---
name: sap-powervs-infrastructure-5-file-storage-share-zonal
title: Accessing VPC zonal file storage shares from IBM Power Virtual Server Instances
description: Then, you mount the file storage share on the virtual server instance in IBM Power Virtual Server.
last-updated: 2026-06-16
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/sap?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing VPC zonal file storage shares from IBM Power Virtual Server Instances
{: #nfs-zonal-powervs-intro}
{: toc-content-type="tutorial"}
{: toc-services="vpc, transit-gateway, power-iaas, sap"}
{: toc-completion-time="2h"}

This tutorial might incur costs.
Use the [Cost Estimator](https://cloud.ibm.com/estimator) to generate a cost estimate based on your projected usage.
{: tip}

In this tutorial, you learn how to mount a file share on an IBM Power Virtual Server server instance.
You cannot directly mount a file storage share on IBM Power Virtual Server instances and must instead use a path through a network load balancer (NLB).
You create a file storage share and a mount target in IBM VPC.
You create a network load balancer with routing mode, and a route table in IBM VPC.
Then, you mount the file storage share on the virtual server instance in IBM Power Virtual Server.
{: shortdesc}

The following architecture overview diagram illustrates this scenario.

The virtual server instance in IBM Power Virtual Server sends a request through a transit gateway to the file storage share.
According to the rule in the routing table of the VPC, the network traffic to the file storage share is directed to the network load balancer.
The network load balancer has *Routing_mode* enabled.
It bypasses a back-end pool and sends requests directly to the destination IP address.
The file storage share responds and the response is sent directly to the virtual server instance in IBM Power Virtual Server.
The network load balancer (NLB) with routing mode has two IP addresses (active and standby).
When a failover occurs, the route mode updates all routing rules that are created for the VPC with a `next_hop` of the standby IP.
Both the active IP and the standby IP are used during the lifetime of an NLB with route mode.

![Architecture overview diagram](../../images/nfs-zonal-powervs.svg){: figure caption="A diagram that shows the architecture for accessing File Storage for VPC."}

## Before you begin
{: #nfs-zonal-powervs-prereqs}

CONTENT:

Create a security group and configure inbound rules for port 2049.
1. Go to [Security groups for VPC](https://cloud.ibm.com/infrastructure/network/securityGroups) and click **Create**.
1. Verify or set the **Geography** and **Region** fields.
1. Enter `nfs-server-sg` for the **Name**.
1. Select the same **Resource group** as the VPC resource group.
1. Select your VPC in the **Virtual private cloud** list.
1. Create an inbound rule for each virtual server instance (NFS client).
   1. In the **Inbound rules** section, click **Create**.
   1. Configure the rule as follows:
      - **Protocol**: Select **TCP**.
      - **Port**: Select **Port range**, and enter `2049` for both **Port min** and **Port max**.
      - **Source type**: Select **IP or CIDR**.
         - Enter the IP address of each virtual server instance.
         - If your instances are in a subnet and you want to allow access from all members of the subnet, enter the subnet's CIDR block.
      - **Destination type**: Select **Any**.
   1. Configure the rule as follows in addition to above when provisioning a mount target with in-transit encryption [EIT]{: tag-green}:
      - **Protocol**: Select **TCP**.
      - **Port**: Select **Port range**, and enter `20049` for both **Port min** and **Port max**.
      - **Source type**: Select **IP or CIDR**.
         - Enter the IP address of each virtual server instance.
         - If your instances are in a subnet and you want to allow access from all members of the subnet, enter the subnet's CIDR block.
      - **Destination type**: Select **Any**.
   1. Click **Create** to save the rule.
1. Create a common outbound rule.
   1. In the **Outbound rules** section, click **Create**.
   1. Configure the rule as follows:
      - **Protocol**: Select **TCP**.
      - **Port**: Select **Any**.
      - **Destination type**: Select **Any**.
      - **Source type**: Select **Any**.
   1. Click **Create** to save the rule.
1. Finalize the security group.
   - Click **Create security group** to apply the configuration.


## Creating a security group to allow NFS V4 traffic
{: #nfs-zonal-powervs-create-sg}
{: step}

CONTENT:

1. Go to [File storage shares for VPC](https://cloud.ibm.com/infrastructure/storage/fileShares).
1. Click **Create** > **Create file share**.
1. In the **Availability** section, choose `Single Zone` availability.
1. In the **Location** section, select the same **Geography**, **Region**, and **Zone** as the virtual private cloud.
1. Enter `nfs-server` in the **Name** field.
   Select the same **Resource group** as the VPC resource group.
1. In the **Size** section, enter the `Storage size` in GB.
1. Enter a `Max IOPS` value.
1. In the **Mount target access mode** section, select **Security groups**.
1. In the **Mount targets (optional)** section, click **Create**.
   - Enter `nfs-server-mount-target`in the **Mount target name** field.
   - Select your **VPC**.
   - In the **Network interfaces** section, click the pencil icon on the new interface.
   - Verify the selected subnet and click **Next**.
   - In the **Security groups** section, check the `nfs-server-sg` security group, clear the **VPC default** security group, and click **Next**.
   - Click **Next** to get to the **Review** section, then click **Save**.
   - Back on the **Create mount target screen**, click **Next**.
   - **Encryption in transit** is disabled by default. **If required** click the toggle to change the preset value. For more information about this feature, see Encryption in transit - [Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit&format=markdown).
   - In the **Review** step, click **Create**.
1. Click **Create file share** to provision the file storage and the mount target.

## Provisioning file storage with zonal availability
{: #nfs-zonal-powervs-create-fs-share}
{: step}

The availability cannot be modified after provisioning.{: important}

The encryption setting of a mount target cannot be modified after it has been created. To change the encryption, you must delete the existing mount target and recreate it. This process does not affect the underlying data, and no data will be lost.{: important}

CONTENT:

1. Go to [File storage shares for VPC](https://cloud.ibm.com/infrastructure/storage/fileShares).
1. Click **Create** > **Create file share**.
1. In the **Availability** section, choose `Regional` availability.
1. In the **Location** section, select the **Geography** and the multizone **Region** (MZR).
1. In the **Details** section, enter `nfs-server` in the **Name** field.
   Select the same **Resource group** as the VPC resource group.
   - The profile is chosen automatically based on your data availability selection.
      If you chose regional availability, your file share uses the **rfs** profile.
   - Select the **Size** and **Max throughput** for your file share.
      You can increase the capacity later, and you can also adjust the bandwidth as needed.
   The **Mount target access mode** is always **Security groups**.
   The previous access mode `Virtual private cloud` is not available for file storage with regional availability.
1. In the **Mount targets (optional)** section, click **Create**.
   - In the **Mount target details** section, enter `nfs-server-mount-target` in the **Mount target name** field.
   - Select your **VPC**.
   - In the **Network interfaces** section, click the pencil icon on the new interface.
      Verify the selected subnet and click **Next**.
   - In the **Security groups** section, check the `nfs-server-sg` security group, clear the **VPC default** security group, and click **Next**.
   - Click **Next** to get to the **Review** section, then click **Save**.
1. Click **Next** when you got back to the **Create mount target screen**.
   - **Encryption in transit** is disabled by default. **If required** click the toggle to change the preset value. For more information about this feature, see Encryption in transit - [Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit&format=markdown).
   - In the **Review** step, click **Create**.
1. Click **Create file share** on the right to provision the file storage and the mount target.

## Gathering the file storage IP address and mount path information
{: #nfs-zonal-powervs-get-mount-path}
{: step}

**End of Marketing**: As of 31 October 2025, new deployments of VMware Solutions offerings are no longer available for new customers. Existing customers can still use and expand their active VMware® workloads on IBM Cloud®. For more information, see [End of Marketing for VMware on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-eos-vms&format=markdown).
{: note}

Later, the **Destination** parameter in the VPC route entry is set to the **Primary IP** of the mount target.
The **Mount path** parameter is used as an argument to the `mount` command on the IBM Power Virtual Server instance.

## Creating the private network load balancer with routing mode
{: #nfs-zonal-powervs-create-nlb-with-routing-mode}
{: step}

### Creating the service-to-service authentication policy
{: #nfs-zonal-powervs-create-auth-policy}

CONTENT:

Customize the **Ingress routes** to route incoming traffic from external sources such as the IBM Cloud Transit Gateway.
Only one custom routing table is associated with an ingress source.
If an ingress routing table exists for the IBM Cloud Transit Gateway source, add the **route** to that table.
1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click **Create**.
1. In the **Location** section, select the same **Geography** and **Region** that is used for the virtual private cloud.
1. Enter `nfs-server-routing` in the **Name** field.
1. Select your VPC in the **Virtual private cloud** list.
1. Enable the **Transit gateway** flag in the **Traffic source (optional)** section.
1. Click **Create routing table** to provision the routing table.

### Creating the network load balancer
{: #nfs-zonal-powervs-create-nlb}

1. Go to [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers) and click **Create**.
1. Select **Network Load Balancer (NLB)** as the **Load balancer type**.
1. In the **Location** section, select the same **Geography** and **Region** that is used for the virtual private cloud.
1. Enter `nfs-server-nlb` in the **Name** field.
1. Select the same **Resource group** as the VPC resource group.
1. Select your VPC in the **Virtual private cloud** list.
1. Select the **Subnet**.
1. Check **Private** in the **Type** section.
1. Set **Routing mode** to **On** to create a network load balancer with routing mode.
1. In the **Back-end pools** section, click **Create pool**.
   Set the parameters to the following values.
   - **Name**:  `nfs-server-fwd-pool`
   - **Pool protocol**: `TCP`
   - **Session stickiness**: `None`
   - **Method**: `Round robin`
   - Click **Create**.

1. In the **Front-end listeners** section, click **Create listener**.
   Select your **Back-end pool** and click **Save**.
1. In the **Security Groups** sections, check the `nfs-server-sg` security group, and clear the default security group.
1. Click **Create load balancer** to provision the load balancer.

As part of the process, you create a back-end pool.
However, you cannot define the back-end pool `Failsafe policy` directly, and it must be updated in the next step.
{: important}

### Updating the network load balancer failsafe policy
{: #nfs-zonal-powervs-upd-nlb-failsafe-policy}

Update the `Failsafe policy` for the `nfs-server-fwd-pool` back-end pool.
The network load balancer then bypasses the back-end pool and sends requests directly to the destination IPs.

1. Go to [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers).
1. Click the load balancer `nfs-server-nlb`.
1. Click the **Back-end pools** tab and select the pool `nfs-server-fwd-pool`.
1. Click `nfs-server-fwd-pool` and then `Edit`.
1. In the `Failsafe policy` section, select `Bypass` as the **Action**.
1. Click `Save`.

### Collecting the private IP addresses of the load balancer
{: #nfs-zonal-powervs-get-nlb-ip-addresses}

1. Go to [Load balancers for VPC](https://cloud.ibm.com/infrastructure/network/loadBalancers).
1. Click `nfs-server-nlb`.
1. In the **Load balancer details - Private IPs** section, make a note of the first IP address entry in the list.

Later, the **Next hop** parameter in the VPC route entry is set to the active **Private IP** address of the load balancer.

## Creating a routing table and routes for VPC
{: #nfs-zonal-powervs-provision-create-table-and-routes}
{: step}

### Creating a routing table
{: #nfs-zonal-powervs-create-routing-table}

CONTENT:

To propagate routes outside the VPC address prefix range, enable **Advertise to** for the transit gateway.
1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click on the name of the ingress route that you created earlier.
1. In the **Traffic** section, click **Edit** to open the **Edit traffic** panel.
1. Under **Traffic source**, expand the **Transit Gateway** section.
1. Toggle the **Advertise to** switch to **On**.
1. Click **Save** to apply the changes to the routing table.

### Updating the routing table
{: #nfs-regional-powervs-update-routing-table}

CONTENT:

1. Go to [File storage shares for VPC](https://cloud.ibm.com/infrastructure/storage/fileShares).
1. Click the **Name** `nfs-server`.
1. In the **Mount targets** section, click the **Name** of the mount target in the VPC to view the mount target details.
1. Make a note of the **Mount path**.
      In the example, the mount path is `10.20.30.40:/73a1ff96_4861_4463_aa09_8c8128b8e277fsf`.
      The first part of the mount path is the **Primary IP** of the mount target: `10.20.30.40` .

### Creating a route
{: #nfs-zonal-powervs-create-route}

1. Go to [Routing tables for VPC](https://cloud.ibm.com/infrastructure/network/routingTables).
1. Click the name `nfs-server-routing`.
1. Click **Create**.
1. Select the zone for your route in the **Zone** field.
1. Enter `nfs-server` in the **Name** field.
1. Using CIDR notation, enter the primary IP address of the file share as **Destination CIDR**.
1. Select `Deliver` as the **Action**.
1. Enter the `IP address of the network load balancer` as the **Next hop (IP address)**.
1. Click **Save** to add the route to the table.

## Mounting the file share on the IBM Power Virtual Server instance
{: #nfs-zonal-powervs-mount-file-share}
{: step}

Log on as the `root` user to the server instance in IBM Power Virtual Server where you want to mount the file share.


-  **Mounting when not using in-transit encryption**

   1. Install the NFS client packages on the instance.

      ```sh
      dnf install nfs-utils
      ```
      {: pre}

   1. Create a directory for the mount point.

      ```sh
      mkdir <mount_point>
      ```
      {: pre}

   1. Mount the remote file share.

      ```sh
      mount -t nfs4 -o <options> <host:/mount_target> <mount_point>
      ```
      {: pre}

      See the following example.

      ```sh
      mkdir /mnt/test
      mount -t nfs4 -o rw,sec=sys 10.20.30.40:/ea90ea14_0a1b_4f36_85c0_1cf83a2c8065 /mnt/test
      ```
      {: codeblock}