棱镜元素，棱镜中央和HTTP代理白名单。

A note of clarification: in this post we\u00a0discuss network communication inside and outside an environment. To prevent any confusion,\u00a0the \u201cenvironment\u201d refers to the internal\u00a0network, either physical local LAN, VLAN, or VPN, which is separated from other systems and the internet\u00a0by a firewall and proxy. Anything within the environment is \u201clocal\u201d and anything past the firewall is \u201cexternal\u201d.<\/p>

So, why does this matter?<\/p>

If your environment\u00a0has an HTTP proxy there is probably also a firewall rule blocking any HTTP(S) traffic that is\u00a0not\u00a0going through the proxy. Without proxy configuration\u00a0in this kind of environment, external HTTP communication is blocked. The 1-click upgrade UI is unable to display or download newer AOS, Foundation, and NCC versions. Life Cycle Manager (LCM) could run an inventory but firmware and software updates would need to be hosted inside the environment using the dark-site bundle. Pulse HD data used for identifying potential cluster issues, usually sent via HTTPS, would get blocked by the firewall. To get these features working the proxy configuration needs to be added in Prism.<\/p>

Once the proxy configuration is set, all HTTP communication initiated by Prism will be sent through the proxy server. This does not affect CVM to CVM communications, but any HTTP(S) connections from Prism will be routed through the proxy until a whitelist entry indicates otherwise, even if the destination IP is in the local subnet. This can cause PE\/PC communication to fail, so for this we need the whitelist configuration.<\/p>

First, let\u2019s review the HTTP proxy setting.\u00a0<\/p>

<\/figure>

This setting affects Prism services on the Nutanix cluster or Prism Central instance only. Changes to this setting will not affect hosted VMs, data service, or other services on the Nutanix cluster.\u00a0<\/p>

To configure an HTTP Proxy on Prism Element or Prism Central, go to Settings and click HTTP Proxy under the Network heading in the left sidebar, then click \u201c+ New Proxy\u201d. The Create HTTP Proxy UI appears.<\/p>

<\/figure>

Fill out the information in the fields provided. Username and Password can be skipped unless your proxy requires authentication. Click save to finish this step.\u00a0<\/p>

Now to the whitelist settings.<\/p>

You likely do not need to add any whitelist entries if your Prism Element cluster is not registered with Prism Central. For Prism Element on its own, add a whitelist entry for any hosts Prism will need to reach internally using HTTP(S).<\/p>

If we are working on Prism Central, or on a cluster registered to Prism Central we almost certainly\u00a0need to add whitelist entries. An exception would be if Prism Central can only be reached by Prism Element through the proxy\u00a0vice versa.<\/p>

A whitelist entry is a single host identified by IP address or a network identified by the network address and subnet mask. Adding a whitelist entry means \u201cignore proxy settings for this address or network\u201d.<\/p>

I would generally recommend adding subnets rather than host records. This saves time, provides reliability, and is functionally future-proofed in case you add new nodes, scale out Prism Central, or add another cluster later.<\/p>

To add a whitelist entry, find the edit icon next to the Proxy entry you just added. In the Update HTTP Proxy UI that appears you will see the settings you recently entered as well as a new section at the bottom, Whitelist. Click Create to add the first whitelist entry.<\/p>

<\/figure>

If you want to whitelist a single IP address, just enter the address. For example, you could enter \u201c10.20.30.123\u201d and click save, and then any HTTP(S) traffic to that IP address would be sent directly rather than through the proxy.<\/p>

To whitelist an entire subnet, provide the network address and the subnet mask. The format you\u2019ll want is like this: \u201c10.20.30.0\/255.255.255.0\u201d. Once this entry is added and the configuration is saved, all communication to the 10.20.30.0\/24 subnet will be sent directly rather than routing through the proxy.<\/p>

From Prism Element add all the IPs owned by Prism Central. From Prism Central add an entry for the cluster virtual IP of each registered cluster, as well as an entry for every CVM in the cluster. Again, you can whitelist a network to save time and ensure that any nodes added into the network later are also whitelisted.<\/p>

Steps to set up the proxy and whitelist are documented in the\u00a0Prism Web Console Guide<\/a>\u00a0and the\u00a0Prism Central Guide<\/a>.\u00a0<\/p>","quoteUsername":"JeremyJ","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">

• 喜欢
• 引用
• 分享