* For a VM deployed in an NC2 cluster on AWS to be accessed by resources within the on-premises datacenter, the security group associated with the User VM (UVM) subnet must allow inbound traffic on the specific ports required by the application.
* If the security group rules do not permit inbound traffic on these ports, the communication will fail, even if other network configurations are correct.
* The administrator should ensure that the UVM Security Group includes rules to allow inbound traffic for the application ' s required ports, facilitating proper communication between the VM and on- premises resources.
Refer to the AWS documentation on security group configurations and Nutanix NC2 documentation for details on configuring network access and security group rules.

Monitoring the health and connectivity of stretched Layer 2 networks is vital for maintaining seamless hybrid cloud operations.
In a Nutanix environment managed via Prism Central, the specific location to verify the operational status of these extensions is underNetwork and Security, specifically within theNetwork Servicessection labeledSubnet Extensions. This dashboard provides visibility into the VTEP (VXLAN Tunnel Endpoint) gateways and the specific subnets that have been extended from the on-premises environment to NC2 on AWS. Administrators can check if the tunnel is " Up " or " Down " and view performance metrics associated with the stretched segment. Ensuring the status is monitored here allows for rapid troubleshooting of connectivity issues that might prevent virtual machines from communicating across the hybrid link.

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.
Custom Security Group:
Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.
By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.
Steps to Create a Custom Security Group:
Navigate to the AWS Management Console and go to the VPC service.
Select "Security Groups" under the "Security" section.
Click on "Create Security Group" and define the name, description, and VPC.
Add inbound and outbound rules according to the desired traffic control policies.
Attach the custom security group to the UVMs or subnets in question.
Reference:
Nutanix Cloud Clusters on AWS Administration Guide
AWS Security Group Documentation
Nutanix Best Practices for Security Groups