--- name: vmwaresolutions-arch-pattern-bastion-vpc title: Architecture pattern for a bastion VPC to manage VMware Cloud Foundation for Classic - Automated instance in Classic description: As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. last-updated: 2025-10-24 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Architecture pattern for a bastion VPC to manage VMware Cloud Foundation for Classic - Automated instance in Classic {: #arch-pattern-bastion-vpc} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} This architecture pattern presents Client VPN-based connectivity to a VMware Cloud Foundation for Classic - Automated instance provisioned in IBM Cloud® classic infrastructure. This solution uses a bastion VPC with [client-to-site VPNaaS](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview&interface=ui&format=markdown) and a connecting [IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about&format=markdown), or alternatively by using a VPC provisioned with [classic connectivity](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure&format=markdown). [IBM Cloud DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started&format=markdown) are used in VPC with a custom resolver. ## Deploying a bastion VPC for managing vCenter Server deployment in Classic {: #arch-pattern-bastion-vpc-overview} The following diagram presents an overview for an architecture pattern for deploying bastion VPC to manage vCenter Server deployment in Classic. ![Architecture overview for a bastion VPC with VMware Solutions](../../images/arch-pattern-bastion-vpc.svg "The solution uses Virtual Private Cloud compute, network, storage resources, and VMware NSX for a Bastion host."){: caption="Architecture overview for a bastion VPC with VMware® Solutions" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. [Create a VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli&format=markdown) for the Bastion hosts. [Choose a VPC prefix](https://cloud.ibm.com/docs/vpc?topic=vpc-choosing-ip-ranges-for-your-vpc&format=markdown), which does not overlap with your Classic. For example, the default VPC prefix of the MZR and Zone typically works on this step. Provision a subnet with a size of your preference, for example, `/27` or larger. 2. [Provision client-to-site VPNaaS](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview&format=markdown) for OpenVPN based VPN connectivity. Configure your preferred authentication method for the clients. Use a prefix for your clients, which does not overlap with the rest. You might use SNAT when the VPN clients communicate with your connected resources. Advertise `10.0.0.0/8` to your client, or smaller prefix based on your preference. 3. Use [classic connectivity](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure&format=markdown), or provision a [IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about&format=markdown) and add your VPC and Classic as connections to it. This provides routed connectivity between your Bastion VPC, Classic, and connected VPN clients. 4. [Provision a DNS service](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started&format=markdown) with a local domain of your choice. For example, `bastion.ibmcloud.local`. 5. [Provision a custom resolver](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-custom-resolver&format=markdown) to your Bastion VPC subnet. Also, configure it as the [DNS server for your VPN clients](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-server&interface=ui&format=markdown). 6. [Configure a DNS forwarder](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-cr-fwd-rules-add&interface=ui&format=markdown) in your custom resolver to point to your VMware Cloud Foundation for Classic - Automated instance AD root domain, for example, `vcs-zyx.ibmcloud.local`. 7. If you need, provision Windows® or Linux® Bastion hosts to your Bastion VPC subnet. You might access them through internet by using OpenVPN client. If you use any IP address range from the Class A block `10.0.0.0/8` as the VPC prefix, you must add a route to your Classic servers to access the VPC hosted servers. Classic servers have a default setting for routes to IBM Cloud private network (`10.0.0.0/8`) and IBM Cloud Services networks (`166.8.0.0/14` and `161.26.0.0/16`) with BCR as a next-hop. If your VPC uses something else, ensure that your Classic assets are routed to it through the BCR. {: note} ## Considerations {: #arch-pattern-bastion-vpc-considerations} When you design or deploy this architecture pattern, consider that you might alternatively use classic Virtual Server Instances for Jump or bastion hosts. Configure the server DNS to point toward vCenter Server Instance Active Directory™ or DNS server, or create entries in the `hosts` file. ## Related links {: #arch-pattern-bastion-vpc-links} * [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown) * [VMware vSphere overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereoverview&format=markdown) * [Getting started with IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started&format=markdown) * [VPNs for VPC overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview&format=markdown)