8.4 HPE Zerto Software: Continuous Data Protection, Disaster Recovery & Cyber Resilience
Key Takeaways
Zerto, a Hewlett Packard Enterprise company since 2021, provides continuous data protection (CDP), disaster recovery orchestration and workload mobility for virtualized and cloud workloads.
Zerto replication is agentless: a Virtual Replication Appliance on each hypervisor host captures every write and streams it to the recovery site, giving RPOs measured in seconds.
Protected VMs are grouped into Virtual Protection Groups (VPGs) that keep write-order fidelity across VMs, and the journal keeps from one hour to 30 days of history.
Zerto 10 added real-time encryption detection, the Zerto Cyber Resilience Vault and a hardened Linux-based Zerto Virtual Manager appliance.
HPE integrates Zerto with its portfolio: GreenLake for Disaster Recovery is powered by Zerto, MSA Gen7 supports it, and B10000 migrations can use it.
HPE Zerto Software
Quick Answer: HPE Zerto replicates every write of protected virtual machines, without agents, to a journal at a recovery site. You can recover to any point in the journal (from one hour to 30 days of history) with RPOs of seconds and fast, orchestrated failover. VMs are protected in Virtual Protection Groups (VPGs) that keep write-order fidelity, so multi-VM applications recover consistently. Zerto 10 adds real-time encryption detection and the Cyber Resilience Vault against ransomware.
Zerto and HPE
Zerto became a Hewlett Packard Enterprise company in 2021. It is not a third-party partner product, and HPE now sells it as HPE Zerto Software. It appears across the portfolio:
- HPE GreenLake for Disaster Recovery delivers Zerto as a GreenLake service.
- The MSA Gen7 QuickSpecs list Zerto replication as an optional data protection feature.
- The B10000 QuickSpecs describe Zerto as a simple, scalable way to migrate large virtualized environments to the B10000 regardless of the source storage.
- Zerto can send long-term retention copies to HPE StoreOnce using Catalyst.
Why continuous data protection
| Approach | Typical recovery point | Recovery granularity |
|---|---|---|
| Nightly backup | Up to 24 hours of data loss | One point per day |
| Hourly snapshots | Up to an hour of loss | One point per hour |
| Synchronous replication | Zero loss, but metro distances only and no way back to a point before corruption | Latest state only |
| Zerto CDP | Seconds | Any point in the journal |
Synchronous replication copies corruption and ransomware encryption instantly. Snapshots and backups leave gaps. CDP gives near-synchronous RPOs at any distance and the ability to rewind to just before a problem began.
How Zerto works
| Component | Role |
|---|---|
| Zerto Virtual Manager (ZVM) | Manages protection and recovery for a site; in Zerto 10 it is a hardened, Linux-based virtual appliance that replaced the Windows-based ZVM |
| Virtual Replication Appliance (VRA) | Runs on each hypervisor host, captures writes of protected VMs at the hypervisor layer and sends them to the recovery site; at the target it writes to the journal and replica disks |
| Virtual Protection Group (VPG) | Set of VMs protected and recovered together with write-order fidelity and shared settings |
| Journal | Log of every change at the recovery site, with a user-defined history from 1 hour to 30 days |
| Checkpoints | Recovery points recorded in the journal every few seconds, plus checkpoints that users tag before risky changes |
Replication is agentless: nothing runs inside the protected VMs, so there is nothing for malware in a VM to disable. Writes are compressed and encrypted in transit. Zerto is storage-agnostic, so the source and target can use different arrays.
Recovery operations
| Operation | Use |
|---|---|
| Failover Test | Boots VMs from a chosen checkpoint in an isolated network to prove recoverability while replication continues |
| Failover (live) | Recovers VMs at the target after a disaster, to the latest or an earlier checkpoint |
| Move | Planned migration of VMs to another site or platform with minimal downtime |
| Reverse protection | After failover, replicates back so the original site can be restored later |
| File and VM restore | Restores individual files or VMs from the journal |
| Long-term retention | Copies to repositories, such as StoreOnce, for retention beyond the journal |
Because recovery is orchestrated per VPG, including boot order and network mapping, RTOs are typically minutes.
Ransomware resilience with Zerto 10
- Real-time encryption detection: as writes are streamed, Zerto analyzes them inline for signs of encryption. It warns of an attack in progress and helps identify the last clean checkpoint. The analysis is also available through an API for security tools.
- Zerto Cyber Resilience Vault: an isolated recovery environment. A landing zone receives continuous replication with a compressed journal of up to 30 days. A separate, air-gapped vault zone receives periodic copies over a direct connection and keeps immutable snapshots of replicas, journals and the Zerto components needed for recovery, so a clean copy survives even if production and the recovery site are both compromised. HPE's reference design uses HPE Alletra storage, ProLiant servers and Aruba networking.
Worked scenario
Ransomware begins encrypting a manufacturing database cluster at 01:02:18. Real-time encryption detection raises an alert within moments. The team selects the checkpoint at 01:02:10, runs a Failover Test in an isolated network to confirm the data is clean, and then performs a failover of the VPG to that checkpoint. The business loses about 8 seconds of transactions instead of everything since the previous night's backup.
Zerto compared with other HPE protection tools
| Need | Best fit |
|---|---|
| RPO of seconds and rewind to any point for VMs | HPE Zerto |
| RPO = 0 across a metro distance with transparent failover | B10000 Active Peer Persistence |
| Deduplicated backups with long retention | StoreOnce or GreenLake for Backup and Recovery |
| Offline copy | Tape |
| Zerto delivered as a service | HPE GreenLake for Disaster Recovery |
Zerto complements backup rather than replacing it: the journal covers up to 30 days, while backup and tape cover longer retention.
Common exam traps
- Calling Zerto a partner product: Zerto is an HPE company.
- Assuming Zerto needs agents in each VM: it is agentless at the hypervisor layer.
- Confusing the journal with backup: the journal holds 1 hour to 30 days; longer retention needs long-term retention or backups.
- Mixing up VPG and VRA: the VPG is the group of VMs; the VRA is the appliance on each host.
Which component of HPE Zerto runs on each hypervisor host and captures the writes of protected virtual machines?
The Zerto Virtual Manager appliance
The Virtual Replication Appliance (VRA)
The Virtual Protection Group definition
The Protection Store Gateway virtual machine
Why does HPE Zerto group the VMs of a multi-tier application into one Virtual Protection Group?
To keep write-order fidelity so all VMs recover to the same consistent point
To deduplicate the VMs with StoreOnce Catalyst before replication
To bypass the journal and replicate the VMs synchronously
To install a replication agent inside each protected VM
How much history can the HPE Zerto journal keep?
Exactly 24 hours, fixed by the product
Up to 7 years for compliance retention
A configurable history from 1 hour up to 30 days
Only the most recent checkpoint is kept
Which feature introduced in Zerto 10 helps identify a ransomware attack while it is happening?
Catalyst Copy to a second StoreOnce system
LTO WORM media in an MSL library
Priority Optimization on the B10000
Real-time encryption detection
Sections you finish are checked off in the contents.
You've completed this section
Continue exploring other exams