---
name: framework-financial-services-vpc-architecture-connectivity-create-vpcs
title: Creating and connecting the management and workload VPCs
description: After completing the work for account setup and management, you can now create the management and workload VPCs from the VPC reference architecture and connect them using Transit Gateway.
last-updated: 2025-03-02
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Creating and connecting the management and workload VPCs
{: #vpc-architecture-connectivity-create-vpcs}

After completing the work for [account setup and management](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup&format=markdown), you can now create the management and workload VPCs from the [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsi&format=markdown) and connect them using [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about&format=markdown).
{: shortdesc}

1. Create two VPCs in a multizone region, one for the management VPC and another for the workload VPC. See [Create a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli&format=markdown) for more details. For now, you should not follow the instructions in any of the other sections in that reference.

   Do _not_ create default address prefixes when you create the VPCs. You can specify `manual` for the `--address-prefix-management` argument in the [`ibmcloud is vpc-create` command](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&format=markdown#vpc-create), such as in `ibmcloud is vpc-create my-vpc --address-prefix-management manual`.
   {: tip}

1. Review [Designing an addressing plan for a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-addressing-plan-design&format=markdown) to get guidance how to plan for addressing within your VPC. VPC uses [Classless Inter-Domain Routing (CIDR) notation](https://cloud.ibm.com/docs/vpc?topic=vpc-choosing-ip-ranges-for-your-vpc&format=markdown) for specifying addresses.

1.  Create the address prefix for each zone in both VPCs based on the plan that you developed in the previous step. See [`ibmcloud is vpc-address-prefix-create`](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&format=markdown#vpc-address-prefix-create) for details.

1. Create the subnets for the three zones by using the CIDRs. For more information, see [Create a subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&format=markdown#subnet-create).

   You need to specify zones. For `us-south`, the three zones are `us-south-1`, `us-south-2`, `us-south-3`. For `us-east`, the three zones are `us-east-1`, `us-east-2`, `us-east-3`. See [multizone regions](https://cloud.ibm.com/docs/overview?topic=overview-locations&format=markdown#mzr-table) for more information, including the zone identifiers for other multizone regions.
   {: tip}

1. Create security groups to define inbound and outbound traffic that's allowed for virtual server instances. For more information, see [Using security groups](https://cloud.ibm.com/docs/vpc?topic=vpc-using-security-groups&format=markdown) and [Overview of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-kube-policies&format=markdown).

1. Configure ACLs for your subnets that do not contain virtual servers or Red Hat OpenShift on IBM Cloud clusters (for example, subnets that contain a VPN Gateway or VPEs). For more information, see [Set up network ACLs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls&format=markdown).

   Even though we recommend security groups where possible, there are subnets without virtual servers or Red Hat OpenShift on IBM Cloud clusters that require ACLs. In our example, we're referring to the subnets that contain virtual private endpoints (VPEs) only or VPN for VPC.

   For more information, see:

   * [Configuring ACLs and security groups for use with VPN](https://cloud.ibm.com/docs/vpc?topic=vpc-acls-security-groups-vpn&format=markdown)

1. [Order Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway&format=markdown).

   For additional consideration, see the following resources:

   * [Interconnect two or more VPCs in the same MZR](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about&format=markdown#use-case-1-interconnect-two-or-more-vpcs-in-the-same-mzr)
   * [Planning for Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips&format=markdown)
   * [Team based privacy that uses IAM, VPC, Transit Gateway, and DNS](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-tg-dns-iam&format=markdown)

## Related controls in IBM Cloud Framework for Financial Services
{: #related-controls}

{{site.data.content.related-controls-disclaimer}}

| Family              | Control                                           |
|---------------------|---------------------------------------------------|
| Access Control (AC) | [AC-20 Use of External Systems](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-20&format=markdown) |
| Security Assessment and Authorization (CA) | [CA-3 Information Exchange](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3&format=markdown) |
| System and Communications Protection (SC)  | [SC-2 Separation of System and User Functionality](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2&format=markdown) \n [SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-3&format=markdown) \n [SC-5 Denial-of-service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5&format=markdown) \n [SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7&format=markdown) \n [SC-7 (4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4&format=markdown) \n [SC-7 (5) Boundary Protection | Deny by Default - Allow by Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5&format=markdown) \n [SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10&format=markdown) \n [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8&format=markdown) \n [SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1&format=markdown) \n [SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11&format=markdown)  |
{: caption="Related controls in IBM Cloud Framework for Financial Services [FSv2.0]" caption-side="top"}
{: #related-controls-fsv2.0}
{: tab-title="FSv2.0"}
{: tab-group="RelatedControls-1"}
{: class="simple-tab-table"}


| Family              | Control                                           |
|---------------------|---------------------------------------------------|
| Access Control (AC) | [AC-20 Use of External Information Systems](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-20&format=markdown) |
| Security Assessment and Authorization (CA) | [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ca-3&format=markdown) |
| System and Communications Protection (SC)  | [SC-2 Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-2&format=markdown) \n [SC-3 Security Function Isolation](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-3&format=markdown) \n [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-5&format=markdown) \n [SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-7&format=markdown) \n [SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-7.4&format=markdown) \n [SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-7.5&format=markdown) \n [SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-7.10&format=markdown) \n [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-8&format=markdown) \n [SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-8.1&format=markdown) \n [SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-sc-11&format=markdown)  |
{: caption="Related controls in IBM Cloud Framework for Financial Services [FSv1.1]" caption-side="top"}
{: #related-controls-fsv1.1}
{: tab-title="FSv1.1"}
{: tab-group="RelatedControls-1"}
{: class="simple-tab-table"}


## Next steps
{: #next-steps}

* [Application provider connectivity to management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management&format=markdown)