vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM Cloud VPE overview 

With IBM Cloud® Virtual Private Endpoint (VPE) for VPC, you can connect to supported IBM Cloud services from your VPC network. You can use IP addresses that you choose, which are allocated from a subnet within your VPC.

VPE is an evolution of the private connectivity to IBM Cloud services. VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally. Also, it is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud.

For more information about supported IBM Cloud services, see [VPE supported services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services).

For more information about IBM Cloud VPEs, see [Virtual Private Endpoint Gateways in VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).



 Considerations with roll-your-own VMware solution in VPC 

VPEs are located in your network address space within the VPC where your VMware® workloads are hosted. When you access IBM Cloud services from VMware workloads, you can use VPE for VPCs as the endpoint for the service. Your VMware Workloads can either be attached to the VPC subnet, or to NSX-T™ overlay segments. VPE uses IBM Cloud private backbone network to access the specific service, and data remains within the private IBM Cloud backbone.

The following diagram presents an overview when using VPEs with VMware workloads on VPC subnets.

Zoom

!
[Configure bandwidth allocation for a virtual machine](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.networking.doc/GUID-FECAC41A-2C7A-4AD6-B740-7D8D44BADB52.html) 
 Virtual machine Consolidation Needed status Not considered essential for notification. Alarm that is reviewed as part of proactive daily checks. [Using Snapshots To Manage Virtual Machines](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.vm_admin.doc/GUID-CA948C69-7F58-4519-AEB1-739545EA94E5.html) 
 Host virtual flash resource status Host virtual flash is not supported in vCenter Server instances. No additional information 
 Host virtual flash resource usage Not configured in vCenter Server instances as they do not support host virtual flash. [About Virtual Flash Resource](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.storage.doc/GUID-E69F0809-3B19-483A-B906-4CE397CE56D6.html) 
 Registration or unregistration of a VASA vendor provider on a vSAN host fails Not configured in vCenter Server instances as they do not support VASA storage. [VMware compatibility guide](https://www.vmware.com/resources/compatibility/search.php?deviceCategory=vasa) 
 Registration or unregistration of third-party IO filter storage providers fails on a host Not configured in vCenter Server instances as they do not support VASA storage. [VMware compatibility guide](https://www.vmware.com/resources/compatibility/search.php?deviceCategory=vasa)
[Product Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_product_guide_5600.pdf) The AT&T Vyatta Network Operating System lays the foundation for a flexible, easy-to-use, and high- performance network services architecture capable of meeting current and future network demands. The AT&T Vyatta Network Operating System is deployed on the AT&T Vyatta vRouter, AT&T Services, and AT&T Distributed Services for use in cloud, virtual, physical, or on-premises environments. It also can be deployed as a co-resident on the hardware that houses the data planes, or centralized to manage a number of distributed data planes, depending on the requirements of an organization. 
 [Release Notes, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_release_notes_1720_5600.pdf) These release notes are for AT&T Vyatta Network Operating System Release 17.2.0. 
 [Remote Access API 2.0 Reference Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_remote_access_api_2_configuration_5600.pdf) This guide describes how to use the Remote Access API 2.0 to remotely run commands on AT&T products that run on the AT&T Vyatta Network Operating System over HTTPs. 
 [Remote Access IPsec VPN Configuration Guide, 17.2.0](https://public.dhe.ibm.com/cloud/bluemix/network/vra/18_remote_access_ipsec_vpn_configuration_5600.pdf) This guide describes how to configure Remote Access Virtual Private Network (VPN) on the AT&T Vyatta Network Operating System.
Managing virtual servers 

You can manage virtual servers, along with other devices, from the device details list. You can cancel, reboot, or rename a vitual server by using the following steps.



 Before you begin 

First, go to the device menu and make sure that you have the correct account permissions to complete the tasks.



* Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-navigating-devices).
* Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-infrapermission) and [Managing device access](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-device-access).





 Device types 

The device details list shows you the following device types:



Table 1. Device types

 Device Device type 

 Virtual servers Virtual 
 Bare metal servers Server 
 Dedicated hosts Dedicated virtual host 



The actions that you see depend on the device type, and the permissions that are granted to your user account.

Complete the following steps to perform management tasks for your servers.



1. From the Devices menu, select Device List.
2. Click Actions for the device you want to manage and select the relevant task. See [Device tasks](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-virtual-serversdevice-tasks) for relevant tasks.





* You can interact with servers in the IBM Cloud console in both the snapshot view (a summary of your device) and on the device's details page (a fully detailed list). To view and interact with your server in the snapshot view, click the arrow next to the Device Name to expand the view.
* Network - create network resources such as DNS Services, Transit Gateway service, VPC and subnets.
* Shared - create VSI and block devices in the shared VPC. Create DNS records for shared services.
* Application1 - create VSI and block devices in the application1 VPC
* Application2 - create VSI and block devices in the application2 VPC.





 IAM Conceptual 



 Network Team 

A conceptual team ownership model was implemented. The network team administers all the network resources and hence most of what is shown in the diagram.

Zoom

![Architecture focusing on the Network team](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/network.png)

Architecture focusing on the Network team





 Shared Team 

The shared team creates the VSI in its isolated VPC. In addition, the team needs to write records into the DNS service since the IP addresses of the VSIs are determined at creation time. Operator access to the VPC, subnets and security groups are required to create a VSI.

Zoom

![Architecture focusing on the Shared team](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/shared.png)

Architecture focusing on the Shared team

The application teams needs the same access as the shared team except manager access to the DNS Services.

Application team access:

Zoom

!
vmware-solutions.vcs-nfs-storage.remove NFS storage is removed from a vCenter Server instance. 
 vmware-solutions.vcs-plan.update A vCenter Server instance's plan is updated. 
 vmware-solutions.vss.create A vSphere instance is created. 
 vmware-solutions.vss.update A vSphere instance is updated. 
 vmware-solutions.vss-template.remove A vSphere template is removed. 
 vmware-solutions.service.create A service is created. 
 vmware-solutions.service.delete A service is deleted. 







 Events for KMIP for VMware 

When you manage keys for the KMIP™ for VMware® service, an event is generated.

The following table provides the actions that generate and send events for KMIP for VMware. The initiator completes these actions from vCenter Server and they do not include the initiator's IP address. The requests for these actions run from within the IBM Cloud private network.

The initiator ID is derived from the TLS (Transport Layer Security) certificate of the vCenter Server that is used to authenticate the connection to the KMIP server. The initiator ID is in the format CertificateID-<value>, where the value matches the fingerprint of the corresponding TLS certificate. Using the fingerprint, you can identify the vCenter Server that triggered the action.



Table 3. Description of actions that generate events for the KMIP for VMware service

 Action Description 

 vmware-solutions.kmip-key.create A KMIP key is created. 
 vmware-solutions.kmip-key.read A KMIP key is retrieved. 
 vmware-solutions.kmip-key-attributes.retrieve A KMIP key's attributes are retrieved. 
 vmware-solutions.kmip-key.activate A KMIP key is activated. 
 vmware-solutions.kmip-key.revoke A KMIP key is revoked. 
 vmware-solutions.kmip-key.destroy A KMIP key is destroyed. 







 Viewing events 

VMware Shared and vCenter Server events are global events.
Demo: Network as a service 

IBM Cloud® network services, including load balancers, security groups, and Content Delivery Network (CDN) make it easy to build cloud-native applications with greater security, performance, and resiliency. In this demo, learn how you can use these services to create a simple three-tiered web app in a matter of clicks.
4. VM to on premise connectivity. Key to connectivity between your BYOIP NSX environment and on premise is the ability to perform route exchange between the two environments. Devising a solution to exchange routes using such technologies as BGP or GRE is essential to a complete working solution.







 Detailed Flows 

In this section, detailed network flows will be reviewed. The following network architecture will be broken down into five different flows:

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/network-flows/flow3.png)



 VM to VM traffic (overlay workload) 

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/network-flows/flow2.png)





 VM to IBM Cloud Private (10.x & 161.x) networks 

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/network-flows/flow3.png)





 VM to Internet 

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/network-flows/flow4.png)





 Internet to VM
Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.vpc for the service name.

Platform roles

Actions



Table 102. Platform roles - Virtual Private Cloud
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 VPN for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.vpn for the service name.

Platform roles

Actions



Table 103. Platform roles - VPN for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 VPN Server for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access.
For more information about the IBM Cloud network design, see [Physical network design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-design_physicalinfrastructure).



 IBM Cloud edge services 

You can deploy a VMware ESXi™ gateway cluster as part of your vCenter Server instance. This cluster is configured to peer with the IBM Cloud customer routers to provide firewall and gateway services for IBM Cloud public and private VLANs of your choice. While you can deploy any virtual firewall technology of your choice to this gateway cluster, IBM Cloud features FortiGate VM as an option for these firewall and gateway services. Using this approach, your FortiGate VM appliances can provide services such as:



* The firewall between public and private networks.
* The firewall between your private VLANs and the subnets within them. For example, you can deploy separate clusters for workload and management on to separate VLANs and use the edge to limit connectivity between management and workload.
* Network peering between your private environment (including your NSX edges and networks) and external environments (such as your on–premises networks).
* Advanced firewall services such as VPN and IPS for these networks.



In the previous figure, this topology is illustrated by the FortiGate-VM Edge component.





 Virtual firewall appliance 

You can also deploy FortiGate VM as a virtual firewall appliance directly within your management and workload networks. With this approach, your FortiGate VM appliances can achieve the following functions:



* Gateway firewall between public and private networks such as NAT, firewall, and VPN
* Gateway firewall between the private network and NSX overlays
* Gateway firewall between different workload tiers within your NSX overlay networks



Additionally, FortiGate VM can use service chaining to integrate directly with NSX–T.

In the previous figure, these topologies are illustrated by the FortiGate-VM Internal component.







 Related links 



* [Solution overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortigate-overview)
The management domain consists of tools to support the virtual infrastructure, cloud operations, cloud automation, business continuity, and security and compliance components for VMware as a Service. VMware as a Service allocates separate workload domains per customer instance. Each workload domain is managed by a separate vCenter Server instance and a dedicated NSX-T Manager cluster for scalability. The vCenter Server and VMware NSX-T™ Manager components for these workload domains are running in the management domain too.

The management domain runs all management components in the VMware as a Service offering for both the management domain and workload domains, except for workload NSX-T Edge nodes. You start with an initial management domain configuration that is extended with each workload domain deployment.





 VMware as a Service workload domain architecture 

A workload domain represents a logical unit that groups VMware ESXi™ hosts managed by vCenter Server, NSX-T, and VMware Cloud Director that are dedicated to the customer workload domain instance. Workload domains exist in the boundaries of an IBM Cloud region.

Each customer workload domain contains the following components that are installed in the management domain:



* NSX-T segment to isolate the management components
* One VMware vCenter Server® instance
* One NSX-T Data Center instance
* One VMware Cloud Director instance



Offloading customer workload instance management components into the management domain makes IaaS resources available in the workload domain for running customer workloads.

Each customer workload domain contains the following components that are installed in the workload domain:



* At least one VMware vSphere® cluster with vSphere HA with single tenant ESXi bare metal servers, networking and shared storage
* One NSX-T Edge cluster that connects the workloads in the domain for logical switching, logical dynamic routing, and load balancing.



The customer workload domain is reserved for use by customer workload except for NSX-T Edge clusters used for North-South networking traffic.





 VMware as a Service workload isolation and data protection 

VMware as a Service uses trust zones. Trust zones are logical grouping of components that we know, control, and trust.
Use case 1 

IBM Cloud® for VMware® Regulated Workloads delivers a virtualized platform for users in a highly regulated industry who require a platform that is designed to support compliance with industry security standards or governmental regulations.

Typical hyper-converged virtual infrastructure designs include management, edge services, and compute all on the same cluster. This approach might blur the lines between the virtualization administrator, typically responsible for the compute and storage infrastructure, the network administrator, and the security administrator.

The IBM Cloud for VMware Regulated Workloads architecture restores the strict separation of duties that are usually enforced in an on-premises environment.

The IBM Cloud for VMware Regulated Workloads architecture spreads the delivery of necessary services across purpose-built regions.

The management region allows the virtualization administrator to manage the entire compute and storage infrastructure. Through the adoption of NSX-T™ as the SDN provider for the workloads, it removes the network and security administration duties from the scope of the virtualization administrator role. NSX-T, unlike NSX for vSphere, is not reliant upon a vCenter to manage the SDN network objects, traffic flows, and security configurations. Divorcing the network control plane from the vCenter means it is no longer possible for the virtualization administrator to view or change anything that impacts the network. The network and security administrators use the NSX-T dedicated management portal to configure the network and the required security policies.

The edge services region is strictly limited to the protection of the management region and the vSphere components that deliver compute and storage resources to the workload region. The security administrator, who has the responsibility of managing the SDN security, might also serve as the administrator of the gateway VMs that run on the gateway cluster. Or, to isolate a single administrator's scope of influence, the responsibility might be assigned to an administrator who has access only to the edge gateway and no access to manage SDN security.

The workload region is managed by one or more administrators that are only responsible for the management of the application VMs deployed upon the workload clusters. One approach where multiple administrators are useful is the case where a user wants to isolate administrative tasks on a per business unit basis or other compliance requirements.
About Citrix Netscaler VPX 

The Citrix Netscaler VPX is a dedicated virtual software appliance that provides load balancing on both the public and private IBM© Cloud network.

Deploying a Citrix Netscaler VPX in your IBM Cloud solution accelerates web application delivery, boosts performance, and ensures your cloud applications and services stay optimized, available, and secure. If you have challenging workloads, such as gaming, big data and analytics, or private clouds, the Citrix Netscaler VPX can help you deliver your solution when, where, and how your users need it most.



 Features 



* The only product that can load balance traffic on both the public and private network
* Management using GUI (Graphical User Interface) or CLI (Command Line Interface)
* Many different types of traffic distribution, including:



* Least Connections
* Round Robin
* Least response time
* Least bandwidth
* Least packets
* URL hashing
* Domain name hashing
* Source IP address hashing
* Destination IP address hashing
* Source IP - Destination IP hashing
* Token
* LRTM



* SSL acceleration / SSL offload
* GSLB (Global Server Load Balancing)



* Uses the DNS infrastructure to connect the client to the best data center
* Monitors the load and availability of the data centers to select the best connection choices



* Content switching
* Cache redirection
* Application firewall capabilities
* Application security features
* Virtual appliance running on dedicated hardware
* Deployed like any other IBM Cloud server, with flexibility and availability in mind
* Offered in bandwidth tiers: 10Mbps, 200Mbps, and 1000Mbps



The Citrix Netscaler VPX can be deployed on demand, in as little as 15 minutes, in any IBM Cloud data center around the world. Several licensing models include the speed and features that you need, and offer the flexibility demanded by today's cloud solutions. This flexibility ensures a good fit for every use case, from small-to-medium implementations, all the way to larger enterprises.

IBM Cloud offers the NetScaler VPX virtual appliance with full, unrestricted root access.





 Application security