A Recovery Plan in Nutanix is the orchestration engine that defines the power-on sequence, network mappings, and script execution for disaster recovery. While a single cluster can support various types of replication—Asynchronous, NearSync, and Synchronous—there are strict architectural limits on how these can be mixed within a single automated plan.

The primary conflict arises when mixing Synchronous (0 RPO) schedules with snapshot-based Asynchronous or NearSync schedules. Synchronous replication is an " Active-Standby " or " Active-Active " storage state where the destination site already has the data in a " mounted " but inactive container. In contrast, Asynchronous and NearSync recovery involve " restoring " a VM from a specific recovery point (snapshot), which includes registering the VM and attaching the disks during the failover process. Because the orchestration logic for a Zero-RPO synchronous failover is fundamentally different from a snapshot restoration, Nutanix prevents placing them in the same Recovery Plan. Attempting to do so will cause validation errors and lead to execution failure, as the orchestrator cannot simultaneously manage real-time failover and snapshot-based restoration for the same logical group. To successfully protect an environment with both types of RPO requirements, administrators must create separate Recovery Plans: one dedicated to Synchronous workloads and another for snapshot-based Asynchronous/NearSync workloads, ensuring that each set of VMs follows its appropriate recovery workflow.

Migrating from legacy Protection Domains to modern Prism Central Protection Policies is a recommended practice for scaling DR management. However, large environments must account for architectural limits during this transition. A Nutanix cluster has specific maximum thresholds for the number of entities (VMs) that can be contained within a single Protection Domain, and similar limits exist for the initial " handoff " to Prism Central.

If a single legacy Protection Domain contains more than 500 VMs, attempting to migrate it as a single unit can lead to timeouts, metadata synchronization failures, and potential gaps in protection. To ensure that all VMs remain consistently protected during the migration, the first step is to " split " the existing large Protection Domain into multiple smaller, more manageable ones. For example, an administrator might split a 600-VM domain into three 200-VM domains. This reduction in " entity density " allows the Nutanix Cerebro and Prism Central services to process the migration tasks more efficiently without hitting resource contention or task timeout limits. Once the VMs are organized into these smaller groups, they can be systematically unlinked from the legacy domains and added to the new PC-based Protection Policies. This phased and controlled approach minimizes risk and ensures that a valid recovery point always exists for every VM throughout the entire migration lifecycle.

Synchronous replication is designed for zero data loss by requiring that every write be acknowledged at both the primary and recovery sites before the application can proceed. This creates a " hard " dependency on the network link between the two clusters . If the network connectivity is interrupted (e.g., during scheduled maintenance), the primary cluster will be unable to receive acknowledgments from the remote site.

By default, if the synchronous link is broken, the primary cluster may pause I/O to the protected VMs to prevent data inconsistency, which would cause the VMs to become unresponsive to users. To prevent this during planned maintenance while ensuring that the VMs stay online at the primary site, the administrator should temporarily transition the protection mode. Changing the Protection Policy from " Synchronous " to " Asynchronous " (Option C) removes the real-time write-mirroring requirement. This allows the VMs to continue serving local I/O independently of the remote site ' s status. While this technically increases the RPO during the maintenance window, it ensures application availability. Once the maintenance is complete and network connectivity is restored, the administrator can change the policy back to Synchronous. The system will then perform a catch-up sync and return to the Zero-RPO state once the data at both sites is identical again. This operational maneuver is a standard best practice for managing " stretched " cluster environments during infrastructure updates.

Nutanix supports two main types of snapshots: crash-consistent and application-consistent. A crash-consistent snapshot is taken at the storage layer without any awareness of the guest OS state; it is equivalent to pulling the power plug on a server. An application-consistent snapshot is more complex because it requires the Nutanix cluster to " quiesce " the applications (such as SQL Server or Exchange) inside the guest OS, flushing pending writes to disk to ensure data integrity.

To perform this quiescence on Windows VMs, the Nutanix cluster must communicate with the Windows Volume Shadow Copy Service (VSS). This communication is handled exclusively by Nutanix Guest Tools (NGT). If NGT is not installed on the VM, or if the NGT agent is not running/communicating with the cluster, the system cannot trigger the VSS hardware provider. In this situation, any request for an " application-consistent " snapshot from a third-party backup solution will fail because the cluster lacks the necessary hooks into the guest OS. However, a " crash-consistent " snapshot will still succeed because it does not require any guest-level interaction. Therefore, when app-consistent backups fail but crash-consistent ones succeed, the most likely root cause is a missing or broken NGT installation on the affected virtual machines.

Nutanix storage is often accessed by external backup solutions (like Veeam, Commvault, or HYCU) using the iSCSI protocol. This allows the backup server to mount snapshots and read data directly from the storage tier. The error message " iscsiadm... discovery... timeout " specifically indicates that the backup server ' s iSCSI initiator is unable to communicate with the Nutanix Data Services IP or the Controller VMs (CVMs) over the network.

When a Nutanix cluster is expanded, it is essential that all networking and firewall configurations applied to the existing nodes are also applied to the new nodes. The iSCSI protocol relies on specific TCP ports: port 3260 is the standard port for iSCSI traffic, and port 3205 is often used for iSCSI discovery and metadata operations within Nutanix. If these ports are not open in the physical firewall or the host-based security rules for the newly added nodes, the backup server will be unable to discover the targets on those specific nodes, leading to the timeout errors . This highlights a common " Day 2 " operational trap: cluster expansion requires careful auditing of network security groups and firewall whitelists to ensure that external integrations—especially BCDR and backup services—continue to have uninterrupted access to the expanded storage fabric. Verifying and opening ports 3205 and 3260 for the new node IPs is the first step to resolving this timeout issue.

Nutanix Metro Availability is a continuous availability solution designed to survive a site failure with zero data loss (Zero RPO). Because it operates on a synchronous replication model, every write performed by a virtual machine must be acknowledged by both the local and the remote clusters before the write is confirmed to the application. This process introduces a " latency penalty " equal to the network Round Trip Time (RTT) between the sites.

To maintain acceptable application performance and ensure cluster stability, Nutanix enforces a strict latency limit of 5 ms RTT between the primary and secondary clusters. If the latency exceeds this 5 ms threshold, the time spent waiting for remote acknowledgments would cause severe performance degradation for high-I/O workloads, such as the SQL or Oracle databases common in financial institutions. Furthermore, high latency increases the risk of the synchronous link being " broken " during periods of high data churn. While the Witness VM (used for tie-breaking) can tolerate much higher latency (up to 200 ms), the data-path link must remain under 5 ms to satisfy the technical requirements of the Metro Availability feature and the performance expectations of Tier-1 business-critical applications.

In modern Nutanix Disaster Recovery (using Prism Central-based Protection Policies), storage placement is often governed by Storage Policies rather than simple container-to-container mapping. Storage Policies use Nutanix Categories to determine where a VM should be placed to meet performance or compliance requirements. In this scenario, the VMs were successfully replicated and recovered, but they were placed in " all the storage containers " rather than the intended FIN-PROD container at the Marseille site. This indicates that while the data arrived, the " destination placement rules " were missing. If a storage policy was created on the Paris cluster to keep these VMs in FIN-PROD but that policy was not mirrored or assigned at the Marseille cluster, the system defaults to the Acropolis Dynamic Scheduler (ADS) placement. ADS will distribute the VMs across all available containers to balance load and capacity, leading to the " scattered " result observed. To resolve this and ensure consistent failover behavior, the administrator must ensure that both the categories and the corresponding storage policies are identical and active at both availability zones. While a missing container (Option C) would typically cause a replication failure rather than scattered recovery, a missing storage policy specifically explains the lack of orchestrated placement during the failover event.