Nutanix MCP Behind a Gateway: Keep Control

Updated 4 November 2026 · Standard formula, shown below

Putting Nutanix MCP (Management Control Plane) behind a gatewayâ€”such as a NAT, proxy, or load balancerâ€”can improve security and centralize access, but it often breaks cluster management if not configured carefully. This guide shows you how to place MCP behind a gateway while retaining full administrative control, including UI access, API calls, and cluster operations.

What You’ll Need

Administrative access to the Nutanix cluster (Prism Element or Prism Central) with credentials that can modify network settings.
SSH access to the cluster nodes (for verifying services and making changes if needed).
Gateway device (router, firewall, or load balancer) with the ability to configure port forwarding, NAT, or reverse proxy rules.
Knowledge of the cluster’s IP addresses and the ports used by MCP: 9440 (Prism UI), 2020 (REST API), 2030 (REST API for Prism Central), and 22 (SSH) if you need remote CLI.
Optional: A DNS name that resolves to the gateway’s public IP for easier access.

Step-by-Step

Plan your network topology. Decide whether the gateway will use port forwarding (1:1 NAT) or a reverse proxy with host-based routing. For a single cluster, port forwarding is simpler; for multiple clusters, a reverse proxy with separate hostnames is better.
Reserve static IPs. Ensure the cluster’s management IPs (Prism Element and Prism Central) are static. If they are DHCP, assign reservations so they don’t change and break the gateway rules.
Configure the gateway’s port forwarding. On your gateway, create NAT rules that map external IP:port to the cluster’s internal IP:port. For example, map external 203.0.113.10:9440 to internal 192.168.1.10:9440. Repeat for ports 2020 and 2030 if you use APIs. If you need SSH, forward port 22 to the cluster’s management IP, but consider using a non-standard external port for security.
Set up firewall rules. On the gateway, allow inbound traffic on the forwarded ports from the source IPs you want to grant access (e.g., your corporate VPN or admin workstation). Block all other sources to keep the cluster secure.
Test the external access. From a machine outside the internal network, try to reach the Prism UI using the gateway’s external IP and port (e.g., https://203.0.113.10:9440). You should see the login page. If not, check the NAT rules and firewall.
Verify API access. Use a REST client (like curl) to hit the API endpoint through the gateway. For example: curl -k https://203.0.113.10:2020/api/nutanix/v3/clusters with appropriate credentials. Ensure you get a valid response.
Update cluster network settings (if needed). If your cluster uses a web proxy for outbound internet (e.g., for licensing or updates), configure that in Prism Element > Settings > Network. This is separate from the gateway and must be set to allow the cluster to reach the internet.
Handle TLS certificates. If you use a reverse proxy with a domain name, you’ll likely want to put a valid SSL certificate on the proxy. Nutanix clusters use self-signed certificates by default, so you’ll need to either trust the cluster’s certificate in your browser or replace it with a CA-signed one. For the proxy, install a certificate for your domain and configure it to forward traffic to the cluster’s HTTPS port.
Test all management functions. After the gateway is in place, log into Prism UI through the gateway and perform a few operations: create a VM, check cluster health, and run a report. This ensures that not only the UI but also the backend API calls (which may use different ports) work correctly.
Document the configuration. Record the gateway IP, forwarded ports, and any DNS records. This will help with troubleshooting later.

Common Mistakes

Forgetting to forward API ports. Many admins only forward 9440 for the UI, but Prism Central and Prism Element also use 2020 and 2030 for API calls. If these are not forwarded, some features (like automation or scripting) will fail.
Using the wrong external IP. If the gateway has multiple external IPs, ensure you are using the correct one that the NAT rule is bound to.
Not considering the cluster’s outbound traffic. The cluster may need to reach external services (like Nutanix licensing or update servers). If the gateway blocks outbound, the cluster may become unhealthy.
Ignoring TLS certificate warnings. Browsers will warn about self-signed certificates. If you ignore this and click through, you might not notice a man-in-the-middle attack. Always validate the certificate fingerprint.
Placing the gateway in front of the cluster’s internal communication. The gateway should only handle management traffic, not the cluster’s internal heartbeat or data replication traffic. Ensure those are on a separate network segment.

Tips

Use a dedicated management VLAN. Keep the management network separate from the data network. This reduces exposure and makes firewall rules simpler.
Enable two-factor authentication (2FA) on Prism. If your version supports it, this adds an extra layer of security when accessing through a gateway.
Set up a VPN for admin access. Instead of exposing the gateway to the internet, consider using a VPN to access the management network. This is often more secure and easier to manage.
Monitor the gateway logs. Regularly review the gateway’s logs for unauthorized access attempts. Nutanix also has audit logs in Prism that you can review.
Keep the cluster software updated. Ensure you are running a supported version of Nutanix AOS. Updates often include security fixes that are important when exposing management interfaces.

Troubleshooting

UI loads but API calls fail. Check that you have forwarded ports 2020 and 2030. Also, verify that the API endpoint is reachable from the gateway (some gateways may block certain protocols).
Connection times out. This usually indicates a firewall or NAT issue. Check the gateway’s firewall rules and NAT entries. Also, verify that the cluster’s IP is reachable from the gateway (ping it).
Certificate errors in browser. If you are using a reverse proxy, ensure the proxy’s certificate is valid and trusted. If you are using direct port forwarding, you may need to import the cluster’s self-signed certificate into your browser’s trust store.
Prism Central is not accessible. If you have Prism Central on a separate IP, make sure you have forwarded the correct ports for it (9440, 2020, 2030). Also, check that Prism Central’s services are running (via SSH: cluster status).
Cluster health is degraded after adding gateway. This could be due to the cluster not being able to reach external services. Check the outbound rules on the gateway and ensure the cluster can reach the internet (or at least the required Nutanix endpoints).
Slow performance when accessing UI. This may be due to latency through the gateway. Consider using a reverse proxy with caching or a closer entry point.

Frequently Asked Questions

Will the gateway affect cluster performance?

No, the gateway only handles management traffic (UI and API). Data plane traffic (VM I/O) does not go through the gateway, so performance is unaffected.

Can I use a load balancer to distribute management traffic?

Yes, but only if you have multiple Prism Central instances. For a single cluster, a load balancer is unnecessary and may complicate things. If you do use one, ensure it supports session persistence (sticky sessions) because some API calls require the same node.

Is it safe to expose the management UI to the internet?

It is generally not recommended. Even with a gateway, it increases the attack surface. A VPN is a safer approach. If you must expose it, use strong authentication, limit IP ranges, and enable audit logging.

What ports do I need to forward for Prism Central?

Prism Central uses the same ports as Prism Element: 9440 (UI), 2020 (API), and 2030 (API). If you have both, forward these ports to each respective IP.

Do I need to change any settings on the cluster itself?

Usually not. The cluster will see the gateway as just another client. However, if you have IP-based access control lists (like firewall rules on the cluster), you may need to allow the gateway’s IP.

Can I use a reverse proxy with path-based routing?

Yes, but Nutanix UI and API do not use paths, so you would need to use host-based routing (different subdomains). For example, prism.example.com for UI and api.example.com for API. This is more complex but works.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.