---
title: "Managing Protected Paths"
slug: "managing-protected-paths-tg"
tags: ["5.5"]
updated: 2026-11-01T15:23:08Z
published: 2026-11-01T15:23:08Z
canonical: "docs.vastdata.com/managing-protected-paths-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Protected Paths

## Overview of Protected Paths

A protected path is a path in the element store (file/object system) that is protected by snapshots and/or replication to one or more remote peers.

Protected paths are used by the following data protection features:

- [Asynchronous replication](/docs-5-5/docs/overview-of-vast-replication-tg), where data is captured by snapshots on a schedule of points in time and replicated to other clusters.
- [Synchronous replication](/docs-5-5/docs/overview-of-vast-replication-tg), where data on a path on a primary cluster is replicated immediately on every write operation to a destination path on a secondary cluster.
- [Global access](/docs-5-5/docs/global-access-tg), where a data path is shared with one or more remote clusters such that the data is accessible to clients of the remote cluster at a target path.
- [Local backup](/docs-5-5/docs/snapshots-and-local-backup-tg), where data is captured by snapshots on a schedule of points in time and stored locally.
- [Backup to S3](/docs-5-5/docs/overview-of-backup-to-s3-tg), where data is captured by snapshots on a schedule of points in time and replicated via S3 to an AWS bucket.

For full configuration instructions for asynchronous replication, asynchronous replication, local backup and backup to S3, see the relevant feature section, linked above.

A protected path can have one or more destinations. In replication and backup features, each destination has a replication stream takes snapshots of the data on a schedule controlled by a [protection policy](/docs-5-5/docs/managing-protection-policies-tg). Each protection policy determines how long snapshots are stored and retained locally and if they are replicated to a remote peer and on what schedule.

### Creating Protected Paths between Tenants

You can configure protected paths between tenants on different clusters, subject to the following restriction:

If Tenant A replicates a protected path to Tenant B on a remote cluster, it cannot then replicate another path to Tenant C on the same remote cluster (that is, Tenant A cannot have replicated protected paths to more than one tenant on the same remote cluster). It can, however, replicate protected paths to Tenant C (or any other tenant) on a different remote cluster. Similarly, Tenant A can replicate additional protected paths to Tenant B on the same remote cluster.

## Limitations and Cautions

> [!WARNING]
> Important
> 
> Limitations:
> 
> - No more than one replicating protected path can be configured per directory.
> - Protected paths with asynchronous replication or backup to S3 cannot be nested.
> - A protected path cannot have a file under it that has a hard link outside of the protected path.
> - It is not allowed to create a protected path on a subdirectory under a path that exposes an S3 bucket.

> Caution
> 
> If you create a protected path to replicate data to a peer that you already replicated data to earlier by means of another protected path that was deleted earlier, the initial synchronization is performed again. In other words, the re-creation of a protected path triggers a new transfer of all data under the path to the peer.

> [!NOTE]
> Note
> 
> Moving data across the boundaries of protected paths is supported by an implicit conversion to a copy and delete task. As such, movement may take longer than expected. This includes the following:
> 
> - Moving a file or directory from a protected path to a non protected path.
> - Moving a file or directory from a non protected path to a protected path.
> - Moving a file or directory from one protected path to another protected path.

## Creating a Remote Protected Path in the VAST Web UI

1. In the left navigation menu, select Data Protection and then Protected Paths.
2. On the Protected Paths tab, click Create Protected Path and then New Remote Protected Path.
3. In the Create Remote Protected Path dialog, complete the fields in the popup to add the source peer:

| Name | Enter a name for the protected path. |
| --- | --- |
| Path | The path you want to replicate. A snapshot of this directory will be taken periodically according to the protection policy. > [!NOTE] > Note > > - If you specify '/' (the root directory), this includes data written via S3. > - To specify a path to a specific S3 bucket with name *bucket*, enter */bucket*. |
4. Click Next and complete the fields for adding the destination peer:

| Mode | Select the mode: - Async Replication. For asynchronous replication to a remote peer. - Sync Replication. For synchronous replication to a remote peer. - S3 Replication. For backup to an S3 bucket. - Global Access. For global access. |
| --- | --- |
| Enable Global Access | Check this box if you want to [enable global access on an asynchronous replication destination path](/docs-5-5/docs/configuring-async-replication-and-global-access-on-shared-paths-tg). This requires that both the source and destination peers are running VAST Cluster 5.4 or later. This field only appears if *Mode* is set to *Async Replication*. |
| Enable bucket replication | Check this box if you want to enable bucket replication. If you want to prevent bucket replication from being enabled, deselect the checkbox, or leave it unchecked. This setting cannot be changed after creating the protected path. For information about bucket replication, see [Bucket Replication](/docs-5-5/docs/s3-access-to-replicated-data-tg#bucket-replication). |
| Protection policy | If you selected *Async Replication* or *S3 Replication* for *Mode*, select a protection policy from the dropdown or select Add new Protection Policy, [configure the new one](/docs-5-5/docs/managing-protection-policies-tg) in the dialog provided and save it. > [!WARNING] > Warning > > After adding a destination to a protected path, it is not possible to change which policy is associated with the destination. All changes to a destination's snapshot schedule, replication schedule, and snapshot expiration must be done by modifying the protection policy. Those modifications affect all destinations that use the same protection policy. To work around this limitation, use one protection policy per destination. |
| Cluster | If *Mode* is set to *Global Access*, select a remote cluster where you want to configure a destination path. The remote cluster must be configured already as a replication peer. If *Mode* is set to *Sync* *Replication*, select the destination cluster. |
| Path | This field is applicable only if there is a remote peer set in the *Cluster* field. Specify the directory on the remote peer cluster where the data should be replicated. This must be a directory that does not yet exist on the remote peer. The remote path must start with “/” > [!TIP] > Tip > > You cannot use "/" as remote path because that always exists already. Therefore if you would like to replicate all data under the root directory, you will need to replicate this to a subdirectory. e.g. path on peer = "/mirror". |
5. Click Save and then Create.

The protected path is created and listed in the Protected Paths tab.

## Creating a Local Protected Path

Create this type of protected path for local backup.

1. In the left navigation menu, select Data Protection and then Protected Paths.
2. On the Protected Paths tab, click Create Protected Path and then New Local Protected Path.
3. In the Create Local Protected Path dialog, complete the fields:

| Name | Enter a name for the protected path. |
| --- | --- |
| Path | The path you want to replicate. A snapshot of this directory will be taken periodically according to the protection policy. > [!NOTE] > Note > > - If you specify '/' (the root directory), this includes data written via S3. > - To specify a path to a specific S3 bucket with name *bucket*, enter */bucket*. |
| Protection policy | Select a protection policy from the dropdown or select Add new Protection Policy, [configure the new one](/docs-5-5/docs/managing-protection-policies-tg) in the dialog provided and save it. > [!WARNING] > Warning > > After adding a destination to a protected path, it is not possible to change which policy is associated with the destination. All changes to a destination's snapshot schedule, replication schedule, and snapshot expiration must be done by modifying the protection policy. Those modifications affect all destinations that use the same protection policy. To work around this limitation, use one protection policy per destination. |
4. Click Create.

The protected path is created and listed in the Protected Paths tab.

## Adding Destinations to a Remote Protected Path

When you first create a remote protected path, you can add one destination. After creating the protected path, you can add additional destinations.

1. In the Protected paths page, edit the protected path.
2. In the Edit Remote Protected Path dialog, click Add Another, and enter the following:

| Mode | Select the mode: - Async Replication. For asynchronous replication to a remote peer. - Sync Replication. For synchronous replication to a remote peer. - S3 Replication. For backup to an S3 bucket. - Global Access. For global access. |
| --- | --- |
| Enable global access | Check this box if you want to [enable global access on an asynchronous replication destination path](/docs-5-5/docs/configuring-async-replication-and-global-access-on-shared-paths-tg). This requires that both the source and destination peers are running VAST Cluster 5.4 or later. This field only appears if *Mode* is set to *Async Replication* and only if the protected path does not already include a *Sync replication* member. |
| Protection policy | If you selected *Async Replication* or *S3 Replication* for *Mode*, select a protection policy from the dropdown or select Add new Protection Policy, [configure the new one](/docs-5-5/docs/managing-protection-policies-tg) in the dialog provided and save it. > [!WARNING] > Warning > > After adding a destination to a protected path, it is not possible to change which policy is associated with the destination. All changes to a destination's snapshot schedule, replication schedule, and snapshot expiration must be done by modifying the protection policy. Those modifications affect all destinations that use the same protection policy. To work around this limitation, use one protection policy per destination. |
| Cluster | If *Mode* is set to *Global Access*, select a remote cluster where you want to configure a destination path. The remote cluster must be configured already as a replication peer. If *Mode* is set to *Sync* *Replication*, select the destination cluster. |
| Path | Specify the path on the remote peer to which you want the stream to replicate the data from the protected path. The path you specify must be to a directory that does not yet exist on the remote peer. The remote path must start with “/” > [!TIP] > Tip > > You cannot use "/" as remote path because that always exists already. Therefore if you would like to replicate all data under the root directory, you will need to replicate this to a subdirectory. e.g. path on peer = "/mirror". |
3. Click Save and then Save again.

## Removing a Destination from a Protected Path

When you remove a destination from a protected path on the source cluster, VMS removes any associated standby stream(s) on destination clusters.

1. On the source cluster, right-click the protected path and select Edit.
2. Click the ![trash_icon.png](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/img-8fc002acc434dcd9cf29fb55b3a93020(34).png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A15%3A54Z&se=2026-11-08T10%3A15%3A54Z&sr=c&sp=r&sig=GThQPI4veEOR3XUm9cRSEtLtiwavE8fd6Ti39X2Eepk%3D) icon for the destination you want to remove.
3. Click Yes to confirm the removal.

## Viewing Protected Paths

In the left navigation menu, select Data Protection and then Protected Paths.

The following information is displayed for each protected path:

| Field | Description |
| --- | --- |
| ID | The ID of the protected path. |
| Name | The name of the protected path. |
| Role | For asynchronous replication, the role of the local peer in the protected path, which can be: - Source. Snapshots are replicated from the local peer to the remote peer. The protected path on the local peer is writeable. - Destination. Snapshots are replicated from the remote peer to the local peer. The replication path on the local peer is read only. - Standalone. Replication between the peers is suspended and data on the local peer is writeable. |
| Global Access | Indicates the Global Access status for the path. |
| Mode | Shows the current replication mode, such as synchronous or asynchronous replication. |
| State | Possible values: - Format. The protected path is being formatted and the initial synchronization has not yet begun. - Initial Sync. The initial data synchronization is in progress. - Active. The initial data synchronization was completed in the past and the protected path is enabled. - Suspended. The protected path was suspended. A protected path can be suspended in any of the following situations: - When manually deactivated. - Temporarily during [graceful failover](/docs-5-5/docs/failover-capabilities-and-scenarios-for-asynchronous-replication-tg#ungraceful-failover) (asynchronous replication). - If the connection between the peers is lost (asynchronous replication). - Following [ungraceful failover](/docs-5-5/docs/failover-capabilities-and-scenarios-for-asynchronous-replication-tg#ungraceful-failover), when the protected path role is standalone and both peers are writeable (asynchronous replication). |
| Health | An indication of whether the state is OK or not: - OK, if the *State* of the protected path is healthy. - Error, if the *State* is not a healthy state. |
| Local Path | The local data path that is being protected. |
| Destination path | For asynchronous replication and global access only. The directory on the peer where the protected data is replicated or made globally accessible. If the protected path has multiple destinations, each destination has a different path on peer. |
| Replication Peer | If there is a replication peer configured on the cluster, this field displays the cluster name of the replication peer. (There is more than one if the protected path has multiple destinations.) |
| Protection Policy | The protection policy which governs the protected path's schedule, snapshot retention and replication peer if applicable. |
| Last Point Creation Time | The time of the last completion of a restore point on the replication peer or replication S3 peer, if applicable. |
| Next Point progress | The progress towards creating the next restore point on the destination peer(s). |
| BW | The speed of the connection with a replication peer or replication S3 peer, if applicable. |
| Aggregated Usage | An estimate of the amount of usable capacity that could be reclaimed by deleting all snapshots on the protected path. This estimation takes into account any nested protected paths that hold common data, because data held by another protected path's snapshots would not be removed even if all snapshots on the protected path were removed. |
| Next Point Physical Size | The physical size on disk of the delta to be transferred in the next restore point. |
| Next Point Logical Size | The logical size on disk of the delta to be transferred in the next restore point. |
| ETA | Applicable during a failover event, this is the estimated time remaining until the local peer completes a change of replication role with respect to the protected path. For example, if the local peer is changing from destination role to source role for the protected path, this is the estimated time until that role change is complete. |
| Files Counted | The number of files at the protected path on the local peer. |
| Progress | Applicable during a failover event, this is the percentage progress of a change of replication role for the local peer with respect to the protected path. For example, if the local peer is changing from destination role to source role for the protected path, this is the percentage progress so far for that role change. |

## Modifying a Protected Path

To modify the configuration of a protected path, right-click the protected path and select Edit. Make your changes and then click Update.

> [!NOTE]
> Note
> 
> You cannot change the protection policy for a destination.

## Activating and Deactivating (Starting and Pausing) Protected Paths

Deactivating a protected path pauses replication for the path. Activating the protected path resumes replication.

> [!NOTE]
> Note
> 
> Deactivating a protected path that is using an indestructible protection policy requires [unlocking the indestructibility mechanism](/docs-5-5/docs/managing-the-indestructibility-mechanism#unlocking-the-indestructibility-mechanism) on the cluster.

Right-click the protected path you want to activate or deactivate, and select Activate or Deactivate as needed.

## Removing a Protected Path

Removing a protected path prevents the ability to resume it. After removing a protected path, if you create a new protected path using the same policy, that new protected path triggers a new initial synchronization, copying over all of the VAST Cluster's data to the S3 replication peer (if a peer is specified in the policy).

> [!TIP]
> Tip
> 
> If you only want to pause replication and you may want to resume later, don't remove the protected path; instead [deactivate the protected path](/docs-5-5/docs/managing-protected-paths-tg#activating-and-deactivating-starting-and-pausing-protected-paths).

Removing a protected path does *not* delete snapshots or restore points that were already backed up to an asynchronous or S3 replication peer.

To remove a protected path:

1. Right-click the protected path and select Remove.
2. Click Yes to confirm the removal.