vania-janet/multiturn-rag-retrieval-data huggingface dataset:
<br><br> * Ensure financial services compliancy for VPC services<br> * Perform network setup of all created services<br> * Perform network isolation of all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 PowerVS workspace architecture decisions 



Table 2. PowerVS workspace architecture decisions

 Requirement Component Choice Alternative choice 

 <br><br> * Connect PowerVS workspace with VPC services<br><br><br> Cloud connections Set up two redundant cloud connections 
 <br><br> * Configure the network for management of all instances<br> * Throughput and latency are not relevant<br><br><br> Management network Configure private network with default configurations and attach it to both cloud connections 
 <br><br> * Configure separate network for backup purposes with higher data throughput<br><br><br> Backup network Configure separate private network with default configurations and attach it to both cloud connections. Networks characteristics might be adapted by the users manually (for example to improve throughput) 
 <br><br> * Preload OS images relevant for customer workload<br><br><br> Preloaded OS images Preload Linux OS images for SAP workload. Keep the number of preloaded images at minimum to save costs. Modify the input parameter that specifies the list of preloaded OS images. 
 <br><br> * Preload a public SSH key that is injected into every OS deployment<br><br><br> Preloaded SSH public key Preload customer specified SSH public key 







 PowerVS management services architecture decisions 



Table 3. PowerVS management services architecture decisions

 Requirement Component Choice Alternative choice 

 <br><br> * Ensure public internet connectivity from all the instances to be deployed in PowerVS workspace<br><br><br> SQUID proxy Set up SQUID proxy software on Linux virtual server instance that is running in edge VPC
Interconnectivity overview 

Interconnectivity consists of multiple services and offerings that enable customers to connect from their remote network locations to IBM Cloud® deployments and between workloads and services that run in IBM Cloud.

It can be divided into the following categories:



* Interconnecting with on-premises networks.
* Interconnecting VPCs and IBM Cloud services.



The following diagram shows an overview of the interconnectivity solutions.

Zoom

![Interconnectivity solutions with VMware on VPC](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-xcon-vmw-arch.svg)

Figure 1. Interconnectivity solutions with VMware® on VPC



 Interconnecting VMware workloads with on-premises networks 

Interconnecting VMware workloads on VPC with on-premises networks provides the capability to know how to interconnect workloads with on-premises network.

The solution consists of the following key offerings:



* IBM Cloud Direct Link offerings provide low-latency, high-throughput connections between IBM Cloud VPC networks directly to a service provider-managed WAN, or a client-managed cloud backbone, or through a supported service provider.
* IBM Cloud VPN for VPC can securely connect your virtual private cloud to another private network. This service offers two types of VPNs, such as Site-to-site gateways that connect your on-premises network to the IBM Cloud VPC network and Client-to-site servers that allows clients to connect to VPN servers on internet.



See the following sections for more detailed overview for these offerings for on-premises connectivity, and architectural considerations when used with VMware workloads on VPC.





 Interconnecting VMware workloads with VPCs and IBM Cloud services
Application Load Balancer (ALB) for VPC
: Application load balancers now support HTTP/HTTPS compression, which you use to compress data that is transmitted to your users. For more information, see [Compression (HTTP/HTTPS only)](https://cloud.ibm.com/docs/vpc?topic=vpc-advanced-traffic-managementcompression).

High Availability (HA) Virtual Network Function (VNF) support
: Support for a highly available, highly resilient virtual network functions can be achieved by using the "routing mode" feature of the IBM Cloud Network Load Balancer (NLB) for VPC. For more information, see [About virtual network functions over VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf) and [About HA VNF deployments](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf-ha).

Updates to Getting started with IBM Cloud VPC button
: The "Getting started with IBM Cloud VPC" button now includes access to tours that are specific to what you are doing on the IBM console. If a tour is not available, the button takes you to the VPC List view.





 06 January 2022 

UI update when you create a virtual server
: When you create a virtual server, the UI is updated to include a link in the Operating system section that opens a panel that contains information about the image lifecycle.







 December 2021 



 16 December 2021 

File Storage for VPC (LA)
: IBM Cloud® File Storage for VPC is now available for customers with special approval to preview this service in the Washington, Dallas, Frankfurt, London, Sydney, and Tokyo regions.
: For more information about this service, see [About File Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about).





 09 December 2021 

Security updates
: The following stock images were refreshed with the most recent fixes and security updates.



* Debian version 10
* CentOS version 7
Because Amsterdam does not have any active compute resources for IBM Cloud® Functions, the failover period in the EU Central region might be longer than in other regions.

Cloud Functions is a Function-as-a-Service offering, and as such, it offers only compute services. It does not back up the data that your workload (actions) processes. To store data, you can use separate cloud-based data stores with separate disaster recovery options, which depend on the storage service's SLAs.





 HIPAA 

Cloud Functions is a Function-as-a-Service offering, and as such, it offers only compute services. It does not offer storage options nor management of your data. Ensuring the HIPAA-compliant processing of your data is subject to your storage service's operation and SLAs.
* Password loss protection for backup or backup copy jobs by using encryption.
* Self-service capabilities, such as the delegation of permissions in a granular way.
* Veeam Cloud Connect Replication services and the need for a stand-alone web tool that allows a tenant to run a cloud failover plan remotely from a web browser.







 VMware backup proxy 

A VMware backup proxy is an architecture component that sits between the backup server and other components of the backup infrastructure. While the backup server administers tasks, the proxy processes jobs and delivers backup traffic. Basic backup proxy tasks include retrieving VM data, compression, de-duplicating, encrypting, and forwarding to the backup repository.

The backup proxy is a key component to scale a Veeam service instance. Backup proxies can be Windows or Linux® based. They can be hosted on VMs, VSI's or bare metal servers. For more information, see [Veeam backup proxy](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-cr-sa-vp).





 Veeam vPower NFS service 

The vPower NFS Service is a Microsoft Windows service that acts as an NFS server, which is then mounted by an ESXi host. The vPower NFS Service emulates the presence of VMDK file by using the Veeam backup files so that the ESXi host can work with them as with regular VMDK files. If your backup repository is a Microsoft Windows backup repository, enable the vPower NFS server on this backup repository server for best performance.





 Backup repository 

A backup repository is a storage location where Veeam keeps backup files, and it can be one of the following storage components:



* Direct attached storage - Microsoft Windows or Linux servers with volumes attached.
* Object storage - It can be manually configured as a capacity tier in a scale-out backup repository. However, the immutability option in IBM Cloud® Object Storage cannot be used with Veeam.
* Network-attached storage - It can be manually configured to provide SMB/CIFS shares or NFS shares.
NTP 123 UDP 
 SMTP 25 TCP 
 DNS 53 UDP 
 LDAP/LDAPS 389, 636 TCP 
 LDAP GC 3268/3269 TCP 
 vCenter 443 TCP 
 VMware Aria Operations Manager appliance 443 TCP 







 Authentication 

User Management for VMware Aria Operations for Logs requires VMware® Identity Manager (vIDM), which integrates with Active Directory. Service accounts are used for application-to-application communication from VMware Aria Operations Manager to the following adapters with the minimum set of permissions that are required for metric collection and topology mapping.



* NSX Manager
* vCenter
* vSAN







 Content packs in VMware Aria Operations for Logs 

Content packs provide more granular monitoring on the virtual infrastructure and enable logs to be retrieved, extracted, and parsed into a human-readable format. In this way, VMware Aria Operations for Logs saves log queries and alerts, and you can use dashboards for efficient monitoring.

The following are installed by default:



* General
* VMware vSphere
* VMware vSAN
* VMware Aria Operations



This design also installs:



* VMware NSX for vSphere
* VMware Aria Operations™ for Networks



Other content packs can be obtained from [VMware Solution Exchange](https://marketplace.vmware.com/vsx/?contentType=2&listingStyle=table).

The VMware Aria Operations for Logs content pack for NSX-T™ provides more dashboards for viewing log information. For installation instructions, see the [VMware documentation](https://docs.vmware.com/en/VMware-Validated-Design/4.3/com.vmware.vvd.sddc-nsxt-domain-deploy.doc/GUID-EB5EDB4D-C4A1-4906-A6A9-379F898BA372.html) about installing the content pack for NSX-T.





 Related links
The following components are included with the F5 BIG-IP service:



 Virtual machines 



* Two virtual machines (VMs) with all options available.
* 2, 4, or 8 CPUs per VM depending on the licensing option.
* 4, 8, or 16 GB RAM per VM depending on the licensing option.







 Networking 



* Private Virtual Extensible LAN (VXLAN) for High Availability (HA) synchronization.
* Access to Traffic Management Shell (TMSH) and Management Console through private management network.







 Licenses and fees 

License fees for each VM are applied to each billing cycle, depending on the licensing option (Good, Better, or Best) and the selected bandwidth.

You cannot change the licensing level after service installation. To change the licensing level, you must delete the existing service and then use a different licensing option to reinstall the service.







 Considerations when you install F5 BIG-IP 

Before you install the F5 BIG-IP service, review the following considerations.

Based on the license model and bandwidth that you select, two BIG-IP VE VMs are deployed with the following configuration:



Table 1. CPU and RAM deployments for different bandwidth and license model selections

 Maximum Bandwidth License Model - Good License Model - Better License Model - Best 

 25 Mbps 2 CPUs, 4 GB RAM 4 CPUs, 8 GB RAM 8 CPUs, 16 GB RAM 
 200 Mbps 2 CPUs, 4 GB RAM 4 CPUs, 8 GB RAM 8 CPUs, 16 GB RAM 
 1 Gbps 2 CPUs, 4 GB RAM 4 CPUs, 8 GB RAM 8 CPUs, 16 GB RAM 
 3 Gbps 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 
 5 Gbps 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 
 10 Gbps 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 8 CPUs, 16 GB RAM 





 Additional considerations 



* F5 BIG–IP limits the appliance throughput based on your chosen maximum bandwidth. Because network performance is affected by many factors, not all configurations and topologies might be able to achieve your chosen maximum bandwidth.
For example, if you want to create a multizone cluster, if you have multiple VLANs for a cluster, or if you have multiple subnets on the same VLAN, the worker nodes on different subnets in the same VLAN or in different VLANs can't automatically communicate with each other. You must enable either a Virtual Router Function (VRF) or VLAN spanning for your IBM Cloud infrastructure account.

Virtual Routing and Forwarding (VRF)
: VRF enables all the VLANs and subnets in your infrastructure account to communicate with each other. Additionally, a VRF is required to allow your workers and master to communicate over the private cloud service endpoint. To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command. Note that VRF eliminates the VLAN spanning option for your account, because all VLANs are able to communicate unless you configure a gateway appliance to manage traffic.

VLAN spanning
: If you can't or don't want to enable VRF, [enable VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/openshift?topic=openshift-access-credsinfra_access), or you can request the account owner to enable it. To check if VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_vlan_spanning_get). Note that you can't enable the private cloud service endpoint if you choose to enable VLAN spanning instead of a VRF.

How does VRF or VLAN spanning affect network segmentation?
Virtual Servers](https://cloud.ibm.com/docs/power-iaas)Power Systems Virtual Servers Service[Qiskit Runtime](https://cloud.ibm.com/docs/quantum-computing)Qiskit Runtime Service Beta[Red Hat OpenShift for HPC](https://cloud.ibm.com/hpc-openshift)Red Hat OpenShift for HPC Software[Satellite](https://cloud.ibm.com/docs/satellite)Satellite Service[Slurm on IBM Cloud](https://cloud.ibm.com/docs/hpc-slurm)Slurm on IBM Cloud Software[VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions)VMware Solutions Service[VMware as a Service](https://cloud.ibm.com/docs/vmware-service)VMware as a Service Service[VMware for Classic](https://cloud.ibm.com/docs/vmware)VMware for Classic Service[Virtual Servers for Classic](https://cloud.ibm.com/docs/virtual-servers)Virtual Servers for Classic Service[Virtualization for Classic
VLANs](https://cloud.ibm.com/docs/vlans)VLANs Service[Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc)Virtual Private Cloud (VPC) Service[Virtual Private Networks (VPN)](https://cloud.ibm.com/docs/iaas-vpn)Virtual Private Networks (VPN) Service[Virtual Router Appliance](https://cloud.ibm.com/docs/virtual-router-appliance)Virtual Router Appliance ServicePlatform[Building infrastructure](https://cloud.ibm.com/docs/cloud-infrastructure)Building infrastructure Platform[Cloud Shell](https://cloud.ibm.com/docs/cloud-shell)Cloud Shell Platform[Creating apps](https://cloud.ibm.com/docs/apps)Creating apps Platform[Getting support](https://cloud.ibm.com/docs/get-support)Getting support Platform[High availability and resiliency for infrastructure](https://cloud.ibm.com/docs/ha-infrastructure)High availability and resiliency for infrastructure Platform[IBM Cloud CLI](https://cloud.ibm.com/docs/cli)IBM Cloud CLI Platform[IBM Cloud Framework for Financial Services - Control Requirements](https://cloud.ibm.com/docs/framework-financial-services-controls)IBM Cloud Framework for Financial Services - Control Requirements Platform[IBM Cloud overview](https://cloud.ibm.com/docs/overview)IBM Cloud overview Platform[Managing billing and usage](https://cloud.ibm.com/docs/billing-usage)Managing billing and usage Platform[Managing your account, resources, and access](https://cloud.ibm.com/docs/account)Managing your account, resources, and access Platform[Running secure enterprise workloads](https://cloud.ibm.com/docs/secure-enterprise)Running secure enterprise workloads Platform[Selling on IBM Cloud](https://cloud.ibm.com/docs/sell)Selling on IBM Cloud
Overview of application support with Veeam 

For applications hosted on the VMs, Veeam® requires network access to the VMs to provide application aware backups. In the Veeam Backup & Replication console, to enable the application-aware image-processing or the guest file system indexing options in the backup job, you need network access between customer overlay and the Veeam bare metal server management network (primary subnet on private VLAN 1). If you want to use these capabilities, routing must be designed and implemented between the customer NSX-T™ overlay networks.

The guest interaction proxy is a backup infrastructure component that sits between the backup server and processed VM. This component is needed if the backup or replication jobs perform the following processing of VMs:



*  Application-aware processing
*  Guest file system indexing
*  Transaction logs processing



The guest interaction proxy deploys the runtime process only in Microsoft® Windows® VMs. In VMs with another guest OS, the runtime process is deployed by the backup server.

For Windows virtual machine (VM) file level restores, Veeam first tries to connect to the Guest VM through the network, and since the network is isolated, the VMware vSphere® Guest Interaction API is then used to complete a network-less restore.

For Linux® VM file level restores, a File Level Restore (FLR) appliance needs to be deployed before you attempt the file level restore by the IBM Backup Administrator. Otherwise, the first time a tenant tries to restore a file, they receive an error in the Veeam Backup & Replication Console. For two of the three restore options, the FLR appliance requires network connectivity to the Linux VM where the file is to be restored, since the network is isolated. Therefore, only the download option is applicable to this service. This download needs to be moved to the correct place in the file system.

For more information about file level restore, see the Veeam documentation.



  Related links 



*  [Veeam Backup & Replication](https://www.veeam.com/vm-backup-recovery-replication-software.html?ad=menu-products)
*  [Veeam Help Center technical documentation](https://www.veeam.com/documentation-guides-datasheets.html?ad=menu-resources)
Load balancing thus helps in achieving optimal resource utilization, maximizing throughput, minimizing response time, and avoiding overload. NSX Edge provides load balancing up to Layer 7.





 Service composer 

Service composer helps you provision and assign network and security services to applications in a virtual infrastructure. These services can be mapped and applied to virtual machines in the security groups. Data security provides visibility into sensitive data that is stored within your organization's virtualized and cloud environments that include IBM Cloud. Based on the violations reported by NSX Data Security, you can make sure that sensitive data is adequately protected and assess compliance with regulations around the world.





 NSX extensibility 

VMware partners can integrate their network service solutions with the NSX platform, which enables customers to have an integrated experience across VMware products. Data center operators can provision complex, multi-tier virtual networks in seconds, independent of the underlying network topology or components from IBM Cloud.





 NSX core components 

You can configure and manage these components through the vSphere Web Client, a command line interface (CLI), and REST API. VMware NSX requires a functional IBM Cloud environment with at least vSphere and vCenter version 6. The components are deployed as VMware Appliance VMs that run on IBM Cloud. NSX components are not supported as virtual server instances. It is recommended that the instructions are followed to create a dedicated ESX Management Cluster. Additionally an Edge Services Cluster might also be required.





 NSX manager 

The NSX manager is the centralized network management component of NSX, and is installed as a virtual appliance on an ESX host in your vCenter Server environment. IBM Cloud Architecture recommends that this VM deploys on a dedicated Management ESX Cluster. One NSX Manager maps to a single vCenter Server environment and multiple NSX Edge, vShield Endpoint, and NSX Data Security instances.





 NSX vSwitch 

NSX vSwitch is the software that operates on IBM Cloud ESX hosts to form a software abstraction layer between servers and the physical network. As the demands on data centers continue to grow and accelerate, requirements that are related to speed and access to the data itself continue to grow as well.
For more information, see [Add a logical switch](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.install.doc/GUID-DD31D6BC-2E56-4E91-B45F-FCA3E80FF786.html). 
 Add a DLR A Distributed Logical Router (DLR) is a virtual appliance that routes between connected logical switches (East-West traffic). For more information, see [Add a Distributed Logical Router](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.install.doc/GUID-E825C0C7-F4CC-4B26-90AF-A2167AC519DB.html). 
 Add an ESG An External Services Gateway (ESG) is a virtual appliance that routes between the physical network and the logical network (North-South traffic). For more information, see [Add an Edge Services Gateway](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.install.doc/GUID-B9A97F20-4996-4E16-822C-0B98DDE70571.html). 
 Configure NSX edge firewall rules An edge firewall monitors North-South traffic to provide perimeter security functions, including firewall, Network Address Translation (NAT), and site-to-site IPsec and SSL VPN. Only the firewall rules on management and uplink interfaces are applicable.
These services are typically reachable over the public internet, but can also be accessed on so-called [service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview). To increase security by isolating network traffic, follow the [instructions to enable virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint). In the documentation, you can also find a [list of services that support private endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointuse-service-endpoint).

When your application does not serve public users, but is only accessed from corporate networks, then a method to isolate network traffic is to access IBM Cloud using a Virtual Private Network (VPN) or Direct Link. The [catalog has offerings for both types](https://cloud.ibm.com/catalog?search=vpn%20label%3Aibm_createdsearch_results). A VPN creates a secure, encrypted transmission channel over a public network whereas the Direct Link offers private network access to IBM Cloud.

It is important to note that network traffic, i.e., data in transit, is secured by an encrypted transmission channel. Thus, you should use TLS / SSL. For your domains, you should utilize the [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started) or similar tools to actively manage encryption certificates and their validity. By setting up notifications you can make sure that certifications do not expire. Note that Secrets Manager allows you to order certificates.

Consider implementing more stringent access rules to resources. [Context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) allow defining access restrictions based on network zones and endpoint types. Thus, it is possible to isolate teams, users and resources by location.







 Evaluate and monitor app security