Network Resources for vCloud Director Replicas

To allow tenant VM replicas created in vCloud Director to communicate to each other after partial site failover or full site failover, the SP must configure the necessary number of networks in the properties of the organization VDC that will be used as a target for tenant VM replicas. The tenant will be able to map source and target networks in the properties of the replication job that creates VM replicas in vCloud Director.

In addition, the SP must provide tenant VM replicas in vCloud Director with network resources that enable access to VM replicas over the network:

• From the production environment on the tenant side after partial site failover. To learn more, see Network Resources for Partial Site Failover.

• From the internet after full site failover. To learn more, see Network Resources for Full Site Failover.

Network Resources for Partial Site Failover

There are three scenarios for enabling communication between production VMs on the tenant source host and VM replicas in vCloud Director after partial site failover:

• Using the NSX Edge gateway. In this scenario, the SP deploys the NSX Edge gateway on the SP side and tenant side and configures the NSX edge gateway in vCloud Director. This scenario does not require additional actions in Veeam Backup & Replication.
• Using an IPsec VPN connection. In this scenario, the SP configures an IPsec VPN connection between the tenant side and SP side. This operation is performed in vCloud Director. This scenario does not require additional actions in Veeam Backup & Replication.
• Using network extension appliances. In this scenario, the SP does not use vCloud Director resources to enable network access to tenant VM replicas. Instead, the SP and tenant deploy network extension appliances on their sides in the similar way as in the regular Veeam Cloud Connect Replication scenario:

• The SP deploys the SP-side network extension appliance at the process of creating a vCloud Director tenant account. To learn more, see Configuring vCloud Director Tenant Account.
• The tenant deploys the tenant-side network extension appliance at the process of adding the SP in the Veeam backup console. To learn more, see Connecting to Service Providers.

For the scenario where production VMs and VM replicas in vCloud Director communicate through network extension appliances after partial site failover, consider the following:

• To provide network resources to tenant VM replicas, the SP should use isolated organization VDC networks.
• The Enable DHCP option must be disabled for organization VDC networks that will be used by tenant VM replicas. This operation can be performed by the SP or tenant in vCloud Director.
• In case Veeam Backup & Replication fails to detect a static IP address of a tenant VM during the replication process, the SP or tenant must manually specify the IP address for the replica of this VM in vCloud Director. In particular, Veeam Backup & Replication cannot detect an IP address of a Linux VM.
• During partial-site failover, the SP network extension appliance imports in its vApp all organization VDC networks and connects to these networks. This allows the appliance to provide network connection to VM replicas that reside in other vApps of the organization VDC used as a cloud host, including those replicas for which the failover operation can be started later.

Keep in mind that if the number of organization VDC networks is greater than 9, the failover operation will fail because the number of virtual network adapters for a VMware vSphere VM cannot exceed 10 (one network adapter is used to connect to the management network).

Network Resources for Full Site Failover

To allow tenant VM replicas in vCloud Director to be accessed over the internet, the SP must configure an NSX Edge gateway in vCloud Director.

To assign public IP addresses to tenant VM replicas after full site failover, the SP can create SNAT and DNAT rules on the NSX Edge gateway. Alternatively, the SP can assign public IP addresses to tenant VM replicas using pre-failover and/or post-failover scripts. To do this, the SP must create the scripts in advance and specify these scripts in the cloud failover plan settings.