What's New in VMware HCX 9.1: Enhanced Appliances, VCF Operations Lifecycle and PhotonOS Deprecation

VMware HCX 9.1 release guide

VMware HCX 9.1 ships with VMware Cloud Foundation (VCF) 9.1 under the name VCF Operations HCX. It changes how the Interconnect and Network Extension appliances are built, moves the HCX Manager lifecycle into VCF Operations, brings back WAN optimization and adds Windows Server 2025 to OS Assisted Migration. It also starts the clock on the PhotonOS appliances, which Broadcom plans to remove in VCF 10.0.

We run HCX migrations for a living, so this guide reads the 9.1 release notes the way a migration lead would: what changed, what it means for a service mesh that is already carrying production traffic, and what to do before you upgrade. Every feature listed here comes from Broadcom's VCF 9.1 release notes. Where we add an opinion or a recommendation, we say so.

What is VMware HCX 9.1?

VMware HCX 9.1 is the workload mobility component of VMware Cloud Foundation 9.1. In the VCF 9.1 release notes it appears as VCF Operations HCX, under the Workload Mobility heading. HCX moves virtual machines between vSphere environments using several migration types (vMotion, Bulk, Cold, Replication Assisted vMotion, HCX Assisted vMotion and OS Assisted Migration) and stretches Layer 2 networks between sites with Network Extension, so VMs keep their IP addresses during a move.

VCF 9.1.0 became generally available in May 2026, and VCF 9.1.1 followed in September 2026. HCX 9.1 is licensed as part of the VCF subscription.

Table 1. HCX 9.1 changes at a glance.

The enhanced IX and NE appliance architecture

The largest change in HCX 9.1 is under the service mesh. HCX has two data plane appliances. The Interconnect appliance (HCX-IX) carries migration traffic, and the Network Extension appliance (HCX-NE) bridges Layer 2 segments between sites. Until 9.1, both ran on a self-managed PhotonOS build with HCX's own network stack.

HCX 9.1 introduces an enhanced architecture for both appliances, built on the NSX Edge stack. Broadcom's stated reasons are better performance and no longer having to maintain two network stacks that do the same job. Traffic between enhanced IX and NE instances uses standard IPsec.

What happens to your existing service meshes

From 9.1, every new service mesh uses the enhanced architecture automatically. Upgrading HCX does not convert anything that already exists: appliances deployed by earlier versions keep the legacy architecture until you move them with the Migrating Network Extensions workflow.

That gives you two kinds of mesh running side by side after the upgrade, and some 9.1 features only work on one of them. WAN optimization, for example, is limited to enhanced meshes. Before you promise a feature to a migration team, check which kind of mesh their wave will use.

PhotonOS appliance deprecation and the VCF 10 timeline

Support for self-managed PhotonOS appliances in VCF Operations HCX is deprecated as of 9.1.0. Broadcom is targeting full removal in VCF 10.0.0. HCX 9.1 includes an automated workflow that moves PhotonOS appliances onto the NSX Edge architecture.

The appliances still work and are supported in 9.1, but any service mesh that will still be running when you upgrade to VCF 10 needs to be on the enhanced architecture first. Large migration programmes often keep Network Extension in place for months while application owners finish testing, so meshes built today can easily outlive the 9.x line.

HCX Manager lifecycle moves into VCF Operations

In HCX 9.1, VCF Operations deploys, manages and upgrades the HCX Manager. If you installed HCX Manager by hand, you can onboard it into VCF Operations and manage it from there. For VCF customers this puts HCX on the same lifecycle tooling as the rest of the platform.

The VCF Operations HCX Management Pack

A new management pack installs into VCF Operations and handles password rotation for local HCX users, certificate rotation and log bundle collection. It is not compatible with the legacy vRealize Operations management pack for HCX. If you monitor HCX through the old pack today, plan to remove it and rebuild any dashboards or alerts that depend on it.

VCF Single Sign-On and VCF Roles

The HCX Manager web UI and API now accept VCF Single Sign-On and VCF Roles. Access to HCX can follow the same identity source and role model as the rest of the VCF estate. Auditors usually ask who could start a migration or change a network extension, and with this change that answer comes from one place.

Security and compliance: FIPS 140-3, certificates and the DFW

HCX 9.1 is FIPS 140-3 certified. For public sector, defence, finance and healthcare customers this removes a common blocker in procurement and security review.

New HCX Manager REST APIs manage HCX certificates without disrupting client trust. In earlier releases, replacing an HCX Manager certificate often meant re-importing it on the paired site and re-checking every integration that trusted the old one. We expect these APIs to make scheduled certificate rotation routine. Test them in a lab before you rely on them in production.

HCX ports are now on the NSX Distributed Firewall (DFW) exclusion list, and enhanced IX and NE instances talk to each other over standard IPsec. In practice, a DFW rule written for application VMs is less likely to block HCX appliance traffic by accident, which is a common cause of tunnels that come up and then carry nothing. Perimeter firewalls between sites still need the usual rules. Our HCX port requirements guide lists every flow.

Migration and interconnect enhancements

WAN optimization is back

HCX 9.1 reintroduces WAN optimization, now embedded directly in the HCX Interconnect service mesh configuration. It is available only on enhanced service meshes. It does not apply to OS Assisted Migration (OSAM) or HCX Assisted vMotion (HAV).

For migrations over thin or long-distance links, such as branch sites, older MPLS circuits or migrations between countries, this can shorten Bulk and Replication Assisted vMotion transfer times. The gain depends on how well your data deduplicates and compresses, so measure it on a pilot wave before you build a schedule around it.

Local site migrations with HCX Assisted vMotion

HCX Assisted vMotion (HAV) can now migrate within a single vCenter instance, with the same vCenter as source and destination and no HCX appliances in the path. This covers moves between clusters inside one vCenter, such as retiring an old cluster, moving onto new hardware or rebalancing a VCF workload domain, using the same HCX scheduling and reporting you use for site-to-site waves.

Storage policies and multiple destination datastores

Two storage changes remove workarounds that migration teams have used for years. Cold migrations now support non-default storage policies, so a powered-off VM can land on the vSAN or VM storage policy it needs without a post-move Storage vMotion. You can also select multiple destination datastores for a single VM, so a database VM with separate data and log disks can keep that separation at the destination. Multiple datastores are not supported for OSAM.

VLAN network extensions to native DVPGs

HCX Network Extension can now extend a source VLAN network to a native Distributed Virtual Port Group (DVPG) at the destination. Destinations that use plain vSphere Distributed Switch port groups, rather than NSX overlay segments, can now be targets for Layer 2 extension.

Refreshed web UI

The HCX Manager web UI has been refreshed and expanded. Update runbooks and screenshots in your migration procedures after the upgrade.

Expanded guest OS support for Bulk and OSAM

Table 2. Windows Server support added in HCX 9.1.

OSAM moves non-vSphere workloads, such as VMs on KVM or Hyper-V, into vSphere using the Sentinel agent. Adding Windows Server 2025 means newer Windows estates on other hypervisors can now move into VCF with HCX. See our OSAM architecture guide for how the Sentinel agent and switchover work.

Which HCX 9.1 features apply to which migration type

Table 3. HCX 9.1 features by migration type. The release notes name exclusions for OSAM and HAV only, so "Not excluded" means the release notes list no exclusion. Confirm details in the HCX 9.1 user guide before a production wave.

How to prepare for an HCX 9.1 upgrade

This is the sequence we follow with clients. Allow two to four weeks for a single-site-pair estate, longer if many network extensions are live.

1. Inventory every service mesh, compute profile and network profile, and record which network extensions carry live traffic.
2. Check that your VCF Operations version can manage HCX 9.1, and decide whether to onboard existing HCX Managers or redeploy.
3. Remove the legacy vRealize Operations management pack for HCX and plan the replacement dashboards in the new pack.
4. Map HCX users and groups to VCF SSO and VCF Roles before you switch authentication.
5. Upgrade HCX Manager, then create a test service mesh to confirm the enhanced appliances deploy cleanly through your firewalls.
6. Run the Migrating Network Extensions workflow for each legacy mesh in a maintenance window between migration waves.
7. Pilot WAN optimization on one wave and measure throughput before and after.

• Service mesh inventory recorded, with legacy and enhanced meshes labelled
• Live network extensions and their rollback plan documented
• Legacy vRealize Operations HCX pack removed; new VCF Operations pack installed
• VCF SSO groups mapped to HCX roles
• Firewall rules checked against the HCX port reference, including UDP 4500
• PhotonOS appliance migration scheduled well ahead of any VCF 10 upgrade

If you are still on vSphere 7 or 8 and planning the move to VCF, our 70-point HCX migration checklist and vSphere to VCF with HCX guide cover the full programme.

Frequently Asked Questions about HCX 9.1

What is new in VMware HCX 9.1?

HCX 9.1 adds an enhanced IX and NE appliance architecture built on the NSX Edge stack, deprecates self-managed PhotonOS appliances, moves HCX Manager lifecycle into VCF Operations, adds a new VCF Operations HCX Management Pack, supports VCF SSO and VCF Roles, is FIPS 140-3 certified, reintroduces WAN optimization, allows HCX Assisted vMotion inside a single vCenter and adds Windows Server 2022 and 2025 support for OS Assisted Migration.

Are PhotonOS-based HCX appliances still supported in HCX 9.1?

Yes, but they are deprecated as of HCX 9.1.0. Broadcom is targeting full removal in VCF 10.0.0, and HCX 9.1 includes an automated workflow to migrate PhotonOS appliances to the NSX Edge based architecture.

Does upgrading to HCX 9.1 convert existing service meshes to the enhanced architecture?

No. Only new service meshes created in 9.1 use the enhanced architecture automatically. Existing IX and NE appliances keep the legacy architecture until you migrate them with the Migrating Network Extensions workflow.

Is WAN optimization available in HCX 9.1?

Yes. HCX 9.1 reintroduces WAN optimization embedded in the Interconnect service mesh configuration. It works only on enhanced service meshes and is not available for OS Assisted Migration or HCX Assisted vMotion.

Can HCX migrate VMs between clusters in the same vCenter?

Yes. In HCX 9.1, HCX Assisted vMotion supports local site migrations where the source and destination are the same vCenter instance, and no HCX appliances are needed.

Is the new VCF Operations HCX Management Pack compatible with the old vRealize Operations pack?

No. The VCF Operations HCX Management Pack is incompatible with the legacy vRealize Operations management pack for HCX, so remove the old pack and rebuild any dependent dashboards and alerts.

Which Windows versions does HCX 9.1 OS Assisted Migration support?

HCX 9.1 adds Windows Server 2022 and Windows Server 2025 to OS Assisted Migration (OSAM). Bulk Migration and guest OS customization add Windows Server 2022.

Is VMware HCX 9.1 FIPS compliant?

Yes. VMware HCX 9.1 is FIPS 140-3 certified.

Sources

• Broadcom: VMware Cloud Foundation 9.1.0.0 release notes, What's new in VCF Operations (Workload Mobility)
• Broadcom KB 314608: Correlating VMware Cloud Foundation versions with constituent products

Written by the Consult Circle VMware HCX migration team. Last reviewed 3 November 2026 against the VCF 9.1 release notes.