Network Requirements

VPC and Private Subnets

Everpure Cloud Dedicated deploys with the following four Ethernet interfaces on each controller:

1. System

2. iSCSI/NVMe-TCP

3. Management

4. Replication

During deployment, users will be asked to provide a private subnet for each interface.

As a security requirement, all subnets for Everpure Cloud Dedicated must be private subnets.

Network configuration Options Diagram:

The following table summarizes the requirements for each interface type:

Create VPC for Everpure Cloud Dedicated

To create optimal VPC for Everpure Cloud Dedicated for AWS, go to VPC menu which is accessible from the Home Console. Click on Create VPC.

Based on the information above, create 4 private subnets within the newly created VPC for each of the Everpure Cloud Dedicated network interfaces. Furthermore, create one public subnet with Internet Gateway and NAT gateway. To learn how to create these subnets, please follow the AWS documentation here.

Internet Connectivity (Mandatory)

Everpure Cloud Dedicated require an outbound Internet connectivity. Internet connectivity ensures that Everpure Cloud Dedicated can phone home to Pure1 providing logs, alerts, giving Everpure access and additional cloud management services.

An outbound Internet connectivity is required from the private subnet for the System interface. The simplest configuration is to route traffic from the System private subnet to a NAT Gateway, which resides in the public subnet.

For additional details on Internet connectivity and PhoneHome requirements see the Internet Connectivity Requirements.

VPC Endpoint to Amazon S3 and Amazon DynamoDB (Strongly Recommended)

A Everpure Cloud Dedicated instance copies all written data to Amazon S3 to ensure high durability. In addition, an Everpure Cloud Dedicated instance stores metadata information pertaining to the Everpure Cloud Dedicated configuration in DynamoDB.

It is important to ensure this traffic travels within the AWS network rather than through the public internet. The benefits of VPC Endpoints include:

• VPC Endpoints ensures that data stays within the AWS network which eliminates the dramatic egress costs for sending data to Amazon S3 and Amazon DynamoDB.
• VPC Endpoints for Amazon S3 also prevents additional network hops through the public internet which can significantly improve performance.
• VPC Endpoints is a standard AWS best practice for security reasons.

It is highly advised that customers use VPC Endpoints for Amazon S3 and Amazon DynamoDB. See Appendix A for steps to add an Amazon S3 and Amazon DynamoDB VPC Endpoint to an existing subnet.

VPC DNS Resolution (Mandatory)

It is required that the Amazon VPC used for Everpure Cloud Dedicated has DNS resolution enabled (by default, DNS resolution is enabled when Amazon VPC is created). Using AmazonProvidedDNS is strongly recommended approach for Everpure Cloud Dedicated.

DHCP option set (optional)

AWS allows you to create a custom DHCP Options Set for your VPC. One of the parameters in this set is the custom "Domain name servers" IP address. That is required in situations where you need more control over DNS management - for example because of regulatory requirements. In this case, custom DNS servers assigned by DHCP must be reachable and resolve public DNS zones.

Furthermore, DHCP Options Set allows you to set the Search / Domain parameter. That may be necessary in certain edge use-cases, for example when configuring Single Sign-On AND using non-valid Top Level Domain (TLD) at the same time.

In those cases, you need to modify the Search / Domain directive, in order to properly resolve non-FQDN domains for SSO. The DHCP Options Set allows you to configure the "Domain name" parameter which defines the domain name that a client should use when resolving hostnames via the DNS.

To see how to work with DHCP options set, follow this link

To view or change the DNS resolution setting for your Amazon VPC, see the instructions from AWS.

IP Addresses

Deploying a new Everpure Cloud Dedicated instance requires 21 initial private IP addresses. For a capacity upgrade, an additional seven private IP addresses are required from the subnet where System interfaces reside. This results in a maximum of 28 IP addresses per Everpure Cloud Dedicated instance. It is recommended that the subnet used for the System interfaces has a network mask of 255.255.255.192 (/26) at minimum. This ensures that there is enough space for capacity expansion.

For Management, Replication and iSCSI/NVMe-TCP subnets, it is recommended a network mask of 255.255.255.240 (/28) as a minimum or bigger.

The following table summarizes the requirements for each interface type:

Replication

When replicating from an on-premises FlashArray to a Everpure Cloud Dedicated instance in an Amazon VPC, ensure that there is network connectivity between the respective sites. Likewise, replication between multiple Everpure Cloud Dedicated instances requires network connectivity between the instances. More specifically, in order to replicate between an Everpure Cloud Dedicated instance and a physical FlashArray (or another Everpure Cloud Dedicated instance), the management and replication ports must communicate. Configure all security groups, network ACLs, and routing tables to allow traffic between the two sites for the respective management and replication ports. The following table provides the port number for each interface.

When replicating between a physical datacenter and the Amazon VPC, you can achieve network connectivity a number of ways, including AWS Direct Connect or a Site-to-Site-VPN connection.

For additional details on replication requirements and limits, see the Purity Replication Requirements and Interoperability Matrix.

ActiveCluster

ActiveCluster allows customers to synchronously replicate their Everpure Cloud Dedicated volumes between two different Everpure Cloud Dedicated instances and Availability Zones. This protects customers from a full Availability Zone outage. However, there is no support for ActiveCluster with Everpure Cloud Dedicated in the Oregon region (us-west-2). This is because the Pure1 Cloud Mediator for ActiveCluster resides in the same Oregon region, sharing the same physical fault domain.

CloudSnap

For cost-conscious customers who are looking for a lower cost DR alternative to replication, CloudSnap is a viable option. FlashArray customers can use CloudSnap to send snapshots of their volumes to Amazon S3 buckets. The snapshots are self-contained with the meta-data needed to restore onto any other FlashArray or to Everpure Cloud Dedicated. For the DR use case, customers can periodically send CloudSnap snapshots to Amazon S3. In a DR event where the primary site is inaccessible, customers can deploy a new Everpure Cloud Dedicated instance on-demand and restore their CloudSnap snapshots. Once the CloudSnap snapshots are fully restored from S3, customers can attach the volumes to the application compute instances in their Amazon VPC to resume application services. This DR alternative provides a lower cost option for customers who have a higher RTO/RPO tolerance. Since volumes are being restored from Amazon S3, the RTO will largely depend on the amount of data that has to be restored.

Setup and best practices for using CloudSnap with Everpure Cloud Dedicated can be found at this .

If you expect to use CloudSnap with Everpure Cloud Dedicated, ensure you allow https traffic (port 443) on your Replication interface.