked by default.
  
  Note: If you choose to block IPv6 traffic, the IPv6 traffic remains blocked even in the monitoring mode.
2. Optionally, turn on the Policy Hit Logs option to log traffic flow hits on the policy rules.
  You can configure syslog monitoring for the policy hit logs for Flow. For details, see Configuring Syslog Monitoring in the Prism Central Guide .
  Note: Policy hit logs are not generated if both source and destination are in inbound or outbound category.
In the Secure AD Groups tab, do the following in the indicated fields and click Next .
1. For Inbound Traffic , click + Add Source and enter the category or subnets that the VDI group can receive the traffic from, as the source.
2. For each VDI ADGroup , click +Add AD Group to select the AD groups (categorized VDI VMs) that you want to secure. You can click Import all AD Groups to add all imported ADGroup categories to the VDI policy.
3. For Outbound Traffic , click + Add Destination and enter the category or subnets that the VDI group can send the traffic to, as the destination.\
  
  Note: If you have not used the default VDI option in Step 2b , ensure that you add all of your Active Directory domain controllers as part of this step, using either categories or subnets, for each ADGroup.
Figure. Secure AD Groups Tab Click to enlarge
Do one of the following:
- Click Apply Now to apply the VDI Policy.
- Click Save and Monitor to save the configuration.
You can switch between the monitoring and applied states on the Security Policies page and clicking the appropriate option in the Actions menu.

Default VDI Policy

To ensure that a VDI VM is secure even before a user logs on to the VDI VM.
To enable access to common network resources without the need to add the resources to every tier of a VDI policy.

You can define a default VDI policy at the time of creating a new VDI policy, or by updating any existing VDI policy. See Step 2b of the VDI Policy Configuration topic for details.

Configuring Active Directory Domain Services

Active Directory Domain Services configuration is used to import user groups for identity based security policies.

Before you begin

Microsegmentation must be enabled to be able to use the ID Firewall feature. For more information, see Enabling Microsegmentation.
You must allow WMI access from Prism Central to all the Active Directory Domain Controllers in your network firewall and Active Directory firewall.
Active Directory Requirements:
- Minimum supported domain functional level in Active Directory is Windows Server 2008 R2.
- ID Firewall checks the membership of Security Groups only, Distribution Groups are not supported.
- NTP must be configured on Active Directory and Prism Central.
- DNS must be configured on Prism Central if you want to use host name for domain controllers.

About this task

To configure an Active Directory domain, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and then select Prism Central Settings to display the Settings page.
Click ID Based Security from the Settings menu (on the left).
The ID Based Security page is displayed. This page allows you to Add New Domain or use an Existing AD .
If you select Use Existing AD in step 3, do the following in the indicated fields:
1. Click the Manually Add Domain Controller button, then click + Domain Controller .
2. Enter the IP Address or Host Name of the domain controllers that you want to monitor for user logons events. You must add all the domain controllers associated with your Active Directory manually.
  
  Click + and add each domain controller individually, then click the blue check mark icon to save.
  
  Note: DNS must be configured on Prism Central for the host name option to work.
If you select Add New Domain in step 3, a set of fields is displayed. Do the following in the indicated fields:
1. Name : Enter a directory name.
  
  This is a name you choose to identify this entry; it need not be the name of an actual directory.
2. Domain : Enter the domain name.
  
  Enter the domain name in DNS format, for example, nutanix.com .
3. Directory URL : Enter the LDAP address of the directory, including the port number.
4. Service Account Username : Enter the service account user name in the user_name@domain.com format that you want Prism Central to use to detect logons and query user and group information from Active Directory.
  
  Caution: Do not use the Domain Admin account as the service account considering the security best practices. Create a new domain user and grant it required permissions as described in Configure Service Account for ID Firewall.
  
  A service account is a special user account that an application or service uses to interact with the Active Directory. Enter your Active Directory service account credentials in this (username) and the following (password) field.
  
  Note: Ensure that you update the service account credentials here whenever the service account password changes or when a different service account is used.
5. Service Account Password : Enter the service account password.
6. When all the fields are correct, click the Save button (lower right).
  
  ID Firewall uses the service account for ID based security with additional requirements, see Configure Service Account for ID Firewall.
Once saved, the Referenced AD Groups section is displayed. You can add a new user group by clicking + Add User Group and edit the auto-generated Category Value . After the active directory configuration is complete, you can create the VDI Policy, see Creating a VDI Policy
Select Add Inclusion Criteria under Manage the VM Inclusion Criteria to specify which VMs are assigned to AD Group categories upon user logon based on VM name.

Note: It is recommend that users add inclusion criteria if at all possible to prevent any unintended categorizations.

Note: The VMs with AppType category assigned cannot be categorized by ID Based Security.

Configure Service Account for ID Firewall

Active Directory service account in Prism Central is used for connectivity with the Active Directory domain services. ID Firewall also uses the same service account for ID based security.

To configure a service account for ID firewall, do the following.

Create a new user in the Active Directory.
Add the user to the Distributed COM Users group and the Event Log Readers domain groups.
Start the dcomcnfg.exe utility and go to Component Services > Computers > My Computer > DCOM Config .
Right-click on Windows Management and Instrumentation and select Properties from the menu.
Switch to Security tab, select Customize option in the Access Permissions section and then click Edit .
Add the user and grant Local Access and Remote Access permissions to the user. Click OK to confirm changes.
Run the WMIMGMT.msc command to start Windows Management Instrumentation snap-in.
Right-click on WMI control (local) and select Properties from the menu.
Switch to Security tab and expand Root tree.
Select CIMV2 in the expanded tree and click Security .
Go to Advanced > Add > Principal and enter the user name.
Change scope by selecting This namespace and subnamespaces in the Applies to drop-down menu.
Click the check-box to grant the Enable Account and Remote Enable permissions. Click OK to confirm changes.
Restart the winmgmt service.
```
C:\> net stop winmgmt 
C:\> net start winmgmt
```
Alternatively, reboot the domain controller.
Repeat step 3 to step 14 on every domain controller.

Modifying the VDI Policy

About this task

To modify the VDI policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to modify, click Actions , and then click Update .
Make the changes you want and then apply or save and monitor the policy.
The update options are the same as those for creating a policy. For information about the options, see Creating a VDI Policy.

Applying the VDI Policy

Applying the VDI policy enforces the policy on the specified categories (VDI AD groups), and any traffic between the categories is blocked.

About this task

To apply the VDI policy, do the following:

Procedure

In the Security Policies dashboard ((see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to apply, click Actions , and then click Apply .
Confirm by typing Apply in the dialog box, and then click OK .

Monitoring the VDI Policy

About this task

The VMs in VDI AD Groups in the VDI policy are allowed to communicate with each other when the policy is in the monitoring state. Traffic is blocked only during the time the policy is applied.

To monitor a security policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the policy that you want to monitor, click Actions , and then click Monitor .
Confirm by typing Monitor in the dialog box, and then click OK .

Deleting the VDI Policy

About this task

To delete the VDI policy, do the following:

Procedure

In the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide ), select the VDI policy.
Click Delete in the Actions menu.

Applying Filtering and Grouping to a Security Policy

About this task

To apply filtering and grouping to a security policy, do the following.

Procedure

Log on to the Prism Central web console.
Click the collapse menu ("hamburger") button on the left of the main menu and go to Policies > Security . The Policies page is displayed.
Click any policy to view the inbound, application, and outbound configuration.
To view specific rule properties, do one of the following.
- In the Search box, search for the required string using the default All filter.
- Click the filter drop-down menu to search the policy based on any of the following filter types.
  
  Category
  
  search category name and value
  
  Address
  
  search address and subnet IP address
  
  Subnet IP
  
  search subnet IP address
  
  Service
  
  search service name
  
  Rule Description
  
  search rule description
  
  Ports (TCP/UDP)
  
  search TCP/UDP ports and services
  
  ICMP
  
  search ICMP ports and services
Figure. Filtering Policies Click to enlarge
To group related rule entities together, click the group icon.
The group option organizes related rule attributes like subnet IP, categories, and service in distinct boxes. Also, the connection flows for all the entities in a group are displayed as a single connection flow. To view all the entities belonging to a group, click the down-arrow icon to expand the group.
Figure. Filtering Policies Click to enlarge

Exporting and Importing Security Policies

Prism Central allows you to export and import security policies for the following security administration aspects.

Have a snapshot of a working security configuration so that system can be restored to the desired state when needed.
Ability to apply security policies as templates. This scenario is useful in ROBO environments (disaster recovery deployments) where the datacenters are being managed by multiple Prism Central instances.

Exporting Security Policies

To export or import security policy, do the following in the Security Policies dashboard (see Security Policies Summary View in the Prism Central Guide )

Note: For VDI policy, the inclusion criteria and default VDI category settings are not included in the export process. You must set these manually after an import if required.

Click the Export & Import drop down menu.
To export the security policies, select Export Security Policy . The security policies binary file is downloaded.
To import any previously exported security policies binary file, select Import Security Policy , then click Browse to select the binary file. Click Import . The security policies are imported.
Note: Existing policies are overridden with new policies. Policies that are not part of this import are deleted.

Read article

Flow Networking Guide

Flow Virtual Networking pc.2022.4

Product Release Date: 2022-05-16

Last updated: 2022-12-09

Purpose

This Flow Networking Guide describes how to enable and deploy Nutanix Flow Networking on Prism Central.

Upgrading from EA Versions

If you have enabled the early access (EA) version of Flow Networking, disable it before upgrading the Prism Central and enabling the general availability (GA) version of Flow Networking.

Documentation	Description
Release Notes \| Flow Networking	Flow Networking Release Notes
Port Reference	Port Reference: See this page for details of ports that must be open in the firewalls to enable Flow Virtual Networking to function.
Nutanix Security Guide	Prism Element and Prism Central security, cluster hardening, and authentication.
AOS guides and release notes	Covers AOS Administration, Hyper-V Administration for Acropolis, Command Reference, Powershell Cmdlets Reference, AOS Family Release Notes, and AOS release-specific Release Notes
Acropolis Upgrade Guide	How to upgrade core and other Nutanix software.
AHV guides and release notes	Administration and release information about AHV.
Prism Central and Web Console guides and release notes	Administration and release information about Prism Central and Prism Element.

Flow Networking Overview

Enabled and administered from Prism Central, Flow Networking powers network virtualization to offer a seamless network experience with enhanced security. It is disabled by default.

To enable and use Flow Networking, ensure that you log on to Prism Central as a local account user with Prism Admin role. If you log on to Prism Central as a non-local account (IDP-based) user or without Prism Admin role privileges, then Prism Central does not allow you to enable or use Flow Networking. The task is reported as Failed with a User Denied Access message.

Note:

Nutanix deploys a number of ports and protocols in its software. ports that must be open in the firewalls to enable Flow Networking to function. To see the ports and protocols used Flow Networking, see Port Reference.

It is a software-defined network virtualization solution providing overlay capabilities for the on-prem AHV clusters. It integrates tools to deploy networking features like Virtual Private Cloud (VPC) and Virtual Private Network (VPN) to support flexible app-driven networking that focuses on VMs and applications instead of virtual LANs and network addresses.

After you enable it on Prism Central, Flow Networking delivers the following.

A simplified, Prism Central-based workflow that deploys the application-driven network virtualization feature.
A secure multi-tenancy solution allowing per-tenant isolation using VPC-based network segmentation and namespace isolation.
A secure VPN-based connectivity solution for multiple sites, with automated VPN bundle upgrades.
NAT-based secure egress to external networks, with IP address retention and policy-based routing.
Self-serve networking services using REST APIs.
Enhanced networking features for more effective disaster recovery.
Note: You can enable network segmentation on a Layer 2 extended virtual subnet that does not have a gateway. For more information about Layer 2 subnet extensions, see Layer 2 Virtual Network Extension. For information about network segmentation of an extended layer 2 subnet, see Segmenting a Stretched L2 Network for Disaster Recovery in the Securing Traffic through Network Segmentation section of the Security Guide .

Deployment Workflow

You can enable Flow Networking using a simple Prism Central driven workflow, which installs the network controller. The network controller is a collection of containerized services that run directly on the Prism Central VM(s). The network controller orchestrates all the virtual networking operations.

Ensure that microservices infrastructure is enabled in Prism Central Settings > Prism Central Management . See Prism Central Guide for information about enabling microservices infrastructure.
Enable Flow Networking in Prism Central Settings > Advanced Networking . It is disabled by default. See Enabling Flow Networking
You can opt out of Flow networking by disabling the Advanced Networking option subject to prerequisites to disable advanced networking. See Disabling Flow Networking.
You can deploy Flow Networking in a dark site (a site that does not have Internet access) environment. See the Deploying Flow Networking at a Dark Site topic for more information.
You can upgrade the Flow networking controller. Nutanix releases an upgrade for the Flow networking controller with AOS and Prism Central releases. See Upgrading Flow Networking.

See the AOS Family Release Notes and Release Notes | Prism Central .
Flow networking allows you to create and manage virtual private clouds (VPCs) and overlay subnets to leverage the underlying physical networks that connect clusters and datacenters. See Virtual Private Cloud.
You can upgrade the network gateway version. Network gateway is used to create VPN or VTEP gateways to connect subnets using VPN connections, or Layer 2 subnet extensions over VPN or VTEP.

Flow Networking Architecture

The Flow Networking architecture uses a three-plane approach to simplify network virtualization.

Prism Central provides the management plane, the network controller itself acts as the control plane while the AHV nodes provide the data plane. This architecture provides a strong foundation for Flow Networking. This architecture is depicted in the following chart.

Deployment Scale

Flow Networking supports the following scale:


Entities	Scale
Virtual Private Clouds	500
Subnets	5,000
Ports	50,000
Floating IPs	2,000 per networking controller-enabled Prism Central.
Routing Policies	1,000 per Virtual Private Cloud. 10,000 per networking controller-enabled Prism Central.

Essential Concepts

VPC: A Virtual Private Cloud (VPC) is an independent and isolated IP address space that functions as a logically isolated virtual network. A VPC could be made up of one or more subnets that are connected through a logical or virtual router. The IP addresses within a VPC must be unique. However, IP addresses may overlap across VPCs. As VPCs are provisioned on top of another IP-based infrastructure (connecting AHV nodes), they are often referred to as the overlay networks. Tenants may spin up VMs and connect them to one or more subnets within a VPC. Virtual Private Cloud (VPC) is a virtualized network of resources that are specifically isolated from the rest of the resource pool. VPC allows you to manage the isolated and secure virtual network with enhanced automation and scaling. The isolation is done using network namespace techniques like IP-based subnets or VLAN based networking.

VPC Subnets: You can use IP address-based subnets to network virtual machines within a VPC. A VPC may use multiple subnets. VPC subnets use private IP address ranges. IP addresses within a single VPC must be unique, in other words, IP addresses inside the same VPC cannot be repeated. However, IP addresses can overlap across multiple VPCs. The following figure shows two VPCs named Blue and Green. Each VPC has two subnets, 192.168.1.0/24 and 192.168.2.0/24, that are connected by a logical router. Each subnet has a VM with an IP address assigned. The subnets and VM IP addresses overlap between the two VPCs.

Displaying an illustration of VPC networks

The communication between VMs in the same subnets or different subnets in the same VPC (also called East-West communication) is enabled using GEneric NEtwork Virtualization Encapsulation (GENEVE). If a Prism Central manages multiple clusters, then the VMs that belong to the same VPC could be deployed across different clusters. The virtual switch on the AHV nodes provide distributed virtual switching and distributed virtual routing for all VPCs.

The communication from a VM in a VPC to an endpoint outside the VPC (called external communication or North-South communication) is enabled by an external network connection. Such a connection may be secured using VPN. The following figure shows the logical connectivity of the VPCs to the external network, and subsequently to the Internet.

Note: You must configure the default route (0.0.0.0/0) to the external subnet as the next hop for connectivity outside the cluster (north-south connectivity).

External Subnets

Subnets outside a VPC are external subnets. External subnets may be subnets within the deployment but not included in a specific VPC. External subnets may also be subnets that connect to the endpoints outside the deployment such as another deployment or site.

External subnets can be deployed with NAT or without NAT. You can add a maximum of two external subnets - one external subnet with NAT and one external subnet without NAT to a VPC. Both external subnets cannot be of the same type. For example, you cannot add two external subnets, both with NAT. You can update an existing VPC similarly.

Primary and Secondary IP Addresses for VMs

See VM IP Address Management.

SNAT and Floating IP Address

SNAT and Floating IP addresses are used only when you use NAT for an external subnet.

In Source Network Address Translation (SNAT), the NAT router modifies the IP address of the sender in IP packets. SNAT is commonly used to enable hosts with private addresses to communicate with servers on the public Internet.

For VMs within the VPC to communicate with the rest of the deployment, the VPC must be associated with an external network. In such a case, the VPC is assigned a unique IP address, called the SNAT IP, from the subnet prefix of the external network. When the traffic from a VM needs to be transmitted outside the VPC, the source IP address of the VM, which is a private IP address, is translated to the SNAT IP address. The reverse translation from SNAT IP to private IP address occurs for the return traffic. Since the SNAT IP is shared by multiple VMs within a VPC, only the VMs within the VPC can initiate connections to endpoints outside the VPC. The NAT gateway allows the return traffic for these connections only. Endpoints outside the VPC cannot initiate connections to VMs within a VPC.

In addition to the SNAT IP address, you can also request a Floating IP address — an IP from the external subnet prefix that is assigned to a VM via the VPC that manages the network of the VM. Unless the floating IP address is assigned to the private IP address (primary or secondary IP address) of the VM, the floating IP address is not reachable. When the VM transmits packets outside the VPC, the private IP of the VM is modified to the Floating IP. The reverse translation occurs on the return traffic. As the VM uses the Floating IP address, an endpoint outside the VPC can also initiate a connection to the VM with the floating IP address.

The translation of the private IP addresses to Floating IP or SNAT IP address, and vice versa, is performed in the hypervisor virtual switch. Therefore, the VM is not aware of this translation. Floating IP translation may be performed on the hypervisor that hosts the VM to which the floating IP is assigned to. However, SNAT translation is typically performed in a centralized manner on a specific host.

NAT Gateway

NAT Gateways are used only when you use NAT for an external subnet.

Network Address Translation (NAT) is a process for modifying the source or destination addresses in the headers of an IP packet while the packet is in transit. In general, the sender and receiver applications are not aware that the IP packets are being manipulated.

A NAT Gateway provides the entities inside an internal network with connectivity to the Internet without exposing the internal network and its entities.

A NAT Gateway is:

A node or a AHV host. You need a host or a node to implement a NAT Gateway because NAT gateways require operations like load balancing and routing that are automatically performed by Flow Networking.
Connected to the internal network with an internal subnet based IP address and to the external network with an externally-routable IP address.
The externally-routable IP address may be an IP address from a private IP address space or an RFC1918 address that is used as a NAT gateway. The NAT Gateway IP address could be a static IP address or a DHCP assigned IP address.

Table 1. NAT Gateway Failover Time
Event	Failover Time
Network controller stops on AHV	Up to 45 seconds.
Node reboot	Up to 45 seconds.
Node power off: When NAT Gateway and network controller MSP worker VMs are not on the same node.	Up to 45 seconds.
Node power off: When NAT Gateway and network controller MSP worker VMs are on the same node.	Up to 300 seconds (5 minutes).

Static IP Address

A static IP address is a fixed IP address that is manually assigned to an interface in a network. Static IP addresses provide stable routes that do not have to be updated frequently in the routing table since the static routes generated using static IP addresses do not need to be updated.

Usually in a large IP-based network (a network that uses IP addresses), a Dynamic Host Configuration Protocol or DHCP server assigns IP addresses to interfaces of an entity (using DHCP client service on the entity). However, some entities may require a static IP address that can be reached (manual remote access or via VPN) quickly. A static IP address can be reached quickly because the IP address is fixed, assigned manually and is stored in the routing table for a long duration. For example, a printer in an internal network would need a static IP address so that it can be connected reliably. Static IP addresses can be used to generate static routes which remain unchanged in routing tables, thus providing stable long-term connectivity to the entity that has the static IP address assigned.

Static Route

Static routes are fixed routes that are created manually by the network administrator. Static routes are more suited for small networks or subnets. Irrespective of the size of a network, static routes may be required in a variety of cases. For example, in VPCs where you use virtual private networks (VPNs) or Virtual Tunnel End Point (VTEP) over VxLAN transport connections to manage secure connections, you could use static routes for specific connections such as site-to-site connections for disaster recovery. In such a case it is necessary to have a known reliable route over which the disaster recovery operations can be performed smoothly. Static routes are primarily used for:

Facilitating the easy maintenance of the routing table in small networks that are not expected to grow.
Routing to and from other internal route or stub networks. A stub network or an internal route network is a network accessed using a single route and the router has only one neighbor.
Use as a default or backup route. Such a route is not expected to specifically match any other route in the routing table.

In a network that is not constantly changing, static routes can provide faster and more reliable services by avoiding the network overheads like route advertisement and routing table updates for specific routes.

Overlay networks

You can create an IP-based Overlay subnet for a VPC. An Overlay network is a virtualized network that is configured on top of an underlying virtual or physical network. A special purpose multicast network can be created as an Overlay network within an existing network. A peer-to-peer network or a VPN are also examples of Overlay networks. An important assumption for an Overlay network is that the underlying network is fully connected. Nutanix provides the capability to create Overlay network-based VPCs.

Comparing Overlay with VLAN

See how overlay networks compare with VLAN networks. A virtual local area network or VLAN network is a Layer 2 network that provides virtualized network segmentation solution. VLANs route and balance traffic in a network based on MAC addresses, Protocols such as Ethernet, ports or specific subnets. A VLAN creates a virtual Layer 3 network using Layer 2 addressing by separating broadcast domains virtually or logically. A VLAN configured network behaves as if the network is segmented using a physical layer 2 switch without implementing a layer 3 IP based subnet for the segmentation. VLAN traffic usually cannot traverse outside the VLAN.

The main advantage that VLAN networks provide is that VLAN networks require only layer 2 (L2) connectivity. VLANs do not require any of the layer 3 (L3) Flow Networking features.

Overlay networks can be laid on underlying physical network connections including VLAN networks. Overlay networks provide the following advantages and constraints:

IP address namespace is decoupled from the physical network.
You can create, update or delete overlay networks without requiring any configurations on the physical network and powering down the systems.
You can create overlay networks that can span across multiple clusters.
VLAN networks are necessary for Bootstrapping of Flow Networking.
Note: Nutanix recommends using VLAN0 as the default untagged (also called native) VLAN for a CVM and AHV host. You can create VLANs for user VMs using the Network Configuration page. You can use the Create Virtual Switch dialog box from the Network Configuration page to create virtual switches for the user VM VLANs.
AHV Networking VLAN and Flow Networking VLAN: VLAN backed subnets for external connectivity are managed by the Flow Networking control plane. Traditional AHV VLAN IPAM networks are managed by Acropolis. Do not configure the same VLAN as both a Flow Networking external network and an AHV IPAM network, as this can lead to IP address conflicts.

Traffic Behavior

Broadcast Traffic

When all the guest VMs belonging to a subnet are in the same AHV: Flow Networking broadcasts the traffic to all guest VMs in the same subnet.

When some VMs belonging to a subnet are in other AHVs: Flow Networking tunnels the traffic to only those AHVs which have endpoints in the same subnet.

In other words, Flow Networking broadcasts traffic to all the guest VMs in the same subnet.

Unicast Traffic

Unicast traffic is traffic transmitted on a one-to-one basis between IP addresses and ports. There is only one sender and one receiver for the traffic. Unicast traffic is usually the most used form of traffic in any LAN network using Ethernet or IP networking. Flow Networking transmits unicast traffic based on the networking policies set.

Unknown Unicast Traffic

Flow Networking always drops unknown unicast traffic. It is not transmitted to any guest VM within or outside the source AHV.

Multicast Traffic

Flow Networking transmits the traffic to the VMs in the multicast group within the same subnet. If the VM is on another AHV, the destination AHV must have an endpoint in the subnet.

Multicast Group

A multicast group is defined by an IP address (called a multicast IP address, usually a Class D IP address) and a port number. Once a host has group membership, the host will receive any data packets that are sent to that group defined by an IP address/port number.

Prerequisites for Enabling Flow Networking

Make sure you meet these prerequisites before you enable Flow networking on Prism Central.

Requirements

Important: Prism Central protection and recovery does not protect or recover Flow networking services.

You must have the following fulfilled to enable Flow networking:

Ensure that you log on to Prism Central as a local account user with Prism Admin role. If you log on to Prism Central as a non-local account (IDP-based) user or without Prism Admin role privileges, then Prism Central does not allow you to enable or use Flow Networking. The task is reported as Failed with a User Denied Access message.
Ensure that the Prism Central running Flow networking is hosted on an AOS cluster running AHV.

The network controller has a dependency only on the AHV version.
Ensure that microservices infrastructure on Prism Central is enabled. See Prism Central Guide for information about microservices infrastructure.
Choose the x-large PC VM size for Flow networking deployments. Small or large PC VMs are not supported for Flow Networking.

If you are running a small or large Prism Central VMs, upgrade the Prism Central VM resources to x-large PC VM. See Acropolis Upgrade Guide for procedure to install an x-large Prism Central deployment.
Although Flow networking may be enabled on a single-node PC, Nutanix strongly recommends that you deploy a three-node scale-out Prism Central for production deployments. The availability of Flow networking service in Prism Central is critical for performing operations on VMs that are connected to overlay networks. A three-node scale-out Prism Central ensures that Flow networking continues to run even if one of the nodes with a PCVM fails.
Prism Central VM registration. You cannot unregister the Prism Element cluster that is hosting the Prism Central deployment where you have enabled Flow Networking. You can unregister other clusters being managed by this Prism Central deployment.
Ensure that Microservices Infrastructure (CMSP) is enabled on Prism Central before you enable Flow Networking. See the Prism Central Guide for more information.

For the procedure to enable Microservices Infrastructure (including enable in dark site), see Enabling Micro Services Infrastructure section in the Prism Central Guide .
Note: When you configure microservices infrastructure, ensure that the DNS name you configure for CMSP does not end with test . Flow networking does not support test as a top level domain. For example, the following are valid domain configurations:
- my.cluster.domain
- my.test.cluster.test.domain
However, the following are examples of domains that Flow networking does not support:
- my.cluster.test
- my.cluster.domain.test
Ensure that you have created a virtual IP address (VIP) for Prism Central. The Acropolis Upgrade Guide describes how to set the VIP for the Prism Central VM. Once set, do not change this address.
Ensure connectivity:
- Between Prism Central and its managed Prism Element clusters.
- To the Internet for connectivity (not required for dark site) to:
  - ECR for Docker images
  - S3 storage for LCM portal
  Note: For dark site deployments, Nutanix provides a dark site bundle, which has the Docker images (normally hosted on ECR) and the network controller package (normally hosted on LCM portal). These dark site bundles can be downloaded using an internet-connected system outside the dark site.
Prism Central backup, restore, and migration. You cannot perform these operations on MSP-enabled Prism Central.
Nutanix recommends increasing the MTU to 9000 bytes on the virtual switch vs0 and ensure that the physical networking infrastructure supports higher MTU values (jumbo frame support). The recommended MTU range is 1600-9000 bytes.

Nutanix CVMs use the standard Ethernet MTU (maximum transmission unit) of 1,500 bytes for all the network interfaces by default. The system advertises the MTU of 1442 bytes to guest VMs using DHCP to account for the extra 58 bytes used by Generic Network Virtualization Encapsulation (Geneve). However, some VMs ignore the MTU advertisements in the DHCP response. Therefore, to ensure that Flow networking functions properly with such VMs, enable jumbo frame support on the physical network and the default virtual switch vs0.

If you cannot increase the MTU of the physical network, decrease the MTU of every VM in a VPC to 1442 bytes in the guest VM console.

Note: Do not change the MTU of the CVM.

Figure. Sample Configurations with and without Higher MTU - VS0, CVM and UVMs Click to enlarge

Requirements for Upgrades

The following applies to upgrades of Flow networking network controller ( Advanced Networking in Prism Control Settings ):

Ensure that the Prism Central host is running an AHV version compatible with the networking controller upgrade version. If necessary, upgrade the AHV version using LCM to the version compatible with the network controller upgrade version.
Note:
See Compatibility and Interoperability Matrix on the Nutanix Support portal for AOS and Prism Central compatibility.
Ensure that all the AHV hosts in the AOS cluster are running the version compatible with the network controller upgrade version.
The network controller upgrade fails if any of the AHV hosts is running an incompatible version.

Limitations

Limitations for Flow networking are as follows.

Flow networking does not support Flow security for guest VMs.

You cannot configure rules for Flow security if a guest VM has any NICs connected to VPCs.
Flow networking is supported only on AHV clusters. It is not supported on ESXi or Hyper-V clusters.
Flow networking is not enabled on the new PE cluster registering with the Flow networking-enable Prism Central if the Prism Element cluster has an incompatible AHV version.
Flow networking does not support updating a VLAN-backed subnet as an external subnet.

You cannot enable the external connectivity option in the Update Subnet dialog box. Therefore, you cannot modify an existing VLAN-backed subnet to add external connectivity.

VLAN backed subnets for external connectivity are managed by the Flow networking control plane. Traditional AHV VLAN IPAM networks are managed by acropolis.

Note: Do not configure the same VLAN as both a Flow networking external network and an AHV IPAM network, as this can lead to IP address conflicts.
Flow networking cannot be disabled if any external subnets and VPCs are in use. Delete the external subnets and VPCs and then disable Flow Networking.
Disaster Recovery backup and migration: CMSP-enabled Prism Central does not support disaster recovery backup and migration operations both as a source and target host.

Flow Networking Configurations

Enabling Flow Networking

Before you begin

Ensure tha microservices infrastructure is enabled on Prism Central. See Enabling Micro Services Infrastructure section in the Prism Central Guide .

About this task

Before you proceed to enable Flow Networking by enabling the Advanced Networking option, see Prerequisites for Enabling Flow Networking.

To enable Advanced Networking, go to Prism Central Settings > Advanced Networking and do the following.

Procedure

In the Advanced Networking pane, click Enable .

Ensure that the prerequisites specified on the pane are fulfilled.

Figure. Enabling Flow Networking Click to enlarge

Prism Central displays the deployment in-progress.
Figure. Deployment Progress Click to enlarge
Flow Networking is enabled.

Figure. Flow Networking Status Click to enlarge

Disabling Flow Networking

About this task

You can disable Flow Networking. However, the network controller cannot be disabled if any external subnets and VPCs are in use. Delete the subnets and VPCs before you disable advanced networking.

Note:

Flow Networking cannot be disabled if any external subnets and VPCs are in use. Delete the external subnets and VPCs and then disable Flow Networking.

To disable Flow Networking, do the following.

Procedure

On the Advanced Networking page, click Disable .

Figure. Click to enlarge
On the confirmation message box, click Confirm to confirm disablement.

To exit without disabling the Advanced Networking controller, click Cancel .

Unregistering a PE from the PC

Before unregistering a Prism Element from PC, disable Flow Networking on that Prism Element using network controller CLI (or atlas_cli).

About this task

When Flow Networking is enabled on a Prism Central, it propagates the capability to participate in VPC networking to all the registered Prism Elements that are running the required AHV version.

In cases where there are VMs on the Prism Element attached to the VPC network, or if the Prism Element is used to host one or more of the external VLAN networks attached to a VPC, Prism Central alerts you with a prompt. When being alerted about the aforementioned conditions, close the CLI and make adequate configuration to resolve the condition (for example, select a different cluster for the external VLAN network and delete the VMs attached to the VPC network running on the Prism Element). After making such configurations, execute the network controller CLI to disable Flow Networking. If the command goes through successfully, it is safe to unregister the Prism Element.

For example, in a deployment of three Prism Elements - PE1, PE2 and PE3 - registered to the Flow Networking-enabled PC, you want to unregister PE3 from the PC. You must first disable Flow Networking using the following steps:

Procedure

SSH to PE3.
Run the ncli cluster info or ncli cluster get-params command to get the cluster parameters.
Copy the cluster UUID (For example: 017457d3-1012-465c-9c54-aa145f2da7d9) from the displayed cluster parameters.
SSH to the Prism Central VM.
Open the network controller console by executing the atlas_cli command.
```
nutanix@cvm$ atlas_cli
```
```
<atlas> 
```
Execute the config.add_to_excluded_clusters <cluster uuid> command, providing the cluster UUID that you copied earlier.
An example of the PC alert, for the condition that PE3 VM is attached to an external network, is as follows:
```
<atlas> config.add_to_excluded_clusters 0005bf8d-2a7f-3b2e-0310-d8e34995511e 
Cluster 0005bf8d-2a7f-3b2e-0310-d8e34995511e has 1 external subnet, 
which will lose connectivity. Are you sure? (yes/no)
```
Note: To enable Flow Networking on the cluster, execute the config.remove_from_excluded_clusters <cluster uuid> command, providing the cluster UUID.

What to do next

To verify if Flow Networking is disabled or enabled, SSH to PE3 and run the acli atlas_config.get command.

The output displays the enable_atlas_networking parameter as False if Flow Networking is disabled and as True if Flow Networking is enabled on the Prism Element.

nutanix@cvm$ acli atlas_config.get
config {
  anc_domain_name_server_list: “10.10.10.10”
  enable_atlas_networking: False
  logical_timestamp: 19
  minimum_ahv_version: “20190916.101588"
  ovn_cacert_path: “/home/certs/OvnController/ca.pem”
  ovn_certificate_path: “/home/certs/OvnController/OvnController.crt”
  ovn_privkey_path: “/home/certs/OvnController/OvnController.key”
  ovn_remote_address: “ssl:anc-ovn-external.default.anc.aj.domain:6652"
}

You can now unregister the PE from the PC.

Upgrading Flow Networking

You can upgrade the Flow networking controller ( Advanced Networking Controller in Prism Central Settings ) using Life Cycle Manager (LCM) on Prism Central.

Before you begin

See Prerequisites for Enabling Flow Networking.

In case of upgrading the Flow networking controller in a dark site, ensure that LCM is configured to reach the local web server that hosts the dark site upgrade bundles.

Note:

The network controller upgrade fails to start after the pre-check if one or more clusters have Flow Networking enabled and are running an AHV version incompatible with the new network controller upgrade version.

About this task

To upgrade the network controller using LCM, do the following.

Procedure

Choose one of the following ways to reach the LCM page:
- Go to Administration > LCM > Inventory
- Click Check for Updates on the Advanced Networking page.
Figure. Check for Updates Click to enlarge
Click Perform Inventory .

When you click Perform Inventory , the system scans the registered Prism Central cluster for software versions that are running currently. Then it checks for any available upgrades and displays the information on the LCM page under Software .
Go to Updates > Software . Select the Advanced Networking Controller version you want to upgrade to and click Update .

Figure. Networking Controller version Click to enlarge

Deploying Flow Networking at a Dark Site

About this task

Dark sites are primarily on-premises installations which do not have access to the internet. Such sites are disconnected from the internet for a range of reasons including security. To deploy Flow networking at such dark sites, you need to deploy the dark site bundle at the site.

This dark site deployment procedure includes downloading and deploying MSP and the network controller bundles.

Before you begin

See Prerequisites for Enabling Flow Networking.
You need access to the Nutanix Portal from an Internet-connected device to download the following dark site bundles:

Note: For dark site deployments, Nutanix provides a dark site bundle, which has the Docker images (normally hosted on ECR) and the network controller package (normally hosted on LCM portal). These dark site bundles can be downloaded using an internet-connected system outside the dark site.
- MSP dark site bundle: https://portal.nutanix.com/page/downloads/list > Microservices Platform (MSP)
- Flow Networking network controller dark site bundle: See the Flow Networking Release Notes for the link to download the dark site bundle.
- Network Gateway bundle: See the Flow Networking Release Notes for the link to download the dark site bundle with checksum text file. Also, see KB-12393 .

To deploy Flow Networking at a dark site, do the following.

Procedure

Start a web server to host the dark site bundles and act as a source for the LCM downloads, if one is not already created.
The web server can be a virtual machine on a cluster at the dark site. All the Prism Central VMs at the dark site must have access to this web server. This web server is used when you deploy any dark site bundle including the network controller darksite bundle.

For more information about the server installation, see:
- Linux web server
- Windows web server
In Prism Central, go to Administration > LCM > Inventory .
Alternatively, SSH into the Prim Central VM as an admin user and run the following command.
```
admin@pcvm$ mspctl controller airgap enable --url=http://<LCM-web-server-ip>/release
```
Where <LCM-web-server-ip> is the IP address of the LCM web server and release is the name of the directory where the packages were extracted.

For example, admin@pcvm$ mspctl controller airgap enable --url=http://10.48.111.33/release . Here, 10.48.111.33 is the IP address of the LCM web server and release is the name of the directory where the packages were extracted.
Verify the configuration by running the following command:
```
nutanix@cvm$ mspctl controller airgap get
```
From a device that has public Internet access, click the Nutanix Compatibility Bundle link and down the bundle. Transfer this bundle to the LCM web server and extract the contents.
From a device that has public Internet access, Nutanix recommends that you download and extract the latest MSP dark site bundle, transfer it to the LCM web server, and extract the contents.
From a device that has public Internet access, download the Flow networking dark site bundle (see Release Notes | Flow Networking for download links). Transfer the bundle to the LCM web server.
Extract or unpack the Flow networking dark site bundle on the LCM web server.

After unpacking, check if the system shows a directory path that includes the following as per the example: http://<LCM-web-server-ip>/release/builds/msp-builds/msp-services/464585393164.dkr.ecr.us-west-2.amazonaws.com/nutanix-msp/atlas-hermes/ .
Run the following command after unpacking to ensure that the file permissions are not disrupted during the unpacking:
- Linux.
```
chmod -R +r builds
```
- Windows NTFS.
```
$> takeown / R / F *
$> icacls <Build-file-path> /t /grant:F 
```
  .
Enable microservices infrastructure.

See the Enabling Microservices Infrastructure section in the Prism Central Guide for details.
Enable Flow Networking. See Enabling Flow Networking.

Troubleshooting Tips

This section provides information to assist troubleshooting of Flow Networking deployments. This is in addition to the information that the "Prism Central Guide" provides.

Audit Logs

Prism Central generates audit logs for all the flow networking activities like it does for other activities on Prism Central. See Audit Summary View in the Prism Central Guide , for more information about Audit log.

Support Bundle Collection

To support troubleshooting for Flow Networking, you can collect logs.

To collect the logs, run the following commands on the Prism Central VM console:

nutanix@cvm$ logbay collect -t msp,anc

An example of the command is as follows:

nutanix@cvm$ logbay collect -t msp,anc -O msp_pod=true,msp_systemd=true,kubectl_cmds=true,persistent=true --duration=-48h0m0s

Where:

-t flag indicates the tags to collect
- msp tag will collect logs from the services running on MSP pods and persistent log volumes (application-level logs)
- anc tag will collect the support bundle, which includes database dumps and OVN state
-O flag adds tag-level options
- msp_pod=true collects logs from MSP service pods
  
  On the PC, these logs can be found under /var/log/containers .
- persistent=true collects persistent log volumes (application-level logs for ANC)
  
  On the PC, these can be found under /var/log/ctrlog
- kubectl_cmds=true runs kubectl commands to get the Kubernetes resource state
--duration sets the duration from the present to collect

The command run generates a zip file at a location, for example: /home/nutanix/data/logbay/bundles/<filename>.zip

Unzip the bundle and you'll find the anc logs under a directory specific to your MSP cluster, the worker VM where the pod is running, and the logging persistent volume of that pod. For example:

./msp/f9684be8-b4e8-4524-74b4-076ed53ca1fd/10.48.128.185__worker_master_etcd/persistent/default/ovn/anc-ovn_StatefulSet/

For more information about the task run, see the text file that the command generates at a location, for example: /home/nutanix/data/logbay/taskdata/<taskID>/collection_result.txt

For more information about the logbay collect command, see the Logbay Log Collection (Command Line) topic in the Nutanix Cluster Check Guide (NCC Guide).

Layer 2 Virtual Subnet Extension Alert: The L2StretchLocalIfConflict alert (Alert with Check ID - 801109) may occur while performing Layer 2 virtual subnet extensions. See KB-10395 for more information about its resolution.

Network Gateway Upgrades

Nutanix deployment can detect and install upgrades for the onprem Nutanix Gateways.

For information about identifying the current Nutanix Gateway version, see Identifying the Gateway Version.

For onprem Nutanix Gateways, the upgrades need to be detected and installed on the respective PC on which each Nutanix Gateway is installed.

For more information, see Detecting Upgrades for Gateways.

When PC detects the upgrades, it displays a banner on the Gateways tab of the Connectivity page. The banner notifies you that a Gateway upgrade is available after you have run LCM inventory. The table on the Gateways tab also displays an alert (exclamation mark) icon for the network gateways that the upgrade applies to. The hover message for the icon informs you that an upgrade is available for that Gateway.

Figure. Upgrade Banner Click to enlarge

For more information about the upgrade procedure, see Upgrading the PC-managed Onprem Nutanix VPN Gateways.

Identifying the Gateway Version

About this task

To identify the current Nutanix Gateway version, do the following:

Procedure

Click the hamburger icon and Networking & Security > Connectivity .
On the Gateways tab, click the Gateway name link text to open the Gateway details page.

In the Gateway table, the VPN Gateway name is a clickable link text.

The Gateway Version is listed in the Properties widget.

Figure. Gateway Version Click to enlarge

Detecting Upgrades for Gateways

About this task

Prism Central can detect whether new Gateway upgrades are available, or not, for Nutanix Gateways using LCM. You can then install the upgrade.

Procedure

Click the hamburger icon of Dashboard .
Click Administration > LCM > Inventory .
Click Perform Inventory .

Note:
Nutanix recommends that you select Enable LCM Auto Inventory in the LCM page in Prism Central to continuously detect new Gateway upgrades as soon as they are available.

The upgrade notification banner is displayed on the Gateways page.

Upgrading the PC-managed Onprem Nutanix VPN Gateways

About this task

Perform upgrades of PC-managed Nutanix Gateways using the respective PC on which the Gateway is created.

To upgrade the on-prem Nutanix Gateways, do the following:

Procedure

Log on to the Prism Central as the admin user and click the gear icon.
Go to Administration > LCM > Inventory .
Click Perform Inventory .

When you click Perform Inventory , the system scans the registered Prism Central cluster for software versions that are running currently. Then it checks for any available upgrades and displays the information on the LCM page under Software .

Note:
Skip this step if you have enabled auto-inventory in the LCM page in Prism Central.
Go to Updates > Software . Select the Gateway version you want to upgrade to and click Update .

LCM upgrades the Gateway version. This process takes sometime.

Network and Security View

The Network and Security category in the Entities Menu expands on-click to display the following networking and security entities that are configured for the registered clusters:

Subnets : This dashboard displays the subnets and the operations that you can perform on subnets.
Virtual Private Clouds : This dashboard displays the VPCs and the operations that you can perform on VPCs.
Floating IPs : This dashboard displays a list of floating IP addresses that you are using in the network. It allows you to request for floating IP addresses from the free pool of I addresses available to the clusters managed by the Prism Central instance.
Connectivity : This dashboard allows you to manage the following networking capabilities:
- Gateways : This tab provides a list of network gateways that you have created and configured, and the operations you can perform on the network gateways. You can check and upgrade the Gateway bundle in Administration > LCM > Inventory .
- VPN Connections : This tab provides a list of VPN connections that you have created and configured, and the operations you can perform on VPN connections.
- Subnet Extensions : This tab provides a list of subnets that you have extended at the Layer 2 level using VPN (point-to-point over Nutanix VPN) or VTEP (point-to-multi-point including third party).
Security Policies : This dashboard provides a list of security policies you configured using Flow Segmentation. For more information about Security Policies, see the Flow Microsegmentation Guide.

See "Network Connections" section for information on how to configure network connections.

Subnets (Overlay IP subnets), Virtual private clouds, floating IPs, and Connectivity are Flow Networking features. These features support flexible app-driven networking that focuses on VMs and applications instead of virtual LANs and network addresses. Flow Networking powers network virtualization to offer a seamless network experience with enhanced security. It is disabled by default. It is a software-defined network virtualization solution providing overlay capabilities for the on-premises AHV clusters.

Security policies drives the Flow Segmentation features for secure communications. See Flow Microsegmentation Guide.

Subnets

Manage subnets in the List view of Subnets dashboard in the Network and Security section.

To access the Subnets dashboard, select Subnets from the entities menu in Prism Central. The Subnets dashboard allows you to view information about the subnets configured for the registered clusters.

Note: This section describes the information and options that appear in the Network and Security dashboard. See Entity Exploring for instructions on how to view and organize that information in a variety of ways.

The following table describes the fields that appear in the subnets list. A dash (-) is displayed in a field when a value is not available or applicable.

Table 1. Subnets Dashboard Fields
Parameter	Description	Values
Name	Displays the subnet name.	(subnet name)
External Connectivity	Displays whether or not the subnet has external connectivity configured.	(Yes/No)
Type	Displays the subnet type.	VLAN
VLAN ID	Displays the VLAN identification number.	(ID number)
VPC	Displays the name of the VPC that the Subnet is used in.	(Name of VPC)
Virtual Switch	Displays the virtual switch that is configured for the VLAN you selected. The default value is the default virtual switch `vs0` . Note: The virtual switch name is displayed only if you add a VLAN ID in the VLAN ID field.	(virtual switch name)
IP Prefix	Displays the IPv4 Address of the network with the prefix.	(IPv4 Address/Prefix)
Cluster	Displays the name of the cluster for which this subnet is configured.	(cluster name)
Hypervisor	Displays the hypervisor that the subnet is hosted on.	(Hypervisor)

To filter the list by network name, enter a string in the filter field. (Ignore the Filters pane as it is blank.)

To view focused fields in the List, select the focus parameter from the Focus drop down list. You can create your own customised focus parameters by selecting Add custom from the drop down list and selecting the necessary fields after providing a Name , in the Subnet Columns .

There is a Network Config action button to configure a new network (see Configuring Network Connections

The Actions menu appears when one or more networks are selected and includes a Manage Categories option (see Assigning a Category ).

Go to the Subnets list view by clicking Network and Security > Subnets on the left side-bar.

To view or select actions you can perform on a subnet, select the subnet and click the Actions dropdown.

Table 2. Subnet Actions
Action	Description
Update	Click this action to update the selected subnet. see Updating a Subnet in the Flow Networking Guide.
Manage Extension	Click this action to create a subnet extension. A subnet extension allows VMs to communicate over the same broadcast domain to a remote Xi availability zone (in case of Xi-Leap based disaster recovery) via the extension.
Manage Categories	Click this action to associate the subnet with a category or change the categories that the subnet is associated with.
Delete	Click this action to delete the selected subnet. See Deleting Subnets, Policies, or Routes in the Flow Networking Guide .

You can also filter the list of subnets by clicking the Filters option and selecting the filtering parameters.

Subnet Summary View

View the details of a subnet listed on the Subnets page.

To view the details of a subnet, click the name of the subnet on the subnet list view.

The Summary page provides buttons for the actions you can perform on the subnet, at the top of the page. Buttons for the following actions are available: Update , Extend , Manage Categories , and Delete .

The subnet Summary page has the following widgets:


Widget Name	Information provided
Subnet Details	Provides the following: Type — Displays the type of network like VLAN or Overlay. VLAN ID — Displays the VLAN ID. This parameter is displayed only for VLAN networks. VPC — Displays the VPC name. This parameter is displayed only for Overlay networks. Cluster — Displays the cluster that the VLAN network is configured on. This parameter is displayed only for VLAN networks. IP Prefix — Displays the IP address prefix configured for the network. This parameter is displayed for both VLAN and Overlay networks.
IP Pool	Provides the IP address Pool Range assigned to the network.
External Connectivity	Provides the following: NAT — Displays whether NAT is enabled or disabled for VPCs connecting to the network. When you hover on the `Enabled` / `Disabled` status, the hover message displays details of VPCs connected to the external subnet. Associated VPCs — Displays the VPCs associated with this external subnet.

Virtual Private Clouds

You can manage Virtual Private Clouds (VPCs) on the Virtual Private Clouds dashboard.

Go to the Virtual Private Clouds dashboard by clicking Network and Security > Virtual Private Clouds on the left side-bar.

You can configure the table columns for the VPC list table. The available column list includes Externally Routable IP Addresses that provides address space within the VPC that is reachable externally without NAT.. For the list of columns that you can add to the list table, see Customizing the VPC List View.

Note:

Ensure that the externally routable IP addresses (subnets with external connectivity without NAT) for different VPCs do not overlap.

Configure the routes for the external connectivity subnets with next hop as the Router or SNAT IP address. Also configure the routes on the router for the return traffic to reach the VPC. See External Connectivity panel in VPC Details View.

To view or select actions you can perform on a VPC, select the VPC and click the Actions drop down.

You can also filter the list of VPC by clicking the Filters option and selecting the filtering parameters.

Customizing the VPC List View

About this task

You can customize the columns in the table. Click the View by drop down and select + Add custom .

In the Virtual Network Columns dialog box, do the following.

Procedure

Enter a name for the view.
Select the columns you want displayed in the table.

During the column selection, the columns you select are moved under the Selected Columns list. The Name (of the VPC) column is the default column already selected. You can add a maximum of 10 columns (including the Name column) to the Selected Column list.

Figure. Customizing Columns in VPC View Click to enlarge

To arrange the order of the selected columns, hover on the column name and click the up or down arrow button as appropriate.
Click Save .

VPC Details View

To view the details of a VPC, click the name of the VPC on the VPC list view.

The VPC details view has the following tabs:

Summary
Figure. Summary Tab Click to enlarge

The Summary tab provides the following panes:
- DNS Servers —Provides more information about the DNS Servers used by the VPC.
- External Connectivity —Provides the name of the external subnet, NAT Gateway host details, router/SNAT IP address and the IP address spaces or ranges configured for the VPC.
- Floating IP Addresses —Provides details of the floating IP addresses that the VPC uses.
Subnets
Figure. Subnet Tab Click to enlarge

The Subnet tab provides the following information for the subnets:
- Name —Displays the name of the subnet.
- IP Range —Displays the IP address range configured for the subnet.
- DHCP IP Pool —Displays the DHCP IP address pool configured for the subnet.
- Default Gateway IP —Displays the IP address used as the default gateway by the entities in the subnet.
- Actions —Displays the actionable links to Edit or Delete the subnet.
Policies
Figure. Policies Tab Click to enlarge

The Policies tab maps the following information about the security-based traffic shaping policies you configure:
- Priority —The traffic priority.
- Rule —The Allow or Deny rule set for the priority.
- Traffic —The traffic type that the priority and rule should be applied to.
- Actions —Actions you can take on the policy. You can perform three actions: Clear counters , Edit the policy or Delete the policy.
Routes
Figure. Routes Tab Click to enlarge

The Routes tab provides the following information about the routes:

The VPC details view has the following configuration options for the VPC:

Update : Use this option to update the VPC. For more information, see Updating Virtual Private Cloud.
Add Subnet : Use this option to add a subnet to the VPC. For more information, see Creating a Subnet.
Create Static Routes : Use this option to create a static route. For more information, Creating Static Routes.
Update Static Routes : Use this option to update static route configurations that you already created. For more information, see Updating Static Routes.
Create Policy : Use this option to create traffic policies in addition to the pre-configured default policy. When you create a VPC, there is one default policy that Advanced Networking creates for the VPC. This policy is pre-configured and cannot be edited. For more information, see Creating a Policy.
Clear All Counters : Allows you to clear all the counters for the VPC.
Delete : Allows you to delete the VPC. For more information, see Deleting a Virtual Private Cloud.

Floating IPs

You can access floating IPs on the Floating IPs dashboard or list view in the Network and Security section.

For information about floating IP addresses and their role in Flow Networking, see SNAT and Floating IP Address.

Go to the Floating IPs dashboard by clicking Network and Security > Floating IPs on the left side-bar.

To view or select actions you can perform on a floating IP address assigned, select the floating IP address and click the Actions drop down. The following actions are available for a selected floating IP address:

Update—Assign or change the assignment of the floating IP address. You can assign the floating IP address to a IP address such as a private IP address in a VPC or the primary IP address of a VM or a secondary IP address created on a VM.
Delete—Delete the floating IP address. The deleted IP address returns to the IP address pool as unused. Before you delete, ensure that it is not assigned to a private IP address or a VM. Change the assignment to None if it is already assigned, using the Update action.

Note: Floating IP addresses are not reachable (Pings fail) unless you associate them to primary or secondary IP addresses of VMs. For more information about assigning floating IP addresses to secondary IP addresses of VMs, see Assigning Secondary IP Addresses to Floating IPs .

To filter the list of floating IP address assignments, click the Filters option and select the appropriate filtering parameters.

To request floating IP addresses, see Requesting Floating IPs.

Connectivity

You can access network Gateways, VPN connections and subnet extensions on the Connectivity dashboard.

Click Network & Security > Connectivity to see the Connectivity dashboard.

The Connectivity dashboard opens on the Gateways tab. To see the VPN connections, click the VPN Connections tab. To see the subnets extended across AZs, click the Subnet Extensions tab.

Gateways Summary View

The Connectivity dashboard opens on the Gateways dashboard or summary view.

The Gateway dashboard provides a list of gateways created for the clusters managed by the Prism Central.

The Gateways dashboard provides a Create Gateway dropdown menu that lets you create a Local or a Remote gateway. You can create a local or remote gateway with VPN or VTEP service. For more information, see Creating a Network Gateway.

You can select a gateway from the list (select the checkbox provided for the gateway) and then perform an action provided in the Actions dropdown list. The Actions dropdown list allows you to Update or Delete the selected gateway.

Displaying the Connectivity dashboard with the Gateways dashboard

The Gateway summary list view provides the following details about the gateway.

Table 1. Gateway List Fields
Parameter	Description	Values
Name	Displays the name of the gateway.	(Name of gateway)
Type	Displays the gateway type.	(Local or Remote)
Service	Displays the service that the gateway uses.	(VPN or VTEP)
Service IP	Displays the IP address used by the service.	(IP address)
Status	Displays the operational status of the gateway.	(Up or Down)
Attachment Type/Vendor	Displays the type of subnet associated with the gateway.	(VLAN or Overlay-VPC name)
Connections	Displays the number of service connections (such as VPN connections) configured and operational on the gateway.	(number)

You can click the name of a gateway to open the gateway details page that presents the information about the gateway in widgets.

Gateway Details View

You can click the name of a gateway in the Gateway dashboard list to open the gateway details page that presents the information about the gateway in widgets.

The gateway details page displays the name of the gateway on the top left corner.

On the top right corner, the close button (X) allows you to close the details page.
The Update button opens the Update Gateway page. For more information, see Updating a Network Gateway in Flow Networking Guide .
The Delete button allows you to delete the gateway. For more information, see Deleting a Network Gateway in Flow Networking Guide .

Displays the gateway details page that provides details of the gateway in two widgets - Properties and Service configuration

The details about the gateway are organized in widgets as follows:

Table 1. Gateway Details
Parameter	Description	Values
Properties widget
Type	Displays the gateway type.	(Local or Remote)
Attachment Type	Displays the network entity like VLAN or VPC that the gateway is attached to.	(VLAN or VPC)
VPC or Subnet (VLAN)	Displays the name of the attached VPC or VLAN subnet.	(Name of VLAN or VPC)
Floating or Private IP Address	Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to the gateway.	(IP Address)
Status	Displays the operational status of the gateway.	(Up or Down)
Gateway Version	Displays the version of the Nutanix gateway appliance deployed.	(Version)
Cluster	Displays the name of the cluster on which the gateway is created.	(Cluster name)
Gateway VM	Displays the name of the VM on which the gateway is created.	(Name of VM - actionable link. Click the name-link to open the VM details page of the gateway VM.)
Service Configuration
Service	Displays the service used by the gateway.	(VPN or VTEP)
External Routing	Displays the type of routing associated with the gateway for external traffic routing.	(Static or eBGP with ASN)
Internal Routing	Displays the type of routing associated with the gateway for internal traffic routing.	(Static or eBGP with ASN)
VPN Connections	Displays the total number of VPN connections associated with the gateway.	(Number - actionable link. Click the link to open the VPN connection details page for the associated VPN connection.)
View VPN Connections	Click this link to open the VPN Connections tab.	-

VPN Connections Summary View

The Connectivity dashboard allows you to open the VPN Connections dashboard or summary view.

VPN Connection: Represents the VPN IPSec tunnel established between local gateway and remote gateway. When you create a VPN connection, you need to select two gateways between which you want to create the VPN connection.

The VPN Connections dashboard provides a list of VPN connections created for the clusters managed by the Prism Central.

The VPN Connections dashboard provides a Create VPN Connection button that opens the Create VPN Connection . For more information, see Creating a VPN Connection in Flow Networking Guide .

You can select a VPN connection from the list (select the checkbox provided for the VPN connection) and then perform an action provided in the Actions dropdown list. The Actions dropdown list allows you to Update or Delete the selected VPN connection.

The VPN Connections summary list view provides the following details about the VPN connection.

Displaying the VPN Connections dashboard.

Table 1. VPN Connections List Fields
Parameter	Description	Values
Name	Displays the name of the connection.	(gateway name)
IPSec Status	Displays the connection status of IPSec tunnel.	(Connected or Not Connected)
EBGP Status	Displays the status of the EBGP gateway connection.	(Established or Not Established)
Local Gateway	Displays the name of the local gateway used for the connection.	(Name of local gateway)
Remote Gateway	Displays the name of the remote gateway used for the connection.	(Name of remote gateway)
Dynamic Routing Priority	Displays the dynamic routing priority assigned to the connection for throughput management. You can assign any value in the range of 100-1000. Flow networking assigns the first VPN connection the value 500 by default. Thereafter, subsequent VPN connections are assigned values decremented by 50. For example, the first connections is assigned 500, then the second connection is assigned 450, the third one 400 and so on.	(Number in the range of 100-1000. User assigned.)

VPN Connections Details View

You can click the name of a VPN connection in the VPN Connections dashboard list to open the VPN connection details page that presents the information about the VPN connection in widgets.

The VPN connection details page displays the name of the VPN connection on the top left corner.

On the top right corner, the close button (X) allows you to close the details page.
The Update button opens the Update VPN Connection page. For more information, see Updating a VPN Connection in Flow Networking Guide .
The Delete button allows you to delete the VPN connection. For more information, see Deleting a VPN Connection in Flow Networking Guide .

Displaying the detailed view of the selected VPN connection with the information organized in widgets.

The details about the VPN connection are organized in widgets as follows:

Summary tab—See the VPN Connection Summary Tab Details table below.
Throughput tab—See the VPN Connection Throughput Tab Details table below.
IPSec Logging tab—Provides logs for the IPSec tunnel.
Routing Protocol Logging tab—Provides logs for the routing protocol used in the VPN connection.

Table 1. VPN Connection Summary Tab Details
Parameter	Description	Values
VPN Connection widget
IPSec Status	Displays the connection status of IPSec tunnel.	(Connected or Not Connected)
EBGP Status	Displays the status of the EBGP gateway connection.	(Established or Not Established)
Dynamic Routing Priority	Displays the dynamic routing priority assigned to the connection for throughput management. You can assign any value in the range of 100-1000. Flow networking assigns the first VPN connection the value 500 by default. Thereafter, subsequent VPN connections are assigned values decremented by 50. For example, the first connections is assigned 500, then the second connection is assigned 450, the third one 400 and so on.	(Number in the range of 100-1000. User assigned.)
Local Gateway Properties
Gateway Name	Displays the name of the local gateway used for the connection.	(Name of local gateway)
Type	Displays the type of gateway.	(Local)
Attachment Type	Displays the network entity like VLAN or VPC that the gateway is attached to.	(VLAN or VPC)
VPC or Subnet (VLAN)	Displays the name of the attached VPC or VLAN subnet.	(Name of VLAN or VPC)
Tunnel IP	Displays the Tunnel IP address of the local gateway.	(IP Address)
Connection Type	Displays the connection type you selected while creating the VPN connection. The connection type may be Initiator or Acceptor of a VPN connection between the local and remote gateways. T	(Initiator or Acceptor)
External Routing	Displays the type of routing associated with the gateway for external traffic routing.	(Static or eBGP with ASN)
Internal Routing	Displays the type of routing associated with the gateway for internal traffic routing.	(Static or eBGP with ASN)
Floating or Private IP Address	Displays the Floating (for VPC) or Private (for VLAN) IP address assigned to the gateway.	(IP Address that you assigned to the local gateway with /30 prefix when you configured the VPN connection.)
Status	Displays the operational status of the gateway.	(Up or Down)
Cluster	Displays the name of the cluster on which the gateway is created.	(Cluster name)
Gateway VM	Displays the name of the VM on which the gateway is created.	(Name of VM - actionable link. Click the name-link to open the VM details page of the gateway VM.)
Remote Gateway Properties
Gateway Name	Displays the name of the remote gateway used for the connection.	(Name of remote gateway)
Type	Displays the type of gateway.	(Remote)
Tunnel IP	Displays the Tunnel IP address of the remote gateway.	(IP Address)
Connection Type	Displays the connection type you selected while creating the VPN connection. The connection type may be Initiator or Acceptor of a VPN connection between the local and remote gateways. T	(Initiator or Acceptor)
External Routing	Displays the type of routing associated with the gateway for external traffic routing.	(Static or eBGP with ASN)
ASN	Displays the ASN of the EBGP route. This information is only displayed if you configured EBGP as the External Routing protocol.	(Number)
Vendor	Displays the name of the vendor of the gateway appliance at the remote site.	(Name of vendor of gateway appliance)
External IP	Displays the IP address assigned to remote the gateway.	(IP Address that you assigned to the remote gateway with /30 prefix when you configured the VPN connection.)
Status	Displays the operational status of the gateway.	-
Protocol Details
Service	Displays the service used by the gateway.	(VPN or VTEP)

Gateway Routes	Displays the status of the routes used by the gateways.	(Sent)

Subnet Extensions Summary View

The Connectivity dashboard opens on the Subnet Extensions dashboard or summary view.

The Subnet Extensions dashboard provides a list of subnet extensions created for the clusters managed by the Prism Central.

The Subnet Extensions dashboard provides a Create Subnet Extension dropdown menu that lets you extend a subnet Across Availability Zones or To a Third Party Data Center . You can extend a subnet using VPN or VTEP service. See Layer 2 Virtual Network Extension for more information.

You can select a subnet extension from the list (select the checkbox provided for the subnet extension) and then perform an action provided in the Actions dropdown list. The Actions dropdown list allows you to Update or Delete the selected subnet extension.

Displaying the Subnet Extension dashboard.

The Subnet Extensions summary list view provides the following details about the gateway.

Table 1. Subnet Extensions List Fields
Parameter	Description	Values
Name	Displays the name of the subnet extension.	(Name of subnet extension)
Type	Displays the subnet extension type.	( Across Availability Zones or To a Third Party Data Center )
Extension Over	Displays the service that the subnet extension uses.	(VPN or VTEP)
Extension Uses	Displays the name of the local network gateway that the subnet extension uses.	(Name of local network gateway)
Local Subnet	Displays the name of the local subnet that the subnet extension uses.	(Name of local subnet)
Remote Site	Displays the name of the remote network gateway that the subnet extension uses.	(Name of remote network gateway)
Connection Status	Displays the status of the connection that is created by the subnet extension. Not Available status indicates that Prism Central is unable to ascertain the status.	(Not Available, Connected, or Disconnected)
Interface Status	Displays the status of the interface that is used by the subnet extension.	(Connected or Down)

You can click the name of a subnet extension to open the subnet extension details page that presents the information about the subnet extension in widgets.

Subnet Extensions Details View

You can click the name of a subnet extension in the Subnet Extensions dashboard list to open the subnet extension details page that presents the information about the subnet extension in widgets.

The subnet extension details page displays the name of the subnet extension on the top left corner. It has two tabs - Summary and Address Table . The Summary tab provides the information about the subnet extension in widgets. The Address Table tab provides MAC Address information only when the subnet extension uses VTEP service.

On the top right corner, the close button (X) allows you to close the details page.
The Update button opens the Update Subnet Extension page. See Updating an Extended Subnet for more information.
The Delete button allows you to delete the subnet extension. See Removing an Extended Subnet for more information.

Displays the subnet extension details page, Summary that provides details of the subnet extension in one extended widget with three sections - Properties, IP Address Pools and Subnet Extension properties.

Displays the subnet extension details page, Address Table tab that provides details of the MAC Addresses in the subnet extension

The details about the subnet extension are organized in two tabs. The Summary tab organizes the subnet extension details in the extended widget as provided in the table. The Address Table tab provides details about the MAC addresses in a list.

Table 1. Subnet Extension Details - Summary Tab Fields
Parameter	Description	Values
Properties
Type	Displays the subnet type.	(VLAN or Overlay)
VLAN ID	(For VLAN subnets only) Displays the VLAN ID of the VLAN subnet that is extended.	(VLAN ID number)
VPC	(For Overlay subnets only) Displays the name of the VPC subnet that is extended.	(Name of VPC)
Cluster	(For VLAN subnets only) Displays the cluster that the VLAN subnet belongs to.	(Name of cluster)
IP Address Prefix	Displays the network IP address with prefix, of the VLAN subnet that is extended.	(IP Address with prefix)
Virtual Switch	(For VLAN subnets only) Displays the virtual switch on which the VLAN subnet is configured.	(Virtual Switch name such as vs0 or vs1)
IP Address Pools
Pool Range	Displays the range of IP addresses in the pool configured in the subnet that is extended.	(IP address range)
(Interactive Graphic Pie Chart)	Displays a dynamic pie chart that displays the statistic you hover on. Displays the following IP address statistics outside the pie chart, that you can hover on: Total number of IP addresses available. Used IP addresses in the subnets Used IP addresses in the IP address pools Free IP addresses in the subnets Free IP addresses in the IP address pools	(IP Address statistics)
Subnet Extension
Subnet Extension (properties) - Common
Type	Displays the subnet extension type.	( Across Availability Zones or To a Third Party Data Center )
Interface Status	Displays the status of the interface that is used by the subnet extension.	(Connected or Down)
Connection Status	Displays the status of the connection that is created by the subnet extension. Not Available status indicates that Prism Central is unable to ascertain the status.	(Not Available, Connected, or Disconnected)
Local IP Address	Displays the IP address that you entered in the Local IP Address field while creating the subnet extension.	(IP Address)
Local Subnet	Displays the name of the local subnet that the subnet extension uses.	(Name of local subnet)
Subnet Extension (properties) - (Only for Across Availability Zones type)
Local Availability Zone	(Only for Across Availability Zones type) Displays the name of the local AZ that is hosting the subnet that is extended.	(Name of the local Availability Zone)
Remote Availability Zone	(Only for Across Availability Zones type) Displays the name of the remote AZ that the subnet is extended to.	(Name of the remote Availability Zone)
Remote Subnet	(Only for Across Availability Zones type) Displays the name of the remote subnet that the subnet extension connects to.	(Name of remote subnet)
Remote IP Address	(Only for Across Availability Zones type) Displays the IP address that you entered in the Remote IP Address field while creating the subnet extension.	(IP Address)
Subnet Extension (properties) - (Only for To a Third Party Data Center type)
Local Gateway	(Only for To a Third Party Data Center type) Displays the name of the local gateway used for the subnet extension.	(Name of local gateway)
Remote Gateway	(Only for To a Third Party Data Center type) Displays the name of the remote gateway used for the subnet extension.	(Name of remote gateway)

Security Policies Summary View

To access the security policies dashboard, select Policies > Security Policies from the entities menu (see Entities Menu). The security policies dashboard allows you to view summary information about defined security policies.

Note: This section describes the information and options that appear in the security policies dashboard.

See Entity Exploring for instructions on how to view and organize that information in a variety of ways.
See Flow Microsegmentation Guide for information about how to create and apply security policies.

Security policies view of the Explore dashboard

The following table describes the fields that appear in the security policies list. A dash (-) is displayed in a field when a value is not available or applicable.

Table 1. Security Policies List Fields
Parameter	Description	Values
Name	Displays the policy name. The policy is one of three types: application, quarantine, or isolation.	(name), Application, Quarantine, Isolation
Purpose	Describes (briefly) the policy's purpose.	(text string)
Policy	Displays (high level) what the policy does.	(boxed text)
Status	Displays the current status of the policy (either applied currently or in monitoring mode).	Applied, Monitoring
Last Modified	Displays the date the policy was last modified (or the creation date if the policy has never been modified).	(date)

You can filter the security polices list based on several parameter values. The following table describes the filter options available when you open the Security Policies view Filter pane. To apply a filter, select a parameter and check the box of the desired value (or multiple values) you want to use as a filter. You can apply filters across multiple parameters.

Table 2. Filter Pane Fields
Parameter	Description	Values
Name	Filters on the item name. Select a condition from the pull-down list ( Contains , Doesn't contain , Starts with , Ends with , or Equal to ) and enter a string in the field. It will return a list of security policies that satisfy the name condition/string.	(policy name string)
Type	Filters on the policy type. Check the box for one or more of the policy types (application, quarantine, isolation). It will limit the list to just those policy types.	Application, Quarantine, Isolation
Status	Filters on the policy status. Check the box for applied or monitoring.	Applied, Monitoring

The security policies dashboard includes a Create Security Policy action button with a drop-down list to Secure an Application or Isolation Environments .

The Actions menu appears when one or more policies are selected. It includes options to update, apply, monitor, and delete. The available actions appear in bold; other actions are grayed out. (For grayed out options, a tool tip explaining the reason is provided.)

Security Policy Details View

To access the details page for a security policy, click on the desired security policy name in the list (see Security Policies Summary View). The Security Policy details page includes the following:

The policy name appears in the upper left. You can switch from one policy to another by selecting the policy name from the pull-down list.
The rule status appears below the name and indicates whether the policy is being applied currently or is in monitoring mode.
Three columns appear that specify the Inbound policy (on the left), the affected entities (in the middle), and the Outbound policy (on the right).
There are three action buttons (upper right).
- Click the appropriate button to update, apply, monitor, or delete the policy (see Nutanix Security Guide for details). The available actions appear in bold; other actions are grayed out. (For grayed out options, a tool tip explaining the reason is provided.)
- Click the question mark icon to open a help page in a separate tab or window.
- Click the X icon to close the details page.

For more information about Security Policies, see Flow Microsegmentation Guide.

Virtual Private Cloud

A Virtual Private Cloud (VPC) is an independent and isolated IP address space that functions as a logically isolated virtual network. A VPC could be made up of one or more subnets that are connected through a logical or virtual router. The IP addresses within a VPC must be unique. However, IP addresses may overlap across VPCs. As VPCs are provisioned on top of another IP-based infrastructure (connecting AHV nodes), they are often referred to as the overlay networks. Tenants may spin up VMs and connect them to one or more subnets within a VPC.

Virtual Private Cloud (VPC) is a virtualized network of resources that are specifically isolated from the rest of the resource pool. VPC allows you to manage the isolated and secure virtual network with enhanced automation and scaling. The isolation is done using network namespace techniques like IP-based subnets or VLAN based networking.

AHV provides the framework to deploy VPC on on-premises clusters using the following.

Advanced Networking subnets and DHCP management
Multiple uplink and bridge management via virtual switch (VS)
Virtual Private Network (VPN) gateways and connections

Flow Networking simplifies the deployment and configuration of overlay-based VPCs. It allows you to quickly:

Create, update and delete VPCs.
Create, update and delete subnets within VPCs.
Note: Create subnets as necessary when you create VPCs.
Add network security policies and services.
Configure hybrid cloud connectivity with VPNs.

This section covers the concepts and procedures necessary to implement VPCs in the network.

VM IP Address Management

Primary Address

The primary IP address is assigned to a VM during initialization when the cluster provides any virtual NIC (NIC) to a VM.

Select Assign Static IP as the Assignment Type to add a static IP address as primary IP address of the VM, when you attach a subnet to a VM.
Select Assign with DHCP as the Assignment Type to allow DHCP to dynamically assign an IP address to the VM.
Select No Private IP as the Assignment Type if you do not want to assign an IP address to the vNIC of the VM.

For more information about attaching a subnet to a VM, see Creating a VM through Prism Central (AHV) in the Prism Central Guide .

Secondary IP Addresses (Overlay Networks only)

For your deployment, you may need to configure multiple (static) IP addresses to a single NIC. These IP addresses (other than the primary IP address) are secondary IP addresses. A secondary IP address can be permanently associated with a specific NIC or be changed to any other NIC. The NIC ownership of a secondary IP address is important for security routing policies.

Note: You can configure secondary IP addresses only for VMs in an Overlay network.

You can configure secondary IP addresses to a NIC when you want to:

Associate multiple floating IP addresses with one VM without creating multiple NICs (each with one primary IP address) for the VM. You can assign one floating IP address to one secondary IP address that you create for the single NIC. For information about floating IP addresses, see Requesting Floating IPs.
Run appliances, such as load balancers, that have multiple IP addresses on each interface.
Host applications in a High Availability (HA) configuration where the ownership of IP address moves from the active entity to the standby entity when the active entity goes down.
Host applications in a clustered configuration where the ownership of IP address follows the leader.
Host Nutanix Files service in a VPC as a case of clustered application.

Note:

In applications that use secondary IP addresses as virtual IP addresses and the NIC ownership of the secondary IP address changes dynamically from one NIC to another, configure the application to incorporate the ownership change in its settings or configuration. If the applications do not incorporate these ownership changes, the VPCs configured for such applications fail.

For information about configuring secondary IP addresses, see Creating Secondary IP Addresses.

IP Address Information

You can view the IP addresses configured on a VM by clicking the See More link in the IP Address column in the VM details view to open the IP Address Information box.

Note: The See More link in the IP Address column in the VM details view and the IP Address Information box are available only if the VM has any secondary IP addresses configured.

Displaying the IP Address Information box

Creating Secondary IP Addresses

You can assign multiple secondary IP addresses to a single vNIC.

About this task

You can add multiple secondary IP addresses to the vNIC configured on a VM. Add the secondary IP addresses to the vNIC in the Create VM or the Update VM page.

Procedure

Go to the Networks section.
Click the Edit icon for the subnet that you want to add the secondary IP addresses from.
The Update NIC dialog box opens.
Check the Add Secondary IPs check box in the Update NIC dialog box.

Figure. Add Secondary IP Addresses Click to enlarge
Add a comma-separated list of the secondary IP addresses that you want to add to the vNIC of the VM.

Note:
Ensure that the secondary IP addresses are within the same subnet that the primary IP address of the NIC is from. The subnets are displayed in the Private IP Assignment section in the Update NIC dialog box.

Ensure that the secondary IP address is not the same as the IP address provided in the Private IP Assignment field.
Click Save .
Click Next on the Resources and the Management tabs of the Update VM page.

If you need to make any other changes on the Resources and the Management tabs for any configurations other than adding secondary IP addresses, make the changes and then click Next on these tabs.
Click Launch VM on the Review tab after you review

What to do next

You can view the secondary IP addresses configured on the VM in the IP Address Information box.

Assigning Secondary IP Addresses to Interfaces

Assign the secondary IP addresses to interfaces or subinterfaces on the VM.

About this task

To assign the secondary IP addresses to virtual interfaces on the VM, do the following on the VM details page:

Procedure

Click Console .
Log in as a root user.
Run the ifconfig command as follows:
```
root@host$ ifconfig <interface> <secondary ip address> <network mask>
```
Provide the following in the command:


Parameter	Description
<interface>	The interface of the VM such as eth0. You can provide subinterfaces such as eth0:1 and eth0:2.
<secondary IP address>	The secondary IP address that you created and want to associate with the interface.
<network mask>	The network mask that is an expansion of the network prefix of the network that the secondary IP address belongs to. For example, if the secondary IP address belongs to 10.0.0.0/24 then the network mask is 255.255.255.0.

Repeat the aforementioned steps for all the secondary IP addresses you want to associate with interfaces on the VM.
Exit from the Console.

Assigning Secondary IP Addresses to Floating IPs

Assign the secondary IP addresses to floating IP addresses on the VM.

About this task

After you assign secondary IP addresses to interfaces or subinterfaces on the VM, you can assign the secondary IP addresses to floating IP addresses that may be used for external connectivity.

Do one of the following:

Procedure

Assign floating IP addresses when you request floating IP addresses in the Assign Floating IPs section of the Request Floating IP dialog box.
To assign floating IP addresses while requesting for them, you must have the secondary IP addresses configured and ready when you are requesting the floating IP addresses.
Select the floating IP address you want to assign, in the Floating IPs dashboard. Click the Update option in the Actions drop-down menu.
Assign the secondary IP addresses you configured to the floating IP addresses you have.

VPC Workflow

A virtual private cloud (VPC) can be deployed on Nutanix cluster infrastructure to manage the internal and external networking requirements using Flow Networking. The workflow to create a complete network based on VPC is described below.

Create a VPC—See Creating Virtual Private Cloud. See Updating Virtual Private Cloud to update a VPC you created.
Add Subnets to the VPC—See Creating a Subnet to create a Subnet. See Updating a Subnet to update a subnet.
Attach the Subnet to VMs—See Attaching a Subnet to a Virtual Machine.

VPC Management

This section provides information and procedures that you need to manage virtual private clouds using Flow networking.

Creating Virtual Private Cloud

About this task

You can create VPCs on the Virtual Private Clouds page. Go to the Virtual Private Clouds page by clicking Virtual Infrastructure > Networking > Virtual Private Clouds .

To create a VPC, do the following.

Procedure

On the VPC dashboard, click Create VPC .

See Network and Security View for more information about the VPC dashboard.

The Create Virtual Private Cloud (VPC) dialog box opens.
Figure. Create Virtual Private Cloud Click to enlarge
Provide the necessary values in respective fields in the Create Virtual Private Cloud (VPC) dialog box.


Fields	Description and Values
Name	Provide a name for the VPC.
External Connectivity	This section takes you through configuration of the parameters necessary for connectivity to the Internet or clusters outside the VPC. A subnet with external connectivity (External Subnet) is required if the VPC needs to send traffic to a destination outside of the VPC. Note: You can add a maximum of two external subnets - one external subnet with NAT and one external subnet without NAT to a VPC. Both external subnets cannot be of the same type. For example, you cannot add two external subnets, both with NAT. You can update an existing VPC similarly. Network address translation (NAT) Gateways perform the required IP-address translations required for external routing. You can also have external connectivity without NAT.
External Subnet	Select an external subnet from the drop down list. By associating the VPC with the external subnet you can provide external connectivity to the VPC. Note: Ensure that the externally routable IP addresses (subnets with external connectivity without NAT) for different VPCs do not overlap. Configure the routes for the external connectivity subnets with next hop as the Router or SNAT IP address. Also configure the routes on the router for the return traffic to reach the VPC. See External Connectivity panel in VPC Details View.
Externally Routable IP Addresses	Provide IP addresses that are externally routable. Externally routable IP addresses are IP addresses that within the VPC which can communicate externally without NAT. These IP addresses are used when an external subnet without NAT is used.
Domain Name Servers (DNS)	(Optional) DNS is advertised to Guest VMs via DHCP. This can be overridden in the subnet configuration. Click + Server IP to add DNS server IPs under IP Address and click the check mark. You can Edit or Delete an IP address you added using the options under Actions .

Click Save .

Requesting Floating IPs

About this task

Each VPN gateway requires a floating IP. If you do not provide one during the VPN gateway creation, then Flow Networking automatically allocates a floating IP to a VPN gateway. To provide floating IP during the VPN gateway creation, you can request floating IPs and assign them to VMs.

You can view the allocated floating IPs on the Floating IPs page. Click Networking > > Floating IPs .

To request a floating IP, do the following.

Procedure

Click the Request Floating IP button on the Floating IPs page.
On the Request Floating IP dialog box, provide the information in the respective fields.

Figure. Request and Assign Floating IPs Click to enlarge

Note:
Uncheck the Assign Floating IPs box if you want to assign the requested IP addresses after you receive it.

See Floating IPs for more information.


Fields	Description and Values
External Subnet	Select a subnet that you configured with external connectivity.
Number of Floating IPs	Enter the number of floating IPs you want. You can request a maximum of 5 floating IP addresses.
Assign Floating IPs	Select this check box if you want to assign the floating IPs to specific VMs in the table. Based on the number you entered in the Number of Floating IPs field, the system provides an equivalent number of rows of `Search VMs` and `IP Address` in the table. Under Search VMs , select the VM to which you want to assign a floating IP address. Under IP Address , select the IP address on the VM (primary or secondary IP address) to which you want to assign the floating IP. You can assign multiple floating IP addresses to multiple secondary IP addresses that you can create on the NIC of the VM. For information about configuring secondary IP addresses, see Creating Secondary IP Addresses.

Note:

Click Save .

What to do next

When you receive the floating IP address you requested, you can see it, assign it (if not already assigned while requesting) or delete it in the Floating IPs view.

Creating a Subnet

About this task

You can create subnets on the Subnets page. Go to the Subnets page by clicking Virtual Infrastructure > Networking and open the Create Subnet dialog box.

You can also open the Create Subnet dialog box from the VPC details view by clicking the Add Subnet option.

To create a subnet, do the following.

Procedure

Click Create Subnet .
The Create Subnet dialog box opens. The following figure displays the Create Subnet dialog box with all the options. These options are displayed based on the values you select in the Type field.
Figure. Create Subnet (With External Connectivity Disabled) Click to enlarge

Figure. Create Subnet (With External Connectivity Enabled) Click to enlarge


Fields	Description and Values
Name	Provide a name for the subnet.
Type	Select the type of subnet you want to create. You can create a `VLAN` subnet or an `Overlay` subnet.
VLAN ID	(VLAN subnet only) Enter the number of the `VLAN` . Enter just the number in this field, for example 1 or 27. Enter 0 for the native VLAN. The value is displayed as vlan.1 or vlan.27 in the View pages. Note: Provision any single VLAN ID either in the AHV network stack or in the Flow Networking (brAtlas) networking stack. Do not use the same VLAN ID in both the stacks.
IP Address management	(Mandatory for Overlay type subnets) This section provides the `Network IP Prefix` and `Gateway IP` fields for the subnet. (Optional for VLAN type subnet) Check this box to display the `Network IP Prefix` and `Gateway IP` fields and configure the IP address details. Unchecking this box hides these fields. In this case, it is assumed that this virtual LAN is managed outside the cluster. Note: The DHCP Settings option is only available for VLAN subnets if you select this option.
DHCP Settings	(Optional for both VLAN and Overlay subnets) Check this box to display fields for defining a domain. Checking this box displays fields to specify DNS servers and domains. Unchecking this box hides those fields. See Settings the DHCP Options for more information.
Cluster (VLAN subnet only)	(VLAN subnet only) This option is available only for `VLAN` subnet configuration. Select the cluster that you want to assign to the subnet.
External Connectivity	(VLAN subnet only) Turn on this toggle switch if you want use this `VLAN` subnet for external connectivity. Note: Ensure that the externally routable IP addresses (subnets with external connectivity without NAT) for different VPCs do not overlap. Configure the routes for the external connectivity subnets with next hop as the Router or SNAT IP address. Also configure the routes on the router for the return traffic to reach the VPC. See External Connectivity panel in VPC Details View.
NAT	(Option under External Connectivity ) If you turn on the External Connectivity toggle switch, then you can choose whether to connect to external networks with or without enabling NAT. Check the NAT check box to enable NAT for external connectivity for VPCs.
Virtual Switch	(VLAN subnet only) Select the virtual switch that is configured for the VLAN you selected. The default value is the default virtual switch vs0. This option is displayed only if you add a VLAN ID in the VLAN ID field.
VPC (Overlay subnet only)	Select the `Virtual Private Cloud (VPC)` that you want to assign to the subnet from the drop down list. You can create VPCs and assign them to `Overlay` subnets.
IP Address Pool	Defines a range of addresses for automatic assignment to virtual NICs. This field is optional for both `VLAN` and `Overlay` . For `VLAN` , this field is displayed only if you select the IP Address Management option. Note: Configure this field for `VLAN` or `Overlay` to complete the creation of the VPC, if you do not need external connectivity for this subnet. You must configure this field only if you need external connectivity for this subnet. Click the Create Pool button and enter the following in the Add IP Pool page: Enter the starting IP address of the range in the Start Address field. Enter the ending IP address of the range in the End Address field. Under Actions , click the check mark to submit the starting and ending IP addresses you entered. Click the X mark to remove the entries.
Override DHCP Server	(VLAN subnet only) To configure a DHCP server, check the Override DHCP Server box and enter an IP address in the DHCP Server IP Address field. See Override DHCP Server (VLAN Only) in Settings the DHCP Options for information about this option.

Click Save .

Settings the DHCP Options

About this task

Selecting the DHCP Settings checkbox in Create Subnet or Update Subnet allows you to configure the DHCP options for the VMs within the subnet. When DHCP settings are configured for a VM in a subnet and the VM is powered on, Flow Networking configures these options on the VM automatically. If you do not configure the DHCP settings, then these options are not available on the VM automatically when you power it on.

You can enable DHCP Settings when you create a subnet and configure the DHCP Settings for the new subnet. You could also update the DHCP Settings for an existing subnet.

DHCP Settings is common to and is available on both the Create Subnet and the Update Subnet dialog boxes.

To configure the DHCP Settings , do the following in the Create Subnet or the Update Subnet dialog box:

Procedure

Provide the information in the DHCP Settings fields.

Figure. DHCP Settings Click to enlarge


Fields	Description and Values
Domain Name Servers	Provide a comma-separated list of DNS IP addresses. Example: 8.8.8.8, 9.9.9.9
Domain Search	Enter the VLAN domain name. Use only the domain name format. Example: nutanix.com
TFTP Server Name	Enter a valid TFTP host server name of the TFTP server where you host the host boot file. The IP address of the TFTP server must be accessible to the virtual machines to download a boot file. Example: tftp_vlan103
Boot File Name	The name of the boot file that the VMs need to download from the TFTP host server. Example: boot_ahv2020xx

(Optional and for VLAN networks only) Check the Override DHCP Server dialog box and enter an IP address in the DHCP Server IP Address field.

You can configure a DHCP server using the Override DHCP Server option only in case of VLAN networks.

The DHCP Server IP address (reserved IP address for the Acropolis DHCP server) is visible only to VMs on this network and responds only to DHCP requests. If this box is not checked, the DHCP Server IP Address field is not displayed and the DHCP server IP address is generated automatically. The automatically generated address is network_IP_address_subnet.254 , or if the default gateway is using that address, network_IP_address_subnet.253 .

Usually the default DHCP server IP is configured as the last usable IP in the subnet (For eg., its 10.0.0.254 for 10.0.0.0/24 subnet). If you want to use a different IP address in the subnet as the DHCP server IP, use the override option.

Attaching a Subnet to a Virtual Machine

About this task

To attach a subnet to a VM, go to the Virtual Infrastructure > VM > List view in Prism Central and do the following.

Procedure

Select the VM you want to attach a subnet to. Click Actions > > Update .
In the Update VM dialog box, click Add NIC .

Figure. Click to enlarge
Provide the necessary information in the indicated fields in the Create NIC dialog box.
1. Select the Subnet Name from the drop down list.
2. Select the Network Connection State as Connected or Disconnected .
  
  The Network Connection State selection defines the state of the connection after the NIC configuration is implemented.
3. Select the Assignment Type .
  
  You can select Assign with DHCP to assign a DHCP based IP address to the VM.
  
  You can select Assign Static IP to assign a static IP address to the VM to reach the VM quickly from any endpoint in the network such as a laptop.
4. Click Add .
Click Save on the Update VM dialog box.

Creating a Policy

About this task

For Policy-based routing you need to create policies that route the traffic in the network.

When you create a VPC, there is one default policy that Flow Networking creates for the VPC. This policy is pre-configured with the Priority 1 and other default values to Deny traffic flow and service (see the table of field descriptions and values for this dialog box).

Note: You cannot update or delete the default policy.

Policies control the traffic flowing between subnets (inter-subnet traffic).
Policies control the traffic flowing in and out of the VPC.
Policies do not control the traffic within a subnet (intra-subnet traffic).

You can create a traffic policy using the Create Policy dialog box. You can open the Create Policy dialog box either from the VPC list view or the VPC list view.

On the VPC list view, select the VPC you want to update and click Create Policy in the Actions drop down menu.
On the VPC details view, click the Create Policy option in the More drop down menu.

To create a policy, do the following in the Create Policy dialog box.

Procedure

Provide the necessary values in the respective fields.

Figure. Create Policy Click to enlarge


Fields	Description and Values	Value in Default Policy
Priority	The priority of the access list (ACL) determines which ACL is processed first. Priority is indicated by an integer number. A higher priority number indicates a higher priority.For example, if two ACLs have priority numbers 100 and 70 respectively, the ACL with priority 100 takes precedence over the ACl with priority 70. Note: Click the `Understand Priorities` link to see the `Understand Priorities` information box (see the image of this box below this table).	1
Source	The source indicates the source IP or subnet for which you want to manage traffic. Source can be: `Any` : Indicates any IP address. `External` : Indicates an IP address that is outside the subnets configured for the VPC. `Custom` : You can provide a specific Source Subnet IP with prefix.	`Any`
Source Subnet IP	Only required if you selected the Source as `Custom` . Provide the subnet IP and prefix that you want to designate as the source for the policy. Use the CIDR notation format to provide the subnet IP. For example, 10.10.10.0/24.	None
Destination	The destination is the destination IP or subnet for which you want to set the priority. Destination can be: `Any` : Indicates any IP address. `External` : Indicates an IP address that is outside the subnets configured for the VPC. `Custom` : You can provide a specific Destination Subnet IP with prefix.	`Any`
Destination Subnet IP	Only required if you selected the Destination as `Custom` .	None
Protocol	You can also set the priority configure policy for certain protocols. You can select one of the following options: `Any` : Indicates any IP address. `Protocol Number` : Provide an integer number that indicates the protocol you want to prioritize. Provide the appropriate value in the Protocol Number field. `TCP` `UDP` `ICMP`
Protocol Number	This field is displayed only if you select Protocol Number as the value in the Protocol field. The number you provide must be the IANA designated number that indicates respective protocol. See IANA Protocol Numbers .	None
Action	Assign the appropriate action for implementation of the policy. `Permit` : Permits traffic and services based on the parameters set. If the Permit rule is set to override a Drop rule, then the Permit rule must be set in both the directions to allow bidirectional communication between the Source and Destination . `Deny` : Denies traffic and service based on the parameters set. `Re-route` :Sends matching traffic to the next-hop IP address specified by the `Reroute IP` . In case of reroute, you need to provide an IP address that the traffic needs to be re-routed to, in the `Reroute IP` field.	`Permit`

Sample Understand Priorities information box.

Click Save .

Creating Static Routes

About this task

You can create a static route using the Create Static Routes dialog box. You can open the Create Static Routes dialog box either from the VPC list view or the VPC details view.

On the VPC list view, select the VPC and click Create Static Routes in the Actions drop down menu.
On the VPC details view, click the Create Static Routes option in the More drop down menu.

To create static route, do the following in the Create Static Routes dialog box:

Procedure

Provide the necessary values in the respective fields.


Fields	Description and Values
Destination Prefix	Provide the IP address with prefix of the destination subnet.
Next Hop Link	Select the next hop link from the drop down list. The next hop link is the IP address that the traffic must be sent for the static route you are configuring.
Add Prefix	You can create multiple static routes using this option. Click this link to add another set of Destination Prefix and Next Hop Link to configure another static route.

Click Save .

Updating Virtual Private Cloud

About this task

You can update a VPC using the Update Virtual Private Cloud (VPC) dialog box. You can open the Update Virtual Private Cloud (VPC) dialog box either from the VPC list view or the VPC details view.

On the VPC list view, select the VPC you want to update and click Update in the Actions drop down menu.
On the VPC details view, click the Update option.

The Update Virtual Private Cloud (VPC) dialog box is identical to the Create Virtual Private Cloud (VPC) dialog box.

For details about the parameters that you can update in the Update Virtual Private Cloud (VPC) dialog box, see Creating Virtual Private Cloud.

Procedure

Update the parameters in the Update Virtual Private Cloud (VPC) dialog box.
Click Save .

Updating a Subnet

About this task

You can update a subnet displayed on the Subnets page. Go to the Subnets page by clicking Virtual Infrastructure > Networking > Subnets and open the Update Subnet dialog box.

You can also open the Update Subnet dialog box from the VPC dashboard for a specific VPC. Click the Edit option for the subnet listed on the Subnets tab of the VPC dashboard.

The fields in the Update Subnet and the Create Subnet dialog boxes are the same.

Note: You cannot edit or update the subnet type. For example, if the subnet type is already configured as VLAN , you cannot modify it to an Overlay type subnet.

To update a subnets, do the following.

Procedure

Select the subnet you want to update. Select Actions > Update Subnet .
Update the necessary values in the respective fields in the Update Subnet dialog box.

Figure. Update Subnet Click to enlarge

The Update Subnet dialog box has the same fields as the Create Subnet dialog box. For details about the fields and the values that can be updated in the Update Subnet dialog box, see Creating a Subnet.
Click Save to ensure that the updates are saved in the configuration.

Category Management

A category is a key-value pair that groups similar entities. Associating a policy with a category ensures that the policy applies to all the entities in the group regardless of how the group scales with time. For example, you can associate a group of VMs with the Department: Marketing category, where Department is a category that includes a value Marketing along with other values such as Engineering and Sales.

Currently, you can associate only VMs with a category. Categories are implemented in the same way on on-premises Prism Central instances and in Xi Cloud Services. For information about configuring categories, see the Prism Central Guide .

Updating a Policy

About this task

You can update a policy using the Update Policy dialog box. You can open the Update Policy dialog box in two ways in the VPC details view.

On the VPC details view, select the VPC you want to update and click the Update option in the top menu.
On the VPC details view, click the Edit option provided in the Actions menu for the selected VPC.

Note: You cannot update or delete the default policy.

The Update Policy dialog box has the same parameters as the Create Policy dialog box.

For details about the parameters that you can update in the Update Policy dialog box, see Creating a Policy.

Procedure

Update the parameters in the Update Policy dialog box.
Click Save .

Updating Static Routes

About this task

You can update a static route using the Update Static Routes dialog box. You can open the Update Static Routes dialog box either from the VPC list view or the VPC details view.

Note: You must configure the default route (0.0.0.0/0) to the external subnet as the next hop for connectivity outside the cluster (north-south connectivity).

On the VPC details view, select the VPC you want to update and click the Update option in the top menu.
On the VPC details view, click the Edit option provided in the Actions menu for the selected VPC.

The Update Static Routes dialog box has the same parameters as the Create Static Routes dialog box.

For details about the parameters that you can update in the Update Static Routes dialog box, see Creating Static Routes.

Procedure

Update the parameters in the Update Static Routes dialog box.
Click Save .

Deleting a Virtual Private Cloud

About this task

Prism Central does not allow you to delete a VPC if the VPC is associated with any subnets and/or VPNs. After you remove all the subnets or VPN associations from the VPC, delete the VPC.

You can delete a VPC from the VPC list view or the VPC details view.

Procedure

Do one of the following.
- To delete a VPC from the VPC list view, select the VPC you want to delete and click Delete in the Actions drop down menu.
- To delete a VPC from the VPC details view, click the VPC name to go to the VPC details view and click the Delete option in the More drop down menu.
In the confirmation dialog box, do the following.
- Click Delete to delete the VPC.
- Click Cancel to exit without deleting the VPC.

Deleting Subnets, Policies or Routes

About this task

You can delete VPC entities such as subnets, policies or routes from the VPC details page.

Note: You cannot update or delete the default policy.

Do the following.

Procedure

Open the VPC details page and go to the respective tab like Subnets , Policies or Routes .
Click the Delete option provided for the selected entity (subnet, policy or route respectively).
In the confirmation dialog box, do the following.
- Click Delete to delete the entity.
- Click Cancel to exit without deleting the entity.

Connections Management

This section covers the management of network gateways, VPN connections and Subnet Extensions including operations like create, update and delete network gateways and VPN connections, and extending subnets.

Network Gateway Management

You can create, update or delete network gateways that host one of VPN or VTEP service for connections.

Creating a Network Gateway

About this task

VPN or s connect two networks together, and can be used in both VLAN and VPC networks on AHV. In other words, you can extend the routing domain of a VLAN network or that of a VPC using a VPN. Accordingly, VPN gateways can be configured using VLANs or VPCs. You need VPN gateways on clusters to provide a gateway to the traffic between on-premise clusters or remote sites.

You can create multiple VPN gateways for a VPC. Since a VPC is configured only on a PC, the VPC is available to all the clusters registered to that PC.

A VPN gateway may be defined as a Local gateway or a Remote gateway based on where the traffic needs to be routed.

To create a VPN gateway, do the following on the Networking & Security > Connectivity > Gateways page.

Procedure

Select Local or Remote in the Create Gateway drop-down menu.
If you select Local in the drop-down menu, the Create Local Gateway dialog box opens. If you select Remote in the drop-down menu, the Create Remote Gateway dialog box opens.
Provide the necessary values in the respective fields as described in the table.
For example, if you select Local in the drop-down menu, then the Create Local Gateway dialog box opens. Provide the necessary values in the respective fields as described in the table.
Figure. Sample Create Local Gateway - VM Deployment Click to enlarge

Figure. Sample Create Local Gateway - VPN Service Configuration Click to enlarge

Figure. Sample Create Local Gateway - VTEP Service Configuration Click to enlarge

Figure. Sample Create Remote Gateway - VPN Gateway Service Click to enlarge

Figure. Sample Create Remote Gateway - VTEP Gateway Service Click to enlarge

Table 1. Local Gateway Fields
Fields	Description	Values
VM Deployment
Name	Enter a name for the network gateway.	(Name)
Gateway Attachments	(for Local gateway type only) Select the gateway attachment as `VPC` or `VLAN` . The VPN VM is deployed on a VPC VM or a cluster that has the selected VLAN respectively. If you select `VPC` , then `VPC Attachment` is displayed. `VPC` is the default value for the `Gateway Attachments` field. The Gateway VM is deployed on the cluster and associated with the VPC selected in the `VPC Attachment` section. `VPC attachment` mode provides the options of eBGP and Static routing methods for external routing (configured in the External Routing Configuration section). If you select `VLAN` , then the `VLAN Attachment` is displayed. The Gateway VM is deployed on the cluster that has the VLAN and the subnet specified in the `VLAN Attachment` section. `VLAN attachment` mode provides only the eBGP routing method for external routing.	(VLAN or VPC)
Gateway VM Deployment - VPC Attachment
Cluster	Select the cluster on which you want to deploy the Gateway VM on.	(Name of the cluster)
VPC (If Gateway Attachment type is VPC)	Select the VPC configured on the selected cluster that you want to use for the Gateway VM deployment.	(Name of the VPC selected)
Floating IP (Optional)	Select a floating IP for the network gateway configuration. If you do not select a floating IP address then Prism Central allocates a floating IP automatically. This allocated floating IP is deleted when you delete the gateway. To request floating IPs and allocate them to subnets, see Requesting Floating IPs	(IP address)
Gateway VM Deployment - VLAN Attachment
Cluster	Select the Cluster, from the drop down list, on which you want to deploy the Gateway VM on. Note: Only clusters with VLANs are available in the list.	(Name of the cluster)
Subnet	Select the subnet you want to attach the Gateway VM to, from the drop down list. Note: The list includes all the subnets you created on the selected cluster. After you select the subnet, the details of the subnet are displayed in a box below the Subnet field. The details include: VLAN ID, IPAM type being Managed or Unmanaged, and Network Address with Prefix.	(Name of the VLAN subnet)
Static IP Address for VPN Gateway VM	Enter the static IP address that the Gateway VM needs to use.	(IP Address with Prefix)
Default Gateway IP	Enter the default gateway IP of the subnet for the Gateway VM.	(IP Address)
Service Configuration
Gateway Service	Select the gateway service you want to use for the gateway.	(VPN or VTEP)
VPN Service Configuration - External Routing Configuration (This section is available for VLAN and VPC attachment types)
Routing Protocol	For `VPC` gateway attachments: Select `Static` for static routing. Note: You need to create static routes (see Creating Static Routes) for external routing and attach the route to the VPC selected in this configuration. Select `eBGP` for eBGP based external routing. For `VLAN` gateway attachments: External routing protocol is pre-set to `eBGP` . You cannot change the routing protocol.	(Static or eBGP)
Redistribute Connected Routes (Applicable only if VLAN type gateway attachment is selected)	( `VLAN` only) Select this checkbox to enable the redistribution of connected routes into the eBGP.	(Check mark or blank)
ASN (Only available if eBGP routing protocol is selected)	(For `eBGP` only) Enter the ASN for your on-prem gateway. If you do not have a BGP environment in your on-prem site, you can choose any number. For example, you can choose a number in the 65000 range. Note: Make sure that this ASN does not conflict with any of the other on-premises BGP ASNs. ASN must be distinct in case of eBGP.	(Number)
eBGP Password	(For `eBGP` in `Local` gateway type only) Enter the eBGP password for the eBGP route.	(Password: The password must be between 1 and 80 characters. Characters allowed for Pre-Shared Key for IPSec a-z A-Z 0-9 ~ ! @ # % ^ & * ( ) _ - + = : ; { } [ ] \| < > , . / ? $ Password length: Minimum 1 and maximum 64 characters. Characters allowed for BGP passwords a-z A-Z 0-9 ~ ! @ # % ^ & * ( ) _ - + = : ; { } [ ] \| < > , . / ? $ Password length: Minimum 1 and maximum 80 characters. )
VPN Service Configuration - Internal Routing Configuration (This section is available for VLAN attachment type only.)
Routing Protocol (Between On-prem Gateway and On-prem Router)	Select the Routing Protocol to be used between on-premises Nutanix gateway and on-premises router. You can select: `Static` : Select this protocol to provide a static route configuration for the VLAN gateway. `OSPF` : Select this protocol to provide an OSPF routing configuration for the VLAN gateway. `iBGP` : Select this protocol to provide a iBGP route configuration for the VLAN gateway. Note: For iBGP, the ASN must be the same between the Gateway appliance and the peer iBGP, when iBGP is selected as the internal routing protocol.	(Static or OSPF or iBGP)
+Add Prefix (Applicable to Static routing)	(For `Static` routing selected in Routing Protocol ) Click this to enter a `Local Prefix` and click the check mark under Actions to add the prefix. If you click the X mark under Actions , the local prefix you entered is not added. The prefixes you add are advertised to all the connected peers via eBGP. The prefix must be a valid IP address with the host bits not set. You can add multiple local prefix IP addresses.	(prefix like /24)
Area ID (Applicable to OSPF protocol)	(OSPF only) Enter the OSPF area id in the IPv4 address format.
Password Type	(OSPF only) Select the password type you want to set for the OSPF route. The options are: `MD5` : Select this option to encrypt the packets with MD5 hash that can be decrypted with the MD5 password at the destination. `Plain Text` : Select this option to set a clear-text password. `None` : Select this if you do to set an open route without password protection
Password	(OSPF only) Enter a password for the MD5 or Plain Text password type you select in the `Password Type` field. For `MD5` : The password must be 1-16 characters long. Characters allowed for OSPF passwords (MD5) a-z A-Z 0-9 For `Plain Text` : The password must be 1-8 characters long. Characters allowed for OSPF passwords (Plain text): a-z.
Peer IP (for iBGP)	Enter the IP Address of the On-prem router used to exchange routes with the network gateway.	(IP Address)
Password	Enter a password with 1-80 characters.	(Password)

VTEP Service Configurations
VxLAN (UDP) Port	The default value provided is 4789. Do not change this.	(Number. Default value is 4789)

Table 2. Remote Gateway Fields
Fields	Description	Values
Name	Enter a name for the network gateway.	(Name)
Gateway Service	Select the gateway service you want to use for the gateway.	(VPN or VTEP)
VPN Service Configurations
Public IP Address	Enter the public IP address of the remote endpoint. If a Floating IP is not selected, a new Floating IP is automatically allocated for the Gateway. These allocated IP addresses are deleted when the network gateway is deleted.	(IP Address)
Vendor	Select the vendor of the third party gateway appliance.	(Name of Vendor)
External Routing
Protocol	Select `Static` for static routing. Note: You need to create static routes (see Creating Static Routes) for external routing and attach the route to the VPC selected in this configuration. Select `eBGP` for eBGP based external routing.	(Static or eBGP)
eBGP ASN (Only available if eBGP routing protocol is selected)	(For `eBGP` only) Enter the ASN for your on-prem gateway. If you do not have a BGP environment in your on-prem site, you can choose any number. For example, you can choose a number in the 1-65000 range. Note: Make sure that this ASN does not conflict with any of the other on-premises BGP ASNs. ASN must be distinct in case of eBGP.	(Number)

VTEP Service Configurations
VTEP IP Address	Enter VTEP IP Addresses of the remote endpoints that you want to create the gateway for. You can add IP addresses of multiple endpoints in one remote gateway.	(Comma separated list of IP Addresses)
VxLAN (UDP) Port	The default value provided is 4789. Do not change this.	(Number. Default value is 4789)

Click Save .

What to do next

The Gateway you create is displayed in the Gateways page.

Updating a Network Gateway

About this task

You can update a network gateway using the Update Gateway dialog box.

You can open the Update Gateway dialog box. The parameters in the Update Gateway dialog box are the same as those in the Create Local Gateway or Create Remote Gateway dialog box.

Procedure

Select the gateway you want to update on Gateways .
Click Update in the Actions menu.
Update the required details in the Update Gateway dialog box.
You cannot modify some information. Such fields are greyed and in-actionable. If you need to modify such information, consider creating a new gateway with the updated parameters and deleting the current gateway.
Click Save .

Deleting a Network Gateway

About this task

If you want to delete a network gateway, you must first delete all the VPN connections associated with the gateway and only then you can delete the network gateway.

To delete a network gateway, do the following on the Gateway page.

Procedure

Do one of the following.
- Select the check box next to the name of the gateway and, in the Actions drop-down list, click Delete .
- Click the name of the gateway and, in the details page, click Delete .
In the confirmation dialog box, do the following.
- Click Delete to delete the entity.
- Click Cancel to exit without deleting the entity.

Virtual Network Connections

Virtual Private Network

You can use the Nutanix VPN solution to set up VPN between your on-prem clusters, which exist in distinct routing domains that are not directly connected. These distinct routing domains could either be VPCs within the same cluster or remote clusters or sites.

If you need to connect one Nutanix deployment in one site to another deployment in a different site, you can create a VPN endpoint in each of the sites. A VPN endpoint consists of a local VPN gateway, remote VPN gateway and VPN connection. Local VPN gateway can be instantiated in a VPC context or a legacy VLAN context. Launching the VPN gateway within a VPC allows stretching of the VPC. For example, in the figure, the Blue VPC is stretched between two sites with a VPN.

VPN connections are useful in connecting two points. You can connect two VPCs in the same cluster using a VPN or VPCs in different clusters in the same site. However, VPN connection can connect only one endpoint to another endpoint. Flow networking based VPN service allows you to only connect two endpoints that use Nutanix VPN based gateway service.

Virtual Tunnel End Points Based Network Extensions

To connect one endpoint to multiple endpoints or third party (non Nutanix) networks, use Virtual Tunnel End Point (VTEP) service based subnet extensions. For more information about VTEP, see .

VPN Workflow

Each endpoint must have configurations for a local VPN gateway, remote VPN gateway (pointer information for the peer local VPN in the remote site endpoint) and a VPN connection (connecting the two endpoints). Then, based on the VPN connection configuration as initiator or acceptor, one endpoint initiates a tunnel and the endpoint at the other end accepts the tunnel connection and, thus, establishes the VPN tunnel.

Gateways: Every VPN endpoint for each site consists of two VPN gateway configurations - Local and Remote.

Local gateway is a VM that runs the VPN protocols (IKEv2, IPSec) and routing (BGP and OSPF). Remote gateway is a pointer - database entry - that provides information about the peer remote VPN endpoint. One of the key information contained in the remote gateway is the source IP of the remote VPN endpoint. For security reasons, the local VPN gateway will accept IKEv2 packets originating only from this Source IP.

VPN gateways are of the following types:
- On premises Nutanix VPN Gateway: Represents the VPN gateway appliance at your on-premises local or remote site if you are using the Nutanix VPN solution.
- On premises Third Party Gateway: Represents the VPN gateway appliance at your on-prem site if you are using your own VPN solution (provided by a third-party vendor).
  
  To configure third party VPN Gateways, see the relevant third party documentation.
VPN Connection: Represents the VPN IPSec tunnel established between local gateway and remote gateway. When you create a VPN connection, you need to select two gateways between which you want to create the VPN connection.

VPN appliances perform the following:

Implementation of IKEv2 and IPSec protocols.
Routing: Between remote sites, Flow Networking advertises prefixes using eBGP. Optionally it uses Static routing. Within a site, Flow Networking uses iBGP or OSPF to share prefixes between the Nutanix VPN appliance and the edge router.

Prerequisites for VPN Configurations

General Requirements

Ensure that you have enabled Flow Networking with microservices Infrastructure.
Ensure that you have floating IP addresses when you create VPN gateways.

Flow Networking automatically allocates a floating IP to a VPN gateway if you do not provide one during the VPN gateway creation. To provide floating IP during the VPN gateway creation, you can request floating IPs. See Requesting Floating IPs.
Ensure that you have one of the following, depending on whether you are using iBGP or OSPF:
- Peer IP (for iBGP): The IP address of the router to exchange routes with the VPN gateway VM.
- Area ID (for OSPF): The OSPF area ID for the VPN gateway in the IP address format.
Ensure that you have the following details for the deployment of the VPN gateway VM:
- Public IP address of the VPN Gateway Device: A public WAN IP address that you want the on-prem gateway to use to communicate with the Xi VPN gateway appliance.
- Static IP Address: A static IP address that you want to allocate to the VPN gateway VM. Use a floating IP address requested as the static IP address.
- IP Prefix Length: The subnet mask in CIDR format of the subnet on which you want to install the VPN gateway VM. You can use an overlay subnet used for a VPC and assigned to the VM that you are using for the VPN gateway.
- Default Gateway IP: The gateway IP address for the on-premise VPN gateway appliance.
- Gateway ASN: ASN must not be the same as any of your on-prem BGP ASNs. If you already have a BGP environment in your on-prem site, the customer gateway is the ASN for your organization. If you do not have a BGP environment in your on-prem site, you can choose any number. For example, you can choose a number in the 65000 range.

Ports and Protocols

Endpoints and Terminations

The following endpoints and terminations occur in the course of Flow networking based connections. For information about creating, updating or deleting VPN connections, see Connections Management.

Note: In a VPN connection do not configure both the gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If you configure the local gateway as Initiator then configure the remote gateway as Acceptor in one endpoint and vice-versa in the (other) remote endpoint.

VPN Endpoint Behind a Network Address Translation or Firewall Device: In this scenario, the IPSec tunnel terminates behind a network address translation (NAT) or firewall device. For NAT to work, open UDP ports 500 and 4500 in both directions.


Things to do in NAT	Things to do in on-prem VPN GW
Open UDP ports 500 and 4500 on both directions	Enable the business application policies to `Allow` the commonly-used business application ports.

IPSec Terminates on the Firewall Device

In this scenario, you do not need to open the ports for NAT (500 and 4500).

However, enable the on-prem VPN gateway to allow the traffic from the PC subnet to the advertised load balancer route where the Source port is any and the Destination port may be in the range of 1024-1034.

The PC subnet refers to the subnet where your Prism Central is running.

Creating a VPN Connection

About this task

Create a VPN connection to establish a VPN IPSec tunnel between VPN gateways in your on-prem site. Select the gateways between which you want to create the VPN connection.

To create a VPN connection, do the following on the Networking > VPN Connections page.

Procedure

Click the Create VPN Connection button on the VPN Connections page.
In the Create VPN Connection dialog box, provide the values in the respective fields.


Fields	Description and Values
Name	Enter a name for the connection.
VPN Connection
IPSec Secret	Enter a secret password for the IPSec connection. To see the password, click Show . To hide the password, click Hide .
Local Gateway	Select the connection parameters on the local gateway as Initiator or Acceptor of VPN Tunnel connections.
VPN Gateway	Select the appropriate VPN Gateway as the local gateway for the VPN connection
VTI Prefix - Local Gateway	Enter a IPv4 Address with /<prefix>. Example: 10.25.25.2/30. This is the VPN Tunnel Interface IP address with prefix for the local gateway. The subnet for this IP address must be a /30 subnet with two usable IP addresses. One of the IP addresses is used for Local Gateway. Use the other IP address for the Remote Gateway.
Connection Handshake	This defines the type of handshake that the connection must use. There are two types of connection handshakes: `Initiator` : The local VPN gateway acts as the initiator of the connection and thus initializes the VPN tunnel. `Acceptor` : The local VPN gateway accepts or rejects incoming connection requests from other gateways. Note: In a VPN connection do not configure both the gateways (local gateway and remote gateway) in an endpoint as Initiators or as Acceptors. If you configure the local gateway as Initiator then configure the remote gateway as Acceptor in one endpoint and vice-versa in the (other) remote endpoint.
Remote Gateway	For a specific VPN connection, set the remote gateway as Initiator or Acceptor when you configure the VPN connection on the Remote Gateway.
VPN Gateway	Select the appropriate VPN Gateway as the remote gateway for the VPN connection.
VTI Prefix - Remote Gateway	The VPN Tunnel Interface IP address with prefix for the local gateway. Provide a IPv4 Address with /<prefix>. Example: 10.25.25.2/30. This is the VPN Tunnel Interface IP address with prefix for the local gateway. The subnet for this IP address must be a /30 subnet with two usable IP addresses. One of the IP addresses is used for Local Gateway. Use the other IP address for the Remote Gateway.
Advanced Settings	Set the traffic route priority for the VPN connection. The route priority uses Dynamic route priority because the priority is dependent on the routing protocol configured in the VPN gateway.
Route Priority - Dynamic Route Priority	Set the route priority as an integer number. The greater the number, higher is the priority.

Click Save .

What to do next

The VPN connection you create is displayed in the VPN Connections page.

Updating VPN Connection

About this task

You can update a VPN Connection using the Update VPN Connection dialog box.

You can open the Update VPN Connection dialog box. The parameters in the Update VPN Connection dialog box are the same as those in the Create VPN Connection dialog box.

Procedure

Select the VPN Connection you want to update on the VPN Connection .
Click Update in the Actions menu.
Update the required details in the Update VPN Connection dialog box.
Click Save .

Deleting a VPN Connection

About this task

To delete a VPN connection, do the following on the VPN Connection page.

Procedure

Do one of the following.
- Select the check box next to the name of the VPN connection and, in the Actions drop-down list, click Delete .
- Click the name of the VPN connection and, in the details page, click Delete .
In the confirmation dialog box, do the following.
- Click Delete to delete the entity.
- Click Cancel to exit without deleting the entity.

VPN Connection within Same Prism Central

You can connect two VPCs within the same Prism Central availability zone using a VPN connection.

About this task

Assume that you have created two VPCs named vpc-a and vpc-b with overlay subnets named subnet-a and subnet-b .

To connect the two VPCs within the same Prism Central using a VPN connection, do the following.

Procedure

Do the following for local gateways:
1. Create a local VPN gateway with dynamically assigned address for vpc-a , for example, named local-vpn-a . Note or write down the assigned IP address.
2. Create a local VPN gateway with dynamically assigned address for vpc-b , for example, named local-vpn-b . Note or write down the assigned IP address.
See Creating a Network Gateway for more information about creating a VPN gateway.
Do the following for remote gateways:
1. Create a remote VPN gateway with the IP address noted in 1.a for vpc-a , for example, named remote-vpn-a .
2. create a local VPN gateway with the IP address noted in 1.b for vpc-b , for example, named remote-vpn-b .
See Creating a Network Gateway for more information about creating a VPN gateway.
Create a VPN connection between vpc-a and vpc-b named, for example, vpn-conn-a-to-b .
Ensure that the VTI IP addresses for the local and remote gateways is unique with /30 prefix.
Note: The VPN Tunnel Interface IP address with prefix for the local gateway. The subnet for this IP address must be a /30 subnet with two usable IP addresses. One of the IP addresses is used for Local Gateway. Use the other IP address for the Remote Gateway.

Ensure that you select local-vpn-a as the local gateway with Connection Handshake set as Acceptor .

Ensure that you select remote-vpn-b as the remote gateway.
Create a VPN connection between vpc-b and vpc-a named, for example, vpn-conn-b-to-a .
Ensure that the VTI IP addresses with /30 prefix for local and remote gateways are the reverse (vice versa) of what you configured for the VPN connection in previous step. For example, if in previous step you configured the VTI IP addresses as 10.20.20.5/30 for local and 10.20.20.6/30 for remote then for VPN connection in this step, configure 10.20.20.6/30 for local gateway and 10.20.20.5/30 for remote gateway respectively. These IP addresses do not need to be reachable anywhere else in the network. However, ensure that these IP addresses do not overlap with any other IP addresses assigned in the network.
Ensure that you select local-vpn-b as the local gateway with Connection Handshake set as Initiator .

Ensure that you select remote-vpn-a as the remote gateway.

Layer 2 Virtual Network Extension

You can extend a subnet between on-prem local and remote clusters or sites (Availability Zones or AZs) to support seamless application migration between these clusters or sites.

Note: One or more on-prem cluster or sites managed by one Prism Central instance is defined as an Availability Zone or AZ. In this section, Availability Zone or AZ refers to and must be understood as one or more on-prem clusters or sites managed by one Prism Central. Local AZ refers to local on-prem clusters or sites managed by a Prism Central instance and remote AZ refers to another on-prem cluster or site managed by another Prism Central instance.

With Layer 2 subnet extension, you can migrate a set of applications to the remote AZ while retaining their network bindings such as IP address, MAC address, and default gateway. Since the subnet extension mechanism allows VMs to communicate over the same broadcast domain, it eliminates the need to re-architect the network topology, which could otherwise result in downtime.

Layer 2 extension assumes that there are underlying existing layer 3 connectivity already available between the Availability Zones. You can extend a subnet from a remote AZ to the primary (Local) AZ (and other remote AZs in case of VTEP-based subnet extensions)

You can extend a Layer 2 subnet across two Nutanix AZs over either VPN or Virtual tunnel End Point (VTEP). SeeLayer 2 Virtual Subnet Extension Over VPN.
You can extend a Layer 2 subnet between a Nutanix AZ and one or more non-Nutanix datacenters only over VTEP. See Layer 2 Virtual Subnet Extension Over VTEP.

You can extend subnets for the following configurations.

IPAM Type. Managed and unmanaged networks.
Subnet Type. On-prem VLAN subnets and VPC subnets.
Traffic Type. IPv4 unicast traffic and ARP.
On-prem Hypervisor. AHV and ESXi
Note: If your cluster is ESXi, use vCenter Server to manually configure the port group attached to the subnet you want to extend. Set the security settings, Promiscuous mode and Forged transmits to Accept on the vSwitch as shown in the following image.

Figure. ESXi Host Port Group Configuration Click to enlarge

Prerequisites for Setting Up Subnet Extension

Ensure the following before you configure Layer 2 subnet extension between your on-prem AZs.

Ensure that the Prism Central versions support Layer 2 virtual subnet extension as specified in the Release Notes. See AOS Family Release Notes and Release Notes | Prism Central as applicable.
See the Prism Central Upgrade and Installation Guidelines and Requirements section of the Acropolis Upgrade Guide for instructions about how to upgrade a Prism Central instance through the Prism Central web console.
Ensure that you pair the Prism Central at the local AZ with the Prism Central at the remote AZ to use Create Subnet Extension wizard to extend a subnet across the AZs and facilitate bidirectional communication between these clusters or sites. Using paired availability zones it is possible to configure both VXLAN over VPN and VTEP based subnet extension. You can also extend subnets using the manual gateway and connection workflows instead of pairing the AZs.
See the Pairing Availability Zones for instructions about how to pair the local and remote AZs.
Ensure that you set up a default static route with 0.0.0.0/0 prefix and the External Network next hop for the VPC you use for any subnet extension. This allows NTP and DNS access for the Network Gateway appliance.

Best Practices for Subnet Extension

Nutanix recommends the following configurations to allow IP address retention for VMs on extended subnets.

When using Nutanix IPAM ensure the address ranges in the paired subnets are unique to avoid conflict between VM IP addresses across extended subnets.
If the source and target sites use third-party IPAM, ensure that there are no conflicting IP address assignments across the two sites.
Note: If the source and target sites use Nutanix IPAM, the Prism Central web console displays a message that indicates an IP address conflict if one exists.
If connectivity between sites already provides encryption, consider using VTEP only subnet extension to reduce encryption overhead.
Use the Subnet Extension to a Third Party Data-Center workflow in the following scenarios
- To extend a subnet to more than one other AZ. This is also known as point to multi-point.
- To extend subnets between clusters managed by the same Prism Central.

Subnet Extension Workflow

You can manage Layer 2 subnet extension on the Subnet Extensions tab of the Connectivity page. Open the Subnet Extensions by clicking the hamburger icon in the top-left corner of the Dashboard and then clicking Connectivity .

You can create point-to-point Layer 2 subnet extensions between two AZs over VPN or VTEP by opening the Create Subnet Extension Across Availability Zones dialog box. See Extending a Subnet Over VPN for VPN-based extensions. See Extending a Subnet Across Availability Zones Over VTEP for VTEP-based extensions.
You can create point-to-point or point-to-multipoint Layer 2 subnet extensions to third party datacenters over VTEP by opening the Create Subnet Extension To A Third Party Data-Center dialog box. See Extending a Subnet to Third Party Datacenters Over VTEP.
You can update a subnet extension that extends across AZs using the Update Subnet Extension Across Availability Zones dialog box. The Update Subnet Extension Across Availability Zones has the same parameters and fields as the Create Subnet Extension Across Availability Zones dialog box. You can open the Update Subnet Extension Across Availability Zones dialog box by:
- Selecting the subnet extended across AZs in the Subnet Extensions and clicking the Update button.
- Clicking the subnet extended across AZs in the Subnet Extensions and clicking the Update button on the Summary tab.

You can update a subnet extension that extends to multiple AZs or third party datacenters using the Update Subnet Extension To A Third Party Data-Center dialog box. Update Subnet Extension To A Third Party Data-Center dialog box has the same parameters and fields as the Create Subnet Extension To A Third Party Data-Center dialog box. You can open the Update Subnet Extension To A Third Party Data-Center dialog box by:

Selecting the subnet extended to third datacenters in the Subnet Extensions and clicking the Update button.
Clicking the subnet extended to third datacenters in the Subnet Extensions and clicking the Update button on the Summary tab.

See Updating an Extended Subnet.

Layer 2 Virtual Subnet Extension Over VPN

Subnet extension using VPN allows seamless, secure migration to a new datacenter or for disaster recovery. VPN based Layer 2 extension provides secure point to point connection to migrate workloads between Availability Zones. Consider VTEP-only Subnet Extension without VPN when encryption is not required.

Subnet extension using VPN is useful:

When the two Availability Zones (where the subnets to be extended belong) do not have any underlying secure connectivity. For example, when connecting over the Internet, VPN (IPSec) provides the necessary connectivity and encryption (security).
Sometimes when you need to move (lift-and-shift) workloads from a VLAN subnet to a VPC subnet retaining the same VM IP addresses . You need connectivity from other subnets to workloads that have already migrated to VPC. In such cases, VPN provides the Layer 3 connectivity and encryption between the VPC segment of extended subnet to other VLAN subnets.

Prerequisites for Setting Up Subnet Extension Over VPN

See Layer 2 Virtual Network Extension for general prerequisites to extend subnets.
Set up VPN gateway services and a VPN connection between local AZ and the remote AZ. The subnet extension feature supports only the Nutanix VPN solution (not a third-party VPN solution) at the both the local and remote AZs. See the Virtual Network Connections for instructions about how to upgrade the VPN gateway VM at the local and remote clusters or sites.
Note: Ensure that the VPN gateway version is 5.0 or higher. See the Updating a Network Gateway section of the Nutanix Flow Networking Guide for instructions about how to upgrade the network gateway at the local and remote sites.
Configure subnets with the same IP CIDR prefix at the source and target sites. For example, if the IP prefix at one site is 30.0.0.0/24, the IP prefix at the other site must also be 30.0.0.0/24. The network and mask must match at both AZs.
Configure distinct DHCP pools for the source and target sites with no IP address overlap. Separate DHCP pools ensure no IP address conflicts occur for dynamically assigned IP addresses between the two AZs.
Procure two free IP addresses, one from each subnet, for the Network Gateway in the subnets to be extended. These IP addresses are configured as local IP address and remote IP address for the subnet extension in the Subnet Extension wizard. These two free IP addresses are the externally accessible IP addresses for the local gateway, and the remote gateway. Those two usable IP addresses are already contained inside the VPN connection and must not conflict with the following:
- DHCP pools on any of the Availability Zones.
- Gateway IP address on any of the Availability Zones.
- IP addresses allocated to existing user VMs on any of the Availability Zones.
- IP addresses used by Network Gateway Management NIC subnet (IP pool 100.64.1.0/24)

Limitation

To use subnet extension over a VPN, both sites must use the VPN service of the Nutanix Network Gateway. Consider VTEP-only subnet extension to connect to non-Nutanix third party sites.

Pairing AZs (Nutanix Disaster Recovery)

To replicate entities (protection policies, recovery plans, and recovery points) to different on-prem AZs (AZs) bidirectionally, pair the AZs with each other. To replicate entities to different Nutanix clusters at the same AZ bidirectionally, you need not pair the AZs because the primary and the recovery Nutanix clusters are registered to the same AZ (Prism Central). Without pairing the AZs, you cannot perform DR to a different AZ.

About this task

To pair an on-prem AZ with another on-prem AZ, perform the following procedure at both the AZs.

Procedure

Log on to the Prism Central web console.
Click the hamburger icon at the top-left corner of the window. Go to Administration > AZs in the left pane.

Figure. Pairing AZ
Click to enlarge
Click Connect to AZ .
Specify the following information in the Connect to Availability Zone window.
Figure. Connect to AZ
Click to enlarge
1. AZ Type : Select Physical Location from the drop-down list.
  A physical location is an on-prem AZ (AZ). To pair the on-prem AZ with Xi Cloud Services, select XI from the drop-down list, and enter the credentials of your Xi Cloud Services account in step c and set d.
2. IP Address for Remote PC : Enter the IP address of the recovery AZ Prism Central.
3. Username : Enter the username of your recovery AZ Prism Central.
4. Password : Enter the password of your recovery AZ Prism Central.
Click Connect .

Extending a Subnet Over VPN

The subnet extension allows VMs to communicate over the same broadcast domain to a remote site or Availability Zone (AZ).

Before you begin

See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VPN for information on prerequisites and best practices for extending a subnet.

About this task

Perform the following procedure to extend a subnet from the on-prem site.

Procedure

Click the hamburger icon in the top-left corner of the Dashboard > Networking & Security > Connectivity > Subnet Extension .
On the Subnet Extension page, select Create Subnet Extension > Across Availability Zones .
In the Create Subnet Extension Across Availability Zones dialog box, enter the necessary details as described in the table.

Figure. Create Subnet Extension Across Availability Zones Click to enlarge


Fields	Description	Values
Extend Subnet over a	Select the gateway service you want to use for the subnet extension.	(VPN or VTEP)
Note: Configure the following fields for the Local and the Remote sides of the dialog box.
Availability Zone	(For Local) Local AZ is pre-selected default. (For Remote) Select the appropriate AZ from the drop-down list of AZs.	(Local: Local AZ) (Remote: Dropdown list of AZs.)
Subnet Type	Select the type of subnet that you want to extend.	(VLAN or Overlay)
Cluster	Displayed if your selected VLAN subnet. Select the cluster from the dropdown list of clusters.	(Name of cluster selected from dropdown list)
VPC	Displayed if your selected Overlay subnet. Select the appropriate VPC from the dropdown list of VPCs.	(Name of VPC selected from dropdown list)
Subnet	Select the subnet that needs to be extended.	(Name of subnet selected from dropdown list)
(Network Information frame)	Displays the details of the VLAN or Overlay network that you selected in the preceding fields.	(Network information)
Gateway IP Address/Prefix	Displays the gateway IP address for the subnet. This field is already populated based on the subnet selected.	(IP Address)
(Local or Remote) IP Address	Enter a unique and available IP address that are externally accessible IP addresses in Local IP Address and Remote IP Address .	(IP Address)
VPN Connection	Select the appropriate VPN Connection from the dropdown list that Flow networking must use for the subnet extension. See Creating a VPN Connection for instructions to create VPN connection.	(Name of VPN connection selected from the dropdown list)

Click Save .

A successful subnet extension is listed on the Subnet Extension dashboard. See .

Layer 2 Virtual Subnet Extension Over VTEP

Subnet extension using Virtual tunnel End Point (VTEP) allows seamless migration to new datacenters or for disaster recovery. VTEP based Layer 2 extension provides point-to-multipoint connections to migrate workloads from one Availability Zone to multiple Availability Zones without encryption. If you need security and encryption, consider using Subnet Extension over VPN.

Subnet extension using VTEP is useful:

When both subnets that need to be stretched are Nutanix subnets (managed or unmanaged). VTEP provides an optimized workflow to stretch the two subnets.
When both subnets are connected over an existing private and secure link that does not need additional encryption.
When one Nutanix subnet needs to be stretched across one or more non-Nutanix networks, sites, or datacenters. Subnet Extension with third-party VTEPs provides point-to-multipoint connectivity to third party datacenters assuming that there is underlying layer 3 connectivity between these VTEPs.

VTEP-based Layer 2 Subnet Extension provides the following advantages:

Layer 2 subnet extension from one AZ to multiple AZs.
Layer 2 subnet extension between Nutanix AZs and non-Nutanix third party VTEP-based AZs.
The Remote VTEP Gateway is a set of endpoint IP addresses. You can add endpoint IP addresses to an existing operational Remote VTEP Gateway without stopping the subnet extension services. This on-the-fly addition enables you to extend the subnets to more AZs than originally planned, or perform maintenance, without disrupting the running services or configuring new remote VTEP gateways.

Prerequisite for Setting Up Subnet Extension Over VTEP

See Layer 2 Virtual Network Extension for general prerequisites to extend subnets.
Set up VTEP local and remote gateway services on local and remote AZs. In case of point-to-multipoint extension, ensure that you create local and remote VTEP gateways on all the remote AZs that the subnet needs to be extended to.
For each extended subnet within the same Network Gateway appliance ensure that you have unique VxLAN Network Identifiers (VNIs) that you can use for the VTEP subnet extensions. VNI may be any number between 0 and 16777215.

Extending a Subnet Across Availability Zones Over VTEP

The subnet extension over VTEP allows VMs to communicate two Availability Zones (AZ) without a VPN connection.

Before you begin

See Layer 2 Virtual Network Extension and Layer 2 Virtual Subnet Extension Over VTEP for information on prerequisites and best practices for extending a subnet.

About this task

To extend a subnet over VTEP across two availability zones (AZs), do the following.

Procedure

Open the Create Subnet Extension Across Availability Zones in one of the following ways:
- On the Subnet Extensions tab, click > Create Subnet Extension > Across Availability Zones > .
- In the Subnets dashboard, select the subnet you want to extend and click Actions > Extend > Across Availability Zones
- In the Subnets dashboard, click the subnet you want to extend. On the subnet details page, click Extend > Across Availability Zones .
Figure. Example of Create VTEP Extension Across AZs with VLAN Subnet Click to enlarge
For Extend Subnet over a , select VTEP .
Enter or select the necessary values for the parameters in the Local and Remote (AZ) sections as described in the table.


Parameters	Description and Value
Availability Zone	Displays the name of the paired availability zone at the local AZ.
Subnet Type	Select the type of the subnet - VLAN or Overlay that you are extending.
Cluster	Select the name of the cluster in the local AZ that the subnet is configured for.
Subnet	Select the name of the subnet at the local AZ for network. The VLAN ID and the IPAM - managed or unmanaged are displayed in the box below the Subnet field.
Gateway IP Address.	Enter the gateway IP address of the subnet you want to extend. Ensure that you provide the IP address in <IP-address/network-prefix> format. for example the gateway IP is 10.20.20.1 in a /24 subnet then provide the gateway IP address as `10.20.20.1/24` . Note: For an unmanaged network, enter the gateway IP address of the created subnet.
Local IP Address	Enter a unique and available (unused) IP address from the subnet provided in Subnet for the Network Gateway appliance.
Remote IP Address	Enter a unique and available (unused) IP address from the subnet provided in Subnet for the remote Network Gateway appliance.
Local VTEP Gateway	Select the local VTEP gateway you created on the local AZ. See Creating a Network Gateway for information about creating VTEP gateways.
Remote VTEP Gateway	Select the VTEP gateway you created on the remote AZ. See Creating a Network Gateway for information about creating VTEP gateways.
Connection Properties
VxLAN Network Identifier (VNI)	Enter a unique number from the range 0-16777215 as VNI. Ensure that this number is not reused anywhere in the local or remote VTEP Gateways.
MTU	The default MTU is 1392 to account for 108 bytes of overhead and the standard physical MTU of 1500 bytes. VPC Geneve encapsulation requires 58 bytes and VXLAN encapsulation requires 50. However, you can enter any valid MTU value for the network, taking this overhead into account. For example, if the physical network MTU and vs0 MTU are 1600 bytes, the Network Gateway MTU can be set to 1492 to account for 108 bytes of overhead. Ensure that the MTU value does not exceed the MTU of the AHV Host interface and all the network interfaces between the local and remote AZs.

Click Save .
After the subnet is extended, the extension appears in the Subnet Extensions list view.

Extending a Subnet to Third Party Datacenters Over VTEP

The subnet extension over VTEP allows VMs to communicate with multiple remote sites or Availability Zones (AZ) that may be third party (non-Nutanix) networks, or datacenters. It also provides the flexibility of adding more remote AZs to the same VTEP-based extended Layer 2 subnet. Examples of compatible VTEP gateways are switches from Cisco, Juniper, Arista, and others that support plain VXLAN VTEP termination.

About this task

To extend a subnet over VTEP across multiple availability zones (AZs) or third party datacenters, do the following.

Procedure

Open the Create Subnet Extension To A Third Party Data-Center in one of the following ways:
- On the Subnet Extensions tab, click > Create Subnet Extension > To A Third Party Data-Center
- In the Subnets dashboard, select the subnet you want to extend and click Actions > Extend > To A Third Party Data-Center
- In the Subnets dashboard, click the subnet you want to extend. On the subnet details page, click Extend > To A Third Party Data-Center .
Figure. Example of Create VTEP Extension To A Third Party Data-Center with VLAN Subnet Click to enlarge
Enter or select the necessary values for the parameters in the Local , Remote (AZ), and Connection Properties sections as described in the table.


Parameters	Description and Value
Local
Availability Zone	Displays the name of the paired availability zone at the local AZ.
Subnet Type	Select the type of the subnet - VLAN or Overlay that you are extending.
Cluster	Select the name of the cluster in the local AZ that the subnet is configured for.
Subnet	Select the name of the subnet at the local AZ for network. The VLAN ID and the IPAM - managed or unmanaged are displayed in the box below the Subnet field.
Gateway IP Address	Enter the gateway IP address of the subnet you want to extend. Ensure that you provide the IP address in <IP-address/network-prefix> format. for example the gateway IP is 10.20.20.1 in a .24 subnet then provide the gatewway IP address as `10.20.20.1/24` . Note: For unmanaged network, enter the gateway IP address of the created subnet.
Local IP Address	Enter a unique and available (unused) IP address from the subnet provided in Subnet .
Local VTEP Gateway	Select the local VTEP gateway you created on the local AZ. See Creating a Network Gateway for more information about creating a local VTEP gateway.
Remote
Remote VTEP Gateway	Select the remote VTEP gateway you created on the local AZ. See Creating a Network Gateway for more information about creating a remote VTEP gateway.
Connection Properties
VxLAN Network Identifier (VNI)	Enter a unique number from the range 0-16777215 as VNI. Ensure that this number is not reused anywhere in the networks that the Prism Central and Cluster are a part of.
MTU	The default MTU is 1392 to account for 108 bytes of overhead and the standard physical MTU of 1500 bytes. VPC Geneve encapsulation requires 58 bytes and VXLAN encapsulation requires 50. However, you can enter any valid MTU value for the network, taking this overhead into account. For example, if the physical network MTU and vs0 MTU are 1600 bytes, the Network Gateway MTU can be set to 1492 to account for 108 bytes of overhead. Ensure that the MTU value does not exceed the MTU of the AHV Host interface and all the network interfaces between the local and remote AZs.

Click Save .
After the subnet is extended, the extension appears in the Subnet Extensions list view.

Updating an Extended Subnet

The Update Subnet Extension Across Availability Zones has the same parameters and fields as the Create Subnet Extension Across Availability Zones dialog box.

About this task

You can update a subnet extension that extends across AZs using the Update Subnet Extension Across Availability Zones or the Update Subnet Extension To A Third Party data center dialog box. The Update Subnet Extension Across Availability Zones or the Update Subnet Extension To A Third Party data center dialog box has the same parameters and fields as the Create Subnet Extension Across Availability Zones or the Create Subnet Extension To A Third Party data center dialog box, respectively.

Based on the type of the subnet extension that you want to modify, refer to the following:

Procedure

Extending a Subnet Over VPN
Extending a Subnet Across Availability Zones Over VTEP
Extending a Subnet to Third Party Datacenters Over VTEP

Removing an Extended Subnet

About this task

Perform the following procedure to remove the subnet extension. This procedure deletes the extended subnet between the two Availability Zones (AZs) or between one Nutanix AZ and one or more third party subnets. Deleting the subnet extension does not automatically remove the network gateways or VPN connections that may have automatically been created by the Subnet Extension wizard. You need to separately delete these entities created automatically when the subnet was extended.

Note: Removing an extended subnet from a cluster or AZ (either source or target AZs) automatically deletes the extended subnet from the corresponding source or target AZs.

Procedure

Click the hamburger icon in the top-left corner of the Dashboard .
The main feature list appears.
Click Network & Security > Connectivity > > Subnet Extensions .
The Subnet Extensions tab displays a list of the extended subnets.
Figure. Sample Subnet Extensions dashboard Click to enlarge
Select the subnet extension you want to remove.
Click Actions > Delete
The confirmation dialog box is displayed.
Click Remove .
Click Cancel to close the dialog box without removing the subnet extension.

What to do next

Check the list in the Subnet Extensions tab to confirm that the subnet extension is removed.

Read article

Welcome to Knowledge Base!

KB at your finger tips

Storage and Backups-Nutanix

File Analytics Guide

Files 2.2

File Analytics

Display Features

Deployment Requirements

Network Requirements

Limitations

Administration

Deploying File Analytics

Before you begin

Procedure

Results

Enabling File Analytics

About this task

Procedure

Results

Example

Disabling File Analytics

About this task

Procedure

What to do next

Launching File Analytics

About this task

Procedure

File Analytics VM Management

Removing File Analytics VMs

About this task

Procedure

Updating Credentials

About this task

Procedure

Managing Deleted Share/Export Audits

About this task

Procedure

Upgrades

Upgrade File Analytics at a Dark Site

About this task

Before you begin

Procedure

Dashboard

Dashboard View

Capacity Trend Details

File Distribution by Type Details

File Operation Trend

Managing File Categories

About this task

Procedure

Health

Anomalies

Anomaly Details

Configuring Anomaly Detection

About this task

Procedure

Configuring an SMTP Server

About this task

Procedure

Audit Trails

View Audit Trails

About this task

Procedure

Audit Trails - Users

Audit Trails Search - Users

Audit Details Page - Users

Audit Trails - Folders

Audit Trails - Files

Audit Trails for Files

Audit Trails - Client IP

Audit Trails Search - Client IP

File Analytics Options

Updating Data Retention

About this task

Procedure

Scanning the File System

About this task

Procedure

Blacklisting

About this task