Amazon FSx for NetApp ONTAP integration with VMware Cloud on AWS is an AWS-managed external NFS datastore built on NetApp’s ONTAP file system that can be attached to a cluster in your SDDC. It provides customers with flexible, high-performance virtualized storage infrastructure that scales independently of compute resources.

For more information and a reference architecture, see the VMware Cloud Tech Zone article VMware Cloud on AWS integration with Amazon FSx for NetApp ONTAP.


VMware Cloud on AWS supports external storage starting with SDDC version 1.20. For information about upgrading an SDDC, see Submit an Upgrade Schedule Request.

Each mountpoint exported by an FSx for ONTAP service is treated as a separate datastore when added as external storage. See Actions Taken by VMware to Ensure SDDC Health for details about the impact of NFS storage failures on SDDC operations.

You cannot deploy FSx for ONTAP in the Connected VPC. Instead, you must deploy it in another VPC that you own, then connect the VPC to a VMware Managed Transit Gateway (VTGW).


  • Log in to the AWS console and create a VPC in the same region as the SDDC. If necessary, you can use an existing VPC owned by any of your AWS accounts, but you cannot use the Connected Amazon VPC for this purpose. In this document, we refer to this VPC as the FSx for ONTAP VPC.
  • Follow the procedure in Create an Amazon FSx for NetApp ONTAP file system to create an FSx for ONTAP Single-AZ or Multi-AZ deployment in the FSx for ONTAP VPC. The Storage Virtual Machine (SVM) IP address shown in the Endpoints section of the Storage Virtual Machine tab must be accessible from the SDDC Management Gateway. Make a note of this address. You'll need it when you attach the FSx for ONTAP storage to an SDDC cluster.
  • To use multi-AZ FSx for ONTAP as an external datastore, an SDDC must be a member of an SDDC group so that it can route the datastore connection through the group's VTGW. If you need to create a new SDDC group that includes this SDDC, or attach the SDDC to an existing SDDC group, follow the procedures in Create or Modify an SDDC Group. To learn more about SDDC groups, see Creating and Managing SDDC Deployment Groups with VMware Transit Connect™
  • To use single-AZ FSx for ONTAP as an external datastore for a single-AZ SDDC, whether or not it is a member of an SDDC group, configure VPC peering for external NFS Storage, as described in About External Storage.


  1. Pick a connection strategy.
    Use this procedure to connect FSx for ONTAP as an external datastore for an SDDC that is a member of an SDDC group. To use VPC peering to connect FSx for ONTAP, see Introducing VPC Peering for External Storage for more information.
  2. Open the VMware Cloud Console and follow the procedure in Attach a VPC to an SDDC Group to attach the FSx for ONTAP VPC to the SDDC group.
    1. Click Add Account and provide the AWS account ID that you used to create the FSx for ONTAP VPC. (Step 2 of Attach a VPC to an SDDC Group.)
    2. In the AWS console navigate to Transit Gateway Attachments and use the dropdown control in the Details section to select the Transit gateway ID of the VTGW. Select the DNS support checkbox under VPC attachment, and click Create Transit Gateway Attachment. (Step 6 of Attach a VPC to an SDDC Group.)
  3. Add routes between the FSx for ONTAP VPC and the SDDC group VTGW.
    1. Add a route from the SDDC group's VTGW to the FSx for ONTAP VPC SVM IP range.
      Open the External VPC tab for the SDDC group and select the AWS Account ID that owns the VPC and expand the row. If no routes have been specified, click ADD ROUTES in the Routes column to open the Edit Routes page and add one or more routes that use this VPC as a Target. Otherwise the Routes column shows the first route and the number of additional routes. Click the pencil icon ( pencil icon) to open the Edit Routes page so you can edit this list to add the FSx for ONTAP VPC SVM IP range.
    2. Add the SDDC management prefixes to the route table(s) used for the FSx ONTAP deployment.
      In the AWS console, navigate to the Amazon FSx page and select File systems, then click your file system to see the route table and other details. Click the route table ID under Route tables, then edit the route table to add a route with these parameters:
      Destination Target
      SDDC Management Gateway CIDR (You can find this on the Connected VPC card of the Networking & Security Dashboard VTGW transit gateway ID.
      See Add and remove routes from a route table in the AWS documentation for more information about editing the main route table of a VPC.
  4. Add an inbound rule to the VPC's default security group.
    In the AWS console, select the default Security Group for the FSx for ONTAP VPC and click the Inbound tab. Add a rule with the following parameters.
    Type Source
    All traffic. Custom. Enter the SDDC Management Gateway CIDR.
    Note: If you want to create a more restrictive rule, you can further restrict traffic by specifying these required ports and protocols.
    Protocols Ports Purpose
    TCP, UDP 111 Portmapper (used to negotiate which ports are used in NFS requests)
    TCP, UDP 635 NFS mountd (receives NFS mount requests)
    TCP, UDP 2049 NFS network traffic
    TCP, UDP 4045 Network Lock Manager (NLM, lockd) - Handles lock requests.
    TCP, UDP 4046 Network Status Monitor (NSM, statd) - Notifies NFS clients about reboots of the server for lock management.
    Click Save.
  5. Attach a mountpoint from the FSx datastore to the SDDC.
    See Add External Storage to a Cluster. In the VMware Cloud Console, open the Storage tab of your SDDC. Click ATTACH DATASTORE and fill in the required values.
    Cluster Select a cluster. Cluster-1 is preselected if there are no other clusters. Stretched clusters are not supported.
    Datastore Choose Attach a new datastore
    NFS server address The NFS IP address shown in the Endpoints section of the FSx Storage Virtual Machine tab. Click VALIDATE to validate the address and retrieve the list of mountpoints (NFS exports) from the server.
    Export Pick one from the list of mountpoints exported by the server at the NFS server address. Each mountpoint must be added as a separate datastore.
    Storage Vendor AWS FSx ONTAP
    Datastore Name Give the datastore a name. Datastore names must be unique within an SDDC.
    Click ATTACH DATASTORE to add the FSx datastore.