vania-janet/multiturn-rag-retrieval-data huggingface dataset:
7. Manually create an overlay transit segment and create uplinks in Tier-0 gateways into the transit segment. Establish dynamic routing between the Tier-0 gateways. BGP is the preferred routing protocol. If you use VRF lite capability in the Tier-0 Gateway, you can use multiple transit segments, depending on your design.
8. Then, create your Tier-1 gateways in the regional edge cluster. You can select which data center (or edge node) is your preferred Tier-1 path in the regional cluster. You can separate routing tables at this level and decide which routes as advertised to the north bound Tier-0. As in the other multitenant patterns, you can use NAT is this case as well.
9. You can attach your segments into this level of Tier-1 gateways. You can create multiple segments and advertise them through Tier-1 gateway to north bound Tier-0 gateways.



This network topology example doesn't consider the management and control plane (vCenter and NSX Managers). The control plane high availability is discussed in another availability pattern.

Tier-0 gateways support VRF lite, which can be used if needed to support more complex topologies for isolating routing tables also at Tier-0 level. Refer to VMware documentation for more details on capabilities and limitations.

The main reason that you need two layers is for physical north-south connectivity in the data centers. Each data center must have their own private and public VLANs and IP addresses for the uplinks. These IP addresses cannot move between the data centers. Therefore, it requires your attention for routing and network address translation if you use public connectivity in this topology.





 Considerations for selecting an overlay network topology 

VMware NSX-T provides many ways to build the network topologies, and the default network topology is useful for many use cases. You can typically start with this, and expand it as your needs grow. When the initial deployment is done, IBM Cloud automation doesn't use the workload overlay topology and you can change the example topology based on your needs. When you change the configuration, the default uplinks provide you the basic-routed connectivity to IBM Cloud private and public networks.
[DNS Layout](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-dns.svg)

DNS Layout



 DNS Resources 



1. Apply the dns_tf layer to create the DNS services and add a DNS zone for each VPC and an A record for each of the test instances:

./apply.sh dns_tf
2. Open the [Resource list](https://cloud.ibm.com/resources) in the IBM Cloud console.
3. Expand the Networking section and notice the DNS Services.
4. Locate and click to open the instance with the suffix spoke0.
5. Click on the DNS zone with the suffix spoke0.com. Notice the A records associated with the test instances that are in the spoke instance.
6. Click on the Custom resolver tab on the left and click on the resolver with the suffix spoke0.com.
7. Click on the Forwarding rules tab and notice the forwarding rules.

Separate DNS instances learn each other's DNS names with forwarding rules. In the diagram there are arrows that indicate a forwarding rule. The associated table are a list of zones that could be resolved by the forwarding rule. Starting on the left notice that the enterprise DNS forwarding rule will look to the transit for the DNS zones: x-transit.com, x-spoke0.com, and x-spoke1.com. The transit DNS instance can resolve x-transit.com and has its own forwarding rules to the enterprise and spokes to resolve the rest. Similarly the spokes rely on the transit DNS instance to resolve the enterprise, transit and the other spokes.
8. Optionally explore the other DNS instances and find similarly named DNS zones and A records for the other test instances.







 DNS Testing
[Zones](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-zones.svg)

Zones

This diagram shows the traffic flow. Only the enterprise <-> spoke is passing through the firewall:

Zoom

![Traffic flow](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-part1-fw.svg)

Traffic flow

This was achieved with Direct Link, Transit Gateway and VPC routing. All zones are configured similarly and the diagram below shows the details of zone 1:

Zoom

![VPC Layout](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-part1.svg)

VPC Layout

The phantom address prefixes in the transit are used to advertise routes. The CIDR 10.1.0.0/16 covers transit and the spokes and is passed through Direct Link to the enterprise as an advertised route. Similarly the CIDR 192.168.0.0/24 covers the enterprise and is passed through the Transit Gateway to the spokes as an advertised route.

Egress routes in the spokes route traffic to the firewall-router. Ingress routes in the transit route enterprise <-> spoke traffic through the firewall-router.





 Step 1: Provision initial VPC resources routing all intra VPC traffic through the firewall-router 

Often an enterprise uses a transit VPC to monitor the traffic with the firewall-router.
* [Context](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_data-share_context)
* [Solution](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_data-share_solution)
* [Results](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_data-share_results)



* [Traditional grocer increases customer traffic and sales with digital insights](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_grocer)



* [Context](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_grocer_context)
* [Results](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_retailuc_grocer_results)





[Transportation use cases for IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_transportcs_uc_transport)



* [Shipping company increases availability of worldwide systems for business partner ecosystem](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_transportuc_shipping)



* [Context](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_transportuc_shipping_context)
* [Solution](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_transportuc_shipping_solution)
* [Results](https://cloud.ibm.com/docs/openshift?topic=openshift-cs_uc_transportuc_shipping_results)
The URL that is used to direct requests to an application. A route is made up of an optional host (or subdomain) and a domain that are specified when an application is pushed. For example, in the route myapp.example.com, myapp is the host and example.com is the domain. A route can be associated with one or more applications. Unless a custom domain is specified, IBM Cloud uses a default shared domain in the route to an application. See also [host](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2002243), [subdomain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2040080), [Uniform Resource Locator](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2042491), [custom domain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx5728384), [endpoint](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2026820), [domain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2021210).





 RPO 

See [recovery point objective](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx3429911).





 RTO 

See [recovery time objective](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx3167918).





 rule 



* The set of allowed contexts that are associated with an IBM Cloud resource. The defined contexts dictate a user's or service's access to that resource.
* A set of conditional statements that are used to determine whether a build can be promoted.
It requires that the TCP connections use the same path on the way in as the way out. One exception is Direct Server Return used by routers like [Network Load Balancers](https://cloud.ibm.com/docs/vpc?topic=vpc-network-load-balancers). It allows incoming connections from the enterprise to pass through the firewall to the transit test instance and then return directly to the originator.

Zoom

![Incoming connections from the enterprise pass through the firewall](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-routing-green.svg)

Incoming connections from the enterprise pass through the firewall

This does not help with the traffic originating in the transit test instance passing through the Transit Gateway then back through ingress routing to the firewall-router. This connection gets stuck at the firewall-router (3) and will not get forwarded back to the worker as shown in red below. Traffic transit -> enterprise and transit -> spoke are failing.

Zoom

![Traffic between transit and enterprise and transit and spoke is failing](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-routing-red.svg)

Traffic between transit to enterprise and transit to spoke is failing

One possible solution is to stop sending traffic destined to the transit VPC to the firewall-router. The wide ingress routes for the transit are currently routing traffic to the firewall-router. More specific routes can be added for the transit to Delegate to the default behavior - send directly to the intended destination instead of the firewall-router.
Transit Gateway docs 

With IBM Cloud Transit Gateway, organizations can define and control communication between resources on the IBM Cloud network, providing dynamic scalability, high availability, and private, in-transit data between IBM Cloud data centers.

 Recommended content 

[Getting started with IBM Cloud Transit Gateway Use IBM Cloud Transit Gateway to interconnect IBM Cloud classic and Virtual Private Cloud (VPC) infrastructures worldwide, keeping traffic within the IBM Cloud network.](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)[Planning for IBM Cloud Transit Gateway Review these considerations before ordering your IBM Cloud® Transit Gateway.](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips)[Ordering IBM Cloud Transit Gateway Order a transit gateway using these instructions.](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>!
If you have existing resources still running on the IBM Cloud Classic Infrastructure, a similar flow can also be used to facilitate communication between VPC and Classic infrastructure resources.
3. VPC to/from VMware (in Classic Infrastructure) connectivity allows for private communication between your VPC and Virtual Machines (VMs) running in an IBM Cloud VMware on Classic Infrastructure environment. Typically, in a VMware deployment, an overlay network is defined which allows for BYOIP. This network flow allows for connectivity with this overlay network by establishing connectiivity between Classic infrastructure and VPC using transit gateway and running GRE tunnel between the VMware's edge router and Transit gateway for overlay communication.
4. VPC to Internet connectivity provides for communication from within the VPC to the public Internet. This network flow leverages a public gateway to allow for egress traffic. Note the traffic flow is one-way.
5. VPC to Cloud Service Private Endpoints connectivity provides for private communication from within the VPC to IBM Cloud Service private endpoints. Note the traffic flow is one-way (meaning an IBM Cloud Service cannot initiate a connection into a resource in your VPC).



Additional details for each of these network flows can be found below.





 Flow1: On-Prem to VPC 

![Flow1](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/onprem-to-vpc.png)





 Flow2: VPC to VPC and/or Classic Infrastructure 

![Flow2](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/vpc-to-vpc.png)





 Flow3: VPC to VMware (Overlay Network for VMs) 

!
[Traffic between transit and enterprise and transit and spoke is failing](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-routing-red.svg)

Traffic between transit to enterprise and transit to spoke is failing

One possible solution is to stop sending traffic destined to the transit VPC to the firewall-router. The wide ingress routes for the transit are currently routing traffic to the firewall-router. More specific routes can be added for the transit to Delegate to the default behavior - send directly to the intended destination instead of the firewall-router.

This diagram shows the traffic flow that is desired for this step. Only the enterprise <-> spoke is passing through the firewall:

Zoom

![Only route enterprise to spoke through the firewall](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-part1-fw.svg)

Only route enterprise to spoke through the firewall



1. enterprise <-> transit
2. spoke <-> transit
3. spoke <-> spoke
4. enterprise <--transit firewall-router--> spoke



This routing can be achieved by adding these routes to the transit ingress route table:



 Zone Destination Next hop 

 Dallas 1 10.1.0.0/24 Delegate 
 Dallas 2 10.2.0.0/24 Delegate 
 Dallas 3 10.3.0.0/24 Delegate 





1.
* UI
* CLI
* API
* Terraform







 Creating an unbound Generic Routing Encapsulation tunnel connection 

You can use an unbound Generic Routing Encapsulation (GRE) tunnel transit gateway connection to connect endpoints. This connection allows a transit gateway to connect to overlay networks hosted on classic infrastructure resources.



 Before you begin 

Before creating an unbound GRE tunnel connection, review [Generic Routing Encapsulation connection considerations](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tipsgre-considerations) for additional prerequisites.

Unbound transit gateway GRE connections require the gateway owner to specifically configure HA for their needs. A GRE connection is a point-to-point connection, has no built in redundancy, and is a single point of failure. When configuring an unbound GRE connection on a transit gateway, you must specify the availability zone. For a robust HA solution, configure multiple GRE connections using different availability zones.

Keep in mind that you are required to enter four IP addresses when you create an unbound GRE tunnel connection. These are:



* Remote gateway IP - the IP address of your GRE tunnel endpoint. This IP address must be a private IP and be the private IP from the classic environment. For example, this IP can be a hardware appliance or even a VM.
* Local gateway IP - the IP address that your tunnel endpoint connects to. This IP is the transit gateway's IP for the purpose of establishing the tunnel so that when you enter the "remote IP" on your tunnel endpoint, you use this IP address.
* Remote tunnel IP - the GRE tunnel address on the tunnel endpoint.
* Local tunnel IP - the GRE tunnel address on the transit gateway side.







 Creating an unbound GRE tunnel connection in the UI 

You can create an unbound GRE tunnel connection on an existing transit gateway, or when you are creating a new transit gateway.



 Creating an unbound GRE tunnel connection on an existing transit gateway 

To create your unbound GRE tunnel on an existing transit gateway, follow these steps:



1.
This process results in a few moments of packet loss for traffic that is entering or exiting the VLANs. Packets within the VLAN continue to flow. In the cases where a network gateway, such as a FortiGate Security Appliance or Virtual Router Appliance is involved, no disruption occurs among the VLANs attached to that gateway. The servers see no network outage themselves, and most workloads automatically recover when the traffic flow resumes. The total duration of the disruption depends on the extent of the tenant’s topology, that is, the number of subnets, VLANs, and pods that your tenancy includes.

During migration, the VLANs are disconnected from the backbone and reconnected to the Customer VRF. The duration of disruption varies, depending on the quantity of VLANs, PODs, and data centers involved. Traffic among VLANs is disrupted, yet the servers stay connected to the network. The application might or might not be affected, depending on its sensitivity to packet loss.



 How to initiate VRF conversion 

To request conversion of your account to VRF, follow these steps:



1. [Open a support case](https://cloud.ibm.com/unifiedsupport/cases/add) through the IBM Cloud console.
2. Select All products, then start typing Virtual Private Cloud and select it.
3. Click Next in the lower right of the page to show the form.



* For the Subject, enter "Network Engineering: Convert account to VRF for VPC Classic Access".
* For the Description, enter the following text:

"I am requesting that account your account number is moved to its own VRF. I understand the risks and approve the change. Please reply with the scheduled window(s) of time where this change will be made so we can prepare for the migration."





Migration is completed by the IBM Cloud Network Engineering team. No other information is required from you, except an agreed-to schedule. Typically, packet loss might last 15 - 30 minutes, depending on the complexity of your account. It might be longer if your account has legacy Direct Link connections.







 Limitations
Layer 7 policy 

A Layer 7 (L7) policy is used to classify traffic by matching its L7 information with L7 rules, and then taking specific actions if those rules match.



* A policy is applied to a front-end application port (protocol).
* Multiple policies can be applied to the same protocol.



Since multiple policies can be applied to a protocol, a priority is associated with each policy.



* Policies with the lowest set priority are evaluated first.
* If the rules associated with the policy do not match the traffic, the next lowest policy on the priority list is evaluated.



If the traffic does not match any of the policy rules, the traffic is redirected to a default pool, which is the pool that was configured when the basic load balancer was deployed.

Each policy is associated with an action that runs when all rules in the policy match the traffic.

The actions can be:



* Reject
* Redirect to HTTPS
* Redirect to URL
* Redirect to pool



Policies set to reject are evaluated first.

If the action is set to REDIRECT_HTTPS, then the HTTP traffic redirects to the HTTPS listener port. Only one configuration of this action is supported per listener. This action cannot configure L7 rules, and you must configure it using the API. You can configure the L7 policy by using the action REDIRECT_HTTPS with the addL7Policies method of the SoftLayer_Network_LBaaS_L7Policy service. A redirectUrl data type provides the HTTPS listener's universally unique identifier (UUID) for HTTPS redirection.

The Redirect to https policy is evaluated after a Reject. If this policy exists, then any existing Redirect to url and Redirect to pool policies do not apply. Also, if there are any existing Redirect to https policies, then you cannot create any new Redirect to url and Redirect to pool policies.

If no HTTPS redirect policy exists, then any policies set to Redirect to url are evaluated after Reject.

Finally, policies set to Redirect to pool are evaluated last.
[Spoke gateway](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-spoke-tgw.svg)

Spoke gateway



1. Apply the layer:

./apply.sh transit_spoke_tgw_tf
2. Run the zone 1 curl tests in the suite my using the -m (markers) to select tests marked with curl, lz1 (left zone 1) and rz1 (right zone 1).

Your expected results are: Connectivity within a VPC, transit <-> spoke(s), and spoke(s) <-> spoke(s) pass. Connectivity to/from enterprise fails.

pytest -m "curl and lz1 and rz1"







 Step 5: Connect Enterprise to Transit via Direct Link and Transit Gateway 

Provision a IBM Cloud® Direct Link using Transit Gateway.

Zoom

![Enterprise link](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-enterprise-link.svg)

Enterprise link

IBM Cloud® Direct Link is a high speed secure data path for connecting an enterprise to the IBM Cloud. In this tutorial Transit Gateway is used for distribution. The use of Transit Gateway is optional for an on-premises connection.

The enterprise in this tutorial is simulated in the form of another VPC. Connecting this simulated enterprise (actually another VPC) via the Transit Gateway will ensure an experience very close to what you would experience with a Direct Link.



1. Apply the enterprise_link_tf layer:

./apply.sh enterprise_link_tf
2.
[Spoke gateway](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-spoke-tgw.svg)

Spoke gateway



1. Apply the layer:

./apply.sh transit_spoke_tgw_tf
2. Run the zone 1 curl tests in the suite my using the -m (markers) to select tests marked with curl, lz1 (left zone 1) and rz1 (right zone 1).

Your expected results are: Connectivity within a VPC, transit <-> spoke(s), and spoke(s) <-> spoke(s) pass. Connectivity to/from enterprise fails.

pytest -m "curl and lz1 and rz1"







 Step 5: Connect Enterprise to Transit via Direct Link and Transit Gateway 

Provision a IBM Cloud® Direct Link using Transit Gateway.

Zoom

![Enterprise link](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-enterprise-link.svg)

Enterprise link

IBM Cloud® Direct Link is a high speed secure data path for connecting an enterprise to the IBM Cloud. In this tutorial Transit Gateway is used for distribution. The use of Transit Gateway is optional for an on-premises connection.

The enterprise in this tutorial is simulated in the form of another VPC. Connecting this simulated enterprise (actually another VPC) via the Transit Gateway will ensure an experience very close to what you would experience with a Direct Link.



1. Apply the enterprise_link_tf layer:

./apply.sh enterprise_link_tf
2. Run the zone 1 curl tests in the suite my using the -m (markers) flag.