--- name: vmwaresolutions-arch-pattern-vcf-zerto-xconnectivity title: Architecture pattern for HPE Zerto Software replication connectivity in IBM Cloud description: As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. last-updated: 2025-12-03 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vmwaresolutions?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Architecture pattern for HPE Zerto Software replication connectivity in IBM Cloud {: #arch-pattern-vcf-zerto-xconnectivity} As of 17 July 2025, new automated installations of Red Hat® OpenShift® for VMware® are no longer available for new or existing deployments of VMware Cloud Foundation for Classic - Automated instances. You can still use or delete your existing Red Hat OpenShift for VMware automated installations until 16 July 2026. The service will no longer be available from 17 July 2026. {: deprecated} This architecture pattern explains how to deploy and configure HPE Zerto Software replication connectivity on VMware Cloud Foundation for VPC instances that are running on IBM Cloud VPC. These connectivity patterns use a combination of IBM Cloud native services and networking services that are provided by VMware NSX®. This pattern assumes that HPE Zerto Software is deployed by following the guidance for the [consolidated architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-arch-pattern-vcf-zerto-con&format=markdown). ## Replication connectivity over private network {: #arch-pattern-vcf-zerto-xconnectivity-private} When you replicate over a private network, the VMware Cloud Foundation for VPC instance needs to connect to on-premises or Classic VMware® and HPE Zerto Software deployments. The following diagram introduces the high-level steps to configure and deploy this connectivity type. ![Replication connectivity over private network](../../images/vcf-arch-zerto-net-priv.svg "Replication connectivity over private network."){: caption="Replication connectivity over private network" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. Provision a new or use an existing Transit Gateway or Direct Link to connect to the Veeam® replication partner network. 1. Validate that the management subnet and the on-premises VMware and Zerto appliance networks can communicate. 1. With Classic VMware and HPE Zerto Software deployments, ensure that you have routing configured toward BCR for the Virtual Private Cloud (VPC) prefixes or subnets. 1. Configure a virtual protection group (VPG) for replication between IBM Cloud and on-premises environments. ## Replication connectivity over the Internet {: #arch-pattern-vcf-zerto-xconnectivity-public-internet} When you replicate over a public network, the VMware Cloud Foundation for VPC instance needs to connect to on-premises VMware and HPE Zerto Software deployments. Two alternative patterns are introduced for this connectivity. In this first alternative pattern, the connectivity is established by using VPC VPNaaS site-to-site IPsec VPN. The following diagram introduces the high-level steps to configure and deploy this connectivity type. ![Replication connectivity over Public Internet by using VPC VPNaaS](../../images/vcf-arch-zerto-net-pub-1.svg "Replication connectivity over Public Internet by using VPC VPNaaS."){: caption="Replication connectivity over Public Internet using VPC VPNaaS" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. Deploy VPC VPN as a Service - Site to Site Gateway. You can use the NSX private uplink subnet in VPC; many IP addresses are available for the VPN Gateway. 1. Establish an IPsec VPN between IBM Cloud VPC and your on-premises networks. You can use either policy-based or route-based tunnels. 1. With policy-based VPN tunnels, ensure that at least the management and the management subnets of VI workload domains are included in the local networks. With route-based tunnels, create VPC routes to the on-premises networks and ensure that the on-premises networks have a route to at least to the management and the management subnets of VI workload domains. 1. Configure a virtual protection group (VPG) for replication between IBM Cloud and on-premises environments. In this second alternative pattern, the connectivity is established by using NSX Tier 0 IPsec VPN and integrated routing with VPC networking (VPC routes). The following diagram introduces the high-level steps to configure and deploy this connectivity type. ![Replication connectivity over Public Internet with NSX Tier 0 IPsec VPN](../../images/vcf-arch-zerto-net-pub-2.svg "Replication connectivity over Public Internet with NSX Tier 0 IPsec VPN."){: caption="Replication connectivity over Public Internet with NSX Tier 0 IPsec VPN" caption-side="bottom"} This architecture pattern deployment is summarized as follows: 1. Create a VPN endpoint in the Tier 0 gateway by using one of the floating IP addresses provisioned for the Tier 0 HA public VIP. 1. Establish an IPsec VPN between IBM Cloud VPC and your on-premises networks. You can use either policy-based or route-based tunnels. 1. With policy-based VPN tunnels, ensure that at least the management and the management subnets of VI workload domains are included in the local networks. With route-based tunnels, use BGP or create static routes in Tier 0 gateway to the on-premises networks and ensure that the on-premises networks have a route to at least to the management and the management subnets of VI workload domains. 1. Create a VPC route to the on-premises networks by using Tier 0's private HA VIP as the next-hop. This route is required for the HPE Zerto Software components in the management subnet to reach the on-premises network. 1. Configure a virtual protection group (VPG) for replication between IBM Cloud and on-premises environments. ## Considerations for Zerto Software Replication connectivity in IBM Cloud {: #arch-pattern-vcf-zerto-xconnectivity-considerations} When you design or deploy this architecture pattern, consider the following information: * Design your network flows carefully. For more information about ports and protocols, see [HPE Zerto Software network ports and protocols](https://help.zerto.com/bundle/Admin.VC.HTML.90/page/Port_Usage.htm){: external}. * Ensure that the used IBM Cloud VPC security groups and firewall rules allow the replication traffic. * Ensure that the networks are properly routed and possible firewall rules allow the required traffic at both source and destination sites. * Ensure that your MTUs match end to end, and that your VPN can handle shorter inner MTU across the Internet. ## Related links {: #arch-pattern-vcf-zerto-xconnectivity-links} * [Architecture pattern for HPE Zerto Software - consolidated architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-arch-pattern-vcf-zerto-con&format=markdown) * [Ordering HPE Zerto Software stand-alone licenses](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-zerto_ordering_licenses&format=markdown) * [VPC network design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-vcf-vpc-deployment&format=markdown) * [HPE Zerto Software product documentation](https://help.zerto.com){: external}