Nutanix: AI assistant (LLM)

If you are deploying with an AI coding assistant (Claude, Codex, and similar), copy the prompt below and paste it into your assistant. It drives the same acli flow as the CLI (acli) guide, but written for the assistant to follow step by step, pausing for your confirmation and for the values only you can supply.

Before you paste

Give the assistant a session that can run acli on a Controller VM (an agentic tool with SSH access to a CVM, or paste the commands it returns into your own acli session); if it cannot reach a CVM it can still walk you through the equivalent steps in the Prism web console. Have these ready: both extracted QCOW2 disks (the root/OS disk and the small cidata seed disk), a storage container name, a network/VLAN name, and a VM name. The assistant will ask for anything it is missing.

Deployment prompt

You are helping me deploy the Sophos Remote Testing Appliance (RTA) as a virtual
machine on a Nutanix AHV cluster, using acli on a Controller VM. Work through the
steps below in order. Before any command that changes state, tell me what it will do
and wait for my confirmation.

CONTEXT:
- The appliance is delivered as TWO QCOW2 disk images: a root/OS disk and a small
  cidata seed disk. The cidata disk carries the engagement identity, so the image is
  customized before I receive it and boots already registered: there is no code to
  read or send and no software to install. It needs no inbound access.
- Both disks are mandatory. Without the cidata seed disk the appliance has no
  engagement identity and will not register.

WHAT I WILL PROVIDE (ask me for any you do not have; never guess these):
- <ROOT_URL>: a URL the cluster can reach for the root QCOW2 disk, extracted from
  the archive my engagement lead sent.
- <CIDATA_URL>: the same for the cidata QCOW2 seed disk from that archive.
- <CONTAINER>: the storage container to upload the images into (for example default).
- <NETWORK>: the network/VLAN name with Layer-2 access to the targets and outbound
  internet.
- <VM_NAME>: the name for the VM (for example Sophos-RTA).

STEPS:
1. Upload BOTH disk images to the Image Service, one for the root disk and one for
   the cidata seed disk:
   acli image.create rta-root   source_url=<ROOT_URL>   image_type=kDiskImage container=<CONTAINER>
   acli image.create rta-cidata source_url=<CIDATA_URL> image_type=kDiskImage container=<CONTAINER>
   The imports run asynchronously. Poll until BOTH images show state kComplete:
   acli image.list
   Do not continue until both are kComplete. If either fails, stop and show me the
   output.

2. Create the VM with UEFI firmware (num_vcpus=4 / memory=8G is recommended; the
   minimum is num_vcpus=2 / memory=4G):
   acli vm.create <VM_NAME> num_vcpus=4 num_cores_per_vcpu=1 memory=8G uefi_boot=true
   uefi_boot=true is mandatory: Nutanix defaults to Legacy BIOS, which this image
   will NOT boot. Do NOT add secure_boot=true; the bootloader is unsigned and Secure
   Boot must stay off (omitting it is correct).

3. Attach BOTH disks: clone the root image as the boot disk, then clone the cidata
   image as a second disk, both on the SCSI bus:
   acli vm.disk_create <VM_NAME> clone_from_image=rta-root   bus=scsi
   acli vm.disk_create <VM_NAME> clone_from_image=rta-cidata bus=scsi
   The VM must end up with two SCSI disks. If the cidata disk is missing, the
   appliance will not register. Confirm both are attached before powering on.

4. Attach the network interface to the engagement network:
   acli vm.nic_create <VM_NAME> network=<NETWORK>

5. Power on the VM:
   acli vm.on <VM_NAME>

VERIFY:
6. Confirm the VM is running with UEFI enabled:
   acli vm.list
   acli vm.get <VM_NAME>
   Expect the VM state on and uefi_boot True. Then open the Prism console (select the
   VM, then Launch Console). Because the image is pre-registered, the console shows a
   live status and troubleshooting dashboard (network interface, VPN tunnel, and
   connectivity health) and the outbound tunnel comes up on its own. There is no code
   to read or send. If the console is blank, the VM most likely booted Legacy BIOS:
   stop and tell me, then recreate it with uefi_boot=true.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a command fails, returns something unexpected,
  or reality does not match what is written here, STOP and show me the exact output.
  Do not improvise, invent flags, or try alternative commands on your own.
- The appliance needs exactly ONE connection: an outbound tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. Never open, forward, or allow any INBOUND
  port to it. If connectivity fails, the problem is on the outbound path, never a
  missing inbound rule.
- Never enable Secure Boot and never change the firmware or boot type away from what
  these steps specify (UEFI / Generation 2). The appliance will not boot otherwise.
- Do not SSH into, log in to, or reconfigure the appliance. Once it boots it
  provisions itself; there is nothing to set up inside it.
- Every value in angle brackets (<LIKE_THIS>) must come from me. Never guess, invent,
  or reuse one. Ask me for any you do not have before running the step that needs it.
- Do not weaken security to force the connection (do not disable TLS inspection, and
  do not turn off a firewall). If something is blocked, tell me what and let me decide.
- Do only what these steps describe: deploy this one appliance. Do not create extra
  resources, install extra software, or take any action beyond that.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination

Destination	connect.remotetesting.secureworks.com
IP addresses	3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.