Deploy a Nutanix Appliance

The following sections detail how to install a virtual appliance to Nutanix and add it to the network.

Download a PDF of this guide.

Review the following requirements and considerations before you begin.

System requirements vary by the appliance generation. For appliance system requirements, see the Supported Components in the Imprivata Environment Reference.

Unsupported

The following virtual appliance configurations are not supported:

  • The cloning of appliance virtual machines is not supported.

  • Infrastructure-level snapshots of appliance virtual machines are not supported.

Considerations for Storage Level RAID Protection

While most customers will want to use RAID 5, Imprivata recommends RAID 1+0 or RAID 10 for any appliances that are experiencing a challenge with throughput, especially G4 database appliances.

NOTE:

For specific questions about enterprise configuration or additional guidance, contact Imprivata services or support.

G4 Appliances

The number of appliances appropriate for a G4 enterprise depends on many factors, including user counts, authentication methods, and other issues.

First, consider the two G4 appliance types and the limits on their numbers per enterprise:

  • Database appliances host the databases, perform database replication, service endpoint agent requests, and contain all audit data.

    • Enforced maximum of two database appliances per enterprise.

    • The first two appliances configured are always database appliances.

  • Service appliances exclusively service endpoint agent requests.

    • Recommended maximum of four service appliances per enterprise.

  • Recommended maximum of six total appliances per enterprise. Adding more appliances beyond six typically does not yield performance improvements.

  • No audit appliances.

For G4 appliances, Imprivata recommends three standard deployment options: two-, four-, and six-appliance enterprises. The two-appliance enterprise offers three different CPU and RAM configuration options for scale.

Recommended Options 2 Appliance Enterprise 4 Appliance Enterprise 6 Appliance Enterprise
Database appliances 2 2 2 2 2
CPUs per appliance 4 8 8 8 8
RAM (GB) per appliance 8 16 32 16 16
Service appliances       2 4
CPUs per appliance       2 2
RAM (GB) per appliance       8 8
Total appliance CPUs in enterprise 8 16 16 20 24
Total appliance RAM in enterprise 16 32 64 48 64
Number of user sessions supported (in optimal conditions) 22,000 to 28,000 28,000 to 36,500 36,500 to 47,500 47,500 to 62,000 62,000 to 80,000+
NOTE:

Regarding the last row of the table above: If many or most users use Virtual Desktop Infrastructure (VDI) applications and/or desktops, then the number of user sessions can be double or triple the number of online users for the enterprise.

IMPORTANT:

If you change the amount of RAM per appliance, it increases the storage required in your hypervisor environment for the virtual memory swap file for powering on the virtual appliance. Ensure that you have allocated enough storage to accommodate the change. Otherwise, powering on the virtual appliance will fail.

IMPORTANT:

For OneSign 7.11 and later releases, G4 appliances ship with four CPUs by default. When deploying new G4 service appliances, manually remove two CPUs. These defaults and requirements do not apply to G4 appliances on Azure. For information on G4 appliances on Azure, see Deploy G4 Appliances on Azure.

  • The base two-appliance G4 enterprise, having 4 CPUs and 8 GB RAM per appliance, totaling 8 CPUs and 16 GB RAM for the enterprise, can be equated to a base two-appliance G3 enterprise that can accommodate 22,000 to 28,000 user sessions.

    Each additional column or step in the G4 table above yields approximately a 30% improvement in throughput.

  • Odd numbers of appliances are recommended only when migrating from a G3 or G2 enterprise to a G4 enterprise, when the original enterprise has an odd number of appliances.

    • Migrations require the same number of G4 appliances in your new G4 enterprise as you have in your existing G3 or G2 enterprise, to support the enterprise export from G3 or G2 and import into G4.

    • For a migration with an odd number of appliances, after you transition your G4 enterprise to production, Imprivata recommends that you transition to a standard deployment configuration.

  • Selecting an optimal enterprise configuration depends on knowing your total number of users and endpoints in your environment, usage patterns to identify peak activity periods, and disaster recovery needs that may stretch the topologies and halve the resources for active/active type setups.

    There are many factors that affect performance including authentication types, multi-factor authentication methods, EPCS (electronic prescription of controlled substances) workflows, underlying hardware options for hosting the virtual machines that host the appliances, underlying network topology, and more.

    Newer high performing systems may yield better throughputs, and conversely older systems may yield poorer performance.

  • For customers with active G3 enterprises larger than two appliances, the rule of thumb is to first count the total number of CPUs in your current deployment. Then in the G4 table above, in row Total appliance CPUs in enterprise, find a G4 configuration with a matching CPU count.

The Imprivata appliance supports the initial assignment of the following:

  • IP address, subnet mask, and default gateway.

  • DNS servers.

  • NTP servers from the NTP Pool Project.

As part of the initialization process, an IP address, subnet, and default gateway are initially assigned.

This is achieved using either DHCP, if enabled in your environment, or later using the Imprivata Appliance Console when adding the appliance to a network. If required, you can change the settings using one of the following:

  • The Imprivata Appliance Console before running the Imprivata appliance configuration (setup) wizard.

  • The Imprivata Appliance Console (https://<appliance IP address>:81/) after completing the appliance configuration (setup) wizard.

NOTE: If DHCP is used to assign these values, be sure to take the necessary steps to prevent duplicate IP address conflicts on the DHCP network. The Imprivata appliance requires a static IP address.

As part of the initialization process, up to three DNS servers are initially assigned.

  • This is achieved using either DHCP, if enabled in your environment, or using the Imprivata Appliance Console.

  • If required, the appliance configuration (setup) wizard lets you change these settings as part of the initial setup of the network services. Additionally, after the appliance has been added to the enterprise, you can use the Imprivata Appliance Console (Network > Name Resolution) to update them.

As part of the initialization process, the following servers from the North American pool are configured by default:

  • 0.north-america.pool.ntp.org

  • 1.north-america.pool.ntp.org

  • 2.north-america.pool.ntp.org

If required, the appliance configuration wizard lets you change these settings as part of the initial setup of the network services. Additionally, after the appliance has been added to the enterprise, you can use the Imprivata Appliance Console (Network > NTP) to update them.

NOTE: If you choose to change the defaults, configure at least two external internet-based NTP servers for redundancy. Internal NTP servers are not recommended.

Using an internal NTP server or a Windows Server as an NTP source is not recommended. Windows does not correct any offset that may occur. Windows will keep adding to the offset and eventually an error will occur.

The following sections detail how to deploy the Imprivata appliance add it to the network.

You upload the Imprivata VMDK file (system-disk1) to create the appliance image.

To create the image:

  1. From your fulfillment letter, download and extract the Imprivata Virtual Appliance RAR file.

  2. In the Prism UI, select Settings from the main menu.

  3. On the Settings page, click Image Configuration, and then click Upload Image.

  4. Enter a name for the image.

  5. From the Image Type list, select Disk.

  6. Select a storage container, specify the image source location, and then click Save.

To deploy the appliance:

  1. In Prism UI, select VM from the main menu, and then click Create VM.

  2. On the Create VM dialog:

    1. Enter a name and select a timezone.

    2. Under Compute Details, allocate the minimum required RAM and CPU, and then click Add New Disk.

      See "Imprivata OneSign Supported Components" in the Imprivata Environment Reference for the minimum requirements.

  3. On the Add Disk dialog:

    1. From the Operation list, select Clone from Image Service .

    2. From the Image list, select the appliance image that was created using the Imprivata VMDK file, and click Add.

  4. On the Create VM dialog:

    1. Under Disks, select Disk as the boot device.

    2. Under Network Adapters (NIC), click Add New NIC.

  5. On the Create NIC dialog:

    1. From the VLAN list, select the target virtual LAN.

    2. Deploy the NIC in a Connected state, and then click Add.

  6. On the Create VM dialog, click Save.

The following procedures detail how to add the appliance to the network.

  1. In the Prism UI, select VM from the main menu, and then click Table.

  2. Locate the virtual machine, click the name, and then click Power on.

  3. Click Launch Console.

NOTE: The initialization scripts run and display progress. The time to complete is approximately 15 minutes. If you receive a database error messaging when trying to log in, the appliance has not finished initializing.

To add the appliance to the network:

  1. Power on the appliance, and open the console to start the appliance initialization scripts.

    • The initialization scripts run in the background and do not display progress. The time to complete is approximately 15 minutes.

    • The Imprivata Appliance Console displays the IP address, subnet mask, and gateway that is initially assigned to the appliance.

  2. (Optional, or if DHCP is unavailable on your network) If required, you can add or change the network configuration manually:

    1. At the login prompt type menu, and then press Enter.

    2. Type 1, and then press Enter to assign or reassign the values.

      NOTE: If you receive a database error message when trying to log in, the appliance has not finished initializing.

  3. Exit the Imprivata Appliance Console.

  4. In a web browser, enter https://<appliance_IP_address>:81 to complete the setup using the appliance configuration (setup) wizard.

You access the virtual appliance function menu from the Imprivata virtual appliance menu. Not all menu options are available until you complete the Imprivata Configuration Wizard.

To access the Imprivata virtual appliance menu:

  1. Open the virtual machine console.

  2. Select Login and press Enter.

  3. At the login prompt, enter menu and press Enter. If prompted, enter the menu password and press Enter. The Imprivata virtual appliance functions menu opens.

The menu options are:

  • Configure Network — Lets you change the default gateway for the appliance. It is for installation only. Change this setting from the Network tab under the Network page of the Imprivata Appliance Console.

  • Reset SSL — Clears all SSL information, including the optional SSL 2.0 setting as explained in Enabling SSL 2.0.

  • Reset Administrator password for Imprivata Appliance Console— Resets the Administrator password to admin. You cannot reset the Super Administrator password.

  • Modify Password for this menu — Lets you set or clear the password for this menu.

  • Restage — Resets the appliance to factory settings. Contact Imprivata Customer Support for assistance with restaging an appliance.

  • Restart — Restarts the appliance. It is best to restart the appliance by using the Imprivata Appliance Console System page > Operations tab > Reboot/shutdown options > Reboot this appliance, unless the Imprivata Appliance Console is unreachable.

  • Shutdown — Shuts down the appliance. The Virtual Machine is still deployed in the VMware host.

  • Quit

Verify that the files were not corrupted during download.

  1. In the Imprivata Virtual Appliance RAR file, there should be three files:

    • .mf - a manifest files, containing checksums for the OVF and VMDK files.

    • .ovf - the virtual machine template file, containing a description of the virtual machine.

    • .vmdk - the virtual machine hard disk file.

  2. Open the .mf file in a text editor. It is formatted similar to the following example:

    SHA1(imprivata6.2.ovf)= a956be53480a2d6f4ca43a9c6ef46fba2e326150
SHA1(system-disk1.vmdk)= a2bedcb3bfb14e7bbbf5ad481d58104aa1ec79ba

  3. Run a hash of each of these two files to verify the resulting checksums against the contents of the manifest file.

    Use the following PowerShell command to get the file hash and convert it to lower case for easy comparison:

    $(Get-FileHash .\imprivata6.2.ovf -Algorithm SHA1 | Select -ExpandProperty Hash).ToLower()

  4. Compare the output of the PowerShell command with the checksum in the manifest file.

    • If the checksums match, it confirms that the download is good and that the extracted files are good.

    • If the checksums do not match, it indicates that the files may be corrupted and may indicate a problem with either the extraction or download process.