Defining DRaaS Components

In a DRaaS configuration, the organization networks for disaster recovery are extended to the cloud. Zerto Cloud Connectors (ZCC) are installed to ensure that these networks have no touch points with the cloud infrastructure network, providing complete network separation between each organization network and the cloud service provider infrastructure network. All the traffic to and from the organization is routed through the cloud connector, so that the following is implemented:

None of the organizations have direct access to the cloud service provider network and cannot see any part of the cloud service provider network that the cloud service provider does not allow them to see.
Each organization has no access to the network of another organization.

A ZCC is a virtual machine installed on the cloud side, one for each customer organization replication network. The ZCC requires both cloud-facing and customer-facing static IP addresses. Also, for the cloud connector, the IP ranges used for the organization network and cloud service provider infrastructure network cannot be the same. The cloud connector requires the following:

4GB disk space
At least 1GB of reserved memory.
2 vCPU.

Zerto recommends using a 10Gbps NIC for each Zerto Cloud Connector, enabling it to handle 10Gbps of traffic.

The ZCC routes traffic between the customer network and the cloud replication network, in a secure manner ensuring complete separation between the customer network and the cloud service provider network. The ZCC has two Ethernet interfaces, one to the customer’s network and one to the cloud service provider's network. Within the cloud connector a bidirectional connection is created between the customer and cloud service provider networks. Thus, all network traffic passes through the ZCC, where the incoming traffic on the customer network is automatically configured to IP addresses of the cloud service provider network.

If the cloud service provider wants to institute additional security when using a ZCC, it can define a static route that will hop to a different cloud network, specifically for use by the Zerto Virtual Manager and VRAs in the cloud site.

Note: If you change the Zerto Virtual Manager and VRAs cloud network, changing the static route settings for a group to the new network only changes the access for new ZCCs with the specified group. Existing ZCCs must be redeployed to use the changed static route.

ZCCs are defined per organization with one ZCC defined for each organization site. Each ZCC requires two ports for each VRA (one port for VRA port 4007 and one port for port 4008) accessed via the ZCC. There is directionality to these ports.

For example, Customer A network has three VRAs and customer B network has two VRAs and the cloud service provider network has four VRAs, then the following ports must be open in the firewall: The cloud service provider’s VRAs need to use six ports to reach customer A’s VRAs, while customer A’s VRAs need eight ports to reach the cloud’s VRAs. The cloud service provider’s VRAs need to use four ports to reach customer B’s VRAs, while customer B’s VRAs need eight ports to reach the cloud’s VRAs.

Customer A (CA) to Cloud Service Provider (CSP) VRAs via ZCC1:

ZCC1_CA:9082, ZCC1_CA:9083 > VRA_CSP_1:4007, VRA_CSP_1:4008
ZCC1_CA:9084, ZCC1_CA:9085 > VRA_CSP_2:4007, VRA_CSP_2:4008
ZCC1_CA:9086, ZCC1_CA:9087 > VRA_CSP_3:4007, VRA_CSP_3:4008
ZCC1_CA:9088, ZCC1_CA:9089 > VRA_CSP_4:4007, VRA_CSP_4:4008

Customer B (CB) to Cloud Service Provider (CSP) VRAs via ZCC2:

ZCC2_CB:9082, ZCC2_CB:9083 > VRA_CSP_1:4007, VRA_CSP_1:4008
ZCC2_CB:9084, ZCC2_CB:9085 > VRA_CSP_2:4007, VRA_CSP_2:4008
ZCC2_CB:9086, ZCC2_CB:9087 > VRA_CSP_3:4007, VRA_CSP_3:4008
ZCC2_CB:9088, ZCC2_CB:9089 > VRA_CSP_4:4007, VRA_CSP_4:4008

Cloud Service Provider (CSP) VRAs to customer VRAs:

ZCC1_CSP:9082, ZCC_CA:9083 > VRA_CA_1:4007, VRA_CA_1:4008
ZCC1_CSP:9084, ZCC_CA:9085 > VRA_CA_2:4007, VRA_CA_2:4008
ZCC1_CSP:9086, ZCC_CA:9087 > VRA_CA_3:4007, VRA_CA_3:4008
ZCC2_CSP:9082, ZCC_CB:9083 > VRA_CB_1:4007, VRA_CB_1:4008
ZCC2_CSP:9084, ZCC_CB:9085 > VRA_CB_2:4007, VRA_CB_2:4008

Note: If a VRA is uninstalled, connectivity from that VRA to any ZCC is lost. After a VRA is reinstalled on the host, the ports that were used for the connection to the ZCC are not reused and new ports must be opened in the firewall for the cloud site.

Setting up Static Routes

Adding a Cloud Connector For a Site

Setting up Static Routes

To set up static routes:

1. In the Zerto Cloud Manager Sites tab, click the site name of a site that provides DRaaS.
2. Click the Site Settings () button.

The Site Settings dialog is displayed.

3. Click Cloud Settings.

The Cloud Settings page is displayed.

4. In the Networking section, click Configure.

The Manage Static Routes dialog is displayed.

5. Click ADD to define a group. This group will contain a static route to the subnet used by the Zerto Virtual Manager and can be applied to more than one cloud connector.

6. To edit the name of the group, click the edit icon next to the newly added group name. Enter the name of the group and click SAVE.
7. To define a static route for that group, click Add Static Route.

8. Specify the static route:
Address: The network address for the static route that you want to route to.
Subnet Mask: The subnet mask for the network.
Gateway: The gateway address for the network on the local network of the Zerto Cloud Connector cloud network interface.
9. Click SAVE.

You can add more groups by repeating steps Click ADD to define a group. This group will contain a static route to the subnet used by the Zerto Virtual Manager and can be applied to more than one cloud connector.- Click SAVE..

You can define more than one static route for a group. The static routes are displayed under each group.

10. Click SAVE.
You can use the group in the definition of a connector.
If you change the Zerto Virtual Manager and VRA cloud network, changing the static route settings for a group to the new network only changes the access for new ZCCs with the specified group. Existing ZCCs must be redeployed to use the changed static route.

Adding a Cloud Connector For a Site

A cloud connector requires 4GB disk space, at least 1GB of reserved memory, and 1 vCPU.

To add a cloud connector for a site:

1. Click a ZORG in the Zerto Cloud Manager Organizations tab or select the row in the display and then click EDIT.
2. Select the Customer Sites tab.
3. Click ADD.

The Install Cloud Connector dialog is displayed.

Specify the following:

Site: The site used by the cloud service provider for the organization.
VM Name: The name to assign to the cloud connector virtual machine.
Host: The recovery host for the cloud connector virtual machine. The dropdown displays the hosts which do not have a cloud connector installed.
Datastore: The datastore for the cloud connector virtual machine.
Organization Network: The customer network details:
Network: The name of the customer’s network.
Address: The IP address used to access the organization network. The customer pairs to this IP address.
Subnet Mask: The subnet mask for the customer network. The default value is 255.255.255.0.
Default Gateway: The default gateway for the customer network.
Cloud Network: The cloud service provider local network details:
Network: The name of the cloud-side network.
Address: The IP address to access the cloud service provider network that communicates with the cloud connector.
Subnet Mask: The subnet mask for the cloud service provider network. The default value is 255.255.255.0.
Static Route Group: The name of the group for which static routes are defined to the Zerto Virtual Manager network and VRA network. If a static route group is not specified, it is assumed that the Zerto Virtual Manager and VRAs are on the same network.
4. Click SAVE.

The cloud connector installation starts and the status is displayed in the table.