---
name: sap-powervs-infrastructure-6-file-storage-share-regional
title: Accessing VPC regional file storage shares from IBM Power Virtual Server instances
description: Then, you mount the file storage share on the virtual server instances in IBM Power Virtual Server.
last-updated: 2026-06-16
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/sap?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing VPC regional file storage shares from IBM Power Virtual Server instances
{: #ha-nlb-rt-rfs-intro}
{: toc-content-type="tutorial"}
{: toc-services="vpc, transit-gateway, power-iaas, sap"}
{: toc-completion-time="2h"}

This tutorial might incur costs.
Use the [Cost Estimator](https://cloud.ibm.com/estimator) to generate a cost estimate based on your projected usage.
{: tip}

In this tutorial, you learn how to mount a file share with regional availability on IBM Power Virtual Server server instances.
You cannot directly mount a file storage share on IBM Power Virtual Server instances and must instead use a path through a network load balancer (NLB).
You create a file storage profile with regional availability and a mount target in IBM VPC.
You create two network load balancers with routing mode in different availability zones in IBM VPC, and configure the route tables.
Then, you mount the file storage share on the virtual server instances in IBM Power Virtual Server.
{: shortdesc}

The following architecture overview diagram illustrates this scenario.

The virtual server instance in IBM Power Virtual Server sends a request through a transit gateway to the file storage share.
According to the rule in the routing table of the VPC, the network traffic to the file storage share is directed to the network load balancer.
*Routing_mode* is enabled for the network load balancer.
It bypasses a back-end pool and sends requests directly to the destination IP address.
The file storage share responds and the response is sent directly to the virtual server instance in IBM Power Virtual Server.
The network load balancer (NLB) with routing mode has two IP addresses (active and standby).
When a failover occurs, the route mode updates all routing rules that are created for the VPC with a `next_hop` of the standby IP.
Both the active IP and the standby IP are used during the lifetime of an NLB with route mode.

![Architecture overview diagram](../../images/nfs-regional-powervs.svg){: figure caption="A diagram that shows the architecture for accessing File Storage for VPC with regional availability."}

## Before you begin
{: #nfs-regional-powervs-prereqs}

- [Create a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=ui&format=markdown) spanning at least two availability zones, or use an existing one.

- Create the address prefixes and the subnets for the multizone region VPC.
- Create two IBM Power Virtual Server workspaces in the IBM Cloud region, with affinity to the availability zones of the VPC.

See the mapping between the VPC zones and the Power Virtual Server zones in [IBM Cloud regions](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-ibm-cloud-reg&format=markdown).{: note}

- Create two virtual server instances in IBM Power Virtual Server.
    Deploy one virtual server instance in each of the two workspaces.
    Note the IP addresses of the virtual server instances.

- Create a Transit Gateway and attach the VPC subnets and the IBM Power Virtual Server workspaces to the Transit Gateway.

- Check the user permissions.
   Make sure that your user account has permissions to create and manage VPC resources.
   See [Granting user permissions for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources&format=markdown).
   Assign a *viewer* role or higher on the resource group used for the VPC resources.
   Assign an *editor* role or higher on the service *VPC Infrastructure Services*.

- Use or create an SSH key to connect to the virtual server instances.
   If you don't have an SSH key, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&format=markdown).


## Creating a security group to allow NFS V4 traffic
{: #nfs-regional-powervs-create-sg}
{: step}

CONTENT:

1. Go to [File storage shares for VPC](https://cloud.ibm.com/infrastructure/storage/fileShares).
1. Click **Create** > **Create file share**.
1. In the **Availability** section, choose `Single Zone` availability.
1. In the **Location** section, select the same **Geography**, **Region**, and **Zone** as the virtual private cloud.
1. Enter `nfs-server` in the **Name** field.
   Select the same **Resource group** as the VPC resource group.
1. In the **Size** section, enter the `Storage size` in GB.
1. Enter a `Max IOPS` value.
1. In the **Mount target access mode** section, select **Security groups**.
1. In the **Mount targets (optional)** section, click **Create**.
   - Enter `nfs-server-mount-target`in the **Mount target name** field.
   - Select your **VPC**.
   - In the **Network interfaces** section, click the pencil icon on the new interface.
   - Verify the selected subnet and click **Next**.
   - In the **Security groups** section, check the `nfs-server-sg` security group, clear the **VPC default** security group, and click **Next**.
   - Click **Next** to get to the **Review** section, then click **Save**.
   - Back on the **Create mount target screen**, click **Next**.
   - **Encryption in transit** is disabled by default. **If required** click the toggle to change the preset value. For more information about this feature, see Encryption in transit - [Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit&format=markdown).
   - In the **Review** step, click **Create**.
1. Click **Create file share** to provision the file storage and the mount target.

## Provisioning file storage with regional availability
{: #nfs-regional-powervs-create-fs-share}
{: step}

The availability cannot be modified after provisioning.{: important}

The encryption setting of a mount target cannot be modified after it has been created. To change the encryption, you must delete the existing mount target and recreate it. This process does not affect the underlying data, and no data will be lost.{: important}

CONTENT:

To support routing mode, you must first create a *service-to-service* authentication policy for your NLB.
1. Log in to [IBM Access Management](https://cloud.ibm.com/iam/authorizations/grant).
1. Click **Authorizations**, then click **Create**.
1. Select **This account** for **Source account** and click **Next**.
1. Select **VPC Infrastructure Services** for **Service** and click **Next**.
1. Select **Specific resources** > **Resource Type** > **Load Balancer for VPC** for the scope access and click **Next**.
1. Select **VPC Infrastructure Services** for the target service and click **Next**.
1. Select **Specific resources** > **Resource Type** > **Virtual Private Cloud** for the scope access and click **Next**.
1. Select the **Editor** checkbox to grant the Editor access role.
1. Click **Authorize**.

## Gathering the file storage IP address and mount path information
{: #nfs-regional-powervs-get-mount-path}
{: step}

**End of Marketing**: As of 31 October 2025, new deployments of VMware Solutions offerings are no longer available for new customers. Existing customers can still use and expand their active VMware® workloads on IBM Cloud®. For more information, see [End of Marketing for VMware on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-eos-vms&format=markdown).
{: note}

Later, set the **Destination** parameter in the VPC route entry to the **primary IP** of the mount target.
Use the **Mount path** parameter as an argument for the `mount` command on the IBM Power Virtual Server instance.

## Creating the private network load balancers with routing mode
{: #nfs-regional-powervs-create-nlb-with-routing-mode}
{: step}

### Creating the service-to-service authentication policy
{: #nfs-regional-powervs-create-auth-policy}

CONTENT:

Customize the **Ingress routes** to route incoming traffic from external sources such as the IBM Cloud Transit Gateway.
Only one custom routing table is associated with an ingress source.
If an ingress routing table exists for the IBM Cloud Transit Gateway source, add the **route** to that table.
1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click **Create**.
1. In the **Location** section, select the same **Geography** and **Region** that is used for the virtual private cloud.
1. Enter `nfs-server-routing` in the **Name** field.
1. Select your VPC in the **Virtual private cloud** list.
1. Enable the **Transit gateway** flag in the **Traffic source (optional)** section.
1. Click **Create routing table** to provision the routing table.

### Creating the network load balancers
{: #nfs-regional-powervs-create-nlb}

You need to create two load balancers, each of them for the specific subnet in an availability zone.

1. Go to the [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers) page and click **Create**.
1. Select **Network Load Balancer (NLB)** as the **Load balancer type**.
1. In the **Location** section, select the same **Geography** and **Region** that is used for the virtual private cloud.

1. Enter `nfs-server-nlb-1` in the **Name** field.

1. Select the same **Resource group** as the VPC resource group.
1. Select your VPC in the **Virtual private cloud** list.
1. Select the **Subnet** according to the subnet of the availability zone.

1. Check **Private** in the **Type** section.
1. Set **Routing mode** to **On** to create a network load balancer with routing mode.
1. In the **Back-end pools** section, click **Create pool**.
   Set the parameters to the following values.
   - **Name**:  `nfs-server-fwd-pool`
   - **Pool protocol**: `TCP`
   - **Session stickiness**: `None`
   - **Method**: `Round robin`
   - Click **Create**.

1. In the **Front-end listeners** section, click **Create listener**.
   Select your **Back-end pool** and click **Save**.

1. In the **Security Groups** sections, check the `nfs-server-sg` security group, and clear the default security group.

1. Click **Create a load balancer** to provision the load balancer.

As part of the process, you create a back-end pool.
However, you cannot define the back-end pool `Failsafe policy` directly, and it must be updated in the next step.
{: important}

Repeat the step and create the second load balancer `nfs-server-nlb-2` in the other VPC zone.

### Updating the network load balancer failsafe policy
{: #nfs-regional-powervs-upd-nlb-failsafe-policy}

Update the `Failsafe policy` for the `nfs-server-fwd-pool` back-end pool.
The network load balancer then bypasses the back-end pool and sends requests directly to the destination IP address.

1. Go to [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers).
1. Click the load balancer `nfs-server-nlb-1`.
1. Click the **Back-end pools** tab and select the pool `nfs-server-fwd-pool`.
1. Click `nfs-server-fwd-pool` and then `Edit`.
1. In the `Failsafe policy` section, select `Bypass` as the **Action**.
1. Click `Save`.

Repeat those steps for load balancer `nfs-server-nlb-2`.

### Collecting the private IP addresses of the load balancer
{: #nfs-regional-powervs-get-nlb-ip-addresses}
{: step}

1. Go to [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers).
1. Click `nfs-server-nlb-1`.

1. In the **Load balancer details - Private IPs** section, make a note of the first IP address entry in the list.

Repeat those steps for load balancer `nfs-server-nlb-2`.

Later, you set the **Next hop** parameter in the VPC route entries to the active **Private IP** address of the load balancer.

## Creating a routing table and routes for VPC
{: #nfs-regional-powervs-provision-create-table-and-routes}
{: step}

### Creating a routing table
{: #nfs-regional-powervs-create-routing-table}

CONTENT:

To propagate routes outside the VPC address prefix range, enable **Advertise to** for the transit gateway.
1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click on the name of the ingress route that you created earlier.
1. In the **Traffic** section, click **Edit** to open the **Edit traffic** panel.
1. Under **Traffic source**, expand the **Transit Gateway** section.
1. Toggle the **Advertise to** switch to **On**.
1. Click **Save** to apply the changes to the routing table.

### Updating the routing table
{: #nfs-regional-powervs-update-routing-table}

CONTENT:

1. Go to [File storage shares for VPC](https://cloud.ibm.com/infrastructure/storage/fileShares).
1. Click the **Name** `nfs-server`.
1. In the **Mount targets** section, click the **Name** of the mount target in the VPC to view the mount target details.
1. Make a note of the **Mount path**.
      In the example, the mount path is `10.20.30.40:/73a1ff96_4861_4463_aa09_8c8128b8e277fsf`.
      The first part of the mount path is the **Primary IP** of the mount target: `10.20.30.40` .

### Creating routes
{: #nfs-regional-powervs-create-routes}

1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click the name `nfs-server-routing`.
1. Click **Create**.
1. Select the zone, according to the zone of the network load balancer, in the **Zone** field.

1. Enter `rfs-route-1` in the **Name** field.
1. Using CIDR notation, enter the IP address of the mount target as **Destination CIDR**.
1. Select `Deliver` as the **Action**.
1. Enter the `IP address of the network load balancer #1` as the **Next hop (IP address)**.

1. Switch `Advertise`to `On`.
1. Click **Save** to add the route to the table.

Repeat those steps, and use the name `rfs-route-2`, for the `IP address of the network load balancer #2`.

## Mounting the file share on the IBM Power Virtual Server instance
{: #nfs-regional-powervs-mount-file-share}
{: step}

Log on as the `root` user to the server instance in IBM Power Virtual Server where you want to mount the file share.


-  **Mounting when not using in-transit encryption**

   1. Install the NFS client packages on the instance.

      ```sh
      dnf install nfs-utils
      ```
      {: pre}

   1. Create a directory for the mount point.

      ```sh
      mkdir <mount_point>
      ```
      {: pre}

   1. Mount the remote file share.

      ```sh
      mount -t nfs4 -o <options> <host:/mount_target> <mount_point>
      ```
      {: pre}

      See the following example.

      ```sh
      mkdir /mnt/test
      mount -t nfs4 -o rw,sec=sys 10.20.30.40:/ea90ea14_0a1b_4f36_85c0_1cf83a2c8065 /mnt/test
      ```
      {: codeblock}


-  **Mounting when using in-transit encryption** [EIT]{: tag-green}

   The utility installs stunnel on the compute host. Stunnel needs a pem file. Because stunnel is used in client mode, you can use the pem that that comes with the distribution.

   1. Install the NFS client packages on the instance.

      ```sh
      dnf install nfs-utils
      ```
      {: pre}

   1. Download the Mount Helper package from GitHub.

      ```sh
      curl -LO https://github.com/IBM/vpc-file-storage-mount-helper/releases/download/latest/mount.ibmshare-latest.tar.gz
      ```
      {: pre}

   1. Extract the compressed file.

      ```sh
      tar -xvf mount.ibmshare-latest.tar.gz
      ```
      {: pre}

   1. Install the Mount Helper and all the dependencies.

      ```sh
      ./install.sh --stunnel
      ```
      {: pre}

   1. Create a directory for the mount point.

      ```sh
      mkdir <mount_point>
      ```
      {: pre}

   1. Mount the remote file share.

      ```sh
      mount -t ibmshare -o stunnel <host:/mount_target> <mount_point>
      ```
      {: pre}

      See the following example.

      ```sh
      mkdir /mnt/test
      mount -t ibmshare -o stunnel,rw,sec=sys 10.20.30.40:/ea90ea14_0a1b_4f36_85c0_1cf83a2c8065 /mnt/test
      ```
      {: codeblock}