0% found this document useful (0 votes)

51 views

Nutanix Security Guide v6 0

This document provides an overview of security features and configuration in Nutanix including hardening instructions, authentication, authorization, user management, certificates, encryption, network segmentation, firewalls, and logging. It covers security using Prism Element and Prism Central.

Uploaded by

marimuthu Periyasamy

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

51 views

Nutanix Security Guide v6 0

Uploaded by

marimuthu Periyasamy

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 175

AOS Security 6.

Security Guide
December 8, 2021
Contents

1. Audience & Purpose............................................................................................... 4

2. Nutanix Security Infrastructure..........................................................................5

SCMA Implementation............................................................................................................................................. 5
RHEL 7 STIG Implementation in Nutanix Controller VM........................................................................... 6
Security Updates........................................................................................................................................................6
Nutanix Security Landscape................................................................................................................................. 6

3. Hardening Instructions (nCLI)............................................................................8

Hardening AHV...........................................................................................................................................................8
Hardening Controller VM....................................................................................................................................... 11
TCP Wrapper Integration..........................................................................................................................13
Enabling Common Criteria................................................................................................................................... 14

4. Security Management Using Prism Element (PE).....................................15

Configuring Authentication.................................................................................................................................. 15
Assigning Role Permissions.................................................................................................................... 27
Certificate Revocation Checking............................................................................................................31
Authentication Best Practices............................................................................................................................32
Emergency Local Account Usage........................................................................................................ 32
Modifying Default Passwords.................................................................................................................33
Controlling Cluster Access...................................................................................................................... 33
Setup Admin Session Timeout.............................................................................................................. 34
Password Retry Lockout.......................................................................................................................... 35
Internationalization (i18n)........................................................................................................................ 35
User Management................................................................................................................................................... 36
Creating a User Account......................................................................................................................... 36
Deleting a User Account......................................................................................................................... 45
Certificate Management....................................................................................................................................... 46
Installing an SSL Certificate................................................................................................................... 46
Replacing a Certificate............................................................................................................................. 50
Exporting an SSL Certificate for Third-party Backup Applications........................................54
Controlling Cluster Access.................................................................................................................................. 55
Data-at-Rest Encryption.......................................................................................................................................56
Data-at-Rest Encryption (SEDs)........................................................................................................... 58
Data-at-Rest Encryption (Software Only)..........................................................................................71
Switching from SED-EKM to Software-LKM.................................................................................... 86
Configuring Dual Encryption..................................................................................................................86
Backing up Keys..........................................................................................................................................87
Importing Keys............................................................................................................................................. 88
Securing Traffic Through Network Segmentation..................................................................................... 89
Traffic Types In a Segmented Network.............................................................................................90
Segmented and Unsegmented Networks.........................................................................................90
Implementation Considerations............................................................................................................ 92
Configuring the Network on an AHV Host...................................................................................... 93
Network Segmentation for Traffic Types (Backplane, Management, and RDMA).............95

ii
Service-Specific Traffic Isolation......................................................................................................... 105
Network Segmentation During Cluster Expansion........................................................................ 111
Network Segmentation–Related Changes During an AOS Upgrade......................................112
Firewall Requirements...........................................................................................................................................112
Log management....................................................................................................................................................112
Log Forwarding........................................................................................................................................... 112
Documenting the Log Fingerprint.......................................................................................................112

5. Security Management Using Prism Central (PC).....................................114

Configuring Authentication................................................................................................................................ 114
Adding An Authentication Directory (Prism Central)................................................................. 114
Adding a SAML-based Identity Provider.........................................................................................120
Enabling and Configuring Client Authentication........................................................................... 121
Certificate Revocation Checking.........................................................................................................124
User Management..................................................................................................................................................125
Managing Local User Accounts........................................................................................................... 125
Controlling User Access (RBAC).........................................................................................................135
Installing an SSL Certificate.............................................................................................................................. 158
Controlling Remote (SSH) Access.................................................................................................................. 162
Password Retry Lockout.....................................................................................................................................163
Security Policies using Flow............................................................................................................................. 164

6. Security Management Using Identity and Access Management

(Prism Central)...................................................................................................... 165
Identity and Access Management Prerequisites and Considerations............................................... 167
Enabling IAM........................................................................................................................................................... 169
Configuring Authentication............................................................................................................................... 170
Enabling and Configuring Client Authentication/CAC................................................................ 171
Updating ADFS When Using SAML Authentication.................................................................... 172
Adding a SAML-based Identity Provider......................................................................................... 173
Restoring Identity and Access Management Configuration Settings............................................... 175

iii
1
AUDIENCE & PURPOSE
This Security Guide is intended for security-minded people responsible for architecting,
managing, and supporting infrastructures, especially those who want to address security
without adding more human resources or additional processes to their datacenters.
This guide offers an overview of the security development life cycle (SecDL) and host of
security features supported by Nutanix. It also demonstrates how Nutanix complies with
security regulations to streamline infrastructure security management. In addition to this, this
guide addresses the technical requirements that are site specific or compliance-standards (that
should be adhered), which are not enabled by default.

Note:
Hardening of the guest OS or any applications running on top of the Nutanix
infrastructure is beyond the scope of this guide. We recommend that you refer to the
documentation of the products that you have deployed in your Nutanix environment.
2
NUTANIX SECURITY INFRASTRUCTURE
Nutanix takes a holistic approach to security with a secure platform, extensive automation,
and a robust partner ecosystem. The Nutanix security development life cycle (SecDL)
integrates security into every step of product development, rather than applying it as an
afterthought. The SecDL is a foundational part of product design. The strong pervasive culture
and processes built around security harden the Enterprise Cloud Platform and eliminate zero-
day vulnerabilities. Efficient one-click operations and self-healing security models easily enable
automation to maintain security in an always-on hyperconverged solution.
Since traditional manual configuration and checks cannot keep up with the ever-growing list of
security requirements, Nutanix conforms to RHEL 7 Security Technical Implementation Guides
(STIGs) that use machine-readable code to automate compliance against rigorous common
standards. With Nutanix Security Configuration Management Automation (SCMA), you can
quickly and continually assess and remediate your platform to ensure that it meets or exceeds
all regulatory requirements.
Nutanix has standardized the security profile of the Controller VM to a security compliance
baseline that meets or exceeds the standard high-governance requirements.
The most commonly used references in United States to guide vendors to build products
according to the set of technical requirements are as follows.

• The National Institute of Standards and Technology Special Publications Security and
Privacy Controls for Federal Information Systems and Organizations (NIST 800.53)
• The US Department of Defense Information Systems Agency (DISA) Security Technical
Implementation Guides (STIG)

SCMA Implementation
The Nutanix platform and all products leverage the Security Configuration Management
Automation (SCMA) framework to ensure that services are constantly inspected for variance to
the security policy.
Nutanix has implemented security configuration management automation (SCMA) to check
multiple security entities for both Nutanix storage and AHV. Nutanix automatically reports log
inconsistencies and reverts them to the baseline.
With SCMA, you can schedule the STIG to run hourly, daily, weekly, or monthly. STIG has the
lowest system priority within the virtual storage controller, ensuring that security checks do not
interfere with platform performance.

Note: Only the SCMA schedule can be modified. The AIDE schedule is run on a fixed weekly
schedule. To change the SCMA schedule for AHV or the Controller VM, see Hardening
Instructions (nCLI) on page 8.

AOS Security | Nutanix Security Infrastructure | 5

RHEL 7 STIG Implementation in Nutanix Controller VM
Nutanix leverages SaltStack and SCMA to self-heal any deviation from the security baseline
configuration of the operating system and hypervisor to remain in compliance. If any
component is found as non-compliant, then the component is set back to the supported
security settings without any intervention. To achieve this objective, Nutanix has implemented
the Controller VM to support STIG compliance with the RHEL 7 STIG as published by DISA.
The STIG rules are capable of securing the boot loader, packages, file system, booting and
service control, file ownership, authentication, kernel, and logging.

Example: STIG rules for Authentication

Prohibit direct root login, lock system accounts other than root, enforce several password
maintenance details, cautiously configure SSH, enable screen-locking, configure user shell
defaults, and display warning banners.

Security Updates
Nutanix provides continuous fixes and updates to address threats and vulnerabilities. Nutanix
Security Advisories provide detailed information on the available security fixes and updates,
including the vulnerability description and affected product/version.
To see the list of security advisories or search for a specific advisory, log on to the Support
Portal and select Documentation, and then Security Advisories.

Nutanix Security Landscape

This topic provides highlights on Nutanix security landscape and its highlights. The following
table helps to identify the security features offered out-of-the-box in Nutanix infrastructure.

Topic Highlights

Authentication and Authorization

• Support for Authentication types and
directories
• Role Permissions
• Password Complexity Support with
standard Pluggable Authentication Module
(PAM) library

Network segmentation VLAN-based, data driven segmentation

Security Policy Management Implement security policies using
Microsegmentation.
Data security and integrity
• Cluster access control
• SSL certificate management
• Data-at-rest (DAR) encryption

Hardening Instructions
• Hardening AHV
• Hardening Controller VM
• TCP Wrapper Integration

AOS Security | Nutanix Security Infrastructure | 6

Topic Highlights

Log monitoring and analysis

• Cluster-wide log shipping
• Documenting the log fingerprint
• Nutanix Pulse diagnostics, see Prism Web
Console Guide

Flow Networking See Flow Networking Guide

UEFI See UEFI Support for VMs topic in the AHV

Admin Guide

Secure Boot See Secure Boot Support for VMs topic in the
AHV Admin Guide

Windows Credential Guard support See Windows Defender Credential Guard

Support in AHV topic in the AHV Admin Guide

RBAC See Controlling User Access (RBAC) in the

AOS Security Guide

AOS Security | Nutanix Security Infrastructure | 7

3
HARDENING INSTRUCTIONS (NCLI)
This chapter describes how to implement security hardening features for Nutanix AHV and
Controller VM.

Hardening AHV
You can use Nutanix Command Line Interface (nCLI) in order to customize the various
configuration settings related to AHV as described below.

AOS Security | Hardening Instructions (nCLI) | 8

Table 1: Configuration Settings to Harden the AHV

Description Command or Settings Output

Getting the cluster-wide Run the following command: Enable Aide : false
configuration of the SCMA nutanix@cvm$ ncli cluster get- Enable Core : false
policy. hypervisor-security-config Enable High Strength P... :
false
Enable Banner : false
Schedule : DAILY

Enabling the Advanced Run the following command: Enable Aide : true
Intrusion Detection nutanix@cvm$ ncli cluster Enable Core : false
Environment (AIDE) to run on edit-hypervisor-security- Enable High Strength P... :
a weekly basis. params enable-aide=true false
Enable Banner : false
Schedule : DAILY

Enabling the high-strength Run the following command: Enable Aide : true
password policies (minlen=15, nutanix@cvm$ ncli cluster Enable Core : false
difok=8, remember=24, edit-hypervisor-security- Enable High Strength P... :
maxclassrepeat=4). params \ true
Enable Banner : false
enable-high-strength- Schedule : DAILY
password=true

Enabling the defense Run the following command: Enable Aide : true
knowledge consent banner of nutanix@cvm$ ncli cluster Enable Core : false
the US department. edit-hypervisor-security- Enable High Strength P... :
params enable-banner=true true
Enable Banner : true
Schedule : DAILY

Changing the default schedule Run the following command: Enable Aide : true
of running the SCMA. The nutanix@cvm$ ncli cluster Enable Core : false
schedule can be hourly, daily, edit-hypervisor-security- Enable High Strength P... :
weekly, and monthly. params schedule=hourly true
Enable Banner : true
Schedule : HOURLY

Enabling the settings so that Run the following command: Enable Aide : true
AHV can generate stack nutanix@cvm$ ncli cluster Enable Core : true
traces for any cluster issue. edit-hypervisor-security- Enable High Strength P... :
params enable-core=true true
Enable Banner : true
Schedule : HOURLY
Note: Nutanix
recommends that Core
should not be set to true
unless instructed by the
Nutanix support team.

AOS Security | Hardening Instructions (nCLI) | 9

Description Command or Settings Output

When a high governance The settings should be as

official needs to run the follows:
hardened configuration. Enable Aide : true
Enable Core : false
Enable High Strength P... :
true
Enable Banner : false
Schedule : HOURLY

When a federal official The settings should be as

needs to run the hardened follows:
configuration. Enable Aide : true
Enable Core : false
Enable High Strength P... :
true
Enable Banner : true
Schedule : HOURLY

Note: A banner file can

be modified to support
non-DoD customer
banners.

Backing up the DoD banner Run the following command

file. on the AHV host:
[root@AHV-host ~]# sudo cp -
a /srv/salt/security/KVM/sshd/
DODbanner \
/srv/salt/security/KVM/sshd/
DODbannerbak

Modifying the DoD banner file. Run the following command

on the AHV host:
[root@AHV-host ~]# sudo vi /
srv/salt/security/KVM/sshd/
DODbanner

Note: Repeat all the

above steps on every
AHV in a cluster.

Setting the banner for all Run the following command:

nodes through nCLI. nutanix@cvm$ ncli cluster
edit-hypervisor-security-
params enable-banner=true

The following options are configured or customized to harden the AHV:

• Enable AIDE: Advanced Intrusion Detection Environment (AIDE) is a Linux utility that
monitors a given node. After you install the AIDE package, the system will generate a
database that contains all the files you selected in your configuration file by entering the
aide -–init command as a root user. You can move the database to a secure location in
a read-only media or on other machines. After you create the database, you can use the
aide -–check command for the system to check the integrity of the files and directories by

AOS Security | Hardening Instructions (nCLI) | 10

comparing the files and directories on your system with the snapshot in the database. In
case there are unexpected changes, a report gets generated, which you can review. If the
changes to existing files or files added are valid, you can use the aide --update command to
update the database with the new changes.
• Enable high strength password: You can run the command as shown in the table in this
section to enable high-strength password policies (minlen=15, difok=8, remember=24,
maxclassrepeat=4).

Note:

• minlen is the minimum required length for a password.

• difok is the minimum number of characters that must be different from the old
password.
• remember is the number of passwords that the system remembers so that you
cannot use those passwords again.
• maxclassrepeat is the number of consecutive characters of same class that you
can use in a password.

• Enable Core: A core dump consists of the recorded state of the working memory of
a computer program at a specific time, generally when the program gets crashed or
terminated abnormally. Core dumps are used to assist in diagnosing or debugging errors in
computer programs. You can enable the core for troubleshooting purposes.
• Enable Banner: You can set a banner to display a specific message. For example, set a
banner to display a warning message that the system is available to authorized users only.

Hardening Controller VM
You can use Nutanix Command Line Interface (nCLI) in order to customize the various
configuration settings related to CVM as described below.

• Run the following command to support cluster-wide configuration of the SCMA policy.
nutanix@cvm$ ncli cluster get-cvm-security-config

The current cluster configuration is displayed.

Enable Aide : false
Enable Core : false
Enable High Strength P...: false
Enable Banner : false
Enable SNMPv3 Only : false
Schedule : DAILY

• Run the following command to schedule weekly execution of Advanced Intrusion Detection
Environment (AIDE).
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-aide=true

The following output is displayed.

Enable Aide : true
Enable Core : false
Enable High Strength P... : false
Enable Banner : false
Enable SNMPv3 Only : false
Schedule : DAILY

AOS Security | Hardening Instructions (nCLI) | 11

• Run the following command to enable the strong password policy.
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-high-strength-password=true

The following output is displayed.

Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : false
Enable SNMPv3 Only : false
Schedule : DAILY

• Run the following command to enable the defense knowledge consent banner of the US
department.
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-banner=true

The following output is displayed.

Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : true
Enable SNMPv3 Only : false
Schedule : DAILY

• Run the following command to enable the settings to allow only SNMP version 3.
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-snmpv3-only=true

The following output is displayed.

Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : true
Enable SNMPv3 Only : true
Schedule : DAILY

• Run the following command to change the default schedule of running the SCMA. The
schedule can be hourly, daily, weekly, and monthly.
nutanix@cvm$ ncli cluster edit-cvm-security-params schedule=hourly

The following output is displayed.

Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : true
Enable SNMPv3 Only : true
Schedule : HOURLY

• Run the following command to enable the settings so that Controller VM can generate stack
traces for any cluster issue.
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-core=true

The following output is displayed.

Enable Aide : true
Enable Core : true
Enable High Strength P... : true
Enable Banner : true
Enable SNMPv3 Only : true

AOS Security | Hardening Instructions (nCLI) | 12

Schedule : HOURLY

Note: Nutanix recommends that Core should not be set to true unless instructed by the
Nutanix support team.

• When a high governance official needs to run the hardened configuration then the settings
should be as follows.
Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : false
Enable SNMPv3 Only : true
Schedule : HOURLY

• When a federal official needs to run the hardened configuration then the settings should be
as follows.
Enable Aide : true
Enable Core : false
Enable High Strength P... : true
Enable Banner : true
Enable SNMPv3 Only : true
Schedule : HOURLY

Note: A banner file can be modified to support non-DoD customer banners.

• Run the following command to backup the DoD banner file.

nutanix@cvm$ sudo cp -a /srv/salt/security/CVM/sshd/DODbanner \
/srv/salt/security/CVM/sshd/DODbannerbak

• Run the following command to modify DoD banner file.

nutanix@cvm$ sudo vi /srv/salt/security/CVM/sshd/DODbanner

Note: Repeat all the above steps on every CVM in a cluster.

• Run the following command to backup the DoD banner file of the PCVM.
nutanix@pcvm$ sudo cp -a /srv/salt/security/PC/sshd/DODbanner \
/srv/salt/security/PC/sshd/DODbannerbak

• Run the following command to modify DoD banner file of the PCVM.
nutanix@pcvm$ sudo vi /srv/salt/security/PC/sshd/DODbanner

• Run the following command to set the banner for all nodes through nCLI.
nutanix@cvm$ ncli cluster edit-cvm-security-params enable-banner=true

TCP Wrapper Integration

Nutanix Controller VM uses the tcp_wrappers package to allow TCP supported daemons to
control the network subnets which can access the libwrapped daemons. By default, SCMA
controls the /etc/hosts.allow file in /srv/salt/security/CVM/network/hosts.allow and
contains a generic entry to allow access to NFS, secure shell, and SNMP.
sshd: ALL : ALLOW
rpcbind: ALL : ALLOW
snmpd: ALL : ALLOW

AOS Security | Hardening Instructions (nCLI) | 13

snmptrapd: ALL : ALLOW

Nutanix recommends that the above configuration is changed to include only the localhost
entries and the management network subnet for the restricted operations; this applies to both
production and high governance compliance environments. This ensures that all subnets used
to communicate with the CVMs are included in the /etc/hosts.allow file.

Enabling Common Criteria

About this task
Common Criteria is an international security certification that is recognized by many countries
around the world. See Nutanix Trust (www.nutanix.com/trust) website for details.

About this task

Procedure

1. Enable Common Criteria Mode.

ncli> cluster edit-params enable-common-criteria-mode=true

2. Verify the state of Common Criteria mode.

ncli> cluster get-params
The output of the above command shows the status of Common Criteria mode in the
following format.
Common Criteria Mode : Enabled
4
SECURITY MANAGEMENT USING PRISM
ELEMENT (PE)
Nutanix provides several mechanisms to maintain security in a cluster using Prism Element.

Configuring Authentication
About this task
Nutanix supports user authentication. To configure authentication types and directories and to
enable client authentication or to enable client authentication only, do the following:

CAUTION: The web console (and nCLI) does not allow the use of the not secure SSLv2 and
SSLv3 ciphers. There is a possibility of an SSL Fallback situation in some browsers which denies
access to the web console. To eliminate this, disable (uncheck) SSLv2 and SSLv3 in any browser
used for access. However, TLS must be enabled (checked).

Procedure

1. Click the gear icon in the main menu and then select Authentication in the Settings page.
The Authentication Configuration window appears.

Note: The following steps combine three distinct procedures, enabling authentication (step
2), configuring one or more directories for LDAP/S authentication (steps 3-5), and enabling
client authentication (step 6). Perform the steps for the procedures you need. For example,
perform step 6 only if you intend to enforce client authentication.

2. To enable server authentication, click the Authentication Types tab and then check the box
for either Local or Directory Service (or both). After selecting the authentication types, click
the Save button.
The Local setting uses the local authentication provided by Nutanix (see User Management
on page 36). This method is employed when a user enters just a login name without
specifying a domain (for example, user1 instead of [email protected]). The Directory
Service setting validates user@domain entries and validates against the directory specified in

AOS Security | Security Management Using Prism Element (PE) | 15

the Directory List tab. Therefore, you need to configure an authentication directory if you
select Directory Service in this field.

Figure 1: Authentication Types Tab

Note: The Nutanix admin user can log on to the management interfaces, including the web
console, even if the Local authentication type is disabled.

3. To add an authentication directory, click the Directory List tab and then click the New
Directory option.
A set of fields is displayed. Do the following in the indicated fields:

a. Directory Type: Select one of the following from the pull-down list.

• Active Directory: Active Directory (AD) is a directory service implemented by

Microsoft for Windows domain networks.

Note:

• Users with the "User must change password at next logon" attribute
enabled will not be able to authenticate to the web console (or nCLI).
Ensure users with this attribute first login to a domain workstation and
change their password prior to accessing the web console. Also, if SSL is
enabled on the Active Directory server, make sure that Nutanix has access
to that port (open in firewall).
• Active Directory domain created by using non-ASCII text may not be
supported. For more information about usage of ASCII or non-ASCII text
in Active Directory configuration, see the Internationalization (i18n) on
page 35 section.
• Use of the "Protected Users" group is currently unsupported for Prism
authentication. For more details on the "Protected Users" group, see

AOS Security | Security Management Using Prism Element (PE) | 16

“Guidance about how to configure protected accounts” on Microsoft
documentation website.
• The Microsoft AD is LDAP v2 and LDAP v3 compliant.
• The Microsoft AD servers supported are Windows Server 2012 R2,
Windows Server 2016, and Windows Server 2019.

• OpenLDAP: OpenLDAP is a free, open source directory service, which uses the
Lightweight Directory Access Protocol (LDAP), developed by the OpenLDAP
project. Nutanix currently supports the OpenLDAP 2.4 release running on CentOS
distributions only.
b. Name: Enter a directory name.
This is a name you choose to identify this entry; it need not be the name of an actual
directory.
c. Domain: Enter the domain name.
Enter the domain name in DNS format, for example, nutanix.com.

d. Directory URL: Enter the URL address to the directory.

AOS Security | Security Management Using Prism Element (PE) | 17

supports LDAPS (port 636) and LDAP/S Global Catalog (ports 3268 and 3269). The
following are example configurations appropriate for each port option:

Note: LDAPS support does not require custom certificates or certificate trust import.

• Port 389 (LDAP). Use this port number (in the following URL form) when the
configuration is single domain, single forest, and not using SSL.
ldap://ad_server.mycompany.com:389

• Port 636 (LDAPS). Use this port number (in the following URL form) when the
configuration is single domain, single forest, and using SSL. This requires all Active
Directory Domain Controllers have properly installed SSL certificates.
ldaps://ad_server.mycompany.com:636

Note: The LDAP server SSL certificate must include a Subject Alternative Name
(SAN) that matches the URL provided during the LDAPS setup.

• Port 3268 (LDAP - GC). Use this port number when the configuration is multiple
domain, single forest, and not using SSL.
• Port 3269 (LDAPS - GC). Use this port number when the configuration is multiple
domain, single forest, and using SSL.

Note: When constructing your LDAP/S URL to use a Global Catalog server, ensure
that the Domain Control IP address or name being used is a global catalog server
within the domain being configured. If not, queries over 3268/3269 may fail.

Note: When querying the global catalog, the users sAMAccountName field must be
unique across the AD forest. If the sAMAccountName field is not unique across the
subdomains, authentication may fail intermittently or consistently.

e. (OpenLDAP only) Configure the following additional fields:

1. User Object Class: Enter the value that uniquely identifies the object class of a user.
2. User Search Base: Enter the base domain name in which the users are configured.
3. Username Attribute: Enter the attribute to uniquely identify a user.
4. Group Object Class: Enter the value that uniquely identifies the object class of a
group.
5. Group Search Base: Enter the base domain name in which the groups are configured.
6. Group Member Attribute: Enter the attribute that identifies users in a group.
7. Group Member Attribute Value: Enter the attribute that identifies the users provided
as value for Group Member Attribute.
f. Search Type. How to search your directory when authenticating. Choose Non Recursive
if you experience slow directory logon performance. For this option, ensure that users

AOS Security | Security Management Using Prism Element (PE) | 18

listed in Role Mapping are listed flatly in the group (that is, not nested). Otherwise,
choose the default Recursive option.
g. Service Account Username: Enter the service account user name in the
[email protected] format that you want the web console to use to log in to the Active
Directory.
A service account is created to run only a particular service or application with the
credentials specified for the account. According to the requirement of the service or
application, the administrator can limit access to the service account.
A service account is under the Managed Service Accounts in the Active Directory server.
An application or service uses the service account to interact with the operating system.

AOS Security | Security Management Using Prism Element (PE) | 19

Enter your Active Directory service account credentials in this (username) and the
following (password) field.

Note: Be sure to update the service account credentials here whenever the service
account password changes or when a different service account is used.

h. Service Account Password: Enter the service account password.

i. When all the fields are correct, click the Save button (lower right).
This saves the configuration and redisplays the Authentication Configuration dialog box.
The configured directory now appears in the Directory List tab.
j. Repeat this step for each authentication directory you want to add.

Note:

• The Controller VMs need access to the Active Directory server, so open the
standard Active Directory ports to each Controller VM in the cluster (and the
virtual IP if one is configured).
• No permissions are granted to the directory users by default. To grant
permissions to the directory users, you must specify roles for the users in that
directory (see Assigning Role Permissions on page 27).

AOS Security | Security Management Using Prism Element (PE) | 20

Figure 2: Directory List Tab

AOS Security | Security Management Using Prism Element (PE) | 21

4. To edit a directory entry, click the Directory List tab and then click the pencil icon

for that entry.

After clicking the pencil icon, the Directory List fields reappear (see step 3). Enter the new
information in the appropriate fields and then click the Save button.

5. To delete a directory entry, click the Directory List tab and then click the X icon for that
entry.
After clicking the X icon, a window prompt appears to verify the delete action; click the OK
button. The entry is removed from the list.

AOS Security | Security Management Using Prism Element (PE) | 22

6. To enable client authentication, do the following:

a. Click the Client tab.

b. Select the Configure Client Chain Certificate check box.
Client Chain Certificate is a list of certificates that includes all intermediate CA and root-
CA certificates.

Note: To authenticate on the PE with Client Chain Certificate the 'Subject name’ field must
be present. The subject name should match the userPrincipalName (UPN) in the AD. The
UPN is a username with domain address. For example [email protected].

Figure 3: Client Tab (1)

c. Click the Choose File button, browse to and select a client chain certificate to upload, and
then click the Open button to upload the certificate.

Note: Uploaded certificate files must be PEM encoded. The web console restarts after the
upload step.

AOS Security | Security Management Using Prism Element (PE) | 23

Figure 4: Client Tab (2)
d. To enable client authentication, click Enable Client Authentication.
e. To modify client authentication, do one of the following:

Note: The web console restarts when you change these settings.

• Click Enable Client Authentication to disable client authentication.

AOS Security | Security Management Using Prism Element (PE) | 24

Figure 5: Authentication Window: Client Tab (3)
Client authentication allows you to securely access the Prism by exchanging a digital
certificate. Prism will validate that the certificate is signed by your organization’s trusted
signing certificate.
Client authentication ensures that the Nutanix cluster gets a valid certificate from the user.
Normally, a one-way authentication process occurs where the server provides a certificate
so the user can verify the authenticity of the server (see Installing an SSL Certificate on
page 46). When client authentication is enabled, this becomes a two-way authentication
where the server also verifies the authenticity of the user. A user must provide a valid
certificate when accessing the console either by installing the certificate on their local
machine or by providing it through a smart card reader. Providing a valid certificate enables
user login from a client machine with the relevant user certificate without utilizing user name
and password. If the user is required to login from a client machine which does not have the
certificate installed, then authentication using user name and password is still available.

Note: The CA must be the same for both the client chain certificate and the certificate on the
local machine or smart card.

AOS Security | Security Management Using Prism Element (PE) | 25

7. To specify a service account that the web console can use to log in to Active Directory and
authenticate Common Access Card (CAC) users, select the Configure Service Account
check box, and then do the following in the indicated fields:

Figure 6: Common Access Card Authentication

a. Directory: Select the authentication directory that contains the CAC users that you want
to authenticate.
This list includes the directories that are configured on the Directory List tab.
b. Service Username: Enter the user name in the user [email protected] format that you want
the web console to use to log in to the Active Directory.
c. Service Password: Enter the password for the service user name.

AOS Security | Security Management Using Prism Element (PE) | 26

d. Click Enable CAC Authentication.

Note: For federal customers only.

Note: The web console restarts after you change this setting.

The Common Access Card (CAC) is a smart card about the size of a credit card, which some
organizations use to access their systems. After you insert the CAC into the CAC reader
connected to your system, the software in the reader prompts you to enter a PIN. After you
enter a valid PIN, the software extracts your personal certificate that represents you and
forwards the certificate to the server using the HTTP protocol.
Nutanix Prism verifies the certificate as follows:

Note: Nutanix Prism does not support OpenLDAP as directory service for CAC.

If you map a Prism role to a CAC user and not to an Active Directory group or organizational
unit to which the user belongs, specify the EDIPI (User Principal Name, or UPN) of that
user in the role mapping. A user who presents a CAC with a valid certificate is mapped to
a role and taken directly to the web console home page. The web console login page is not
displayed.

Note: If you have logged on to Prism by using CAC authentication, to successfully log out of
Prism, close the browser after you click Log Out.

8. Click the Close button to close the Authentication Configuration dialog box.

Assigning Role Permissions

About this task

When user authentication is enabled for a directory service (see Configuring Authentication on
page 15), the directory users do not have any permissions by default. To grant permissions
to the directory users, you must specify roles for the users (with associated permissions) to
organizational units (OUs), groups, or individuals within a directory.
If you are using Active Directory, you must also assign roles to entities or users, especially
before upgrading from a previous AOS version.
To assign roles, do the following:

AOS Security | Security Management Using Prism Element (PE) | 27

Procedure

1. In the web console, click the gear icon in the main menu and then select Role Mapping in the
Settings page.
The Role Mapping window appears.

Figure 7: Role Mapping Window

AOS Security | Security Management Using Prism Element (PE) | 28

2. To create a role mapping, click the New Mapping button.
The Create Role Mapping window appears. Do the following in the indicated fields:

a. Directory: Select the target directory from the pull-down list.

Only directories previously defined when configuring authentication appear in this list.
If the desired directory does not appear, add that directory to the directory list (see
Configuring Authentication on page 15) and then return to this procedure.
b. LDAP Type: Select the desired LDAP entity type from the pull-down list.
The entity types are GROUP, USER, and OU.
c. Role: Select the user role from the pull-down list.
There are three roles from which to choose:

• Viewer: This role allows a user to view information only. It does not provide permission
to perform any administrative tasks.
• Cluster Admin: This role allows a user to view information and perform any
administrative task (but not create or modify user accounts).
• User Admin: This role allows the user to view information, perform any administrative
task, and create or modify user accounts.
d. Values: Enter the case-sensitive entity names (in a comma separated list with no spaces)
that should be assigned this role.
The values are the actual names of the organizational units (meaning it applies to all users
in those OUs), groups (all users in those groups), or users (each named user) assigned this
role. For example, entering value "admin-gp,support-gp" when the LDAP type is GROUP
and the role is Cluster Admin means all users in the admin-gp and support-gp groups
should be assigned the cluster administrator role.

Note:

• Do not include a domain in the value, for example enter just admin-gp, not
[email protected]. However, when users log into the web console, they
need to include the domain in their user name.
• The AD user UPN must be in the user@domain_name format.
• When an admin defines user role mapping using an AD with forest setup, the
admin can map to the user with the same name from any domain in the forest
setup. To avoid this case, set up the user-role mapping with AD that has a
specific domain setup.

e. When all the fields are correct, click Save.

This saves the configuration and redisplays the Role Mapping window. The new role map
now appears in the list.

Note: All users in an authorized service directory have full administrator permissions when
role mapping is not defined for that directory. However, after creating a role map, any

AOS Security | Security Management Using Prism Element (PE) | 29

users in that directory that are not explicitly granted permissions through the role mapping
are denied access (no permissions).

f. Repeat this step for each role map you want to add.
You can create a role map for each authorized directory. You can also create multiple
maps that apply to a single directory. When there are multiple maps for a directory, the
most specific rule for a user applies. For example, adding a GROUP map set to Cluster
Admin and a USER map set to Viewer for select users in that group means all users in
the group have administrator permission except those specified users who have viewing
permission only.

Figure 8: Create Role Mapping Window

AOS Security | Security Management Using Prism Element (PE) | 30

3. To edit a role map entry, click the pencil icon

for that entry.

After clicking the pencil icon, the Edit Role Mapping window appears, which contains the
same fields as the Create Role Mapping window (see step 2). Enter the new information in
the appropriate fields and then click the Save button.

4. To delete a role map entry, click the "X" icon for that entry.
After clicking the X icon, a window prompt appears to verify the delete action; click the OK
button. The entry is removed from the list.

5. Click the Close button to close the Role Mapping window.

Certificate Revocation Checking

Enabling Certificate Revocation Checking using Online Certificate Status Protocol (nCLI)

About this task

OCSP is the recommended method for checking certificate revocation in client authentication.
You can enable certificate revocation checking using the OSCP method through the command
line interface (nCLI).
To enable certificate revocation checking using OCSP for client authentication, do the following.

AOS Security | Security Management Using Prism Element (PE) | 31

Procedure

1. Set the OCSP responder URL.

ncli authconfig set-certificate-revocation set-ocsp-responder=<ocsp url><ocsp url> indicates
the location of the OCSP responder.

2. Verify if OCSP checking is enabled.

ncli authconfig get-client-authentication-config

The expected output if certificate revocation checking is enabled successfully is as follows.

Auth Config Status: true
File Name: ca.cert.pem
OCSP Responder URI: http://<ocsp-responder-url>

Enabling Certificate Revocation Checking using Certificate Revocation Lists (nCLI)

About this task

Note: OSCP is the recommended method for checking certificate revocation in client
authentication.

You can use the CRL certificate revocation checking method if required, as described in this
section.
To enable certificate revocation checking using CRL for client authentication, do the following.

Procedure
Specify all the CRLs that are required for certificate validation.
ncli authconfig set-certificate-revocation set-crl-uri=<uri 1>,<uri 2> set-crl-refresh-
interval=<refresh interval in seconds> set-crl-expiration-interval=<expiration interval in
seconds>

• The above command resets any previous OCSP or CRL configurations.

• The URIs must be percent-encoded and comma separated.
• The CRLs are updated periodically as specified by the crl-refresh-interval value. This
interval is common for the entire list of CRL distribution points. The default value for this is
86400 seconds (1 day).
• The periodically updated CRLs are cached in-memory for the duration specified by value
of set-crl-expiration-interval and expired after the duration, in case a particular CRL
distribution point is not reachable. This duration is configured for the entire list of CRL
distribution points. The default value for this is 604800 seconds (7 days).

Authentication Best Practices

The authentication best practices listed here are guidance to secure the Nutanix platform by
using the most common authentication security measures.

Emergency Local Account Usage

The admin account is used as a local emergency account. This account ensures that both the
Prism Web Console and the Controller VM are available when the external services such as
active directory is unavailable.

AOS Security | Security Management Using Prism Element (PE) | 32

Note: Local emergency account usage is not supported for any external access mechanisms,
specifically for the external application authentication or external Rest API authentication.

For all the external authentication, the cluster must be configured to use an external IAM
service such as an active directory. Service accounts should be created on the IAM and
accounts should have access grants to the cluster through Prism web console user account
management configuration for authentication.

Modifying Default Passwords

You must change the default Controller VM password for nutanix user account by adhering to
the password complexity requirements. For more information on changing default passwords,
see Prism Web Console guide.

Procedure

1. SSH to the Controller VM.

2. Change the nutanix user account password.

nutanix@cvm$ passwd

Note:

• Ensure that you preserve the modified nutanix user password, since the local
authentication (PAM) module requires the previous password of the nutanix user
to successfully start the password reset process.
• For the root account, both the console and SSH direct login is disabled.
• In the subsequent release, the nutanix user interactive emergency account will
be converted to a disabled service account. Hence, it is recommended to use the
admin user as the administrative emergency account.

Controlling Cluster Access

About this task

Nutanix supports key-based SSH access to a cluster. Adding a key through the Prism web
console provides key-based access to the cluster, Controller VM, and hypervisor host. Each
node employs a public/private key pair, and the cluster is made secure by distributing and
using these keys.
You can create a key pair (or multiple key pairs) and add the public keys to enable key-based
SSH access. However, when site security requirements do not allow such access, you can
remove all public keys to prevent SSH access.
To control key-based SSH access to the cluster, do the following:

Note: Use this procedure to lock down access to the Controller VM and hypervisor host. In
addition, it is possible to lock down access to the hypervisor.

AOS Security | Security Management Using Prism Element (PE) | 33

Procedure

1. Click the gear icon in the main menu and then select Cluster Lockdown in the Settings page.
The Cluster Lockdown dialog box appears. Enabled public keys (if any) are listed in this
window.

Figure 9: Cluster Lockdown Window

2. To disable (or enable) remote login access, uncheck (check) the Enable Remote Login with
Password box.
Remote login access is enabled by default.

3. To add a new public key, click the New Public Key button and then do the following in the
displayed fields:

a. Name: Enter a key name.

b. Key: Enter (paste) the key value into the field.

Note: Prism supports the following key types.

• RSA
• ECDSA

a. Click the Save button (lower right) to save the key and return to the main Cluster
Lockdown window.
There are no public keys available by default, but you can add any number of public keys.

4. To delete a public key, click the X on the right of that key line.

Note: Deleting all the public keys and disabling remote login access locks down the cluster
from SSH access.

Setup Admin Session Timeout

By default, the users are logged out automatically after being idle for 15 minutes. You can
change the session timeout for users and configure to override the session timeout by following
the steps shown below.

Procedure

1. In the Prism Web Console main menu, select UI Settings from the gear icon pull-down list on
the right.

AOS Security | Security Management Using Prism Element (PE) | 34

2. Select the session timeout for the current user from the Session Timeout For Current User
drop-down list.

Figure 10: Session Timeout Settings

3. Select the appropriate option from the Session Timeout Override drop-down list to override
the session timeout.

Password Retry Lockout

For enhanced security, Prism Element locks out the admin account for a period of 15 minutes
after a default number of unsuccessful login attempts. Once the account is locked out, the
following message is displayed at the logon screen.
Account locked due to too many failed attempts
You can attempt entering the password after the 15 minutes lockout period, or contact Nutanix
Support in case you have forgotten your password.

Internationalization (i18n)
The following table lists all the supported and unsupported entities in UTF-8 encoding.

Table 2: Internationalization Support

Supported Entities Unsupported Entities

Cluster name Acropolis file server

Storage Container name Share path

Storage pool Internationalized domain names

VM name E-mail IDs

Snapshot name Hostnames

Volume group name Integers

AOS Security | Security Management Using Prism Element (PE) | 35

Supported Entities Unsupported Entities

Protection domain name Password fields

Remote site name Any Hardware related names ( for example,

vSwitch, iSCSCI initiator, vLAN name)

User management

Chart name

CAUTION: The creation of none of the above entities are supported on Hyper-V because of the
DR limitations.

Entities Support (ASCII or non-ASCII) for the Active Directory Server

• In the New Directory Configuration, Name field is supported in non-ASCII.

• In the New Directory Configuration, Domain field is not supported in non-ASCII.
• In Role mapping, Values field is supported in non-ASCII.
• User names and group names are supported in non-ASCII.

User Management
Nutanix user accounts can be created or updated as needed using the Prism web console.

• The web console allows you to add (see Creating a User Account on page 36), edit
(see Updating a User Account on page 38), or delete (see Deleting a User Account on
page 45) local user accounts at any time.
•
You can reset the local user account password using nCLI if you are locked out and cannot
login to the Prism Element or Prism Central web console ( see Resetting Password (CLI) on
page 44).
• You can also configure user accounts through Active Directory and LDAP (see Configuring
Authentication on page 15). Active Directory domain created by using non-ASCII text
may not be supported.

Note: In addition to the Nutanix user account, there are IPMI, Controller VM, and hypervisor host
users. Passwords for these accounts cannot be changed through the web console.

Creating a User Account

About this task

The admin user is created automatically when you get a Nutanix system, but you can add more
users as needed. Note that you cannot delete the admin user. To create a new user, do the
following:

Note: You can also configure user accounts through Active Directory and LDAP (see
Configuring Authentication on page 15).

AOS Security | Security Management Using Prism Element (PE) | 36

Procedure

1. Click the gear icon in the main menu and then select Local User Management in the Settings
page.
The User Management dialog box appears.

Figure 11: User Management Window

2. To add a user, click the New User button and do the following in the displayed fields:

a. Username: Enter a user name.

b. First Name: Enter a first name.
c. Last Name: Enter a last name.
d. Email: Enter the user email address.
e. Password: Enter a password (maximum of 255 characters).
A second field to verify the password is not included, so be sure to enter the password
correctly in this field.
f. Language: Select the language setting for the user.
By default English is selected. You have an option to select Simplified Chinese or
Japanese. Depending the language that you select here, the cluster locale will be updated
for the new user. For example, if you select Simplified Chinese, next time when the
new user that you have created logs in, the user interface will be displayed in Simplified
Chinese.
g. Roles: Assign a role to this user.
There are three options:

• Checking the User Administrator box allows the user to view information, perform
any administrative task, and create or modify user accounts. (Checking this box
automatically checks the Cluster Admin box as well to indicate this user has full

AOS Security | Security Management Using Prism Element (PE) | 37

permissions. However, a user administrator has full permissions regardless of whether
the cluster administrator box is checked.)
• Checking the Cluster Administrator box allows the user to view information and
perform any administrative task (but not create or modify user accounts).
• Leaving both boxes unchecked allows the user to view information, but it does not
provide permission to perform cluster or user administrative tasks.
h. When all the fields are correct, click the Save button (lower right).
This saves the configuration and redisplays the dialog box with the new user appearing in
the list.

Figure 12: Create User Window

Updating a User Account

About this task

To update credentials for an existing user, do the following:

Note: To update your account credentials (that is, the user you are currently logged in as),
see Updating My Account on page 40. Changing the password for a different user is not
supported; you must log in as that user to change the password.

AOS Security | Security Management Using Prism Element (PE) | 38

Procedure

1. Click the gear icon in the main menu and then select Local User Management in the Settings
page.
The User Management dialog box appears.

Figure 13: User Management Window

2. To disable login access, click the Yes value in the Enabled field for that user; to enable the
account, click the No value.
A Yes value means the login is enabled; a No value means it is disabled. A user account is
enabled (login access activated) by default.

3. To edit the user credentials, click the pencil icon for that user and update one or more of the
values as desired in the displayed fields:

a. Username: The username is fixed when the account is created and cannot be changed.
b. First Name: Enter a different first name.
c. Last Name: Enter a different last name.
d. Email: Enter a different email address.
e. Roles: Change the role assigned to this user.
There are three options:

• Checking the Cluster Admin box allows a user to view information and perform any
administrative task (but not create or modify user accounts).
• Checking the User Admin box allows the user to view information, perform any
administrative task, and create or modify user accounts. (Checking this box
automatically checks the Cluster Admin box as well to indicate this user has full

AOS Security | Security Management Using Prism Element (PE) | 39

permissions. However, a user administrator has full permissions regardless of whether
the cluster administrator box is checked.)
• Leaving both boxes unchecked allows the user to view information, but it does not
provide permission to perform cluster or user administrative tasks.
f. When all the fields are correct, click the Save button (lower right).
This saves the configuration and redisplays the dialog box with the new user appearing in
the list.

Figure 14: Update User Window

Updating My Account

About this task

To update your account credentials (that is, credentials for the user you are currently logged in
as), do the following:

AOS Security | Security Management Using Prism Element (PE) | 40

Procedure

1. To update your password, select Change Password from the user icon

pull-down list in the web console.

The Change Password dialog box appears. Do the following in the indicated fields:

a. Current Password: Enter the current password.

b. New Password: Enter a new password.
c. Confirm Password: Re-enter the new password.
d. When the fields are correct, click the Save button (lower right). This saves the new
password and closes the window.

AOS Security | Security Management Using Prism Element (PE) | 41

Figure 15: Change Password Window

AOS Security | Security Management Using Prism Element (PE) | 42

2. To update other details of your account, select Update Profile from the user icon pull-down
list.
The Update Profile dialog box appears. Update (as desired) one or more of the following
fields:

a. First Name: Enter a different first name.

b. Last Name: Enter a different last name.
c. Email: Enter a different user email address.
d. Language: Select a language for your account.
e. API Key: Enter the key value to use a new API key.
f. Public Key: Click the Choose File button to upload a new public key file.
g. When all the fields are correct, click the Save button (lower right). This saves the changes
and closes the window.

Figure 16: Update Profile Window

AOS Security | Security Management Using Prism Element (PE) | 43

Resetting Password (CLI)
This procedure describes how to reset your password or any another user's password (if you
are locked out and cannot log in to the Prism Element or Prism Central web console).

About this task

To reset the password using nCLI, do the following:

Procedure

1. Access the CVM via SSH.

2. Log in with the admin credentials.

3. Use the ncli user reset-password command and specify the username and password of the
user whose password is to be reset:
nutanix@cvm$ ncli user reset-password user-name=xxxxx password=yyyyy

• Replace user-name=xxxxx with the name of the user whose password is to be reset.
• Replace password=yyyyy with the new password.

What to do next
You can relaunch the Prism web console and verify the new password setting.

Exporting an SSL Certificate for Third-party Backup Applications

Nutanix allows you to export an SSL certificate for Prism Element on a Nutanix cluster and use
it with third-party backup applications.

Procedure

1. Log on to a Controller VM in the cluster using SSH.

2. Run the following command to obtain the virtual IP address of the cluster:
nutanix@cvm$ ncli cluster info

The current cluster configuration is displayed.

Cluster Id : 0001ab12-abcd-efgh-0123-012345678m89::123456
Cluster Uuid : 0001ab12-abcd-efgh-0123-012345678m89
Cluster Name : three
Cluster Version : 6.0
Cluster Full Version : el7.3-release-fraser-6.0-a0b1c2345d6789ie123456fg789h1212i34jk5lm6
External IP address : 10.10.10.10
Node Count : 3
Block Count : 1
. . . . .

Note: The external IP address in the output is the virtual IP address of the cluster.

3. Run the following command to enter into the Python prompt:

nutanix@cvm$ python

The Python prompt appears.

4. Run the following command to import the SSL library.

$ import ssl

AOS Security | Security Management Using Prism Element (PE) | 44

5. From the Python console, run the following command to print the SSL certificate.
$ print ssl.get_server_certificate(('virtual_IP_address',9440), \
ssl_version=ssl.PROTOCOL_TLSv1_2)

The SSL certificate is displayed on the console.

Deleting a User Account

About this task

To delete an existing user, do the following:

Procedure

1. Click the gear icon in the main menu and then select Local User Management in the Settings
page.
The User Management dialog box appears.

Figure 17: User Management Window

AOS Security | Security Management Using Prism Element (PE) | 45

2. Click the X icon for that user. Note that you cannot delete the admin user.
A window prompt appears to verify the action; click the OK button. The user account is
removed and the user no longer appears in the list.

Certificate Management
This chapter describes how to install and replace an SSL certificate for configuration and use on
the Nutanix Controller VM.

Note: Nutanix recommends that you check for the validity of the certificate periodically, and
replace the certificate if it is invalid.

Installing an SSL Certificate

About this task

Nutanix supports SSL certificate-based authentication for console access. To install a self-
signed or custom SSL certificate, do the following:

Note:

• Nutanix recommends that customers replace the default self-signed certificate with
a CA signed certificate.
• SSL certificate (self-signed or signed by CA) can only be installed cluster-wide from
Prism. SSL certificates can not be customized for individual Controller VM.

Procedure

1. Click the gear icon in the main menu and then select SSL Certificate in the Settings page.
The SSL Certificate dialog box appears.

Figure 18: SSL Certificate Window

2. To replace (or install) a certificate, click the Replace Certificate button.

AOS Security | Security Management Using Prism Element (PE) | 46

3. To create a new self-signed certificate, click the Regenerate Self Signed Certificate option
and then click the Apply button.
A dialog box appears to verify the action; click the OK button. This generates and applies a
new RSA 2048-bit self-signed certificate for the Prism user interface.

Figure 19: SSL Certificate Window: Regenerate

AOS Security | Security Management Using Prism Element (PE) | 47

4. To apply a custom certificate that you provide, do the following:

a. Click the Import Key and Certificate option and then click the Next button.

Figure 20: SSL Certificate Window: Import

b. Do the following in the indicated fields, and then click the Import Files button.

Note: All three imported files for the custom certificate must be PEM encoded.

• Private Key Type: Select the appropriate type for the signed certificate from the pull-
down list (RSA 4096 bit, RSA 2048 bit, EC DSA 256 bit, or EC DSA 384 bit).
• Private Key: Click the Browse button and select the private key associated with the
certificate to be imported.
• Public Certificate: Click the Browse button and select the signed public portion of the
server certificate corresponding to the private key.
• CA Certificate/Chain: Click the Browse button and select the certificate or chain of the
signing authority for the public certificate.

AOS Security | Security Management Using Prism Element (PE) | 48

Figure 21: SSL Certificate Window: Select Files

In order to meet the high security standards of NIST SP800-131a compliance, the
requirements of the RFC 6460 for NSA Suite B, and supply the optimal performance for
encryption, the certificate import process validates the correct signature algorithm is
used for a given key/cert pair. Refer to the following table to ensure the proper set of
key types, sizes/curves, and signature algorithms. The CA must sign all public certificates
with proper type, size/curve, and signature algorithm for the import process to validate
successfully.

Note: There is no specific requirement for the subject name of the certificates (subject
alternative names (SAN) or wildcard certificates are supported in Prism).

Table 3: Recommended Key Configurations

Key Type Size/Curve Signature Algorithm

RSA 4096 SHA256-with-RSAEncryption

RSA 2048 SHA256-with-RSAEncryption
EC DSA 256 prime256v1 ecdsa-with-sha256
EC DSA 384 secp384r1 ecdsa-with-sha384

AOS Security | Security Management Using Prism Element (PE) | 49

Key Type Size/Curve Signature Algorithm
EC DSA 521 secp521r1 ecdsa-with-sha512

You can use the cat command to concatenate a list of CA certificates into a chain file.
$ cat signer.crt inter.crt root.crt > server.cert

Order is essential. The total chain should begin with the certificate of the signer and end
with the root CA certificate as the final entry.

Results
After generating or uploading the new certificate, the interface gateway restarts. If the
certificate and credentials are valid, the interface gateway uses the new certificate immediately,
which means your browser session (and all other open browser sessions) will be invalid until
you reload the page and accept the new certificate. If anything is wrong with the certificate
(such as a corrupted file or wrong certificate type), the new certificate is discarded, and the
system reverts back to the original default certificate provided by Nutanix.

Note: The system holds only one custom SSL certificate. If a new certificate is uploaded, it
replaces the existing certificate. The previous certificate is discarded.

Replacing a Certificate
Nutanix simplifies the process of certificate replacement to support the need of Certificate
Authority (CA) based chains of trust. Nutanix recommends you to replace the default supplied
self-signed certificate with a CA signed certificate.

Procedure

1. Login to the Prism and click the gear icon.

2. Click SSL Certificate.

3. Select Replace Certificate to replace the certificate.

AOS Security | Security Management Using Prism Element (PE) | 50

4. Do one of the following.

» Select Regenerate self signed certificate to generate a new self-signed certificate.

Note:

• This automatically generates and applies a certificate.

» Select Import key and certificate to import the custom key and certificate. RSA 4096 bit,
RSA 2048 bit, Elliptic Curve DSA 256 bit, and Elliptic Curve DSA 384 bit types of key and
certificate are supported.
The following files are required and should be PEM encoded to import the keys and
certificate.

• The private key associated with the certificate. The below section describes generating a
private key in detail.
• The signed public portion of the server certificate corresponding to the private key.
• The CA certificate or chain of the signing authority for the certificate.

Note:
You must obtain the Public Certificate and CA Certificate/Chain from the certificate
authority.

AOS Security | Security Management Using Prism Element (PE) | 51

Figure 22: Importing Certificate

Generating an RSA 4096 and RSA 2048 private key

• Run the following OpenSSL command to generate a RSA 4096 private key and the
Certificate Signing Request (CSR).
openssl req -out server.csr -new -newkey rsa:40966
-nodes -sha256 -keyout server.key

• Run the following OpenSSL command to generate an RSA 2048 private key and the
Certificate Signing Request (CSR).
openssl req -out server.csr -new -newkey rsa:2048
-nodes -sha256 -keyout server.key

After executing the openssl command, the system prompts you to provide more details
that will be incorporated into your certificate. The mandatory fields are - Country Name,
State or Province Name, and Organization Name. The optional fields are - Locality Name,
Organizational Unit Name, Email Address, and Challenge Password.
Nutanix recommends including a DNS name for all CVMs in the certificate using the Subject
Alternative Name (SAN) extension. This avoids SSL certificate errors when you access a
CVM by direct DNS instead of the shared cluster IP. This example shows how to include a
DNS name while generating an RSA 4096 private key:
openssl req -out server.csr -new -newkey rsa:4096 -sha256 -nodes

AOS Security | Security Management Using Prism Element (PE) | 52

-addext "subjectAltName = DNS:example.com"
-keyout server.key

For a 3-node cluster you can provide DNS name for all three nodes in a single command. For
example:
openssl req -out server.csr -new -newkey rsa:4096 -sha256 -nodes
-addext "subjectAltName = DNS:example1.com,DNS:example2.com,DNS:example3.com"
-keyout server.key

If you have added a SAN (subjectAltName) extension to your certificate, then every time you
add or remove a node from the cluster, you must add the DNS name when you generate or
sign a new certificate.
Generating an EC DSA 256 and EC DSA 384 private key

• Run the following OpenSSL command to generate a EC DSA 256 private key and the
Certificate Signing Request (CSR).
openssl ecparam -out dsakey.pem -name prime256v1 –genkey
openssl req -out dsacert.csr -new -key dsakey.pem -nodes -sha256

• Run the following OpenSSL command to generate a EC DSA 384 private key and the
Certificate Signing Request (CSR).
openssl ecparam -out dsakey.pem -name secp384r1 –genkey
openssl req -out dsacert.csr -new -key dsakey.pem -nodes –sha384

Note: To adhere the high security standards of NIST SP800-131a compliance, requirements
of the RFC 6460 for NSA Suite B, provide the optimal performance for encryption. The
certificate import process validates the correct signature algorithm used for a given key or
certificate pair.

The following figure displays the supported configurations.

Figure 23: Supported Configurations

5. If the CA chain certificate provided by the certificate authority is not in a single file, then run
the following command to concatenate the list of CA certificates into a chain file.
cat signer.crt inter.crt root.crt > server.cert

Note: The chain should start with the certificate of the signer and ends with the root CA
certificate.

6. Browse and add the Private Key, Public Certificate, and CA Certificate/Chain.

7. Click Import Files.

What to do next
Prism restarts and you must login to use the application.

AOS Security | Security Management Using Prism Element (PE) | 53

Exporting an SSL Certificate for Third-party Backup Applications
Nutanix allows you to export an SSL certificate for Prism Element on a Nutanix cluster and use
it with third-party backup applications.

Procedure

1. Log on to a Controller VM in the cluster using SSH.

2. Run the following command to obtain the virtual IP address of the cluster:
nutanix@cvm$ ncli cluster info

The current cluster configuration is displayed.

Note: The external IP address in the output is the virtual IP address of the cluster.

3. Run the following command to enter into the Python prompt:

nutanix@cvm$ python

The Python prompt appears.

4. Run the following command to import the SSL library.

$ import ssl

5. From the Python console, run the following command to print the SSL certificate.
$ print ssl.get_server_certificate(('virtual_IP_address',9440), \
ssl_version=ssl.PROTOCOL_TLSv1_2)

The SSL certificate is displayed on the console.

AOS Security | Security Management Using Prism Element (PE) | 54

efghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef
ghij
-----END CERTIFICATE-----

Controlling Cluster Access

About this task
Nutanix supports key-based SSH access to a cluster. Adding a key through the Prism web
console provides key-based access to the cluster, Controller VM, and hypervisor host. Each
node employs a public/private key pair, and the cluster is made secure by distributing and
using these keys.
You can create a key pair (or multiple key pairs) and add the public keys to enable key-based
SSH access. However, when site security requirements do not allow such access, you can
remove all public keys to prevent SSH access.
To control key-based SSH access to the cluster, do the following:

Note: Use this procedure to lock down access to the Controller VM and hypervisor host. In
addition, it is possible to lock down access to the hypervisor.

Procedure

1. Click the gear icon in the main menu and then select Cluster Lockdown in the Settings page.
The Cluster Lockdown dialog box appears. Enabled public keys (if any) are listed in this
window.

Figure 24: Cluster Lockdown Window

2. To disable (or enable) remote login access, uncheck (check) the Enable Remote Login with
Password box.
Remote login access is enabled by default.

AOS Security | Security Management Using Prism Element (PE) | 55

3. To add a new public key, click the New Public Key button and then do the following in the
displayed fields:

a. Name: Enter a key name.

b. Key: Enter (paste) the key value into the field.

Note: Prism supports the following key types.

• RSA
• ECDSA

a. Click the Save button (lower right) to save the key and return to the main Cluster
Lockdown window.
There are no public keys available by default, but you can add any number of public keys.

4. To delete a public key, click the X on the right of that key line.

Note: Deleting all the public keys and disabling remote login access locks down the cluster
from SSH access.

Data-at-Rest Encryption
Nutanix provides an option to secure data while it is at rest using either self-encrypted drives or
software-only encryption and key-based access management (cluster's native or external KMS
for software-only encryption).

Encryption Methods
Nutanix provides you with the following options to secure your data.

• Self Encrypting Drives (SED) Encryption - You can use a combination of SEDs and an
external KMS to secure your data while it is at rest.
• Software-only Encryption - Nutanix AOS uses the AES-256 encryption standard to encrypt
your data. Once enabled, software-only data-at-rest encryption cannot be disabled, thus
protecting against accidental data leaks due to human errors. Software-only encryption
supports both Nutanix Native Key Manager (local and remote) and External KMS to secure
your keys.
Note the following points regarding data-at-rest encryption.

• Encryption is supported for AHV, ESXi, and Hyper-V.

• For ESXi and Hyper-V, software-only encryption can be implemented at a cluster level or
container level. For AHV, encryption can be implemented at the cluster level only.
• Nutanix recommends using cluster-level encryption. With the cluster-level encryption,
the administrative overhead of selecting different containers for the data storage gets
eliminated.
• Encryption cannot be disabled once it is enabled at a cluster level or container level.
• Encryption can be implemented on an existing cluster with data that exists. If encryption is
enabled on an existing cluster (AHV, ESXi, or Hyper-V), the unencrypted data is transformed
into an encrypted format in a low priority background that is designed not to interfere with
other workload running in the cluster.

AOS Security | Security Management Using Prism Element (PE) | 56

• Data can be encrypted using either self-encrypted drives (SEDs) or software-only
encryption. You can change the encryption method from SEDs to software-only.You can
perform the following configurations.

• For ESXi and Hyper-V clusters, you can switch from SEDs and External Key Management
(EKM) combination to software-only encryption and EKM combination. First, you must
disable the encryption in the cluster where you want to change the encryption method.
Then, select the cluster and enable encryption to transform the unencrypted data into an
encrypted format in the background.
• For AHV, background encryption is supported.
• Once the task to encrypt a cluster begins, you cannot cancel the operation. Even if you stop
and restart the cluster, the system resumes the operation.
• In the case of mixed clusters with ESXi and AHV nodes, where the AHV nodes are used for
storage only, the encryption policies consider the cluster as an ESXi cluster. So, the cluster-
level and container-level encryption are available.
• You can use a combination of SED and non-SED drives in a cluster. After you encrypt a
cluster using the software-only encryption, all the drives are considered as unencrypted
drives. In case you switch from the SED encryption to the software-only encryption, you can
add SED or non-SED drives to the cluster.
• Data is not encrypted when it is replicated to another cluster. You must enable the
encryption for each cluster. Data is encrypted as a part of the write operation and decrypted
as a part of the read operation. During the replication process, the system reads, decrypts,
and then sends the data over to the other cluster. You can use a third-party network solution
if there a requirement to encrypt the data during the transmission to another cluster.
• Software-only encryption does not impact the data efficiency features such as deduplication,
compression, erasure coding, zero block suppression, and so on. The software encryption
is the last data transformation performed. For example, during the write operation,
compression is performed first, followed by encryption.

Key Management
Nutanix supports a Native Key Management Server, also called Local Key Manager (LKM),
thus avoiding the dependency on an External Key Manager (EKM). Cluster localised Key
Management Service support requires a minimum of 3-node in a cluster and is supported only
for software-only encryption. So, 1-node and 2-node clusters can use either the Native KMS
(remote) option or an EKM. .
The following types of keys are used for encryption.

• Data Encryption Key (DEK) - A symmetric key, such as AES-256, that is used to encrypt the
data.
• Key Encryption Key (KEK) - This key is used to encrypt or decrypt the DEK.
Note the following points regarding the key management.

• Nutanix does not support the use of the Local Key Manager with a third party External Key
Manager.
• Dual encryption (both SED and software-only encryption) requires an EKM. For more
information, see Configuring Dual Encryption on page 86.
• You can switch from an EKM to LKM, and inversely. For more information, see Switching
between Native Key Manager and External Key Manager on page 83.

AOS Security | Security Management Using Prism Element (PE) | 57

• Rekey of keys stored in the Native KMS is supported for the Leader Keys. For more
information, see Changing Key Encryption Keys (SEDs) on page 69 and Changing Key
Encryption Keys (Software Only) on page 84.
• You must back up the keys stored in the Native KMS. For more information, see Backing up
Keys on page 87.
• You must backup the encryption keys whenever you create a new container or remove an
existing container. Nutanix Cluster Check (NCC) checks the status of the backup and sends
an alert if you do not take a backup at the time of creating or removing a container.

Data-at-Rest Encryption (SEDs)

For customers who require enhanced data security, Nutanix provides a data-at-rest security
option using Self Encrypting Drives (SEDs) included in the Ultimate license.

Note: If you are running the AOS Pro License on G6 platforms and above, you can use SED
encryption by installing an add-on license.

Following features are supported:

• Data is encrypted on all drives at all times.

• Data is inaccessible in the event of drive or node theft.
• Data on a drive can be securely destroyed.
• A key authorization method allows password rotation at arbitrary times.
• Protection can be enabled or disabled at any time.
• No performance penalty is incurred despite encrypting all data.
• Re-key of the leader encryption key (MEK) at arbitrary times is supported.

Note: If an SED cluster is present, then while executing the data-at-rest encryption, you will get
an option to either select data-at-rest encryption using SEDs or data-at-rest encryption using
AOS.

Figure 25: SED and AOS Options

Note: This solution provides enhanced security for data on a drive, but it does not secure data in
transit.

AOS Security | Security Management Using Prism Element (PE) | 58

Data Encryption Model
To accomplish these goals, Nutanix implements a data security configuration that uses SEDs
with keys maintained through a separate key management device. Nutanix uses open standards
(TCG and KMIP protocols) and FIPS validated SED drives for interoperability and strong
security.

Figure 26: Cluster Protection Overview

This configuration involves the following workflow:

1. The security implementation begins by installing SEDs for all data drives in a cluster.
The drives are FIPS 140-2 validated and use FIPS 140-2 validated cryptographic modules.
Creating a new cluster that includes SEDs only is straightforward, but an existing cluster can
be converted to support data-at-rest encryption by replacing the existing drives with SEDs
(after migrating all the VMs/vDisks off of the cluster while the drives are being replaced).

Note: Contact Nutanix customer support for assistance before attempting to convert an
existing cluster. A non-protected cluster can contain both SED and standard drives, but
Nutanix does not support a mixed cluster when protection is enabled. All the disks in a
protected cluster must be SED drives.

2. Data on the drives is always encrypted but read or write access to that data is open. By
default, the access to data on the drives is protected by the in-built manufacturer key.
However, when data protection for the cluster is enabled, the Controller VM must provide
the proper key to access data on a SED. The Controller VM communicates with the SEDs
through a Trusted Computing Group (TCG) Security Subsystem Class (SSC) Enterprise
protocol.
A symmetric data encryption key (DEK) such as AES 256 is applied to all data being written
to or read from the disk. The key is known only to the drive controller and never leaves the
physical subsystem, so there is no way to access the data directly from the drive.
Another key, known as a key encryption key (KEK), is used to encrypt/decrypt the DEK and
authenticate to the drive. (Some vendors call this the authentication key or PIN.)
Each drive has a separate KEK that is generated through the FIPS compliant random number
generator present in the drive controller. The KEK is 32 bytes long to resist brute force
attacks. The KEKs are sent to the key management server for secure storage and later
retrieval; they are not stored locally on the node (even though they are generated locally).
In addition to the above, the leader encryption key (MEK) is used to encrypt the KEKs.
Each node maintains a set of certificates and keys in order to establish a secure connection
with the external key management server.

AOS Security | Security Management Using Prism Element (PE) | 59

3. Keys are stored in a key management server that is outside the cluster, and the Controller
VM communicates with the key management server using the Key Management
Interoperability Protocol (KMIP) to upload and retrieve drive keys.
Only one key management server device is required, but it is recommended that multiple
devices are employed so the key management server is not a potential single point of failure.
Configure the key manager server devices to work in clustered mode so they can be added
to the cluster configuration as a single entity that is resilient to a single failure.
4. When a node experiences a full power off and power on (and cluster protection is enabled),
the controller VM retrieves the drive keys from the key management server and uses them to
unlock the drives.
If the Controller VM cannot get the correct keys from the key management server, it cannot
access data on the drives.
If a drive is re-seated, it becomes locked.
If a drive is stolen, the data is inaccessible without the KEK (which cannot be obtained from
the drive). If a node is stolen, the key management server can revoke the node certificates to
ensure they cannot be used to access data on any of the drives.

Preparing for Data-at-Rest Encryption (External KMS for SEDs and Software Only)

About this task

CAUTION: DO NOT HOST A KEY MANAGEMENT SERVER VM ON THE ENCRYPTED CLUSTER

THAT IS USING IT!
Doing so could result in complete data loss if there is a problem with the VM while it is
hosted in that cluster.

If you are using an external KMS for encryption using AOS, preparation steps outside the
web console are required. The information in this section is applicable if you choose to use an
external KMS for configuring encryption.
You must install the license of the external key manager for all nodes in the cluster. See the
Acropolis Release Notes for a complete list of the supported key management servers. For
instructions on how to configure a key management server, refer to the documentation from
the appropriate vendor.
The system accesses the EKM under the following conditions:

• Starting a cluster
• Regenerating a key (key regeneration occurs automatically every year by default)
• Adding or removing a node (only when Self Encrypting Drives is used for encryption)
• Switching between Native to EKM or EKM to Native
• Starting, and restarting a service (only if Software-based encryption is used)
• Upgrading AOS (only if Software-based encryption is used)
• NCC heartbeat check if EKM is alive

Procedure

1. Configure a key management server.

The key management server devices must be configured into the network so the cluster
has access to those devices. For redundant protection, it is recommended that you employ

AOS Security | Security Management Using Prism Element (PE) | 60

at least two key management server devices, either in active-active cluster mode or stand-
alone.

Note: The key management server must support KMIP version 1.0 or later.

» SafeNet
Ensure that Security > High Security > Key Security > Disable Creation and Use of Global
Keys is checked.

» Vormetric
Set the appliance to compatibility mode. Suite B mode causes the SSL handshake to fail.

2. Generate a certificate signing request (CSR) for each node in the cluster.

• The Common Name field of the CSR is populated automatically with

unique_node_identifier.nutanix.com to identify the node associated with the certificate.

Note: If a custom common name (CN) is needed, contact Nutanix customer support for
assistance.

• A UID field is populated with a value of Nutanix. This can be useful when configuring a
Nutanix group for access control within a key management server, since it is based on
fields within the client certificates.

Note: Some vendors when doing client certificate authentication expect the client username
to be a field in the CSR. While the CN and UID are pre-generated, many of the user populated
fields can be used instead if desired. If a node-unique field such as CN is chosen, users
must be created on a per node basis for access control. If a cluster-unique field is chosen,
customers must create a user for each cluster.

3. Send the CSRs to a certificate authority (CA) and get them signed.

» Safenet
The SafeNet KeySecure key management server includes a local CA option to generate
signed certificates, or you can use other third-party vendors to create the signed
certificates.
To enable FIPS compliance, add user nutanix to the CA that signed the CSR. Under
Security > High Security > FIPS Compliance click Set FIPS Compliant.

Note: Some CAs strip the UID field when returning a signed certificate.

To comply with FIPS, Nutanix does not support the creation of global keys.
In the SafeNet KeySecure management console, go to Device > Key Server > Key Server >
KMIP Properties > Authentication Settings.
Then do the following:

• Set the Username Field in Client Certificate option to UID (User ID).
• Set the Client Certificate Authentication option to Used for SSL session and username.
If you do not perform these settings, the KMS creates global keys and fails to encrypt the
clusters or containers using the software only method.

4. Upload the signed SSL certificates (one for each node) and the certificate for the CA to the
cluster. These certificates are used to authenticate with the key management server.

AOS Security | Security Management Using Prism Element (PE) | 61

5. Generate keys (KEKs) for the SED drives and upload those keys to the key management
server.

Supported Key Management Servers

Table 4: Supported Key Management Server/Software

Vendor KMS

IBM
• IBM Security Key Lifecycle Manager v4.0
• IBM Security Key Lifecycle Manager v3.0.0.1
• IBM Security Key Lifecycle Manager v2.7.0.1
• IBM Security Key Lifecycle Manager
v2.5.0.8

Note: If you are planning to use IBM

SKLM, you must contact Nutanix Support
for assistance and internal documentation
for configuring IBM SKLM to manage
Nutanix keys.

HyTrust KeyControl 4.3.1

Gemalto
• SafeNet KeySecure 460 v8.0.1
• SafeNet Virtual KeySecurek150v
• SafeNet Virtual KeySecurek150v v8.9

Thales eSecurity
• Vormetric Data Security Manager v5.2
(patch 2)
• Vormetric Data Security Manager 6.0.2
• Vormetric Data Security Manager &
Vormetric Transparent Encryption 6.3

Fornetix Key Orchestration 2.1

KeyNexus Unified Key Manager 2

SafeNet Assured Technologies G350v KeySecure 8.6.1

• External Key Management support applies to AOS Data-at-Rest Encryption for all
hypervisors supported by AOS.
• The listed KMS vendors are also supported for all subsequent minor versions in the same
family.

AOS Security | Security Management Using Prism Element (PE) | 62

Configuring Data-at-Rest Encryption (SEDs)
Nutanix offers an option to use self-encrypting drives (SEDs) to store data in a cluster. When
SEDs are used, there are several configuration steps that must be performed to support data-
at-rest encryption in the cluster.

Before you begin

A separate key management server is required to store the keys outside of the cluster. Each
key management server device must be configured and addressable through the network. It
is recommended that multiple key manager server devices be configured to work in clustered
mode so they can be added to the cluster configuration as a single entity (see step 5) that is
resilient to a single failure.

About this task

To configure cluster encryption, do the following:

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.
The Data at Rest Encryption dialog box appears. Initially, encryption is not configured, and a
message to that effect appears.

Figure 27: Data at Rest Encryption Screen (initial)

2. Click the Create Configuration button.

Clicking the Continue Configuration button, configure it link, or Edit Config button does the
same thing, which is display the Data-at-Rest Encryption configuration page.

3. Select the Encryption Type as Drive-based Encryption. This option is displayed only when
SEDs are detected.

AOS Security | Security Management Using Prism Element (PE) | 63

4. In the Certificate Signing Request Information section, do the following:

Figure 28: Certificate Signing Request Section

a. Enter appropriate credentials for your organization in the Email, Organization,

Organizational Unit, Country Code, City, and State fields and then click the Save CSR Info
button.
The entered information is saved and is used when creating a certificate signing request
(CSR). To specify more than one Organization Unit name, enter a comma separated list.

Note: You can update this information until an SSL certificate for a node is uploaded to
the cluster, at which point the information cannot be changed (the fields become read
only) without first deleting the uploaded certificates.

b. Click the Download CSRs button, and then in the new screen click the Download CSRs
for all nodes to download a file with CSRs for all the nodes or click a Download link to
download a file with the CSR for that node.

Figure 29: Download CSRs Screen

c. Send the files with the CSRs to the desired certificate authority.
The certificate authority creates the signed certificates and returns them to you. Store the
returned SSL certificates and the CA certificate where you can retrieve them in step 5.

AOS Security | Security Management Using Prism Element (PE) | 64

• The certificates must be X.509 format. (DER, PKCS, and PFX formats are not
supported.)
• The certificate and the private key should be in separate files.

5. In the Key Management Server section, do the following:

Figure 30: Key Management Server Section

a. Click the Add New Key Management Server button.

b. In the Add a New Key Management Server screen, enter a name, IP address, and port
number for the key management server in the appropriate fields.
The port is where the key management server is configured to listen for the KMIP
protocol. The default port number is 5696.

» If you have configured multiple key management servers in cluster mode, click the Add
Address button to provide the addresses for each key management server device in
the cluster.
» If you have stand-alone key management servers, click the Save button. Repeat this
step (Add New Key Management Server button) for each key management server
device to add.

Note: If your key management servers are configured into a leader/follower (active/
passive) relationship and the architecture is such that the follower cannot accept write
requests, do not add the follower into this configuration. The system sends requests

AOS Security | Security Management Using Prism Element (PE) | 65

(read or write) to any configured key management server, so both read and write
access is needed for key management servers added here.

Note: To prevent potential configuration problems, always use the Add Address button
for key management servers configured into cluster mode. Only a stand-alone key
management server should be added as a new server.

Figure 31: Add Key Management Server Screen

c. To edit any settings, click the pencil icon for that entry in the key management server list
to redisplay the add page and then click the Save button after making the change. To
delete an entry, click the X icon.

6. In the Add a New Certificate Authority section, enter a name for the CA, click the Upload CA
Certificate button, and select the certificate for the CA used to sign your node certificates
(see step 3c). Repeat this step for all CAs that were used in the signing process.

Figure 32: Certificate Authority Section

7. Go to the Key Management Server section (see step 4) and do the following:

a. Click the Manage Certificates button for a key management server.

b. In the Manage Signed Certificates screen, upload the node certificates either by clicking
the Upload Files button to upload all the certificates in one step or by clicking the Upload
link (not shown in the figure) for each node individually.
c. Test that the certificates are correct either by clicking the Test all nodes button to test
the certificates for all nodes in one step or by clicking the Test CS (or Re-Test CS) link

AOS Security | Security Management Using Prism Element (PE) | 66

for each node individually. A status of Verified indicates the test was successful for that
node.

Note: Before removing a drive or node from an SED cluster, ensure that the testing is
successful and the status is Verified. Otherwise, the drive or node will be locked.

a. Repeat this step for each key management server.

Note: Before removing a drive or node from an SED cluster, ensure that the testing is
successful and the status is Verified. Otherwise, the drive or node will be locked.

Figure 33: Upload Signed Certificates Screen

AOS Security | Security Management Using Prism Element (PE) | 67

8. When the configuration is complete, click the Protect button on the opening page to enable
encryption protection for the cluster.
A clear key icon appears on the page.

Figure 34: Data-at-Rest Encryption Screen (unprotected)

The key turns gold when cluster encryption is enabled.

Note: If changes are made to the configuration after protection has been enabled, such as
adding a new key management server, you must rekey the disks for the modification to take
full effect (see Changing Key Encryption Keys (SEDs) on page 69).

Figure 35: Data-at-Rest Encryption Screen (protected)

Enabling/Disabling Encryption (SEDs)

Data on a self encrypting drive (SED) is always encrypted, but enabling/disabling data-at-
rest encryption for the cluster determines whether a separate (and secured) key is required to
access that data.

About this task

To enable or disable data-at-rest encryption after it has been configured for the cluster (see
Configuring Data-at-Rest Encryption (SEDs) on page 63), do the following:

Note: The key management server must be accessible to disable encryption.

AOS Security | Security Management Using Prism Element (PE) | 68

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.

2. In the Cluster Encryption page, do one of the following:

» If cluster encryption is enabled currently, click the Unprotect button to disable it.
» If cluster encryption is disabled currently, click the Protect button to enable it.
Enabling cluster encryption enforces the use of secured keys to access data on the SEDs in
the cluster; disabling cluster encryption means the data can be accessed without providing a
key.

Changing Key Encryption Keys (SEDs)

The key encryption key (KEK) can be changed at any time. This can be useful as a periodic
password rotation security precaution or when a key management server or node becomes
compromised. If the key management server is compromised, only the KEK needs to be
changed, because the KEK is independent of the drive encryption key (DEK). There is no need
to re-encrypt any data, just to re-encrypt the DEK.

About this task

To change the KEKs for a cluster, do the following:

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.

AOS Security | Security Management Using Prism Element (PE) | 69

2. In the Cluster Encryption page, select Manage Keys and click the Rekey All Disks button
under Hardware Encryption.
Rekeying a cluster under heavy workloads may result in higher-than-normal IO latency, and
some data may become temporarily unavailable. To continue with the rekey operation, click
Confirm Rekey.
This step resets the KEKs for all the self encrypting disks in the cluster.

Note:

• The Rekey All Disks button appears only when cluster protection is active.
• If the cluster is already protected and a new key management server is added,
you must press the Rekey All Disks button to use this new key management
server for storing secrets.

Figure 36: Cluster Encryption Screen

Destroying Data (SEDs)

Data on a self encrypting drive (SED) is always encrypted, and the data encryption key (DEK)
used to read the encrypted data is known only to the drive controller. All data on the drive can
effectively be destroyed (that is, become permanently unreadable) by having the controller
change the DEK. This is known as a crypto-erase.

About this task

To crypto-erase a SED, do the following:

Procedure

1. In the wen console, go to the Hardware dashboard and select the Diagram tab.

AOS Security | Security Management Using Prism Element (PE) | 70

2. Select the target disk in the diagram (upper section of screen) and then click the Remove
Disk button (at the bottom right of the following diagram).
As part of the disk removal process, the DEK for that disk is automatically cycled on the
drive controller. The previous DEK is lost and all new disk reads are indecipherable. The key
encryption key (KEK) is unchanged, and the new DEK is protected using the current KEK.

Note: When a node is removed, all SEDs in that node are crypto-erased automatically as part
of the node removal process.

Figure 37: Removing a Disk

Data-at-Rest Encryption (Software Only)

For customers who require enhanced data security, Nutanix provides a software-only
encryption option for data-at-rest security (SEDs not required) included in the Ultimate license.

Note: On G6 platforms running the AOS Pro license, you can use software encryption by
installing an add-on license.

Software encryption using a local key manager (LKM) supports the following features:

• For AHV, the data can be encrypted on a cluster level. This is applicable to an empty cluster
or a cluster with existing data.
• For ESXi and Hyper-V, the data can be encrypted on a cluster or container level. The
cluster or container can be empty or contain existing data. Consider the following points for
container level encryption.

• Once you enable container level encryption, you can not change the encryption type to
cluster level encryption later.
• After the encryption is enabled, the administrator needs to enable encryption for every
new container.
• Data is encrypted at all times.
• Data is inaccessible in the event of drive or node theft.
• Data on a drive can be securely destroyed.
• Re-key of the leader encryption key at arbitrary times is supported.
• Cluster’s native KMS is supported.

AOS Security | Security Management Using Prism Element (PE) | 71

Note: In case of mixed hypervisors, only the following combinations are supported.

• ESXi and AHV

• Hyper-V and AHV

Note: This solution provides enhanced security for data on a drive, but it does not secure data in
transit.

Data Encryption Model

To accomplish the above mentioned goals, Nutanix implements a data security configuration
that uses AOS functionality along with the cluster’s native or an external key management
server. Nutanix uses open standards (KMIP protocols) for interoperability and strong security.

Figure 38: Cluster Protection Overview

This configuration involves the following workflow:

• For software encryption, data protection must be enabled for the cluster before any data is
encrypted. Also, the Controller VM must provide the proper key to access the data.
• A symmetric data encryption key (DEK) such as AES 256 is applied to all data being written
to or read from the disk. The key is known only to AOS, so there is no way to access the data
directly from the drive.
• In case of an external KMS:
Each node maintains a set of certificates and keys in order to establish a secure connection
with the key management server.
Only one key management server device is required, but it is recommended that multiple
devices are employed so the key management server is not a potential single point of failure.
Configure the key manager server devices to work in clustered mode so they can be added
to the cluster configuration as a single entity that is resilient to a single failure.

Configuring Data-at-Rest Encryption (Software Only)

Nutanix offers a software-only option to perform data-at-rest encryption in a cluster or
container.

AOS Security | Security Management Using Prism Element (PE) | 72

Before you begin

• Nutanix provides the option to choose the KMS type as the Native KMS (local), Native KMS
(remote), or External KMS.
• Cluster Localised Key Management Service (Native KMS (local)) requires a minimum of 3-
node cluster. 1-node and 2-node clusters are not supported.
• Software encryption using Native KMS is supported for remote office/branch office (ROBO)
deployments using the Native KMS (remote) KMS type.
• For external KMS, a separate key management server is required to store the keys outside
of the cluster. Each key management server device must be configured and addressable
through the network. It is recommended that multiple key manager server devices be
configured to work in clustered mode so they can be added to the cluster configuration as a
single entity that is resilient to a single failure.

CAUTION: DO NOT HOST A KEY MANAGEMENT SERVER VM ON THE ENCRYPTED

CLUSTER THAT IS USING IT!!
Doing so could result in complete data loss if there is a problem with the VM while it
is hosted in that cluster.

Note: To view the supported key management servers, see Supported Key Management
Servers on page 62.

• This feature requires an Ultimate license, or as an Add-On to the PRO license (for the latest
generation of products). Ensure that you have procure the add-on license key to use the
data-at-rest encryption using AOS, contact Sales team to procure the license.
• CAUTION: For security, you can't disable software-only data-at-rest encryption once it is
enabled.

About this task

To configure cluster or container encryption, do the following:

AOS Security | Security Management Using Prism Element (PE) | 73

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the
Settings page.
The Data at Rest Encryption dialog box appears. Initially, encryption is not configured, and
a message to that effect appears.

Figure 39: Data at Rest Encryption Screen (initial)

2. Click the Create Configuration button.

Clicking the Continue Configuration button, configure it link, or Edit Config button does
the same thing, which is display the Data-at-Rest Encryption configuration page

AOS Security | Security Management Using Prism Element (PE) | 74

3. Select the Encryption Type as Encrypt the entire cluster or Encrypt storage containers.
Then click Save Encryption Type.

CAUTION: You can enable encryption for the entire cluster or just the container. However,
if you enable encryption on a container; and there are any encryption key issue like loss of
encryption key, you can encounter the following:

• The entire cluster data is affected, not just the encrypted container.
• All the user VMs of the cluster will not able to access the data.

The hardware option is displayed only when SEDs are detected. Else, software based
encryption type will be used by default.

Figure 40: Select encryption type

Note: For ESXi and Hyper-V, the data can be encrypted on a cluster or container level. The
cluster or container can be empty or contain existing data. Consider the following points for
container level encryption.

To enable encryption for every new storage container, do the following:

a. In the web console, select Storage from the pull-down main menu (upper left of screen)
and then select the Table and Storage Container tabs.
b. To enable encryption, select the target storage container and then click the Update link.
The Update Storage Container window appears.
c. In the Advanced Settings area, select the Enable check box to enable encryption for the
storage container you selected.

AOS Security | Security Management Using Prism Element (PE) | 75

Figure 41: Update storage container
d. Click Save to complete.

AOS Security | Security Management Using Prism Element (PE) | 76

4. Select the Key Management Service.
To keep the keys safe with the native KMS, select Native KMS (local) or Native KMS
(remote) and click Save KMS type. If you select this option, skip to step 9 to complete the
configuration.

Note:

• Cluster Localised Key Management Service (Native KMS (local)) requires a

minimum of 3-node cluster. 1-node and 2-node clusters are not supported.
• For enhanced security of ROBO environments (typically, 1 or 2 node clusters),
select the Native KMS (remote) for software based encryption of ROBO clusters
managed by Prism Central.

Note: This is option is available only if the cluster is registered to Prism Central.

For external KMS type, select the External KMS option and click Save KMS type. Continue
to step 5 for further configuration.

Figure 42: Select KMS Type

Note: You can switch between the KMS types at a later stage if the specific KMS
prerequisites are met, see Switching between Native Key Manager and External Key
Manager on page 83.

AOS Security | Security Management Using Prism Element (PE) | 77

5. In the Certificate Signing Request Information section, do the following:

Figure 43: Certificate Signing Request Section

a. Enter appropriate credentials for your organization in the Email, Organization,

Organizational Unit, Country Code, City, and State fields and then click the Save CSR
Info button.
The entered information is saved and is used when creating a certificate signing request
(CSR). To specify more than one Organization Unit name, enter a comma separated list.

Figure 44: Download CSRs Screen

c. Send the files with the CSRs to the desired certificate authority.
The certificate authority creates the signed certificates and returns them to you. Store
the returned SSL certificates and the CA certificate where you can retrieve them in step
5.

AOS Security | Security Management Using Prism Element (PE) | 78

• The certificates must be X.509 format. (DER, PKCS, and PFX formats are not
supported.)
• The certificate and the private key should be in separate files.

6. In the Key Management Server section, do the following:

Figure 45: Key Management Server Section

a. Click the Add New Key Management Server button.

» If you have configured multiple key management servers in cluster mode, click the
Add Address button to provide the addresses for each key management server
device in the cluster.
» If you have stand-alone key management servers, click the Save button. Repeat this
step (Add New Key Management Server button) for each key management server
device to add.

Note: If your key management servers are configured into a master/slave (active/
passive) relationship and the architecture is such that the follower cannot accept write
requests, do not add the follower into this configuration. The system sends requests

AOS Security | Security Management Using Prism Element (PE) | 79

(read or write) to any configured key management server, so both read and write
access is needed for key management servers added here.

Note: To prevent potential configuration problems, always use the Add Address
button for key management servers configured into cluster mode. Only a stand-alone
key management server should be added as a new server.

Figure 46: Add Key Management Server Screen

7. In the Add a New Certificate Authority section, enter a name for the CA, click the Upload
CA Certificate button, and select the certificate for the CA used to sign your node
certificates (see step 3c). Repeat this step for all CAs that were used in the signing process.

Figure 47: Certificate Authority Section

8. Go to the Key Management Server section (see step 4) and do the following:

a. Click the Manage Certificates button for a key management server.

b. In the Manage Signed Certificates screen, upload the node certificates either by clicking
the Upload Files button to upload all the certificates in one step or by clicking the
Upload link (not shown in the figure) for each node individually.
c. Test that the certificates are correct either by clicking the Test all nodes button to test
the certificates for all nodes in one step or by clicking the Test CS (or Re-Test CS) link

AOS Security | Security Management Using Prism Element (PE) | 80

for each node individually. A status of Verified indicates the test was successful for that
node.
d. Repeat this step for each key management server.

Note: Before removing a drive or node from an SED cluster, ensure that the testing is
successful and the status is Verified. Otherwise, the drive or node will be locked.

Figure 48: Upload Signed Certificates Screen

9. When the configuration is complete, click the Enable Encryption button.

Enable Encryption window is displayed.

Figure 49: Data-at-Rest Encryption Screen (unprotected)

CAUTION: To help ensure that your data is secure, you cannot disable software-only data-
at-rest encryption once it is enabled. Nutanix recommends regularly backing up your data,
encryption keys, and key management server.

10. Enter ENCRYPT.

11. Click Encrypt button.

The data-at-rest encryption is enabled. To view the status of the encrypted cluster or
container, go to Data at Rest Encryption in the Settings menu.
When you enable encryption, a low priority background task runs to encrypt all the
unencrypted data. This task is designed to take advantage of any available CPU space to
encrypt the unencrypted data within a reasonable time. If the system is occupied with other

AOS Security | Security Management Using Prism Element (PE) | 81

workloads, the background task consumes less CPU space. Depending on the amount of
data in the cluster, the background task can take 24 to 36 hours to complete.

Note: If changes are made to the configuration after protection has been enabled, such as
adding a new key management server, you must do the rekey operation for the modification
to take full effect. In case of EKM, rekey to change the KEKs stored in the EKM. In case
of LKM, rekey to change the leader key used by native key manager, see Changing Key
Encryption Keys (Software Only) on page 84) for details.

Note: Once the task to encrypt a cluster begins, you cannot cancel the operation. Even if
you stop and restart the cluster, the system resumes the operation.

Figure 50: Data-at-Rest Encryption Screen (protected)

AOS Security | Security Management Using Prism Element (PE) | 82

Supported Key Management Servers

Table 5: Supported Key Management Server/Software

Vendor KMS

IBM
• IBM Security Key Lifecycle Manager v4.0
• IBM Security Key Lifecycle Manager v3.0.0.1
• IBM Security Key Lifecycle Manager v2.7.0.1
• IBM Security Key Lifecycle Manager
v2.5.0.8

Note: If you are planning to use IBM

SKLM, you must contact Nutanix Support
for assistance and internal documentation
for configuring IBM SKLM to manage
Nutanix keys.

HyTrust KeyControl 4.3.1

Gemalto
• SafeNet KeySecure 460 v8.0.1
• SafeNet Virtual KeySecurek150v
• SafeNet Virtual KeySecurek150v v8.9

Thales eSecurity
• Vormetric Data Security Manager v5.2
(patch 2)
• Vormetric Data Security Manager 6.0.2
• Vormetric Data Security Manager &
Vormetric Transparent Encryption 6.3

Fornetix Key Orchestration 2.1

KeyNexus Unified Key Manager 2

SafeNet Assured Technologies G350v KeySecure 8.6.1

Switching between Native Key Manager and External Key Manager

After Software Encryption has been established, Nutanix supports the ability to switch the
KMS type from the External Key Manager to the Native Key Manager or from the Native Key
Manager to an External Key Manager, without any down time.

Note:

AOS Security | Security Management Using Prism Element (PE) | 83

• The Native KMS requires a minimum of 3-node cluster.
• For external KMS, a separate key management server is required to store the keys
outside of the cluster. Each key management server device must be configured and
addressable through the network. It is recommended that multiple key manager
server devices be configured to work in clustered mode so they can be added to the
cluster configuration as a single entity that is resilient to a single failure.
• It is recommended that you backup and save the encryption keys with identifiable
names before and after changing the KMS type. For backing up keys, see Backing up
Keys on page 87.

To change the KMS type, change the KMS selection by editing the encryption configuration.
For details, see step 3 in Configuring Data-at-Rest Encryption (Software Only) on page 72
section.

Figure 51: Select KMS type

After you change the KMS type and save the configuration, the encryption keys are re-
generated on the selected KMS storage medium and data is re-encrypted with the new keys.
The old keys are destroyed.

Note: This operation completes in a few minutes, depending on the number of encrypted objects
and network speed.

Changing Key Encryption Keys (Software Only)

About this task

To change the KEKs for a cluster, do the following:

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.

AOS Security | Security Management Using Prism Element (PE) | 84

2. In the Cluster Encryption page, select Manage Keys and click the Rekey button under
Software Encryption.

Note: The Rekey button appears only when cluster protection is active.

Note: If the cluster is already protected and a new key management server is added, you
must press the Rekey button to use this new key management server for storing secrets.

Figure 52: Cluster Encryption Screen

Note: The system automatically regenerates the leader key yearly.

Destroying Data (Software Only)

Data on the AOS cluster is always encrypted, and the data encryption key (DEK) used to read
the encrypted data is known only to the AOS. All data on the drive can effectively be destroyed
(that is, become permanently unreadable) by deleting the container or cluster. This is known as
a crypto-erase.

About this task

Note: To help ensure that your data is secure, you cannot disable software-only data-at-rest
encryption once it is enabled. Nutanix recommends regularly backing up your data, encryption
keys, and key management server.

To crypto-erase the container or cluster, do the following:

Procedure

1. Delete the storage container or destroy the cluster.

• For information on how to delete a storage container, see the Web Console Guide.
• For information on how to destroy a cluster, see Acropolis Advanced Administration
Guide.

Note: Curator scans and deletes the DEK and KEK keys automatically after a container has
been deleted automatically.

AOS Security | Security Management Using Prism Element (PE) | 85

2. Delete the exported key, if any.

Switching from SED-EKM to Software-LKM

This section describes the steps to switch from SED and External KMS combination to
software-only and LKM combination.

About this task

To switch from SED-EKM to Software-LKM, do the following.

Procedure

1. Perform the steps for the software-only encryption with External KMS. For more information,
see Configuring Data-at-Rest Encryption (Software Only) on page 72.
After the background task completes, all the data gets encrypted by the software. The time
taken to complete the task depends on the amount of data and foreground I/O operations in
the cluster.

2. Disable the SED encryption. Ensure that all the disks are unprotected.
For more information, see Enabling/Disabling Encryption (SEDs) on page 68.

3. Switch the key management server from the External KMS to Local Key Manager. For more
information, see Switching between Native Key Manager and External Key Manager on
page 83.

Configuring Dual Encryption

About this task

Dual Encryption protects the data on the clusters using both SED and software-only
encryption. An external key manager is used to store the keys for dual encryption, the Native
KMS is not supported.
To configure dual encryption, do the following:

Procedure

1. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.

2. In the Cluster Encryption page, check to enable both Drive-based and Software-based
encryption.

AOS Security | Security Management Using Prism Element (PE) | 86

3. Click Save Encryption Type.

Figure 53: Dual Encryption

4. Continue with the rest of the encryption configuration, see:

• Configuring Data-at-Rest Encryption (Software Only) on page 72

• Configuring Data-at-Rest Encryption (SEDs) on page 63

Backing up Keys

About this task

You can take a backup of encryption keys:

• when you enable Software-only Encryption for the first time

• after you regenerate the keys
Backing up encryption keys is critical in the very unlikely situation in which keys get corrupted.
You can download key backup file for a cluster on a PE or all clusters on a PC. To download key
backup file for all clusters, see Taking a Consolidated Backup of Keys (Prism Central) topic in
this guide.
To download the key backup file for a cluster, do the following:

Procedure

1. Log on to the Prism Element web console.

2. Click the gear icon in the main menu and then select Data at Rest Encryption in the Settings
page.

3. In the Cluster Encryption page, select Manage Keys.

4. Enter and confirm the password.

5. Click the Download Key Backup button.

The backup file is saved in the default download location on your local machine.

Note: Ensure you move the backup key file to a safe location.

AOS Security | Security Management Using Prism Element (PE) | 87

Taking a Consolidated Backup of Keys (Prism Central)
If you are using the Native KMS option with software encryption for your clusters, you can take
a consolidated backup of all the key from Prism Central.

About this task

To take a consolidated backup of keys for software encryption-enabled clusters (Native KMS-
only), do the following.

Procedure

1. Log on to the Prism Central instance to which the clusters are registered.

2. Click the hamburger icon and then select Clusters > List view.

3. Select a cluster, go to Actions and select Download Encryption Keys.

Figure 54: Select KMS Type

The backup file is saved in the default download location on your local machine.

Note: Ensure you move the backup key file to a safe location.

Importing Keys
You can import the encryption keys from backup. You must note the specific commands in this
topic if you backed up your keys to an external key manager (EKM)

About this task

Note: Nutanix recommends that you contact Nutanix Support for this operation. Extended
cluster downtime might result if you perform this task incorrectly.

Procedure

1. Log on to any Controller VM in the cluster with SSH.

2. Retrieve the encryption keys stored on the cluster and verify that all the keys you want to
retrieve are listed.
In this example, the password is Nutanix.123. date is the timestamp portion of the backup file
name.
mantle_recovery_util --backup_file_path=/home/nutanix/encryption_key_backup_date \
--password=Nutanix.123 --list_key_ids=true

3. Import the keys into the cluster.

mantle_recovery_util --backup_file_path=/home/nutanix/key_backup \

AOS Security | Security Management Using Prism Element (PE) | 88

--password=Nutanix.123 --interactive_mode

4. If you are using an external key manager such as IBM Security Key Lifecycle Manager,
Gemalto Safenet, or Vormetric Data Security Manager, use the --store_kek_remotely option
to import the keys into the cluster.
In this example, date is the timestamp portion of the backup file name.
mantle_recovery_util --backup_file_path path/encryption_key_backup_date \
--password key_password --store_kek_remotely

Securing Traffic Through Network Segmentation

Network segmentation enhances security, resilience, and cluster performance by isolating a
subset of traffic to its own network.
You can achieve traffic isolation in one or more of the following ways:
Isolating Backplane Traffic by using VLANs (Logical Segmentation)
You can separate management traffic from storage replication (or backplane) traffic by
creating a separate network segment (LAN) for storage replication. For more information
about the types of traffic seen on the management plane and the backplane, see Traffic
Types In a Segmented Network on page 90.
To enable the CVMs in a cluster to communicate over these separated networks, the
CVMs are multihomed. Multihoming is facilitated by the addition of a virtual network
interface card (vNIC) to the Controller VM and placing the new interface on the
backplane network. Additionally, the hypervisor is assigned an interface on the backplane
network.
The traffic associated with the CVM interfaces and host interfaces on the backplane
network can be secured further by placing those interfaces on a separate VLAN.
In this type of segmentation, both network segments continue to use the same external
bridge and therefore use the same set of physical uplinks. For physical separation, see
Physically Isolating the Backplane Traffic on an AHV Cluster on page 99.
Isolating backplane traffic from management traffic requires minimal configuration
through the Prism web console. No manual host (hypervisor) configuration steps are
required.
For information about isolating backplane traffic, see Isolating the Backplane Traffic
Logically on an Existing Cluster (VLAN-Based Segmentation Only) on page 95.
Isolating Backplane Traffic Physically (Physical Segementation)
You can physically isolate the backplane traffic (intra cluster traffic) from the
management traffic (Prism, SSH, SNMP) in to a separate vNIC on the CVM and using
a dedicated virtual network that has its own physical NICs. This type of segmentation
therefore offers true physical separation of the backplane traffic from the management
traffic.
You can use Prism to configure the vNIC on the CVM and configure the backplane traffic
to communicate over the dedicated virtual network. However, you must first manually
configure the virtual network on the hosts and associate it with the physical NICs that it
requires for true traffic isolation.
See Physically Isolating the Backplane Traffic on an AHV Cluster on page 99 for more
information about physically isolating backplane traffic.

AOS Security | Security Management Using Prism Element (PE) | 89

Isolating service-specific traffic
You can also secure traffic associated with a service (for example, Nutanix Volumes) by
confining its traffic to a separate vNIC on the CVM and using a dedicated virtual network
that has its own physical NICs. This type of segmentation therefore offers true physical
separation for service-specific traffic.
You can use Prism to create the vNIC on the CVM and configure the service to
communicate over the dedicated virtual network. However, you must first manually
configure the virtual network on the hosts and associate it with the physical NICs that it
requires for true traffic isolation.You need one virtual network for each service you want
to isolate. For a list of the services whose traffic you can isolate in the current release, see
Cluster Services That Support Traffic Isolation on page 93.
For information about isolating service-specific traffic, see Isolating Service-Specific
Traffic on page 105.
Isolating Stargate-to-Stargate traffic over RDMA
Some Nutanix platforms support remote direct memory access (RDMA) for Stargate-to-
Stargate service communication. You can create a separate virtual network for RDMA-
enabled network interface cards. If a node has RDMA-enabled NICs, Foundation passes
the NICs through to the CVMs during imaging. The CVMs use only the first of the two
RDMA-enabled NICs for Stargate-to-Stargate communications. The virtual NIC on the
CVM is named rdma0. Foundation does not configure the RDMA LAN. After creating
a cluster, you need to enable RDMA by creating an RDMA LAN from the Prism web
console. For information on RDMA support, see the Nutanix Hardware Administration
Guide.
For information about isolating backplane traffic on an RDMA cluster, see Isolating the
Backplane Traffic on an Existing RDMA Cluster on page 97.

Traffic Types In a Segmented Network

The traffic entering and leaving a Nutanix cluster can be broadly classified into the following
types:
Backplane traffic
Backplane traffic is intra-cluster traffic that is necessary for the cluster to function, and it
comprises traffic between CVMs and traffic between CVMs and hosts for functions such
as storage RF replication, host management, high availability, and so on. This traffic uses
eth2 on the CVM. For nodes that have RDMA-enabled NICs, the CVMs use a separate
RDMA LAN for Stargate-to-Stargate communications.
Management traffic
Management traffic is administrative traffic, or traffic associated with Prism and SSH
connections, remote logging, SNMP, and so on. The current implementation simplifies the
definition of management traffic to be any traffic that is not on the backplane network,
and therefore also includes communications between user VMs and CVMs. This traffic
uses eth0 on the CVM.
Traffic on the management plane can be further isolated per service or feature. An
example of this type of traffic is the traffic that the cluster receives from external iSCSI
initiators (Nutanix Volumes iSCSI traffic). For a list of services supported in the current
release, see Cluster Services That Support Traffic Isolation on page 93.

Segmented and Unsegmented Networks

In the default, unsegmented network in a Nutanix cluster, the Controller VM has two virtual
network interfaces—eth0 and eth1. Interface eth0 is connected to the built-in external virtual
switch, which is in turn connected to the external network through a bond or NIC team that

AOS Security | Security Management Using Prism Element (PE) | 90

contains the host’s physical uplinks. Interface eth1 is connected to an internal network that
enables the CVM to communicate with the hypervisor. In this network, all traffic, whether
backplane traffic or management traffic, uses interface eth0. These interfaces are on the default
VLAN on the virtual switch.

Figure 55: Unsegmented Network

In a segmented network, management traffic uses interface eth0 and the backplane traffic uses
interface eth2. The backplane network uses either the default VLAN or, optionally, a separate
VLAN that you specify when segmenting the network.
The following diagram shows the two virtual networks. (Note that the RDMA LAN is not
illustrated in the diagram.)

Figure 56: Segmented Network

AOS Security | Security Management Using Prism Element (PE) | 91

If you further isolate service-specific traffic, additional vNICs are created on the CVM. Each
service requiring isolation is assigned a dedicated virtual NIC on the CVM. The NICs are named
ntnx0, ntnx1, and so on. Each service-specific NIC is placed on a configurable existing or new
virtual network (vSwitch or bridge) and a VLAN and IP subnet are specified.

Implementation Considerations

Supported Environment
Network segmentation is supported in the following environment:

• The hypervisor must be one of the following:

• For network segmentation by traffic type (separating backplane traffic from management
traffic):

• AHV
• ESXi
• Hyper-V

Note: Only logical segmentation (or VLAN-based segmentation) is supported on

Hyper-V. Physical network segmentation is not supported on Hyper-V.

• For service-specific traffic isolation:

• AHV
• ESXi
• For logical network segmentation, AOS version must be 5.5 or later. For physical
segmentation and service-specific traffic isolation, the AOS version must be 5.11 or later.
• From the 5.11.1 release, you cannot enable network segmentation on mixed-hypervisor
clusters. However, if you enable network segmentation on a mixed-hypervisor cluster
running a release earlier than 5.11.1 and you upgrade that cluster to 5.11.1 or later, network
segmentation continues to work seamlessly.
• RDMA requirements:

• Network segmentation is supported with RDMA for AHV and ESXi hypervisors only.
• For the NX-9030-G5 platform, each node must have two Mellanox CX-3 Pro network
cards.
• For G6 platforms, each node must have two Mellanox CX-4 network cards. (For this
reason, RDMA is not supported on platforms that have only one NIC per node.)
• For more information on RDMA, see the Nutanix Hardware Administration Guide.

Prerequisites

For Nutanix Volumes

Stargate does not monitor the health of a segmented network. If physical network
segmentation is configured, network failures or connectivity issues are not tolerated. To
overcome this issue, configure redundancy in the network. That is, use two or more uplinks in a
fault tolerant configuration, connected to two separate physical switches.

AOS Security | Security Management Using Prism Element (PE) | 92

For Disaster Recovery

• Ensure that the VLAN and subnet that you plan to use for the network segment are routable.
• Make sure that you have a pool of IP addresses to specify when configuring segmentation.
For each cluster, you need n+1 IP addresses, where n is the number of nodes in the cluster.
The additional IP address is for the virtual IP address requirement.
• Enable network segmentation for disaster recovery at both sites (local and remote) before
configuring remote sites at those sites.

Limitations

For Nutanix Volumes

• If network segmentation is enabled for Volumes, volume group attachments are not
recovered during VM recovery.
• Nutanix service VMs such as Files and Buckets continue to communicate with the CVM eth0
interface when using Volumes for iSCSI traffic. Other external clients use the new service-
specific CVM interface.

Cluster Services That Support Traffic Isolation

In this release, you can isolate traffic associated with the following services to its own virtual
network:

• Nutanix Volumes iSCSI traffic

• Disaster recovery

Configurations in Which Network Segmentation Is Not Supported

Network segmentation is not supported in the following configurations:

• Clusters on which the CVMs have a manually created eth2 interface.

• Clusters on which the eth2 interface on one or more CVMs have been assigned an IP address
manually. During an upgrade to an AOS release that supports network segmentation, an
eth2 interface is created on each CVM in the cluster. Even though the cluster does not use
these interfaces until you configure network segmentation, you must not manually configure
these interfaces in any way.

Note: If you have configured an eth2 interface on the CVM manually, to make the cluster
compatible with the requirements for enabling network segmentation, remove the eth2 interface
before upgrading to an AOS version that supports network segmentation.

Configuring the Network on an AHV Host

These steps describe how to configure host networking for physical and service-specific
network segmentation on an AHV host. These steps are prerequisites for physical and service-
specific network segmentation and you must perform these steps before you perform physical
or service-specific traffic isolation. If you are configuring networking on an ESXi host, perform
the equivalent steps by referring to the ESXi documentation. On ESXi, you create vSwitches
and port groups to achieve the same results.

About this task

For information about the procedures to create, update and delete a virtual switch in Prism
Element Web Console, see the Configuring a Virtual Network for Guest VMs section in the Prism
Web Console Guide.

AOS Security | Security Management Using Prism Element (PE) | 93

Note: The term unconfigured node in this procedure refers to a node that is not part of a cluster
and is being prepared for cluster expansion.

To configure host networking for physical and service-specific network segmentation, do the
following:

Note: If you are segmenting traffic on nodes that are already part of a cluster, perform the first
step. If you are segmenting traffic on an unconfigured node that is not part of a cluster, perform
the second step directly.

Procedure

1. If you are segmenting traffic on nodes that are already part of a cluster, do the following:

a. From the default virtual switch vs0, remove the uplinks that you want to add to the virtual
switch you created by updating the default virtual switch.
For information about updating the default virtual switch vs0 to remove the uplinks, see
the Creating or Updating a Virtual Switch section in the Prism Web Console Guide.
b. Create a virtual switch for the backplane traffic or service whose traffic you want to
isolate.
Add the uplinks to the new virtual switch.
For information about creating a new virtual switch, see the Creating or Updating a Virtual
Switch section in the Prism Web Console Guide.

2. If you are segmenting traffic on an unconfigured node (new host) that is not part of a
cluster, do the following:

a. Create a bridge for the backplane traffic or service whose traffic you want to isolate by
logging on to the new host.
ovs-vsctl add-br br1

b. From the default bridge br0, log on to the host and remove the uplinks that you want to
add to the bridge you created.
ovs-vsctl del-port br0 br0-up -- add-bond br0 br0-up eth0 eth1

c. Log on to the host and then add the uplinks and bond to the bridge.
ovs-vsctl add-bond br1 br1-up eth2 eth3

Note: If this step is not done correctly, a network loop can be created that causes a
network outage. Ensure that no other uplink interfaces exist on this bridge before adding
the new interfaces, and always add interfaces into a bond.

What to do next
Prism can configure a VLAN only on AHV hosts. Therefore, if the hypervisor is ESXi, in addition
to configuring the VLAN on the physical switch, make sure to configure the VLAN on the port
group.
If you are performing physical network segmentation, see Physically Isolating the Backplane
Traffic on an AHV Cluster on page 99.
If you are performing service-specific traffic isolation, see Service-Specific Traffic Isolation on
page 105.

AOS Security | Security Management Using Prism Element (PE) | 94

Network Segmentation for Traffic Types (Backplane, Management, and RDMA)
You can segment the network on a Nutanix cluster in the following ways:

• You can segment the network on an existing cluster by using the Prism web console.
• You can segment the network when creating a cluster by using Nutanix Foundation 3.11.2 or
higher versions.
The following topics describe network segmentation procedures for existing clusters and
changes during AOS upgrade and cluster expansion. For more information about segmenting
the network when creating a cluster, see the Field Installation Guide.

Isolating the Backplane Traffic Logically on an Existing Cluster (VLAN-Based Segmentation

Only)
You can segment the network on an existing cluster by using the Prism web console. The
network segmentation process creates a separate network for backplane communications on
the existing default virtual switch and places the eth2 interfaces (that are created on the CVMs
during upgrade) and the host interfaces on the newly created network. This method allows you
to achieve logical segmentation of traffic over the selected VLAN. From the specified subnet,
IP addresses are assigned to each new interface. Two IP addresses are therefore required
per node. If you specify the optional VLAN ID, the newly created interfaces are placed on the
VLAN. You must configure a separate VLAN for the backplane network to achieve logical
segmentation.

Before you begin

If your cluster has RDMA-enabled NICs, follow the procedure in Isolating the Backplane Traffic
on an Existing RDMA Cluster on page 97.

• Ensure that you create port groups on the backplane virtual switch for the host and CVM.
For example, on an ESXi host, create a port group each for host and CVM on the backplane
vSwitch.
• For new backplane networks, you must specify a non-routable subnet. The interfaces on the
backplane network are automatically assigned IP addresses from this subnet, so reserve the
entire subnet for the backplane network alone.
• Make sure that the VLAN for the backplane network is configured on the physical switch
ports to which the nodes are connected.

About this task

Typically, VLAN 100 and VLAN 200 are configured on the Ethernet links that connect Nutanix
nodes to the physical switch.

Note: It is not mandatory to configure these VLAN IDs. Nutanix does not control these VLAN IDs.
Consult your networking team to acquire these VLANs or any other available VLANs for usage
with Nutanix nodes.

To segment the network on an existing cluster for a backplane LAN, do the following:

Procedure

1. Log on to the Prism web console, click the gear icon in the top-right corner, and then click
Network Configuration in the Settings page.
The Network Configuration dialog box is displayed.

2. On the Controller VM Interfaces tab, in the Backplane LAN row, click Configure.
The Create Interface dialog box is displayed.

AOS Security | Security Management Using Prism Element (PE) | 95

3. In the Create Interface dialog box, do the following:

a. In Subnet IP, specify a non-routable subnet.

Make sure that the subnet has a sufficient number of IP addresses. Two IP addresses
are required per node. Reconfiguring the backplane to increase the size of the subnet
involves cluster downtime, so you might also want to make sure that the subnet can
accommodate new nodes in the future.
b. In Netmask, specify the netmask.
c. If you want to assign the interfaces on the network to a VLAN, specify the VLAN ID in
VLAN ID.
A VLAN is strongly recommended. If you do not specify a VLAN ID, the default VLAN on
the virtual switch is implied.

4. Click Verify and Save.

If the network settings you specified pass validation, the backplane network is created and
the CVMs perform a reboot in a rolling fashion (one at a time), after which the services use
the new backplane network. The progress of this operation can be tracked on the Prism
tasks page.

Note: Segmenting backplane traffic can involve up to two rolling reboots of the CVMs. The
first rolling reboot is done to move the backplane interface (eth2) of the CVM to the selected
port group or bridge. This is done only for CVM(s) whose backplane interface is not already
connected to the selected port group or bridge. The second rolling reboot is done to migrate
the cluster services to the newly configured backplane interface.

5. Restart the Acropolis service on all the nodes in the cluster.

Note: Perform this step only if your AOS version is 5.17.0.x. This step is not required if your
AOS version is 5.17.1 or later.

a. Log on to any CVM in the cluster with SSH.

b. Stop the Acropolis service.
nutanix@cvm$ allssh genesis stop acropolis

Note: You cannot manage your guest VMs after the Acropolis service is stopped.

c. Verify if the Acropolis service is DOWN on all the CVMs.

nutanix@cvm$ cluster status | grep -v UP

An output similar to the following is displayed:

nutanix@cvm$ cluster status | grep -v UP

2019-09-04 14:43:18 INFO zookeeper_session.py:143 cluster is attempting to connect to

Zookeeper

2019-09-04 14:43:18 INFO cluster:2774 Executing action status on SVMs X.X.X.1, X.X.X.2,
X.X.X.3

The state of the cluster: start

Lockdown mode: Disabled

CVM: X.X.X.1 Up
Acropolis DOWN []

AOS Security | Security Management Using Prism Element (PE) | 96

CVM: X.X.X.2 Up, ZeusLeader
Acropolis DOWN []
CVM: X.X.X.3 Maintenance

d. From any CVM in the cluster, start the Acropolis service.

nutanix@cvm$ cluster start

In this method, port groups are not specified so logical segmentation (VLAN-based
segmentation) is done on the default vSwitch (ESXi) or bridge (AHV). The process creates
host backplane interface on the Backplane Network port group on ESXi or br1-backplane on
AHV. The eth2 interface on the CVM is on CVM Backplane Network by default.

Isolating the Backplane Traffic on an Existing RDMA Cluster

Segment the network on an existing RDMA cluster by using the Prism web console.

About this task

The network segmentation process creates a separate network for RDMA communications on
the existing default virtual switch and places the rdma0 interface (created on the CVMs during
upgrade) and the host interfaces on the newly created network. From the specified subnet,
IP addresses are assigned to each new interface. Two IP addresses are therefore required per
node. If you specify the optional VLAN ID, the newly created interfaces are placed on the VLAN.
A separate VLAN is highly recommended for the RDMA network to achieve true segmentation.

Before you begin

• For new RDMA networks, you must specify a non-routable subnet. The interfaces on the
backplane network are automatically assigned IP addresses from this subnet, so reserve the
entire subnet for the backplane network alone.
• If you plan to specify a VLAN for the RDMA network, make sure that the VLAN is configured
on the physical switch ports to which the nodes are connected.
• Configure the switch interface as a Trunk port.

Procedure

1. Log on to the Prism web console, click the gear icon in the top-right corner, and then click
Network Configuration in the Settings page.
The Network Configuration dialog box is displayed.

2. Click the Internal Interfaces tab.

AOS Security | Security Management Using Prism Element (PE) | 97

3. Click Configure in the RDMA row.
Ensure that you have configured the switch interface as a trunk port.
The Create Interface dialog box is displayed.

Figure 57: Create Interface Dialog Box

AOS Security | Security Management Using Prism Element (PE) | 98

4. In the Create Interface dialog box, do the following:

a. In Subnet IP and Netmask, specify a non-routable subnet and netmask, respectively. Make
sure that the subnet can accommodate cluster expansion in the future.
b. In VLAN, specify a VLAN ID for the RDMA LAN.
A VLAN ID is optional but highly recommended for true network segmentation and
enhanced security.
c. c. From the PFC list, select the priority flow control value configured on the physical
switch port.

5. Click Verify and Save.

6. Click Close.

Physically Isolating the Backplane Traffic on an Existing Cluster

By using the Prism web console, you can configure the eth2 interface on a separate virtual
switch if you wish to isolate the backplane traffic to a separate physical network.
If you do not configure as separate virtual switch, the backplane traffic uses another VLAN in
the default switch for VLAN-based traffic isolation.
A virtual switch is known as the following in different hypervisors.

Hypervisor Virtual Switch

AHV Virtual Switch

ESXi vSwitch

Hyper-V Hyper-V Virtual Switch

Network segmentation process creates a separate network for backplane communications on

the new virtual switch. The segmentation process places the CVM eth2 interfaces and the host
interfaces on the newly created network. Specify a subnet with a network mask and, optionally,
a VLAN ID. From the specified subnet, assign IP addresses to each new interface in the new
network. You require a minimum of two IP addresses per node.
If you specify the optional VLAN ID, the newly created interfaces are placed on VLAN.
Nutanix highly recommends a separate VLAN for the backplane network to achieve true
segmentation.

Requirements and Limitations

• Ensure that physical isolation of backplane traffic is supported by the AOS version deployed.
• Ensure that you configure the network (port groups or bridges) on the hosts and associate
the network with the required physical NICs before you enable physical isolation of the
backplane traffic.
For AHV, see Configuring the Network on an AHV Host on page 93. For ESXI and Hyper-
V, see VMware and Microsoft documentation respectively.

Physically Isolating the Backplane Traffic on an AHV Cluster

Before you begin

On the AHV hosts, do the following:

AOS Security | Security Management Using Prism Element (PE) | 99

1. From the default virtual switch vs0, remove the uplinks (physical NICs) that you want to add
to a new virtual switch you create for the backplane traffic in the next step.
2. Create a virtual switch for the backplane traffic.
Add the uplinks to the new bond when you create the new virtual switch.
See Configuring the Network on an AHV Host on page 93 for instructions about how to
perform these tasks on a host.

Note: Before you perform the following procedure, ensure that the uplinks you added to the
virtual switch are in the UP state.

About this task

Perform the following procedure to physically segment the backplane traffic.

Procedure

1. Log on to the Prism web console, click the gear icon in the top-right corner, and then click
Network Configuration in the Settings page.

2. On the Controller VM Interfaces tab, in the Backplane LAN row, click Configure.

3. In the Backplane LAN dialog box, do the following:

a. In Subnet IP, specify a non-routable subnet that is different from the subnet used by the
AHV host and CVMs.
The AOS CVM default route uses the CVM eth0 interface, and there is no route on the
backplane interface. Therefore, Nutanix recommends only using a non-routable subnet
for the backplane network. To avoid split routing, do not use a routable subnet for the
backplane network.
Make sure that the backplane subnet has a sufficient number of IP addresses. Two IP
addresses are required per node. Reconfiguring the backplane to increase the size of the
subnet involves cluster downtime, so you might also want to make sure that the subnet
can accommodate new nodes in the future.
b. In Netmask, specify the network mask.
c. If you want to assign the interfaces on the network to a VLAN, specify the VLAN ID in the
VLAN ID field.
Nutanix strongly recommends configuring a separate VLAN. If you do not specify a VLAN
ID, AOS applies the untagged VLAN on the virtual switch.
d. In the Virtual Switch list, select the virtual switch you created for the backplane traffic.

4. Click Verify and Save.

Note: Segmenting backplane traffic can involve up to two rolling reboots of the CVMs. The
first rolling reboot is done to move the backplane interface (eth2) of the CVM to the selected
port group or virtual switch. This is done only for CVM(s) whose backplane interface is not
already connected to the selected port group or bridge virtual switch. The second rolling
reboot is done to migrate the cluster services to the newly configured backplane interface.

AOS Security | Security Management Using Prism Element (PE) | 100

Physically Isolating the Backplane Traffic on an ESXi Cluster

Before you begin

On the ESXi hosts, do the following:
1. Create a vSwitch for the backplane traffic.
2. From vSwitch0, remove the uplinks (physical NICs) that you want to add to the vSwitch you
created for the backplane traffic.
3. On the backplane vSwitch, create one port group for the CVM and another for the host.
Ensure that at least one uplink is present in the Active Adaptors list for each port group if
you have overridden the failover order.
See the ESXi documentation for instructions about how to perform these tasks.

Note: Before you perform the following procedure, ensure that the uplinks you added to the
vSwitch are in the UP state.

About this task

Perform the following procedure to physically segment the backplane traffic.

Procedure

1. Log on to the Prism web console, click the gear icon in the top-right corner, and then click
Network Configuration in the Settings page.

2. On the Controller VM Interfaces tab, in the Backplane LAN row, click Configure.

3. In the Backplane LAN dialog box, do the following:

a. In Subnet IP, specify a non-routable subnet.

If you do not specify a secure non-routable subnet, AHV uses the routable subnet on the
default gateway. AOS does not route packets from the backplane network. Therefore,
Nutanix recommends only using a secure non-routable subnet for the backplane network.
Do not use a routable subnet for this purpose.
Make sure that the subnet has a sufficient number of IP addresses. Two IP addresses
are required per node. Reconfiguring the backplane to increase the size of the subnet
involves cluster downtime, so you might also want to make sure that the subnet can
accommodate new nodes in the future.
b. In Netmask, specify the network mask.
c. If you want to assign the interfaces on the network to a VLAN, specify the VLAN ID in the
VLAN ID field.
Nutanix strongly recommends configuring a separate VLAN. If you do not specify a VLAN
ID, AOS applies the default VLAN on the virtual switch.
d. In the Host Port Group list, select the port group you created for the host.
e. In the CVM Port Group list, select the port group you created for the CVM.

Note:
Nutanix clusters support both vSphere Standard Switches and vSphere Distributed
Switches. However, you must mandatorily configure only one type of virtual
switches in one cluster. Configure all the backplane and management traffic in one
cluster on either vSphere Standard Switches or vSphere Distributed Switches. Do
not mix Standard and Distributed vSwitches on a single cluster.

AOS Security | Security Management Using Prism Element (PE) | 101

4. Click Verify and Save.
If the network settings you specified pass validation, the backplane network is created and
the CVMs perform a reboot in a rolling fashion (one at a time), after which the services use
the new backplane network. The progress of this operation can be tracked on the Prism
tasks page.

Physically Isolating the Backplane Traffic on a Hyper-V Cluster

Before you begin

On the Hyper-V hosts, do the following:
1. Create a Hyper-V Virtual Switch for the backplane traffic.
2. From the default External Switch, remove the uplinks (physical NICs) that you want to add
to the backplane Virtual Switch you created for the backplane traffic.
3. On the backplane Virtual Switch, create a subnet and, optionally, assign a VLAN.
See the Hyper-V documentation for instructions about how to perform these tasks.

Note: Before you perform the following procedure, ensure that the uplinks you added to the
backplane Virtual Switch are in the UP state.

About this task

Perform the following procedure to physically segment the backplane traffic.

Procedure

1. Log on to the Prism web console, click the gear icon in the top-right corner, and then click
Network Configuration in the Settings page.

2. On the Controller VM Interfaces tab, in the Backplane LAN row, click Configure.

3. In the Backplane LAN dialog box, do the following:

a. In Subnet IP, specify a non-routable subnet.

AOS Security | Security Management Using Prism Element (PE) | 102

involves cluster downtime, so you might also want to make sure that the subnet can
accommodate new nodes in the future.
b. In Netmask, specify the network mask.
c. If you want to assign the interfaces on the network to a VLAN, specify the VLAN ID in the
VLAN ID field.
Nutanix strongly recommends configuring a separate VLAN. If you do not specify a VLAN
ID, AOS applies the default VLAN on the virtual switch.
d. In the Bridge list, select the bridge you created for the backplane traffic.

4. Click Verify and Save.

Note: Segmenting backplane traffic can involve up to two rolling reboots of the CVMs. The
first rolling reboot is done to move the backplane interface (eth2) of the CVM to the selected
port group or virtual switch. This is done only for CVM(s) whose backplane interface is not
already connected to the selected port group or bridge virtual switch. The second rolling
reboot is done to migrate the cluster services to the newly configured backplane interface.

Reconfiguring the Backplane Network

Backplane network reconfiguration is a CLI-driven procedure that you perform on any one of
the CVMs in the cluster. The change is propagated to the remaining CVMs.

About this task

CAUTION: At the end of this procedure, the cluster stops and restarts, even if only the VLAN is
changed, and therefore involves cluster downtime.

To reconfigure the cluster, do the following:

Procedure

1. Log on to any CVM in the cluster using SSH.

2. Reconfigure the backplane network.

nutanix@cvm$ backplane_ip_reconfig [--backplane_vlan=vlan-id] \
[--backplane_subnet=subnet_ip_address --backplane_netmask=netmask]

Replace vlan-id with the new VLAN ID, subnet_ip_address with the new subnet IP address,
and netmask with the new netmask.
For example, reconfigure the backplane network to use VLAN ID 10 and subnet 172.30.25.0
with netmask 255.255.255.0.
nutanix@cvm$ backplane_ip_reconfig --backplane_vlan=10 \
--backplane_subnet=172.30.25.0 --backplane_netmask=255.255.255.0

Output similar to the following is displayed:

This operation will do a 'cluster stop', resulting in disruption of
cluster services. Do you still want to continue? (Type "yes" (without quotes)
to continue)

AOS Security | Security Management Using Prism Element (PE) | 103

Type yes to confirm that you want to reconfigure the backplane network.

CAUTION: During the reconfiguration process, you might receive an error message similar to
the following.
Failed to reach a node.
You can safely ignore this error message and therefore do not stop the script manually.

Note: The backplane_ip_reconfig command is not supported on ESXi clusters with vSphere
Distributed Switches. To reconfigure the backplane network on a vSphere Distributed
Switch setup, disable the backplane network (see Disabling Network Segmentation on
page 104) and enable again with a different subnet or VLAN.

3. Type yes to confirm that you want to reconfigure the backplane network.
The reconfiguration procedure takes a few minutes and includes a cluster restart. If you type
anything other than yes, network reconfiguration is aborted.

4. After the process completes, verify that the backplane was reconfigured.

a. Verify that the IP addresses of the eth2 interfaces on the CVM are set correctly.
nutanix@cvm$ svmips -b

Output similar to the following is displayed:

172.30.25.1 172.30.25.3 172.30.25.5

b. Verify that the IP addresses of the backplane interfaces of the hosts are set correctly.
nutanix@cvm$ hostips -b

Output similar to the following is displayed:

172.30.25.2 172.30.25.4 172.30.25.6

The svmips and hostips commands, when used with the option b, display the IP addresses
assigned to the interfaces on the backplane.

Disabling Network Segmentation

Backplane network reconfiguration is a CLI-driven procedure that you perform on any one of
the CVMs in the cluster. The change is propagated to the remaining CVMs.

About this task

To disable network segmentation, do the following:

Procedure

1. Log on to any CVM in the cluster using SSH.

2. Disable the backplane network.

CAUTION: If you use the following command, the cluster stops and restarts, and therefore
involves cluster downtime. Therefore, use the following command only if there are no VMs
running in your cluster, or in non-production clusters.

nutanix@cvm$ backplane_network_disable

Output similar to the following is displayed:

This operation will do a 'cluster stop', resulting in disruption of cluster
services. Do you want to continue? (Type "yes" (without quotes) to continue)
Type yes to confirm that you want to disable network segmentation.

AOS Security | Security Management Using Prism Element (PE) | 104

If you type yes, network segmentation is disabled and the cluster is restarted.

3. Verify that network segmentation was successfully disabled. You can verify this in one of
two ways:

» Verify that the backplane is disabled.

nutanix@cvm$ network_segment_status

Output similar to the following is displayed:

2017-11-23 06:18:23 INFO zookeeper_session.py:110 network_segment_status is
attempting to connect to Zookeeper
Network segmentation is disabled

» Verify that the commands to show the backplane IP addresses of the CVMs and hosts
list the management IP addresses (run the svmips and hostips commands once without
the b option and once with the b option, and then compare the IP addresses shown in the
output).
nutanix@cvm$ svmips
192.0.2.2 192.0.2.3 192.0.2.4
nutanix@cvm$ svmips -b
192.0.2.2 192.0.2.3 192.0.2.4
nutanix@cvm$ hostips
192.0.2.5 192.0.2.6 192.0.2.7
nutanix@cvm$ hostips -b
192.0.2.5 192.0.2.6 192.0.2.7

In the example above, the outputs of the svmips and hostips commands with and
without the b option are the same, indicating that the backplane network segmentation is
disabled.

Service-Specific Traffic Isolation

Isolating the traffic associated with a specific service is a two-step process. The process is as
follows:

• Configure the networks and uplinks on each host manually. Prism only creates the VNIC that
the service requires, and it places that VNIC on the bridge or port group that you specify.
Therefore, you must manually create the bridge or /port group on each host and add the
required physical NICs as uplinks to that bridge or port group.
• Configure network segmentation for the service by using Prism. Create an extra VNIC for the
service, specify any additional parameters that are required (for example, IP address pools),
and the bridge or port group that you want to dedicate to the service.

Isolating Service-Specific Traffic

Before you begin

• Ensure to configure each host as described in Configuring the Network on an AHV Host on
page 93.
• Review Prerequisites on page 92.

About this task

To isolate a service to a separate virtual network, do the following:

AOS Security | Security Management Using Prism Element (PE) | 105

Procedure

1. Log on to the Prism web console and click the gear icon at the top-right corner of the page.

2. In the left pane, click Network Configuration.

3. In the details pane, on the Internal Interfaces tab, click Create New Interface.
The Create New Interface dialog box is displayed.

4. On the Interface Details tab, do the following:

a. Specify a descriptive name for the network segment.

b. (On AHV) Optionally, in VLAN ID, specify a VLAN ID.
Make sure that the VLAN ID is configured on the physical switch.
c. In Bridge (on AHV) or CVM Port Group (on ESXi), select the bridge or port group that
you created for the network segment.
d. To specify an IP address pool for the network segment, click Create New IP Pool, and
then, in the IP Pool dialog box, do the following:

• In Name, specify a name for the pool.

• In Netmask, specify the network mask for the pool.
• Click Add an IP Range, specify the start and end IP addresses in the IP Range dialog
box that is displayed.
• Use Add an IP Range to add as many IP address ranges as you need.

Note: Add at least n+1 IP addresses in an IP range considering n is the number of nodes
in the cluster.

• Click Save.
• Use Add an IP Pool to add more IP address pools. You can use only one IP address
pool at any given time.
• Select the IP address pool that you want to use, and then click Next.

Note: You can also use an existing unused IP address pool.

5. On the Feature Selection tab, do the following:

You cannot enable network segmentation for multiple services at the same time. Complete
the configuration for one service before you enable network segmentation for another
service.

a. Select the service whose traffic you want to isolate.

b. Configure the settings for the selected service.
The settings on this page depend on the service you select. For information about
service-specific settings, see Service-Specific Settings and Configurations on page 108.
c. Click Save.

6. In the Create Interface dialog box, click Save.

The CVMs are rebooted multiple times, one after another. This procedure might trigger
more tasks on the cluster. For example, if you configure network segmentation for disaster
recovery, the firewall rules are added on the CVM to allow traffic on the specified ports

AOS Security | Security Management Using Prism Element (PE) | 106

through the new CVM interface and updated when a new recovery cluster is added or an
existing cluster is modified.

What to do next
See Service-Specific Settings and Configurations on page 108 for any additional tasks that are
required after you segment the network for a service.

Modifying Network Segmentation Configured for a Service

To modify network segmentation configured for a service, you must first disable network
segmentation for that service and then create the network interface again for that service with
the new IP address pool and VLAN.

About this task

For example, if the interface of the service you want to modify is ntnx0, after the
reconfiguration, the same interface (ntnx0) is assigned to that service if that interface is not
assigned to any other service. If ntnx0 is assigned to another service, a new interface (for
example ntnx1) is created and assigned to that service.
Perform the following to reconfigure network segmentation configured for a service.

Procedure

1. Disable the network segmentation configured for a service by following the instructions in
Disabling Network Segmentation Configured for a Service on page 107.

2. Create the network again by following the instructions in Isolating Service-Specific Traffic on
page 105.

Disabling Network Segmentation Configured for a Service

To disable network segmentation configured for a service, you must disable the dedicated
VNIC. Disabling network segmentation frees up the name of the VNIC. Disabling network
segmentation frees up the vNIC’s name. The free name is reused in a subsequent network
segmentation configuration.

About this task

At the end of this procedure, the cluster performs a rolling restart. Disabling network
segmentation might also disrupt the functioning of the associated service. To restore normal
operations, you might have to perform other tasks immediately after the cluster has completed
the rolling restart. For information about the follow-up tasks, see Service-Specific Settings and
Configurations on page 108.
To disable the network segmentation configured for a service, do the following:

Procedure

1. Log on to the Prism web console and click the gear icon at the top-right corner of the page.

2. In the left pane, click Network Configuration.

3. On the Internal Interfaces tab, for the interface that you want to disable, click Disable.

Note: The defined IP address pool is available even after disabling the network segmentation.

AOS Security | Security Management Using Prism Element (PE) | 107

Deleting a vNIC Configured for a Service
If you disable network segmentation for a service, the vNIC for that service is not deleted. AOS
reuses the vNIC if you enable network segmentation again. However, you can manually delete a
vNIC by logging into any CVM in the cluster with SSH.

Before you begin

Ensure you disable the network segmentation configured for a service by following the
instructions in Disabling Network Segmentation Configured for a Service on page 107.

About this task

Perform the following to delete a vNIC.

Procedure

1. Log on to any CVM in the cluster with SSH.

2. Delete the vNIC.

nutanix@cvm$ network_segmentation --service_network --interface="interface-name" --delete

Replace interface-name with the name of the interface you want to delete. For example,
ntnx0.

Service-Specific Settings and Configurations

The following sections describe the settings required by the services that support network
segmentation.

Nutanix Volumes

Network segmentation for Volumes also requires you to migrate iSCSI client connections to the
new segmented network. If you no longer require segmentation for Volumes traffic, you must
also migrate connections back to eth0 after disabling the vNIC used for Volumes traffic.
You can create two different networks for Nutanix Volumes with different IP pools, VLANs, and
data services IP addresses. For example, you can create two iSCSI networks for production and
non-production traffic on the same Nutanix cluster.
Follow the instructions in Isolating Service-Specific Traffic on page 105 again to create the
second network for Volumes after you create the first network.

Table 6: Settings to be Specified When Configuring Traffic Isolation

Parameter or Setting Description

Virtual IP (Optional) Virtual IP address for the service. If
specified, the IP address must be picked from
the specified IP address pool. If not specified,
an IP address from the specified IP address
pool is selected for you.
Client Subnet The network (in CIDR notation) that hosts the
iSCSI clients. Required If the vNIC created for
the service on the CVM is not on the same
network as the clients.

AOS Security | Security Management Using Prism Element (PE) | 108

Parameter or Setting Description
Gateway Gateway to the subnetwork that hosts the
iSCSI clients. Required If you specify the client
subnet.

Migrating iSCSI Connections to the Segmented Network

After you enable network segmentation for Volumes, you must manually migrate connections
from existing iSCSI clients to the newly segmented network.

Before you begin

Make sure that the task for enabling network segmentation for the service succeeds.

About this task

Note: Even though support is available to run iSCSI traffic on both the segmented and
management networks at the same time, Nutanix recommends that you move the iSCSI traffic for
guest VMs to the segmented network to achieve true isolation.

To migrate iSCSI connections to the segmented network, do the following:

Procedure

1. Log out from all the clients connected to iSCSI targets that are using CVM eth0 or the Data
Service IP address.

2. Optionally, remove all the discovery records for the Data Services IP address (DSIP) on eth0.

3. If the clients are allowlisted by their IP address, remove the client IP address that is on the
management network from the allowlist, and then add the client IP address on the new
network to the allowlist.
nutanix@cvm$ acli vg.detach_external vg_name initiator_network_id=old_vm_IP
nutanix@cvm$ acli vg.attach_external vg_name initiator_network_id=new_vm_IP

Replace vg_name with the name of the volume group and old_vm_IP and new_vm_IP with the old
and new client IP addresses, respectively.

4. Discover the virtual IP address specified for Volumes.

5. Connect to the iSCSI targets from the client.

Migrating Existing iSCSI Connections to the Management Network (Controller VM eth0)

About this task

To migrate existing iSCSI connections to eth0, do the following:

Procedure

1. Log out from all the clients connected to iSCSI targets using the CVM vNIC dedicated to
Volumes.

2. Remove all the discovery records for the DSIP on the new interface.

3. Discover the DSIP for eth0.

4. Connect the clients to the iSCSI targets.

AOS Security | Security Management Using Prism Element (PE) | 109

Disaster Recovery with Protection Domains

The settings for configuring network segmentation for disaster recovery apply to all
Asynchronous, NearSync, and Metro Availability replication schedules. You can use disaster
recovery with Asynchronous, NearSync, and Metro Availability replications only if both the
primary site and the recovery site is configured with Network Segmentation. Before enabling
or disabling the network segmentation on a host, disable all the disaster recovery replication
schedules running on that host.

Note: Network segmentation does not support disaster recovery with Leap.

Table 7: Settings to be Specified When Configuring Traffic Isolation

Parameter or Setting Description

Note: Virtual IP address is different from

the external IP address and the data
services IP address of the cluster.

Gateway Gateway to the subnetwork.

Remote Site Configuration

After configuring network segmentation for disaster recovery, configure remote sites at both
locations. You also need to reconfigure remote sites if you disable network segmentation.
For information about configuring remote sites, see Remote Site Configuration in the Data
Protection and Recovery with Prism Element Guide.

Segmenting a Stretched Layer 2 Network for Disaster Recovery

A stretched Layer 2 network configuration allows the source and remote metro clusters to be in
the same broadcast domain and communicate without a gateway.

About this task

You can enable network segmentation for disaster recovery on a stretched Layer 2 network
that does not have a gateway. A stretched Layer 2 network is usually configured across the
physically remote clusters such as a metro availability cluster deployment. A stretched Layer 2
network allows the source and remote clusters to be configured in the same broadcast domain
without the usual gateway.
See AOS Release Notes for minimum AOS version required to configure a stretched Layer 2
network.
To configure a network segment as a stretched L2 network, do the following.

AOS Security | Security Management Using Prism Element (PE) | 110

Procedure

• Run the following command:

nutanix@cvm$ network_segmentation --service_network --service_name=kDR --ip_pool=DR-ip-pool-
name --service_vlan=DR-vlan-id --desc_name=Description --host_physical_network=portgroup/
bridge --stretched_metro

Replace the following: (See Isolating Service-Specific Traffic on page 105 for the
information)

• DR-ip-pool-name with the name of the IP Pool created for the DR service or any existing
unused IP address pool.
• DR-vlan-id with the VLAN ID being used for the DR service.
• Description with a suitable description of this stretched L2 network segment.
• portgroup/bridge with the details of Bridge or CVM Port Group used for the DR service.
For more information about the network_segmentation command, see the Command
Reference.

Network Segmentation During Cluster Expansion

When you expand a cluster on which the network is segmented only by traffic type
(management and backplane), network segmentation is extended to the added nodes. For
each node you add to the cluster, two IP addresses are allocated from the specified non-
routable network address space. If IP addresses are not available in the specified network,
a message is displayed on the tasks page in the Prism Element web console, and you must
reconfigure the network before you retry cluster expansion. When you change the subnet, any
IP addresses that are currently assigned to the interfaces on the backplane network change,
and the procedure therefore involves stopping the cluster. For information about how to
reconfigure the network, see Reconfiguring the Backplane Network on page 103.

Note:

• Before you add one or more nodes to a cluster on which you have configured
network segmentation, ensure that the network settings on the switch to which the
new nodes are connected are identical to the other nodes in the cluster. AOS does
not perform any network validation of the new nodes. Because a hypervisor reimage
operation causes the new nodes to lose their network configuration, do not reimage
the nodes as part of your cluster expansion.
• When you add nodes to a cluster, you must configure the ports on the physical
switch with the VLAN ID used for the backplane.
• For ESXi clusters with vSphere Distributed Switches (DVS), before you expand the
cluster, ensure that the node you want to add is part of the same vCenter cluster,
same DVS as the other nodes in the cluster, and is not in a disconnected state.
• Ensure that the nodes you add to the cluster have memory more than 20 GB if your
ESXi cluster has vSphere Distributed Switches.

When you expand a cluster on which service-specific traffic isolation is configured, you must
manually configure the networking on the hypervisor host of the new (unconfigured) node
before adding it to the cluster. For information about the steps to perform on an unconfigured
node, see Configuring the Network on a Host. The steps to perform involve logging on to the
host by using SSH and running the ovs-vsctl commands. After you configure the networking
on the new node, add it to the cluster by using the documented cluster expansion workflow.

AOS Security | Security Management Using Prism Element (PE) | 111

See Expanding a Cluster in Prism Web Console Guide for instructions about how to add nodes
to your Nutanix cluster.

Network Segmentation–Related Changes During an AOS Upgrade

When you upgrade from an AOS version which does not support network segmentation to an
AOS version that does, the eth2 interface (used to segregate backplane traffic) is automatically
created on each CVM. However, the network remains unsegmented, and the cluster services on
the CVM continue to use eth0 until you configure network segmentation.
The vNICs ntnx0, ntnx1, and so on, are not created during an upgrade to a release that supports
service-specific traffic isolation. They are created when you configure traffic isolation for a
service.

Note:
Do not delete the eth2 interface that is created on the Controller VMs, even if you are
not using the network segmentation feature.

Firewall Requirements
Available from the Nutanix Support portal, the Port Reference describes detailed port
information (like protocol, service description, source, destination, and associated service) for
Nutanix products and services. It includes port and protocol information for 1-click upgrades
and LCM updates.

Log management
This chapter describes how to configure cluster-wide setting for log-forwarding and
documenting the log fingerprint.

Log Forwarding
The Nutanix Controller VM provides a method for log integrity by using a cluster-wide setting
to forward all the logs to a central log host. Due to the appliance form factor of the Controller
VM, system and audit logs does not support local log retention periods as a significant increase
in log traffic can be used to orchestrate a distributed denial of service attack (DDoS).
Nutanix recommends deploying a central log host in the management enclave to adhere to any
compliance or internal policy requirement for log retention. In case of any system compromise,
a central log host serves as a defense mechanism to preserve log integrity.

Note: The audit in the Controller VM uses the audisp plugin by default to ship all the audit logs
to the rsyslog daemon (stored in /home/log/messages). Searching for audispd in the central log
host provides the entire content of the audit logs from the Controller VM. The audit daemon
is configured with a rules engine that adheres to the auditing requirements of the Operating
System Security Requirements Guide (OS SRG), and is embedded as part of the Controller VM
STIG.

Use the nCLI to enable forwarding of system, audit, aide, and SCMA logs of all the Controller
nodes in a cluster at the required log level. See Sending Logs to a Remote Syslog Server in the
Acropolis Advanced Administration Guide for details.

Documenting the Log Fingerprint

For forensic analysis, non-repudiation is established by verifying the fingerprint of the public
key for the log file entry.

AOS Security | Security Management Using Prism Element (PE) | 112

Procedure

1. Login to the CVM.

2. Run the following command to document the fingerprint for each public key assigned to an
individual admin.
nutanix@cvm$ ssh-keygen -lf /<location of>/id_rsa.pub

The fingerprint is then compared to the SSH daemon log entries and forwarded to the
central log host (/home/log/secure in the Controller VM).

Note: After completion of the ssh public key inclusion in Prism and verification of
connectivity, disable the password authentication for all the Controller VMs and AHV hosts.
From the Prism main menu, de-select Cluster Lockdown configuration > Enable Remote
Login with password check box from the gear icon drop-down list.

AOS Security | Security Management Using Prism Element (PE) | 113

5
SECURITY MANAGEMENT USING PRISM
CENTRAL (PC)
Prism Central provides several mechanisms and features to enforce security of your multi-
cluster environment.
If you enable Identity and Access Management (IAM), see Security Management Using Identity
and Access Management (Prism Central) on page 165.

Configuring Authentication
CAUTION: Prism Central does not support the SSLv2 and SSLv3 ciphers. Therefore, you must
disable the SSLv2 and SSLv3 options in a browser before accessing Prism Central. This avoids
an SSL Fallback and access denial situations. However, you must enable TLS protocol in the
browser.

Prism Central supports these user authentication options:

• SAML authentication: Users can authenticate using one of the supported identity providers
(IDP). The Security Assertion Markup Language (SAML) is an open standard for exchanging
authentication and authorization data between two parties- an identity provider and a
service provider (Prism Central).
If you do not enable Nutanix Identity and Access Management (IAM) on Prism Central, ADFS
is the only supported IDP for Single Sign-on. Additional IDPs are available when you enable
IAM. See Security Management Using Identity and Access Management (Prism Central) on
page 165 and also Updating ADFS When Using SAML Authentication on page 172.
• Local user authentication: Users can authenticate using a local Prism Central account. See
the Managing Local User Accounts topic in the Nutanix Security Guide.
• Active Directory authentication: Users can authenticate using their Active Directory (or
OpenLDAP) credentials when Active Directory support is enabled for Prism Central.

Adding An Authentication Directory (Prism Central)

Before you begin

CAUTION: Prism Central does not allow the use of the (not secure) SSLv2 and SSLv3 ciphers. To
eliminate the possibility of an SSL Fallback situation and denied access to Prism Central, disable
(uncheck) SSLv2 and SSLv3 in any browser used for access. However, TLS must be enabled
(checked).

AOS Security | Security Management Using Prism Central (PC) | 114

Procedure

1. In the web console, click the gear icon in the main menu and then select Authentication in
the Settings page.
The Authentication Configuration window appears.

Figure 58: Authentication Configuration Window

2. To add an authentication directory, click the New Directory button.

A set of fields is displayed. Do the following in the indicated fields:

a. Directory Type: Select one of the following from the pull-down list.

• Active Directory: Active Directory (AD) is a directory service implemented by

Microsoft for Windows domain networks.

Note:

• Users with the "User must change password at next logon" attribute
enabled will not be able to authenticate to Prism Central. Ensure users
with this attribute first login to a domain workstation and change their
password prior to accessing Prism Central. Also, if SSL is enabled on the
Active Directory server, make sure that Nutanix has access to that port
(open in firewall).
• Use of the "Protected Users" group is currently unsupported for Prism
authentication. For more details on the "Protected Users" group, see

AOS Security | Security Management Using Prism Central (PC) | 115

• OpenLDAP: OpenLDAP is a free, open source directory service, which uses the
Lightweight Directory Access Protocol (LDAP), developed by the OpenLDAP project.
b. Name: Enter a directory name.
This is a name you choose to identify this entry; it need not be the name of an actual
directory.
c. Domain: Enter the domain name.
Enter the domain name in DNS format, for example, nutanix.com.

d. Directory URL: Enter the URL address to the directory.

The URL format is as follows for an LDAP entry: ldap://host:ldap_port_num. The host
value is either the IP address or fully qualified domain name. (In some environments, a
simple domain name is sufficient.) The default LDAP port number is 389. Nutanix also
supports LDAPS (port 636) and LDAP/S Global Catalog (ports 3268 and 3269). The
following are example configurations appropriate for each port option:

Note: LDAPS support does not require custom certificates or certificate trust import.

• Port 389 (LDAP). Use this port number (in the following URL form) when the
configuration is single domain, single forest, and not using SSL.
ldap://ad_server.mycompany.com:389

Note:

• When constructing your LDAP/S URL to use a Global Catalog server,

ensure that the Domain Control IP address or name being used is a global

AOS Security | Security Management Using Prism Central (PC) | 116

catalog server within the domain being configured. If not, queries over
3268/3269 may fail.
• Cross-forest trust between multiple AD forests is not supported.

e. [OpenLDAP only] Configure the following additional fields:

• User Object Class: Enter the value that uniquely identifies the object class of a user.
• User Search Base: Enter the base domain name in which the users are configured.
• Username Attribute: Enter the attribute to uniquely identify a user.
• Group Object Class: Enter the value that uniquely identifies the object class of a
group.
• Group Search Base: Enter the base domain name in which the groups are configured.
• Group Member Attribute: Enter the attribute that identifies users in a group.
• Group Member Attribute Value: Enter the attribute that identifies the users provided
as value for Group Member Attribute.
f. Search Type. How to search your directory when authenticating. Choose Non Recursive
if you experience slow directory logon performance. For this option, ensure that users
listed in Role Mapping are listed flatly in the group (that is, not nested). Otherwise,
choose the default Recursive option.
g. Service Account Username: Enter the service account user name in the
[email protected] format that you want the web console to use to log in to the Active
Directory.
A service account is created to run only a particular service or application with the
credentials specified for the account. According to the requirement of the service or
application, the administrator can limit access to the service account.
A service account is under the Managed Service Accounts in the Active Directory server.
An application or service uses the service account to interact with the operating system.

AOS Security | Security Management Using Prism Central (PC) | 117

Enter your Active Directory service account credentials in this (username) and the
following (password) field.

Note: Be sure to update the service account credentials here whenever the service
account password changes or when a different service account is used.

h. Service Account Password: Enter the service account password.

Note:
No permissions are granted to the directory users by default. To grant permissions
to the directory users, you must specify roles for the users in that directory (see
Configuring Role Mapping on page 149).

AOS Security | Security Management Using Prism Central (PC) | 118

Figure 59: Directory List Fields

3. To edit a directory entry, click the pencil icon for that entry.
After clicking the pencil icon, the relevant fields reappear. Enter the new information in the
appropriate fields and then click the Save button.

4. To delete a directory entry, click the X icon for that entry.

After clicking the X icon, a window prompt appears to verify the delete action; click the OK
button. The entry is removed from the list.

AOS Security | Security Management Using Prism Central (PC) | 119

Adding a SAML-based Identity Provider

Before you begin

• An identity provider (typically a server or other computer) is the system that provides
authentication through a SAML request. There are various implementations that can provide
authentication services in line with the SAML standard.
• If you enable IAM by enabling CMSP, you can specify other tested standard-compliant
IDPs in addition to ADFS. See the Prism Central release notes topic Identity and Access
Management Software Support for specific support requirements and also Security
Management Using Identity and Access Management (Prism Central) on page 165.
Only one identity provider is allowed at a time, so if one was already configured, the + New
IDP link does not appear.
• You must configure the identity provider to return the NameID attribute in SAML response.
The NameID attribute is used by Prism Central for role mapping.

Procedure

1. In the web console, click the gear icon in the main menu and then select Authentication in
the Settings page.

2. To add a SAML-based identity provider, click the + New IDP link.

A set of fields is displayed. Do the following in the indicated fields:

a. Configuration name: Enter a name for the identity provider. This name will appear in the
log in authentication screen.
b. Import Metadata: Click this radio button to upload a metadata file that contains the
identity provider information.
Identity providers typically provide an XML file on their website that includes metadata
about that identity provider, which you can download from that site and then upload to
Prism Central. Click + Import Metadata to open a search window on your local system

AOS Security | Security Management Using Prism Central (PC) | 120

and then select the target XML file that you downloaded previously. Click the Save button
to save the configuration.

Figure 60: Identity Provider Fields (metadata configuration)

This completes configuring an identity provider in Prism Central, but you must also configure
the callback URL for Prism Central on the identity provider. To do this, click the Download
Metadata link just below the Identity Providers table to download an XML file that describes
Prism Central and then upload this metadata file to the identity provider.

3. To edit a identity provider entry, click the pencil icon for that entry.
After clicking the pencil icon, the relevant fields reappear. Enter the new information in the
appropriate fields and then click the Save button.

4. To delete an identity provider entry, click the X icon for that entry.
After clicking the X icon, a window prompt appears to verify the delete action; click the OK
button. The entry is removed from the list.

Enabling and Configuring Client Authentication

Procedure

1. In the web console, click the gear icon in the main menu and then select Authentication in
the Settings page.

AOS Security | Security Management Using Prism Central (PC) | 121

2. Click the Client tab, then do the following steps.

a. Select the Configure Client Chain Certificate check box.

The Client Chain Certificate is a list of certificates that includes all intermediate CA and
root-CA certificates.
b. Click the Choose File button, browse to and select a client chain certificate to upload, and
then click the Open button to upload the certificate.

Note: Uploaded certificate files must be PEM encoded. The web console restarts after the
upload step.

c. To enable client authentication, click Enable Client Authentication.

d. To modify client authentication, do one of the following:

Note: The web console restarts when you change these settings.

• Click Enable Client Authentication to disable client authentication.

• Click Remove to delete the current certificate. (This also disables client authentication.)
• To enable OCSP or CRL based certificate revocation checking, see Certificate
Revocation Checking on page 31.
Client authentication allows you to securely access the Prism by exchanging a digital
certificate. Prism will validate that the certificate is signed by your organization’s trusted
signing certificate.
Client authentication ensures that the Nutanix cluster gets a valid certificate from the user.
Normally, a one-way authentication process occurs where the server provides a certificate
so the user can verify the authenticity of the server (see Installing an SSL Certificate on
page 158). When client authentication is enabled, this becomes a two-way authentication
where the server also verifies the authenticity of the user. A user must provide a valid
certificate when accessing the console either by installing the certificate on the local
machine or by providing it through a smart card reader.

Note: The CA must be the same for both the client chain certificate and the certificate on the
local machine or smart card.

AOS Security | Security Management Using Prism Central (PC) | 122

3. To specify a service account that the Prism Central web console can use to log in to Active
Directory and authenticate Common Access Card (CAC) users, select the Configure Service
Account check box, and then do the following in the indicated fields:

Note: For federal customers only.

Note: The Prism Central console restarts after you change this setting.

Note: Nutanix Prism does not support OpenLDAP as directory service for CAC.

If you map a Prism Central role to a CAC user and not to an Active Directory group or
organizational unit to which the user belongs, specify the EDIPI (User Principal Name, or
UPN) of that user in the role mapping. A user who presents a CAC with a valid certificate is
mapped to a role and taken directly to the web console home page. The web console login
page is not displayed.

Note: If you have logged on to Prism Central by using CAC authentication, to successfully log
out of Prism Central, close the browser after you click Log Out.

AOS Security | Security Management Using Prism Central (PC) | 123

Certificate Revocation Checking

Enabling Certificate Revocation Checking using Online Certificate Status Protocol (nCLI)

About this task

Procedure

1. Set the OCSP responder URL.

ncli authconfig set-certificate-revocation set-ocsp-responder=<ocsp url><ocsp url> indicates
the location of the OCSP responder.

2. Verify if OCSP checking is enabled.

ncli authconfig get-client-authentication-config

The expected output if certificate revocation checking is enabled successfully is as follows.

Auth Config Status: true
File Name: ca.cert.pem
OCSP Responder URI: http://<ocsp-responder-url>

Enabling Certificate Revocation Checking using Certificate Revocation Lists (nCLI)

About this task

Note: OSCP is the recommended method for checking certificate revocation in client
authentication.

You can use the CRL certificate revocation checking method if required, as described in this
section.
To enable certificate revocation checking using CRL for client authentication, do the following.

• The above command resets any previous OCSP or CRL configurations.

AOS Security | Security Management Using Prism Central (PC) | 124

User Management
Managing Local User Accounts

About this task

The Prism Central admin user is created automatically, but you can add more (locally defined)
users as needed. To add, update, or delete a user account, do the following:

Note:

• To add user accounts through Active Directory, see “” () . If you enable the Prism
Self Service feature, an Active Directory is assigned as part of that process.
• Changing the Prism Central admin user password does not impact registration (re-
registering clusters is not required).

Procedure

• Click the gear icon in the main menu and then select Local User Management in the Settings
page.
The Local User Management dialog box appears.

Figure 61: User Management Window

AOS Security | Security Management Using Prism Central (PC) | 125

• To add a user account, click the New User button and do the following in the displayed
fields:

a. Username: Enter a user name.

b. First Name: Enter a first name.
c. Last Name: Enter a last name.
d. Email: Enter the user email address.
e. Password: Enter a password (maximum of 255 characters).

Note: A second field to verify the password is not included, so be sure to enter the
password correctly in this field.

f. Language: Select the language setting for the user.

English is selected by default. You have an option to select Simplified Chinese or
Japanese. If you select either of these, the cluster locale is updated for the new user. For

AOS Security | Security Management Using Prism Central (PC) | 126

example, if you select Simplified Chinese, the user interface is displayed in Simplified
Chinese when the new user logs in.
g. Roles: Assign a role to this user.
There are three options:

• Checking the User Admin box allows the user to view information, perform any
administrative task, and create or modify user accounts.
• Checking the Prism Central Admin (formerly "Cluster Admin") box allows the user
to view information and perform any administrative task, but it does not provide
permission to manage (create or modify) other user accounts.
• Leaving both boxes unchecked allows the user to view information, but it does
not provide permission to perform any administrative tasks or manage other user
accounts.
h. When all the fields are correct, click the Save button (lower right).
This saves the configuration and redisplays the dialog box with the new user appearing in
the list.

AOS Security | Security Management Using Prism Central (PC) | 127

Figure 62: Create User Window

AOS Security | Security Management Using Prism Central (PC) | 128

• To modify a user account, click the pencil icon for that user and update one or more of the
values as desired in the Update User window.

Figure 63: Update User Window

• To disable login access for a user account, click the Yes value in the Enabled field for that
user; to enable the account, click the No value.
A Yes value means the login is enabled; a No value means it is disabled. A user account is
enabled (login access activated) by default.
• To delete a user account, click the X icon for that user.
A window prompt appears to verify the action; click the OK button. The user account is
removed and the user no longer appears in the list.

AOS Security | Security Management Using Prism Central (PC) | 129

Updating My Account

About this task

To update your account credentials (that is, credentials for the user you are currently logged in
as), do the following:

AOS Security | Security Management Using Prism Central (PC) | 130

Procedure

1. To update your password, select Change Password from the user icon pull-down list of the
main menu.
The Change Password dialog box appears. Do the following in the indicated fields:

a. Current Password: Enter the current password.

Note: Password complexity requirements might appear above the fields; if they do, your new
password must comply with these rules.

AOS Security | Security Management Using Prism Central (PC) | 131

Figure 64: Change Password Window
AOS Security | Security Management Using Prism Central (PC) | 132
2. To update other details of your account, select Update Profile from the user icon pull-down
list.
The Update Profile dialog box appears. Do the following in the indicated fields for any
parameters you want to change:

a. First Name: Enter a different first name.

b. Last Name: Enter a different last name.
c. Email Address: Enter a different user email address.
d. Language: Select a different language for your account from the pull-down list.
e. API Key: Enter a new API key.

Note: Your keys can be managed from the API Keys page on the Nutanix support portal.
Your connection will be secure without the optional public key (following field), and the
public key option is provided in the event that your default public key expires.

f. Public Key: Click the Choose File button to upload a new public key file.
g. When all the fields are correct, click the Save button (lower right). This saves the changes
and closes the window.

AOS Security | Security Management Using Prism Central (PC) | 133

AOS Security | Security Management Using Prism Central (PC) | 134
Resetting Password (CLI)
This procedure describes how to reset your password or any another user's password (if you
are locked out and cannot log in to the Prism Element or Prism Central web console).

About this task

To reset the password using nCLI, do the following:

Procedure

1. Access the CVM via SSH.

2. Log in with the admin credentials.

3. Use the ncli user reset-password command and specify the username and password of the
user whose password is to be reset:
nutanix@cvm$ ncli user reset-password user-name=xxxxx password=yyyyy

• Replace user-name=xxxxx with the name of the user whose password is to be reset.
• Replace password=yyyyy with the new password.

What to do next
You can relaunch the Prism web console and verify the new password setting.

Controlling User Access (RBAC)

Prism Central supports role-based access control (RBAC) that you can configure to provide
customized access permissions for users based on their assigned roles. The roles dashboard
allows you to view information about all defined roles and the users and groups assigned to
those roles.

• Prism Central includes a set of predefined roles (see Built-in Role Management on
page 135).
• You can also define additional custom roles (see Custom Role Management on page 136).
• Configuring authentication confers default user permissions that vary depending on the
type of authentication (full permissions from a directory service or no permissions from an
identity provider). You can configure role maps to customize these user permissions (see
Configuring Role Mapping on page 149).
• You can refine access permissions even further by assigning roles to individual users or
groups that apply to a specified set of entities (see Assigning a Role on page 155).

Note: Please note that the entities are treated as separate instances. For example, if you want
to grant a user or a group the permission to manage cluster and images, an administrator
must add both of these entities to the list of assignments.

• With RBAC, user roles do not depend on the project membership. You can use RBAC and
log in to Prism Central even without a project membership.

Note: Defining custom roles and assigning roles are supported on AHV only.

Built-in Role Management

The following built-in roles are defined by default. You can see a more detailed list of
permissions for any of the built-in roles through the details view for that role (see Displaying

AOS Security | Security Management Using Prism Central (PC) | 135

Role Permissions on page 157). The Project Admin, Developer, Consumer, and Operator roles
are available when assigning roles in a project.

Role Privileges

Super Admin Full administrator privileges

Prism Admin Full administrator privileges except for creating or modifying
the user accounts
Prism Viewer View-only privileges
Self-Service Admin Manages all cloud-oriented resources and services

Note: This is the only cloud administration role available.

Project Admin Manages cloud objects (roles, VMs, Apps, Marketplace)

belonging to a project

Note: You can specify a role for a user when you assign
a user to a project, so individual users or groups can have
different roles in the same project.

Developer Develops, troubleshoots, and tests applications in a project

Consumer Accesses the applications and blueprints in a project
Operator Accesses the applications in a project

Note: Previously, the Super Admin role was called User Admin, the Prism Admin role was called
Prism Central Admin and Cluster Admin, and the Prism Viewer was called Viewer.

Custom Role Management

If the built-in roles are not sufficient for your needs, you can create one or more custom roles
(AHV only).

Creating a Custom Role

About this task

To create a custom role, do the following:

AOS Security | Security Management Using Prism Central (PC) | 136

Procedure

1. Go to the roles dashboard (select Administration > Roles in the pull-down menu) and click
the Create Role button.
The Roles page appears. See Custom Role Permissions on page 145 for a list of the
permissions available for each custom role option.

AOS Security | Security Management Using Prism Central (PC) | 137

Figure 66: Roles Page

AOS Security | Security Management Using Prism Central (PC) | 138

2. In the Roles page, do the following in the indicated fields:

a. Role Name: Enter a name for the new role.

b. Description (optional): Enter a description of the role.

Note: All entity types are listed by default, but you can display just a subset by entering a
string in the Filter Entities search field.

c. App: Click the radio button for the desired application permissions (No Access, Basic
Access, or Set Custom Permissions). If you specify custom permissions, click the Change

AOS Security | Security Management Using Prism Central (PC) | 139

link to display the Custom App Permissions window, check all the permissions you want
to enable, and then click the Save button.

Figure 67: Custom App Permissions Window

d. VM: Click the radio button for the desired VM permissions (No Access, View Access,
Basic Access, Edit Access, or Set Custom Permissions). Check the Allow VM Creation
box to allow this role to create VMs. If you specify custom permissions, click the Change

AOS Security | Security Management Using Prism Central (PC) | 140

link to display the Custom VM Permissions window, check all the permissions you want
to enable, and then click the Save button.

Figure 68: Custom VM Permissions Window

e. Blueprint: Click the radio button for the desired blueprint permissions (No Access,
View Access, Basic Access, or Set Custom Permissions). Check the Allow Blueprint
Creation box to allow this role to create blueprints. If you specify custom permissions,

AOS Security | Security Management Using Prism Central (PC) | 141

click the Change link to display the Custom Blueprint Permissions window, check all the
permissions you want to enable, and then click the Save button.

Figure 69: Custom Blueprint Permissions Window

f. Marketplace Item: Click the radio button for the desired marketplace permissions (No
Access, View marketplace and published blueprints, View marketplace and publish
new blueprints, or Set custom permissions). If you specify custom permissions, click the

AOS Security | Security Management Using Prism Central (PC) | 142

Change link to display the Custom Marketplace Item Permissions window, check all the
permissions you want to enable, and then click the Save button.

Note: The permission you enable for a Marketplace Item implicitly applies to a Catalog
Item entity. For example, if you select No Access permission for the Marketplace Item
entity while creating the custom role, the custom role will not have access to the Catalog
Item entity as well.

Figure 70: Custom Marketplace Permissions Window

g. Report: Click the radio button for the desired report permissions (No Access, View
Only, Edit Access, or Set Custom Permissions). If you specify custom permissions,

AOS Security | Security Management Using Prism Central (PC) | 143

click the Change link to display the Custom Report Permissions window, check all the
permissions you want to enable, and then click the Save button.

Figure 71: Custom VM Permissions Window

h. Cluster: Click the radio button for the desired cluster permissions (No Access or Cluster
Access).
i. Subnet: Click the radio button for the desired subnet permissions (No Access or Subnet
Access).
j. Image: Click the radio button for the desired image permissions (No Access, View Only,
or Set Custom Permissions). If you specify custom permissions, click the Change link to

AOS Security | Security Management Using Prism Central (PC) | 144

display the Custom Image Permissions window, check all the permissions you want to
enable, and then click the Save button.

Figure 72: Custom Image Permissions Window

3. Click Save to add the role. The page closes and the new role appears in the Roles view list.

Modifying a Custom Role

About this task

Perform the following procedure to modify or delete a custom role.

Procedure

1. Go to the roles dashboard and select (check the box for) the desired role from the list.

2. Do one of the following:

» To modify the role, select Update Role from the Actions pull-down list. The Roles page for
that role appears. Update the field values as desired and then click Save. See Creating a
Custom Role on page 136 for field descriptions.
» To delete the role, select Delete from the Action pull-down list. A confirmation message is
displayed. Click OK to delete and remove the role from the list.

Custom Role Permissions

A selection of permission options are available when creating a custom role.

AOS Security | Security Management Using Prism Central (PC) | 145

The following table lists the permissions you can grant when creating or modifying a custom
role. When you select an option for an entity, the permissions listed for that option are granted.
If you select Set custom permissions, a complete list of available permissions for that entity
appears. Select the desired permissions from that list.

Entity Option Permissions

App (application) No Access (none)

Basic Access Abort App Runlog, Access Console VM,
Action Run App, Clone VM, Create AWS VM,
Create Image, Create VM, Delete AWS VM,
Delete VM, Download App Runlog, Update
AWS VM, Update VM, View App, View AWS
VM, View VM
Set Custom Abort App Runlog, Access Console VM,
Permissions (select Action Run App, Clone VM, Create App,
from list) Create AWS VM, Create Image, Create VM,
Delete App, Delete AWS VM, Delete VM,
Download App Runlog, Update App, Update
AWS VM, Update VM, View App, View AWS
VM, View VM
VM Recovery Point No Access (none)
View Only View VM Recovery Point
Full Access Delete VM Recovery Point, Restore VM
Recovery Point, Snapshot VM, Update VM
Recovery Point, View VM Recovery Point,
Allow VM Recovery Point creation
Set Custom Abort App Runlog, Access Console VM,
Permissions (Change) Action Run App, Clone VM, Create App,
Create AWS VM, Create Image, Create VM,
Delete App, Delete AWS VM, Delete VM,
Download App Runlog, Update App, Update
AWS VM, Update VM, View App, View AWS
VM, View VM

Note:
You can assign permissions for the VM Recovery Point entity
to users or user groups in the following two ways.

• Manually assign permission for each VM where the

recovery point is created.
• Assign permission using Categories in the Role Assignment
workflow.

Tip: When a recovery point is created, it is associated with

the same category as the VM.

VM No Access (none)
View Access Access Console VM, View VM

AOS Security | Security Management Using Prism Central (PC) | 146

Entity Option Permissions
Basic Access Access Console VM, Update VM Power State,
View VM
Edit Access Access Console VM, Update VM, View Subnet,
View VM
Set Custom Access Console VM, Clone VM, Create
Permissions (select VM, Delete VM, Update VM, Update VM
from list) Boot Config, Update VM CPU, Update VM
Categories, Update VM Disk List, Update VM
GPU List, Update VM Memory, Update VM NIC
List, Update VM Owner, Update VM Power
State, Update VM Project, View Cluster, View
Subnet, View VM
Allow VM creation (n/a)
(additional option)
Blueprint No Access (none)
View Access View Account, View AWS Availability Zone,
View AWS Elastic IP, View AWS Image, View
AWS Key Pair, View AWS Machine Type, View
AWS Region, View AWS Role, View AWS
Security Group, View AWS Subnet, View AWS
Volume Type, View AWS VPC, View Blueprint,
View Cluster, View Image, View Project, View
Subnet
Basic Access Access Console VM, Clone VM, Create
App,Create Image, Create VM, Delete VM,
Launch Blueprint, Update VM, View Account,
View App, View AWS Availability Zone, View
AWS Elastic IP, View AWS Image, View AWS
Key Pair, View AWS Machine Type, View
AWS Region, View AWS Role, View AWS
Security Group, View AWS Subnet, View AWS
Volume Type, View AWS VPC, View Blueprint,
View Cluster, View Image, View Project, View
Subnet, View VM
Set Custom Access Console VM, Clone VM, Create App,
Permissions (select Create Blueprint, Create Image, Create VM,
from list) Delete Blueprint, Delete VM, Download
Blueprint, Export Blueprint, Import Blueprint,
Launch Blueprint, Render Blueprint, Update
Blueprint, Update VM, Upload Blueprint, View
Account, View App, View AWS Availability
Zone, View AWS Elastic IP, View AWS Image,
View AWS Key Pair, View AWS Machine Type,
View AWS Region, View AWS Role, View
AWS Security Group, View AWS Subnet, View
AWS Volume Type, View AWS VPC, View
Blueprint, View Cluster, View Image, View
Project, View Subnet, View VM
Marketplace Item No Access (none)

AOS Security | Security Management Using Prism Central (PC) | 147

Entity Option Permissions
View marketplace and View Marketplace Item
published blueprints
View marketplace and Update Marketplace Item, View Marketplace
publish new blueprints Item
Set Custom Config Marketplace Item, Create Marketplace
Permissions (select Item, Delete Marketplace Item, Render
from list) Marketplace Item, Update Marketplace Item,
View Marketplace Item
Report No Access (none)
View Only Notify Report Instance, View Common Report
Config, View Report Config, View Report
Instance
Edit Access Create Common Report Config, Create
Report Config, Create Report Instance, Delete
Common Report Config, Delete Report
Config, Delete Report Instance, Notify Report
Instance, Update Common Report Config,
Update Report Config, View Common Report
Config, View Report Config, View Report
Instance
Set Custom Create Common Report Config, Create
Permissions (select Report Config, Create Report Instance, Delete
from list) Common Report Config, Delete Report
Config, Delete Report Instance, Notify Report
Instance, Update Common Report Config,
Update Report Config, View Common Report
Config, View Report Config, View Report
Instance
Cluster No Access (none)
View Access View Cluster
Subnet No Access (none)
View Access View Subnet
Image No Access (none)
View Only View Image
Set Custom Copy Image Remote, Create Image, Delete
Permissions (select Image, Migrate Image, Update Image, View
from list) Image

Granting Restore Permission to Project User

About this task

By default, only a self service admin or a cluster admin can view and restore the recovery
points. However, a self service admin or cluster admin can grant permission to the project user
to restore the VM from a recovery point.
To grant restore Permission to a project user, do the following:

AOS Security | Security Management Using Prism Central (PC) | 148

Procedure

1. Log on to Prism Central with cluster admin or self service admin credentials.

2. Go to the roles dashboard (select Administration > Roles in the pull-down menu) and do one
of the following:

• Click the Create Role button.

• Select an existing role of a project user and then select Duplicate from the Actions drop-
down menu. To modify the duplicate role, select Update Role from the Actions pull-down
list.

3. The Roles page for that role appears. In the Roles page, do the following in the indicated
fields:

a. Role Name: Enter a name for the new role.

b. Description (optional): Enter a description of the role.
c. Expand VM Recovery Point and do one of the following:

• Select Full Access and then select Allow VM recovery point creation.
• Click Change next to Set Custom Permissions to customize the permissions. Enable
Restore VM Recovery Point permission. This permission also grants the permission to
view the VM created from the restore process.
d. Click Save to add the role. The page closes and the new role appears in the Roles view
list.

4. In the Roles view, select the newly created role and click Manage Assignment to assign the
user to this role.

5. In the Add New dialog, do the following:

• Under Select Users or User Groups or OUs, enter the target user name. The search box
displays the matched records. Select the required listing from the records.
• Under Entities, select VM Recovery Point, select Individual Entry from the drop-down list,
and then select All VM Recovery Points.
• Click Save to finish.

Configuring Role Mapping

About this task

After user authentication is configured (see Configuring Authentication on page 114), the
users or the authorized directories are not assigned the permissions by default. The required
permissions must be explicitly assigned to users, authorized directories, or organizational units
using role mapping.
You can refine the authentication process by assigning a role with associated permissions to
users, groups, and organizational units. This procedure allows you to map and assign users to
the predefined roles in Prism Central such as, User Admin, Cluster Admin, and Viewer. To assign
roles, do the following:

AOS Security | Security Management Using Prism Central (PC) | 149

Procedure

1. Click the gear icon in the main menu and then select Role Mapping from the Settings page.
The Role Mapping window appears.

Figure 73: Role Mapping Window

AOS Security | Security Management Using Prism Central (PC) | 150

2. To create a role mapping, click the New Mapping button.
The Create Role Mapping window appears. Enter the required information in the following
fields.

Figure 74: Create Role Mapping Window

3. Directory or Provider: Select the target directory or identity provider from the pull-down list.
Only directories and identity providers previously configured in the authentication settings
are available. If the desired directory or provider does not appear in the list, add that
directory or provider, and then return to this procedure.

4. Type: Select the desired LDAP entity type from the pull-down list.
This field appears only if you have selected a directory from the Directory or Provider pull-
down list. The following entity types are available:

• User: A named user. For example, dev_user_1.

• Group: A group of users. For example, dev_grp1, dev_grp2, sr_dev_1, and staff_dev_1.
• OU: organizational units with one or more users, groups, and even other organizational
units. For example, all_dev, consists of user dev_user_1 and groups dev_grp1, dev_grp2,
sr_dev_1, and staff_dev_1.

AOS Security | Security Management Using Prism Central (PC) | 151

5. Role: Select a user role from the pull-down list.
You can choose one of the following roles:

• Viewer: Allows users with view-only access to the information and hence cannot perform
any administrative tasks.
• Cluster Admin (Formerly Prism Central Admin): Allows users to view and perform all
administrative tasks except creating or modifying user accounts.
• User Admin: Allows users to view information, perform administrative tasks, and to create
and modify user accounts.

6. Values: Enter the entity names. The entity names are assigned with the respective roles that
you have selected.
The entity names are case sensitive. If you need to provide more than one entity name, then
the entity names should be separated by a comma (,) without any spaces in between them.
LDAP-based authentication

• For AD
Enter the actual names used by the organizational units (it applies to all users and groups
in those OUs), groups (all users in those groups), or users (each named user) used in
LDAP in the Values field.
For example, entering sr_dev_1,staff_dev_1 in the Values field when the LDAP type is
Group and the role is Cluster Admin, implies that all users in the sr_dev_1 and staff_dev_1
groups are assigned the administrative role for the cluster.
Do not include the domain name in the value. For example, enter all_dev, and not
all_dev@<domain_name>. However, when users log in to Cluster Admin, include the domain
along with the username.
User: Enter the sAMAccountName or userPrincipalName in the values field.
Group: Enter common name (cn) or name.
OU: Enter name.
• For OpenLDAP
User: Use the username attribute (that was configured while adding the directory) value.
Group: Use the group name attribute (cn) value.
OU: Use the OU attribute (ou) value.
SAML-based authentication:
You must configure the NameID attribute in the identity provider. You can enter the NameID
returned in the SAML response in the Values field.
For SAML, only User type is supported. Other types such as, Group and OU, are not
supported.
If you enable Identity and Access Management, see Security Management Using Identity and
Access Management (Prism Central) on page 165

AOS Security | Security Management Using Prism Central (PC) | 152

7. Click Save.
The role mapping configurations are saved, and the new role is listed in the Role Mapping
window.
You can create a role map for each authorized directory. You can also create multiple role
maps that apply to a single directory. When there are multiple maps for a directory, the most
specific rule for a user applies.
For example, adding a Group map set to Cluster Admin and a User map set to Viewer for a
few specific users in that group means all users in the group have administrator permission
except those few specific users who have only viewing permission.

8. To edit a role map entry, click the pencil icon for that entry.
After clicking the pencil icon, the Edit Role Mapping window appears which is similar to the
Create Role Mapping window. Edit the required information in the required fields and click
the Save button to update the changes.

9. To delete a role map entry, click the X icon for that entry and click the OK button to confirm
the role map entry deletion.
The role map entry is removed from the list.

Cluster Role-Based Access Control (RBAC)

Cluster role-based access control (RBAC) feature enables a super-admin user to provide Prism
Admin and Prism Viewer roles access to one or more clusters registered with Prism Central. A
user with Prism Central admin or viewer role is able to view and act on the entities like VM, host,
and container from the allowed clusters.
Cluster RBAC is currently supported on an on-prem Prism Central instance hosted in a Prism
Element cluster running AHV or ESXi. After you enable the Micro Services Infrastructure feature
on Prism Central, the Cluster RBAC feature is then automatically enabled.
This feature supports clusters that are hosted on AHV and VMware ESXi.

Note: The Prism Central supports assigning up to 15 clusters to any user or user group.

Configuring Cluster RBAC

About this task

To configure Cluster RBAC in Prism Central for users or user groups, do the following.

Procedure

1. Log on to Prism Central as an admin user or any user with super admin access.

2. Configure active directory settings.

Note: You can skip this step if an active directory is already configured.

Go to Prism Central Settings > Authentication, click + New Directory and add your preferred
active directory.

3. Click the hamburger menu and go to Administration > Roles.

The page displays system defined and custom roles.

4. Select Prism Admin or Prism Viewer role, then click Actions > Manage Assignment.

AOS Security | Security Management Using Prism Central (PC) | 153

5. Click Add New to add a new user or user groups to this role.

Figure 75: Role Assignment

You will add users or user groups and assign clusters to the new role in the upcoming steps.

6. In the Select Users or Groups field, do the following:

a. Select the configured active directory (AD) from the drop-down.

b. Search and add the users or user groups.
To search a user or user group, start typing few letters and the system will automatically
suggest the names.

7. In the Select Clusters field, you can provide cluster access to AD users or User Groups using
the Individual entity option (one or more registered clusters) or ALL Clusters option.

Figure 76: Select Clusters

8. Click Save.
AD users or User Groups can log on and access Prism Central as a Prism Admin or Prism
Viewer, and view or act on the entities like VM, host, and container from the configured
clusters.

AOS Security | Security Management Using Prism Central (PC) | 154

Assigning a Role

About this task

In addition to configuring basic role maps (see Configuring Role Mapping on page 149), you
can configure more precise role assignments (AHV only). To assign a role to selected users or
groups that applies just to a specified set of entities, do the following:

Procedure

1. Log on to Prism Central as "admin" user or any user with "super admin" access.

2. Configure Active Directory settings.

Note: You can skip this step if an active directory is already configured.

Go to Prism Central Settings > Authentication, click + New Directory and add your preferred
active directory.

3. Click the hamburger menu and go to Administration > Roles.

The page displays system defined and custom roles.

4. Select the desired role in the roles dashboard, then click Actions > Manage Assignment.

5. Click Add New to add a user or user groups to this role.

Figure 77: Role Assignment

You will be adding users or user groups and assigning entities to the new role in the next
steps.

6. In the Select Users or Groups field, do the following:

a. Select the configured active directory (AD) from the drop-down.

b. Search and add the users or groups.
Typing few letters in the search field displays a list of users from which you can select, and
you can add multiple user names in this field.

7. In the Select Entities field, you can provide access to various entities. The list of available
entities depends on the role selected in Step 4.

AOS Security | Security Management Using Prism Central (PC) | 155

This table lists the available entities for each role:

Table 8: Available Entities for a Role

Role Entities

Consumer AHV VM, Image, Image Placement Policy,

OVA, Subnets: VLAN

Developer AHV VM, Cluster, Image, Image Placement

Policy, OVA, Subnets:VLAN

Operator AHV VM, Subnets:VLAN

Prism Admin Individual entity (one or more clusters), All

Clusters

Prism Viewer Individual entity (one or more clusters), All

Clusters

Custom role (User defined role) Individual entity, In Category (only AHV VMs)

This table shows the description of each entity:

Table 9: Description of Entities

Entity Description

AHV VM Allows you to manage VMs including create

and edit permission

Image Allows you to access and manage image

details

Image Placement Policy Allows you to access and manage image

placement policy details

OVA Allows you to view and manage OVA details

Subnets: VLAN Allows you to view subnet details

Cluster Allows you to view and manage details of

assigned clusters (AHV and ESXi clusters)

All Clusters Allows you to view and manage details of all

clusters

Individual entity Allows you to view and manage individual

entities such as AHV VM, Clusters, and
Subnets:VLAN

8. Repeat Step 5 and Step 6 for any combination of users/entities you want to define.

Note: To allow users to create certain entities like a VM, you may also need to grant them
access to related entities like clusters, networks, and images that the VM requires.

9. Click Save.

AOS Security | Security Management Using Prism Central (PC) | 156

Displaying Role Permissions

About this task

Do the following to display the privileges associated with a role.

Procedure

1. Go to the roles dashboard and select the desired role from the list.
For example, if you click the Consumer role, the details page for that role appears, and you
can view all the privileges associated with the Consumer role.

Figure 78: Role Summary Tab

AOS Security | Security Management Using Prism Central (PC) | 157

2. Click the Users tab to display the users that are assigned this role.

Figure 79: Role Users Tab

3. Click the User Groups tab to display the groups that are assigned this role.

4. Click the Role Assignment tab to display the user/entity pairs assigned this role (see
Assigning a Role on page 155).

Installing an SSL Certificate

About this task
Prism Central supports SSL certificate-based authentication for console access. To install a self-
signed or custom SSL certificate, do the following:

Note: Nutanix recommends that you replace the default self-signed certificate with a CA signed
certificate.

Procedure

1. Click the gear icon in the main menu and then select SSL Certificate in the Settings page.

AOS Security | Security Management Using Prism Central (PC) | 158

2. To replace (or install) a certificate, click the Replace Certificate button.

Figure 80: SSL Certificate Window

3. To create a new self-signed certificate, click the Replace Certificate option and then click the
Apply button.
A dialog box appears to verify the action; click the OK button. This generates and applies a
new RSA 2048-bit self-signed certificate for Prism Central.

Figure 81: SSL Certificate Window: Regenerate

AOS Security | Security Management Using Prism Central (PC) | 159

4. To apply a custom certificate that you provide, do the following:

a. Click the Import Key and Certificate option and then click the Next button.

Figure 82: SSL Certificate Window: Import

b. Do the following in the indicated fields, and then click the Import Files button.

Note: All three imported files for the custom certificate must be PEM encoded.

AOS Security | Security Management Using Prism Central (PC) | 160

Figure 83: SSL Certificate Window: Select Files

Note: Prism does not have any specific requirement or enforcement logic for the subject
name of the certificates (subject alternative names (SAN)) or wildcard certificates.

Table 10: Supported Key Configurations

Key Type Size/Curve Signature Algorithm

RSA 4096 SHA256-with-RSAEncryption

RSA 2048 SHA256-with-RSAEncryption
EC DSA 256 prime256v1 ecdsa-with-sha256
EC DSA 384 secp384r1 ecdsa-with-sha384

AOS Security | Security Management Using Prism Central (PC) | 161

Key Type Size/Curve Signature Algorithm
EC DSA 521 secp521r1 ecdsa-with-sha512

You can use the cat command to concatenate a list of CA certificates into a chain file.
$ cat signer.crt inter.crt root.crt > server.cert

Order is essential. The total chain should begin with the certificate of the signer and end
with the root CA certificate as the final entry.

Note: The system holds only one custom SSL certificate. If a new certificate is uploaded, it
replaces the existing certificate. The previous certificate is discarded.

Controlling Remote (SSH) Access

About this task
Key-based SSH access to Prism Central is supported. Prism Central employs a public/private
key pair, and it is made secure by distributing and using these keys. Create a key pair (or
multiple key pairs) and add the public keys to enable key-based SSH access. However, when
site security requirements do not allow such access, you can remove all public keys to prevent
SSH access.
To control key-based SSH access to Prism Central, do the following:

AOS Security | Security Management Using Prism Central (PC) | 162

Procedure

1. Click the gear icon in the main menu and then select Cluster Lockdown in the Settings page.
The Cluster Lockdown dialog box appears. Enabled public keys (if any) are listed in this
window.

Figure 84: Cluster Lockdown Window

2. To disable (or enable) remote login access, uncheck (check) the Enable Remote Login with
Password box.
Remote login access is enabled by default.

3. To add a new public key, click the New Public Key button and then do the following in the
displayed fields:

a. Name: Enter a key name.

b. Key: Enter (paste) the key value into the field.
c. Click the Save button (lower right) to save the key and return to the main Cluster
Lockdown window.
There are no public keys available by default, but you can add any number of public keys.

4. To delete a public key, click the X on the right of that key line.

Note: Deleting all the public keys and disabling remote login access locks down the cluster
from SSH access.

Password Retry Lockout

For enhanced security, Prism Central locks out the default 'admin' account for a period of 15
minutes after a default number of unsuccessful login attempts. Once the account is locked out,
the following message is displayed at the logon screen.
Account locked due to too many failed attempts
You can attempt entering the password after the 15 minutes lockout period, or contact Nutanix
Support in case you have forgotten your password.

AOS Security | Security Management Using Prism Central (PC) | 163

Security Policies using Flow
Nutanix Flow includes a policy-driven security framework that inspects traffic within the data
center. For more information, see the Flow Microsegmentation Guide.
6
SECURITY MANAGEMENT USING
IDENTITY AND ACCESS MANAGEMENT
(PRISM CENTRAL)
Enabled and administered from Prism Central, Identity and Access Management (IAM) is an
authentication and authorization feature that uses attribute-based access control (ABAC). It
is disabled by default. This section describes Prism Central IAM prerequisites, enablement, and
SAML-based standard-compliant identity provider (IDP) configuration.
After you enable the Micro Services Infrastructure (CMSP) on Prism Central, IAM is
automatically enabled. You can configure a wider selection of identity providers, including
Security Assertion Markup Language (SAML) based identity providers. The Prism Central web
console presents an updated sign-on/authentication page.
The enable process migrates existing directory, identity provider, and user configurations,
including Common Access Card (CAC) client authentication configurations. After enabling
IAM, if you want to enable a client to authenticate by using certificates, you must also enable
CAC authentication. See Identity and Access Management Prerequisites and Considerations
on page 167. See also the Prism Central release notes topic Identity and Access Management
Software Support for specific support requirements.
The work flows for creating authentication configurations and providing user and role access
described in Configuring Authentication on page 114 are the same whether IAM is enabled or
not.

IAM Features
Highly Scalable Architecture
Based on the Kubernetes open source platform, IAM uses independent pods for
authentication (AuthN), authorization (AuthZ), and IAM data storage and replication.

• Each pod automatically scales independently of Prism Central when required. No user
intervention or control is required.
• When new features or functions are available, you can update IAM pods independently
of Prism Central updates through Life Cycle Manager (LCM).
• IAM uses a rolling upgrade method to help ensure zero downtime.
Secure by Design

• Mutual TLS authentication (mTLS) secures IAM component communication.

• The Micro Services infrastructure (CMSP) on Prism Central provisions certificates for
mTLS.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 165
More SAML Identity Providers (IDP)
Without enabling CMSP/IAM on Prism Central, Active Directory Federation Services
(ADFS) is the only supported IDP for Single Sign-on. After you enable it, IAM supports
more IDPs. Nutanix has tested these IDPs when SAML IDP authentication is configured
for Prism Central.

• ADFS
• Azure ADFS
• Okta
• PingOne
• Shibboleth
• Keycloak
Users can log on from the Prism Central web console only. IDP-initiated authentication
work flows are not supported. That is, logging on or signing on from an IDP web page or
site is not supported.
Updated Authentication Page
After enabling IAM, the Prism Central login page is updated depending on your
configuration. For example, if you have configured local user account and Active
Directory authentication, this default page appears for directory users as follows. To log
in as a local user, click the Log In with your Nutanix Local Account link.

Figure 85: Sample Default Prism Central IAM Logon Page, Active Directory And Local User
Authentication

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 166
In another example, if you have configured SAML authentication instances named Shibboleth
and AD2, Prism Central displays this page.

Figure 86: Sample Prism Central IAM Logon Page, Active Directory , Identity Provider, And
Local User Authentication

Identity and Access Management Prerequisites and Considerations

Make sure you meet the requirements listed before you enable the Micro Services
Infrastructure, which enables IAM.

IAM Prerequisites
For specific minimum software support and requirements for IAM, see the Prism Central release
notes.
For Micro Services Infrastructure requirements, see the Enabling Micro Services Infrastructure
topic in the Prism Central Guide.
Prism Central

• The Microservices Infrastructure and IAM is supported on clusters running AHV or

ESXi only. For ESXi clusters you may need to enter your vCenter credentials (user
name and password) and a network for deployment.
• The host cluster must be registered with this Prism Central instance.
• Ensure that you have created a Virtual IP address (VIP) for Prism Central. The
Acropolis Upgrade Guide describes how to set the VIP for the Prism Central VM. Once
set, do not change this address.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 167
• Ensure that you have created a fully qualified domain name (FQDN) for Prism Central.
Once the Prism Central FQDN is set, do not change it. The Prism Central Guide
describes how to set the FQDN in the Cluster Details window.
• When Micro Services Infrastructure is enabled on a Prism Central scale-out three-node
deployment, reconfiguring the IP address and gateway of the Prism Central VMs is not
supported.
• Ensure connectivity:

• Between Prism Central and its managed Prism Element clusters.

• To the Internet for Prism Central clusters. Dark site Prism Central deployments are
not supported.
• Enable Microservices Infrastructure on Prism Central (CMSP) first to enable and use
IAM. See the Enabling Micro Services Infrastructure topic in the Prism Central Guide.
• IAM supports small or large single PC VM deployments. However, you cannot expand
the single VM deployment to a scale-out three-node deployment once CMSP has been
enabled.
• IAM supports scale-out three-node PC VM deployments. Reverting this deployment to
a single PC VM deployment is not supported.
• Make sure Prism Central is managing at least one Prism Element cluster. The Prism
Central Guide describes how to register a cluster.
• You cannot unregister the Prism Element cluster that is hosting the Prism Central
deployment where you have enabled CMSP and IAM. You can unregister other clusters
being managed by this Prism Central deployment.
Prism Element Clusters
Ensure that you have configured the following cluster settings. See the Prism Web
Console Guide for details.

• Virtual IP address (VIP). Once set, do not change this address

• iSCSI data services IP address (DSIP). Once set, do not change this address
• NTP server
• Name server

IAM Considerations
Existing Authentication and Authorization Migrated After Enabling IAM

• When you enable IAM by enabling CMSP, IAM migrates existing authentication and
authorization configurations, including Common Access Card client authentication
configurations.
User Session Lifetime

• Each session has a maximum lifetime of 8 hours

• Session idle time is 15 minutes. After 15 minutes, a user or client is logged out and must
re-authenticate.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 168
Client Authentication and Common Access Card (CAC) Support

• IAM supports deployments where CAC authentication and client authentication

are enabled on Prism Central. After enabling IAM, if you want to enable a client to
authenticate by using certificates, you must also enable CAC authentication.
• Ensure that port 9441 is open in your firewall if you are using CAC client
authentication.
Hypervisor Support

• You can deploy IAM on an on-premise Prism Central (PC) deployment hosted on
an AOS cluster running AHV or ESXi. Clusters running other hypervisors are not
supported.

Enabling IAM
Before you begin

• IAM on Prism Central is disabled by default. When you enable the Micro Services
Infrastructure on Prism Central, IAM is automatically enabled.
• See the Enabling Micro Services Infrastructure topic in the Prism Central Guide.
• See Identity and Access Management Prerequisites and Considerations on page 167
and also the Prism Central release notes topic Identity and Access Management Software
Support for specific support requirements.

Procedure

1. Enable Micro Services Infrastructure on Prism Central as described in the Enabling Micro
Services Infrastructure topic in the Prism Central Guide.

2. To view task status:

a. Open a web browser and log in to the Prism Central web console.
b. Go to the Activity > Tasks dashboard and find the IAM Migration & Bootstrap task.
The task takes up to 60 minutes to complete. Part of the task is migrating existing
authentication configurations.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 169
3. After the enablement tasks are completed, including the IAM Migration & Bootstrap task, log
out of Prism Central. Wait at least 15 minutes before logging on to Prism Central.
The Prism Central web console shows a log in page similar to the following. Depending on
your existing authentication configuration, it might look different.

Figure 87: Sample Prism Central IAM Logon Page

What to do next
Configure authentication and access. If you are implementing SAML authentication with Active
Directory Federated Services (ADFS), see Updating ADFS When Using SAML Authentication on
page 172.

Prism Central supports user authentication with these authentication options:

• SAML authentication. Users can authenticate through a supported identity provider when
SAML support is enabled for Prism Central. The Security Assertion Markup Language (SAML)
is an open standard for exchanging authentication and authorization data between two
parties: an identity provider (IDP) and Prism Central as the service provider.
If you do not enable Nutanix Identity and Access Management (IAM) on Prism Central,
ADFS is the only supported IDP for Single Sign-on. If you enable IAM, additional IDPs are

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 170
available. See Security Management Using Identity and Access Management (Prism Central)
on page 165 and also Updating ADFS When Using SAML Authentication on page 172.
• Local user authentication. Users can authenticate if they have a local Prism Central account.
See the Managing Local User Accounts topic in the Nutanix Security Guide.
• Active Directory authentication. Users can authenticate using their Active Directory (or
OpenLDAP) credentials when Active Directory support is enabled for Prism Central. See the
Nutanix Security Guide for these procedures.

Enabling and Configuring Client Authentication/CAC

Before you begin

• If you have enabled Identity and Access Management (IAM) on Prism Central as described in
Enabling IAM on page 169 and want to enable a client to authenticate by using certificates,
you must also enable CAC authentication.
• Ensure that port 9441 is open in your firewall if you are using CAC client authentication. After
enabling CAC client authentication, your CAC logon redirects the browser to use port 9441.

Procedure

1. In the web console, click the gear icon in the main menu and then select Authentication in
the Settings page.

2. Click the Client tab, then do the following steps.

a. Select the Configure Client Chain Certificate check box.

b. Click the Choose File button, browse to and select a client chain certificate to upload, and
then click the Open button to upload the certificate.

Note: Uploaded certificate files must be PEM encoded. The web console restarts after the
upload step.

c. To enable client authentication, click Enable Client Authentication.

d. To modify client authentication, do one of the following:

Note: The web console restarts when you change these settings.

• Click Enable Client Authentication to disable client authentication.

• Click Remove to delete the current certificate. (This also disables client authentication.)
• To enable OCSP or CRL based certificate revocation checking, see the Certificate
Revocation Checking topic in the Nutanix Security Guide.
Client authentication allows you to securely access the Prism by exchanging a digital
certificate. Prism will validate that the certificate is signed by your organization’s trusted
signing certificate.
Client authentication ensures that the Nutanix cluster gets a valid certificate from the user.
Normally, a one-way authentication process occurs where the server provides a certificate
so the user can verify the authenticity of the server. When client authentication is enabled,
this becomes a two-way authentication where the server also verifies the authenticity of the

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 171
user. A user must provide a valid certificate when accessing the console either by installing
the certificate on the local machine or by providing it through a smart card reader.

Note: The CA must be the same for both the client chain certificate and the certificate on the
local machine or smart card.

Note: For federal customers only.

Note: The Prism Central console restarts after you change this setting.

• Validates that the certificate has been signed by your organization’s trusted signing
certificate.
• Extracts the Electronic Data Interchange Personal Identifier (EDIPI) from the certificate
and uses the EDIPI to check the validity of an account within the Active Directory. The
security context from the EDIPI is used for your PRISM session.
• Prism Central supports both certificate authentication and basic authentication in order
to handle both Prism Central login using a certificate and allowing REST API to use
basic authentication. It is physically not possible for REST API to use CAC certificates.
With this behavior, if the certificate is present during Prism Central login, the certificate
authentication is used. However, if the certificate is not present, basic authentication is
enforced and used.
If you map a Prism Central role to a CAC user and not to an Active Directory group or
organizational unit to which the user belongs, specify the EDIPI (User Principal Name, or
UPN) of that user in the role mapping. A user who presents a CAC with a valid certificate is
mapped to a role and taken directly to the web console home page. The web console login
page is not displayed.

Note: If you have logged on to Prism Central by using CAC authentication, to successfully log
out of Prism Central, close the browser after you click Log Out.

Updating ADFS When Using SAML Authentication

With Nutanix IAM enabled, to maintain compatibility with new and existing IDP/SAML
authentication configurations, update your Active Directory Federated Services (ADFS)

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 172
configuration - specifically the Prism Central Relying Party Trust settings. For these
configurations, you are using SAML as the open standard for exchanging authentication and
authorization data between ADFS as the identity provider (IDP) and Prism Central as the
service provider. See the Microsoft Active Directory Federation Services documentation for
details.

About this task

In your ADFS Server configuration, update the Prism Central Relying Party Trust settings by
creating claim rules to send the selected LDAP attribute as the SAML NameID in Email address
format. For example, map the User Principal Name to NameID in the SAML assertion claims.
As an example, this topic uses UPN as the LDAP Attribute to map. You could also map the
email address attribute to NameID. See the Microsoft Active Directory Federation Services
documentation for details about creating a claims aware Relying Party Trust and claims rules.

Procedure

1. In the Relying Party Trust for Prism Central, configure a claims issuance policy with two rules.

a. One rule based on the Send LDAP Attributes as Claims template.

b. One rule based on the Transform an Incoming Claim template

2. For the rule using the Send LDAP Attributes as Claims template, select the LDAP Attribute
as User-Principal-Name and set Outgoing Claim Type to UPN.

3. For the rule using the Transform an Incoming Claim template:

a. Set Incoming claim type to UPN.

b. Set the Outgoing claim type to Name ID.
c. Set the Outgoing name ID format to Email.
d. Select Pass through all claim values.

Adding a SAML-based Identity Provider

Before you begin

Procedure

1. In the web console, click the gear icon in the main menu and then select Authentication in
the Settings page.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 173
2. To add a SAML-based identity provider, click the + New IDP link.
A set of fields is displayed. Do the following in the indicated fields:

Figure 88: Identity Provider Fields (metadata configuration)

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 174
Restoring Identity and Access Management Configuration Settings
Prism Central regularly backs up the Identity and Access Management (IAM) database, typically
every 15 minutes. This procedure describes how to restore a specific time-stamped IAM backup
instance.

About this task

You can restore authentication and authorization configuration settings available from the IAM
database. For example, use this procedure to restore your authentication and authorization
configuration to a previous state. You can choose an available time-stamped backup instance
when you run the shell script in this procedure, and your authentication and authorization
configuration is restored to the settings in the point-in-time backup.

Procedure

1. Log in to the Prism Central VM through an SSH session as the nutanix user.

2. Run the backup shell script restore_iamv2.sh

nutanix@pcvm$ sh /home/nutanix/cluster/bin/restore_iamv2.sh

The script displays a numbered list of available backups, including the backup file time-
stamp.
Enter the Backup No. from the backup list (default is 1):

3. Select a backup by number to start the restore process.

The script displays a series of messages indicating restore progress, similar to:
You Selected the Backup No 1
Stopping the IAM services
Waiting to stop all the IAM services and to start the restore process
Restore Process Started
Restore Process Completed
...
Restarting the IAM services
IAM Services Restarted Successfully

After the script runs successfully, the command shell prompt returns and your IAM
configuration is restored.

4. To validate that your settings have been restored, log on to the Prism Central web console
and go to Settings > Authentication and check the settings.

AOS Security | Security Management Using Identity and Access Management (Prism Central) | 175

Online Voting System Final
100% (3)
Online Voting System Final
92 pages
120.20.co.0 Information Communication Technology Fundamentals - Reviewed
No ratings yet
120.20.co.0 Information Communication Technology Fundamentals - Reviewed
32 pages
Complete Guide To Understanding The Citrix Logon Process
No ratings yet
Complete Guide To Understanding The Citrix Logon Process
17 pages
Nutanix Security Guide v6 - 6 - Compressed
No ratings yet
Nutanix Security Guide v6 - 6 - Compressed
233 pages
Nutanix Controller VM Security Operations Guide
No ratings yet
Nutanix Controller VM Security Operations Guide
15 pages
Nutanix Systems Engineering (SE) Academy
No ratings yet
Nutanix Systems Engineering (SE) Academy
8 pages
Corebootcamp 1o4 Hci Rebranded
No ratings yet
Corebootcamp 1o4 Hci Rebranded
61 pages
Nutanix_for_XC_Series_Deployment_and_Configuration_5_x_Lab_Guide
No ratings yet
Nutanix_for_XC_Series_Deployment_and_Configuration_5_x_Lab_Guide
145 pages
Nutanix Support Guide
No ratings yet
Nutanix Support Guide
24 pages
nutanix-NCM - Update - 13 March-2021
No ratings yet
nutanix-NCM - Update - 13 March-2021
48 pages
Vmware Virtualization Health Check Service
No ratings yet
Vmware Virtualization Health Check Service
13 pages
BP Nutanix Volumes
No ratings yet
BP Nutanix Volumes
49 pages
Nutanix - Advanced Admin AOS v5 - 10
No ratings yet
Nutanix - Advanced Admin AOS v5 - 10
61 pages
NCP-MCI-6-5_12082024
No ratings yet
NCP-MCI-6-5_12082024
157 pages
WP Nutanix Complete Cluster Technical Whitepaper
No ratings yet
WP Nutanix Complete Cluster Technical Whitepaper
15 pages
NSX For VSphere - A Foundation of The SDDC
No ratings yet
NSX For VSphere - A Foundation of The SDDC
234 pages
Nutanix Support Guide
No ratings yet
Nutanix Support Guide
29 pages
MetroCluster Service and Expansion Guide
No ratings yet
MetroCluster Service and Expansion Guide
178 pages
Customerfacing Portfolio Intro Deck
No ratings yet
Customerfacing Portfolio Intro Deck
29 pages
Life Cycle Manager Dark Site Guide v2 - 3
No ratings yet
Life Cycle Manager Dark Site Guide v2 - 3
33 pages
The Nutanix Bible: by Steven Poitras
No ratings yet
The Nutanix Bible: by Steven Poitras
164 pages
Demystifying Cisco ACI For HP Servers With OneView, Virtual Connect and B22 Modules
No ratings yet
Demystifying Cisco ACI For HP Servers With OneView, Virtual Connect and B22 Modules
30 pages
NSX Administration Guide NSX For Vsphere 6.2
No ratings yet
NSX Administration Guide NSX For Vsphere 6.2
370 pages
Nutanix Files
No ratings yet
Nutanix Files
64 pages
NS0 157
No ratings yet
NS0 157
42 pages
Fos 90x Webtools
No ratings yet
Fos 90x Webtools
197 pages
DDN A3i Ai400x2 Nvidia DGX h100 Basepod Reference Architecture
No ratings yet
DDN A3i Ai400x2 Nvidia DGX h100 Basepod Reference Architecture
24 pages
Nutanix Move v3 - 6
No ratings yet
Nutanix Move v3 - 6
159 pages
Netapp Certification Program: Reference Document List
No ratings yet
Netapp Certification Program: Reference Document List
19 pages
Tech Note-Nutanix-Clusters-On-Aws
100% (1)
Tech Note-Nutanix-Clusters-On-Aws
43 pages
AHV Admin Guide v6 - 0
100% (1)
AHV Admin Guide v6 - 0
142 pages
NMC Guide
No ratings yet
NMC Guide
581 pages
cr4 2x PDF
No ratings yet
cr4 2x PDF
2,092 pages
CVM Commands
No ratings yet
CVM Commands
13 pages
ALL NETAPP Helthcheck
100% (1)
ALL NETAPP Helthcheck
6 pages
Vsphere Admin6 AOS v6 - 6
No ratings yet
Vsphere Admin6 AOS v6 - 6
107 pages
Running Red Hat OpenShift Container Platform On VMware Cloud Foundation
No ratings yet
Running Red Hat OpenShift Container Platform On VMware Cloud Foundation
17 pages
CIS IBM AIX 7.2 Benchmark v1.0.0
No ratings yet
CIS IBM AIX 7.2 Benchmark v1.0.0
553 pages
Docker Course
No ratings yet
Docker Course
34 pages
Clustered ONTAP 8 2 Overview
No ratings yet
Clustered ONTAP 8 2 Overview
33 pages
Thinksystem Storage Guidebook
No ratings yet
Thinksystem Storage Guidebook
44 pages
Vmware Vsan and Vxrail Buyer'S Guide and Reviews September 2019
No ratings yet
Vmware Vsan and Vxrail Buyer'S Guide and Reviews September 2019
13 pages
Why Nutanix Acropolis Hypervisor
No ratings yet
Why Nutanix Acropolis Hypervisor
21 pages
Nutanix and Vmware Vsan Buyer'S Guide and Reviews September 2019
No ratings yet
Nutanix and Vmware Vsan Buyer'S Guide and Reviews September 2019
13 pages
AHV Admin Guide v6 0
No ratings yet
AHV Admin Guide v6 0
148 pages
Workload Migration - Deployment and Operations Guide
No ratings yet
Workload Migration - Deployment and Operations Guide
71 pages
Veritas Storage Foundation 5.0 Administrator's Guide
No ratings yet
Veritas Storage Foundation 5.0 Administrator's Guide
710 pages
Nutanix: Nutanix Certified Professional (NCP) 5.10 Exam
No ratings yet
Nutanix: Nutanix Certified Professional (NCP) 5.10 Exam
7 pages
Ocade Gen 7
No ratings yet
Ocade Gen 7
100 pages
SPOCC User Guide
No ratings yet
SPOCC User Guide
33 pages
Nutanix
No ratings yet
Nutanix
43 pages
NPM Administrator Guide PDF
No ratings yet
NPM Administrator Guide PDF
390 pages
NetApp ONTAP Simulate Setup Guide
No ratings yet
NetApp ONTAP Simulate Setup Guide
41 pages
Software-Defined Storage: IBM Spectrum Storage Family
No ratings yet
Software-Defined Storage: IBM Spectrum Storage Family
48 pages
INF BCO1436 Vmware Replication Best Practices
No ratings yet
INF BCO1436 Vmware Replication Best Practices
46 pages
Network Appliance NS0-145
No ratings yet
Network Appliance NS0-145
56 pages
NCP MCI Demo
No ratings yet
NCP MCI Demo
8 pages
02 VMware NSX For Vsphere 6.2 Architecture Overview
No ratings yet
02 VMware NSX For Vsphere 6.2 Architecture Overview
104 pages
vSphere 5 AutoLab 1.1a Deployment Guide
From Everand
vSphere 5 AutoLab 1.1a Deployment Guide
Alastair Cooke
No ratings yet
SolarWinds Server & Application Monitor : Deployment and Administration
From Everand
SolarWinds Server & Application Monitor : Deployment and Administration
Justin M. Brant
No ratings yet
Software-Defined WAN SD-WAN A Clear and Concise Reference
From Everand
Software-Defined WAN SD-WAN A Clear and Concise Reference
Gerardus Blokdyk
No ratings yet
Learning OpenStack Networking (Neutron), Second Edition: Wield the power of OpenStack Neutron networking to bring network infrastructure and capabilities to your cloud
From Everand
Learning OpenStack Networking (Neutron), Second Edition: Wield the power of OpenStack Neutron networking to bring network infrastructure and capabilities to your cloud
James Denton
No ratings yet
Instant VMware vCloud Starter
From Everand
Instant VMware vCloud Starter
Daniel Langenhan
No ratings yet
Advanced Certification in Cyber Security 1
No ratings yet
Advanced Certification in Cyber Security 1
13 pages
CSIT128 / CSIT828: Joseph Tonien
No ratings yet
CSIT128 / CSIT828: Joseph Tonien
43 pages
Fortiadc DG Apache
No ratings yet
Fortiadc DG Apache
43 pages
Record Book Practicals(Answer Key) (2)
No ratings yet
Record Book Practicals(Answer Key) (2)
33 pages
SumatraPDF Settings
No ratings yet
SumatraPDF Settings
2 pages
XCAT 2.0: A Component-Based Programming Model For Grid Web Services
No ratings yet
XCAT 2.0: A Component-Based Programming Model For Grid Web Services
10 pages
Mis207 Term Project
No ratings yet
Mis207 Term Project
30 pages
Soccer Betting Tips Mobile App
No ratings yet
Soccer Betting Tips Mobile App
3 pages
Nmap Scripts
100% (1)
Nmap Scripts
52 pages
Unit 4 INTERNET AND WEB
No ratings yet
Unit 4 INTERNET AND WEB
29 pages
Module 1 (Reviewer)
No ratings yet
Module 1 (Reviewer)
14 pages
How To Access Online Classes and Paid Materials: Prepinsta
No ratings yet
How To Access Online Classes and Paid Materials: Prepinsta
11 pages
2kl18mca50 Intern Report
No ratings yet
2kl18mca50 Intern Report
16 pages
Skilly - Freelance Platform Wireframe
No ratings yet
Skilly - Freelance Platform Wireframe
10 pages
E - PROC - AUCTION - ROYAL ENFIELD - 25th - Nov - Steelez
No ratings yet
E - PROC - AUCTION - ROYAL ENFIELD - 25th - Nov - Steelez
6 pages
User Parameters - ERP SCM
No ratings yet
User Parameters - ERP SCM
12 pages
Network Design: Planning A Network With Different Users, Hosts, and Services
No ratings yet
Network Design: Planning A Network With Different Users, Hosts, and Services
8 pages
Hej Mubarek Ramazan Tekst PDF
No ratings yet
Hej Mubarek Ramazan Tekst PDF
1 page
Free MTN Configuration 3.5G and Others: Manual Instructions
No ratings yet
Free MTN Configuration 3.5G and Others: Manual Instructions
3 pages
Quick Start Guide - For Law Enforcement
No ratings yet
Quick Start Guide - For Law Enforcement
2 pages
Mine Resume
No ratings yet
Mine Resume
2 pages
3.5.7 Lab Social Engineering
No ratings yet
3.5.7 Lab Social Engineering
4 pages
Google Maps API Succinctly
100% (1)
Google Maps API Succinctly
104 pages
If I Can't Have You mp3: Manage Sources (2/7)
No ratings yet
If I Can't Have You mp3: Manage Sources (2/7)
4 pages
Final Thesis Capstone 12345
No ratings yet
Final Thesis Capstone 12345
68 pages
Evolution Fo Google (1st)
No ratings yet
Evolution Fo Google (1st)
9 pages
Message
No ratings yet
Message
2 pages