--- name: vmwaresolutions-arch-pattern-direct-link-evpn title: Architecture pattern for using Direct Link with NSX and EVPN description: As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. last-updated: 2025-10-24 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Architecture pattern for using Direct Link with NSX and EVPN {: #arch-pattern-direct-link-evpn} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} On [VMware Cloud Foundation for Classic - Automated](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview&format=markdown) instance in IBM Cloud® classic infrastructure, your workloads are deployed and run on VMware NSX® overlay networks. As part of the deployment, the automation deploys an example NSX topology. You can use the provisioned examples as your base or build your own topologies on overlay. These overlay networks are not automatically advertised to IBM Cloud classic infrastructure network. This architecture pattern presents private connectivity for VMware Cloud Foundation for Classic - Automated that uses [Direct Link](https://cloud.ibm.com/docs/dl?format=markdown) and EVPN. EVPN (Ethernet VPN) is a standard-based BGP control plane that extends Layer 2 and Layer 3 connectivity between different data centers. Multi-Protocol BGP (MP-BGP) EVPN is established between NSX T0 and a Customer Router through Direct Link. IBM Cloud private network and Direct Link are used as L3 transport network for VXLAN traffic. VXLAN is the used encapsulation between NSX and the Customer Router. You can use Gateway Appliance or vCenter Server gateway cluster with Juniper vSRX or other device as part of the solution. This is optional. ## Deploying Direct Link with NSX and EVPN {: #arch-pattern-direct-link-evpn-overview} The following diagram presents an overview for an architecture pattern for using Direct Link with NSX and EVPN. ![Direct Link with NSX and EVPN](../../images/arch-pattern-vcs-nsx-t-direct-link-evpn.svg "Direct Link with NSX and EVPN."){: caption="Direct Link with NSX and EVPN" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. VCF for Classic - Automated instance is deployed at IBM Cloud classic infrastructure. Two IBM Cloud private VLANs and one IBM Cloud Public VLAN (optional) are deployed. Each of these VLANs host multiple subnets. You can see the details through IBM Cloud for VMware Solutions portal. 2. NSX T0 is deployed with two interfaces - private and public (optional). If you opt for a public one, this interface is attached to your Public VLAN and has direct internet access. Your T0's private interface is attached to the Private VLAN and it uses IBM Cloud portable private IP. 3. If vCenter Server gateway cluster with vSRX (or other third-party device) or IBM Cloud Gateway Appliance is deployed to your classic infrastructure, you must configure your VCF for Classic - Automated instance private primary VLAN. It is routed through the vSRX or Gateway Appliance. Ensure that you allow BGP and VXLAN traffic though the firewall. 4. Create a Direct Link at your IBM Cloud data center or zone location and attach your classic network as a connection. All your classic networks in the region are advertised with Local routing option (or all with Global Option). Ensure that you advertise the required networks for establishing the BGP session and VXLAN traffic. 5. Configure MP-BGP with eBGP multihop and EVPN on your T0 router. Create a T0 VRF for each tenant as an EVPN tenant in NSX. 6. VXLAN or VNI are used for each tenant. Transport between your colocation router and NSX transport nodes and Tier-0 traverse through IBM Cloud classic infrastructure network and Direct Link. 7. Each tenant can have their own WANs or MPLS. You must arrange the network separation at colocation by using your routers and switches. Also, you must design and configure how to secure and separate the tenants and connect to tenant WANs. ## Considerations {: #arch-pattern-direct-link-evpn-considerations} When you design or deploy this architecture pattern, consider the following steps: * You are responsible for configuring EVPN between your T0 gateways and the routers in colocation. * You can deploy more NSX edge transport nodes manually on IBM Cloud side, if needed. * EVPN uses its own address family in MP-BGP and NSX advertises EVPN type-5 routes. * If you use `vpnv4 unicast address-family` in the connecting router to connect to MPLS VPNs, your router must be able to convert the advertisements between these two address families. * Refer to your router vendor and VMware NSX documentation for EVPN interoperability and EVPN configuration details. ## Related links {: #arch-pattern-direct-link-evpn-links} * [VMware vSphere overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereoverview&format=markdown) * [Getting started with IBM Cloud Direct Link (2.0)](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl&format=markdown) * [Configuring EVPN](https://techdocs.broadcom.com/us/en/vmware-cis/nsx/nsxt-dc/3-1/administration-guide/tier-0-gateways/configuring-evpn.html){: external}