vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Learning about VMware as a Service architecture and workload isolation 

The IBM Cloud® for VMware as a Service architecture is based on two logical entities that are created uniquely per supported cloud region.



* Management domain - Hosts the IBM® operations tools and all the single-tenant customer management tools except for the networking edges that are used by customer workloads.
* Customer workload domain - Hosts single-tenant IBM Cloud IaaS, networking edges, and customer deployed networking and workload.



Zoom

![VMware as a Service region](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/vmware-service/images/vmware-aas-region.svg)

Figure 1. VMware as a Service region

The architecture details VMware as a Service solution components and different architecture layers to provide a dedicated and private implementation for customers. The architecture provides standardized and customizable deployment choices of VMware Cloud Director™ based virtual data center environments.

With single tenant Cloud Director instances and its virtual data center instances, customers can migrate or deploy VMware workloads to the cloud on the IBM-hosted and managed VMware infrastructure. Customer workloads that consist of networking configurations and VMs are isolated to single tenant dedicated infrastructure.



 VMware as a Service management domain architecture 

The management domain contains the components for managing the virtual infrastructure of the workload domains in VMware as a Service. The management domain also provides the foundation for deploying solutions for workload provisioning and operations management.

The management domain consists of tools to support the virtual infrastructure, cloud operations, cloud automation, business continuity, and security and compliance components for VMware as a Service. VMware as a Service allocates separate workload domains per customer instance. Each workload domain is managed by a separate vCenter Server instance and a dedicated NSX-T Manager cluster for scalability. The vCenter Server and VMware NSX-T™ Manager components for these workload domains are running in the management domain too.
3 4 2048 Mhz 4 GB 20 GB 



NSX switch

An upgraded Virtual Distributed Switch (VDS) is deployed to all hosts to implement distributed capabilities.

NSX Edge services gateway

Deployed as multi-function VM appliances as needed in the environment. For routing-only, an active cluster of up to eight gateways can be deployed. For any/all other services, it is deployed in an active-standby deployment. Communications that are external to the VM environment require IBM Cloud® assigned portable IPs to include any NAT pools, VIPs, and VPN endpoints.



Table 3. NSX Edge services

 Gateway form vCPU Memory Specific usage 

 X-Large 6 8 GB Suitable for L7 high performance LB 
 Quad-Large 4 1 GB Suitable for high performance ECMP and FW deployment 
 Large 2 1 GB Small DC & Single Service 
 Compact 1 512 MB Small deployments or single service use or PoC
Ordering services for Cyber Recovery instances 

You can order various add-on services for your Cyber Recovery instance. For example, Caveonix RiskForesight™ is a recommended service. You can also add optional services, such as Red Hat® OpenShift® for VMware® and Zerto.



 Available services for Cyber Recovery instances 

The following table shows the services that are available to Cyber Recovery instances. The table also shows the installed service versions.



Table 1. Available services for Cyber Recovery instances

 Service name Current version 

 [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations) 4.1 
 [Entrust CloudControl™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations) 6.6 
 [F5® BIG-IP®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations) BIG-IP VE 17.1 
 [FortiGate® Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations) 7.2.5 
 [VMware HCX™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations) Periodically updated to the most recent version 
 [Juniper® vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview) 3.0 (23.1R2) 
 [Red Hat OpenShift for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overview) 4.12
Additionally, Cloud Functions actions can be connected to an API Management tool of choice. Similar to other use cases, all considerations for scalability, and other Qualities of Services apply.

See the following example that includes a discussion of [using Serverless as an API backend](https://martinfowler.com/articles/serverless.htmlACoupleOfExamples).





 Mobile back end 

Many mobile applications require server-side logic. However, mobile developers usually don’t have experience in managing server-side logic, and would rather focus on the app that is running on the device. This development goal is easily obtained by using Cloud Functions as the server-side back end, and is a good solution. In addition, the built-in support for server-side Swift allows developers to reuse their existing iOS programming skills. Since mobile applications often have unpredictable load patterns, you want to use a Cloud Functions solution like IBM Cloud®. This solution can scale to meet practically any demand in workload without the need to provision resources ahead of time.





 Data processing 

With the amount of data now available, application development requires the ability to process new data, and potentially react to it. This requirement includes processing both structured database records as well as unstructured documents, images, or videos. Cloud Functions can be configured by system-provided or custom feeds to react to changes in data, and automatically execute actions on the incoming feeds of data. Actions can be programmed to process changes, transform data formats, send and receive messages, invoke other actions, and update various data stores. Supported data stores include SQL based relational databases, in-memory data grids, NoSQL database, files, messaging brokers, and various other systems. Cloud Functions rules and sequences provide flexibility to change the processing pipeline without programming, and is performed through simple configuration updates. The data store options and low administrative maintenance make a Cloud Functions based system highly agile, and easily adaptable to changing requirements.





 Cognitive 

Cognitive technologies can be effectively combined with Cloud Functions to create powerful applications. For example, Watson Visual Recognition can be used with Cloud Functions to automatically extract useful information from videos without having to watch them.
An explicit formal specification of the representation of the objects, concepts, and other entities that can exist in some area of interest and the relationships among them.





 orderer node 

See [ordering node](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9884023).





 ordering node 

A node that collects transactions from network members, orders the transactions and bundles them into blocks.





 ordering service 

A service that provides a shared communication channel to clients and peers for the broadcast of messages that contain transactions.





 org 

See [organization](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2032585).





 organization (org) 



* The grouping methodology for users in IBM Cloud. Orgs are used to manage quotas. Users in an org share memory and service instance quotas. See also [domain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2021210), [space](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2039442).
* The entity that owns APIs or applications that use APIs. A provider organization owns APIs and associated plans, and can additionally own applications. A consumer organization owns only applications. An organization has at least one owner. An organization can be a project team, department, or division.







 origin server 

A server that processes and responds to incoming requests from clients, and is typically used with a caching server.





 out-of-band 

Pertaining to data transferred through a stream that is independent from the main data stream.







 P 



 PaaS 

See [platform as a service](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2029786).





 paravirtualized mode 

A lightweight virtualization technique. While in paravirtualized mode, a virtual machine does not require virtualization extensions from the host computer, thus allowing virtualization on hardware systems that do not support hardware-assisted virtualization.





 parent image 

An image that provides a base for another image.
* Customer Networks
* NTP server (time.services.softlayer.com)
* IBM Cloud for VMware Solutions Active Directory, DNS
* The Remote Collectors require NAT rules on the NSX ESG to enable connectivity to the primary node, primary node replica, and data nodes







 Ports 



Table 3. Operation Manager ports

 Component Protocol Port 

 vCenter Server TCP 443 
 DNS TCP/UDP 53 
 LDAP/LDAPS TCP 389/636 
 LDAP GC TCP 3268/3269 
 NTP UDP 123 
 SMTP TCP 25 
 SNMP UDP 161 





 Authentication 

User Management for VMware Aria Operations requires VMware Identity Manager (vIDM), which integrates with Active Directory. Service accounts are used for application-to-application communication from VMware Aria Operations Manager™ to the following adapters with the minimum set of permissions that are required for metric collection and topology mapping:



* NSX Manager
* vCenter
* vSAN™









 Management Packs 

Management Packs for VMware Aria Operations extend operational management capabilities of the VMware Aria Operations platform to provide product-specific alerts and dashboards.

The following Management Packs are installed in VMware Aria Operations by default:



* Management Pack for VMware vCenter Server®
* Management Pack for VMware Aria Operations for Logs
* Management Pack for vSAN
* Management Pack for VMware Aria Automation
* Management Pack for VMware Aria Business for Cloud



The following components are installed by IBM Cloud for VMware Solutions:



* VMware SDDC Health Management Pack
* Management Pack for NSX for vSphere
* VMware Aria Operations Federation Management pack
* Management Pack for Hybrid Cloud Extension (HCX™)



Other management packs can be installed by the client. For more information, see [VMware Solution Exchange](https://marketplace.vmware.com/vsx/?contentType=1&listingStyle=table).



 Management Pack for VMware vCenter Server
The features are Network Address translation, site to site IPsec VPNs, firewall policies, inclusion of guest introspection within firewall policies, and advanced netflow tracking. Describing these features in detail is beyond the scope of this document. For more information about NSX-T, see [VMware NSX-T Data Center Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html).





 NSX-T data center deployment architecture 



 vSphere distributed switch deployment 

In this architecture for IBM Cloud VPC, each IBM Cloud bare metal server has only one PCI interface. Therefore, only one vSphere Distributed Switch is used in the ESXi hosts. Note the different to deployments Classic, two vSphere Distributed Switches are currently used, one for private and one for public. Although it is possible to provision multiple PCI interfaces for each IBM Cloud bare metal server also in IBM Cloud VPC, this architecture uses a minimum number of vDS Switches. It also takes advantage of running the vSphere VDS switch version 7.0.x, which allows a converged NSX-T architecture. The following diagram presents how PCI and VLAN interfaces, Distributed Virtual Switches, and Distributed Port Groups are used with NSX-T based deployment.

Zoom

![Bare Metal Server network interfaces and Distributed PortGroups with NSX-T](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-vpc-hosts-vmk-tep.svg)

Figure 2. IBM Cloud bare metal server network interfaces and Distributed PortGroups with NSX-T

When you create IBM Cloud bare metal server VLAN interfaces for NSX-T components that are attached to a VPC subnet, your Distributed Switch must contain a port group that matches the used VLAN ID.

Each physical host has redundant 100 Gb network connection for network access to IBM Cloud VPC.
IBM Cloud optional services considerations 

It is important to understand that any add-on services that you are using in your VMware NSX-V environment are related to that instance. These services are deleted when the NSX-V environment is deprovisioned.

The following list provides the services that you might currently use:



* [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations)
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
* [VMware HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
* [Entrust CloudControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
* [Entrust DataControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-dc_considerations)
* [Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview)
* [Red Hat OpenShift for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overview)
* [Veeam](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
* [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview)
VLANs docs 

Virtual Local Area Networks (VLANs) are used by IBM Cloud to isolate broadcast traffic on the public and private networks.

 Developer tools 

[Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/multi_vlan_firewall)

 Recommended content 

[Getting started with VLANs Instructions for setting up a VLAN.](https://cloud.ibm.com/docs/vlans?topic=vlans-getting-started)[About VLANs Learn about VLANS and how they direct traffic to your resources.](https://cloud.ibm.com/docs/vlans?topic=vlans-about-vlans)[Ordering premium VLANs When you're ready to explore a more complex network topology, you can add more VLANs to isolate traffic between groups of devices.](https://cloud.ibm.com/docs/vlans?topic=vlans-ordering-premium-vlans)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>!
You map an external, or public, IP address to a set of internal VMs for load balancing. The load balancer accepts TCP, UDP, HTTP, or HTTPS requests on the external IP address and decides which internal server to use. Port 80 is the default port for HTTP and port 443 is the default port for HTTPs. Two types of load-balancing services are available in NSX: one-armed mode (proxy mode) or Inline mode (transparent mode). For more information, see [Logical Load Balancer](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-152982CF-108F-47A6-B86A-0F0F6A56D628.html). 
 Changing NSX passwords For more information, see [Firewall considerations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_networkingonvcenterservervc_networkingonvcenterserver-firewall-considerations). 
 Deploy a Juniper vSRX appliance The [FortiGate Virtual Appliance service](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerationsfortinetvm_considerations) deploys a pair of FortiGate Virtual Appliances to your environment, which can help you reduce risk by implementing critical security controls within your virtual infrastructure. However, you can also implement your own third-party solution as needed, add a vSRX gateway to your vCenter Server instance. For more information, see [Installing vSRX with VMware vSphere Web Client](https://www.juniper.net/documentation/en_US/vsrx/topics/task/installation/security-vsrx-vsphere-client-installing.html).
[Cyber Recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-cr_overview) This offering provides air-gapped protection, immutable storage, and rapid recovery of applications and data for ransomware protection. 







 Add-on services 

Review and choose services for your deployment.



 Security and compliance services 

The following table describes the security and compliance services that are available.



Table 3. Security and compliance services

 Service name Description 

 [Caveonix RiskForesight™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations) This service manages cyberrisk and compliance risk with proactive monitoring and automated defense controls to protect against threats and to meet industry or government regulations. 
 [FortiGate® Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations) This service deploys a pair of FortiGate Virtual Appliances to your environment, which can help you reduce risk by implementing critical security controls within your virtual infrastructure. 
 [F5 BIG-IP®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations) This service provides intelligent L4-L7 load balancing and traffic management services at a local and global scale, robust network and web application firewall protection, and secure and federated application access. 
 [Entrust CloudControl™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations) This service enforces and controls compliance against security standards, and provides detailed role-based access control (RBAC), approval, and auditing capabilities. 
 [KMIP™ for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) This service provides a highly available service to manage encryption keys that are used by VMware in IBM Cloud.
The VMs disks are connected to a mount server and then the antivirus software on the mount server that is used to scan files from the mounted disks.
* VMware NSX-T™ overlay segments allow the creation of isolated segments onto which copies of the VMs can be attached and isolated from the production VMs.
* NSX-T distributed firewall provides the required isolation so that only required cybertoolsets can access the copies of the VMs.
* Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT) are used to allow IP access between the cybertoolsets and the copies of the VMs.



For more information, see [Veeam technologies used in the sandbox](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeam-cr-sandboxveeam).



The following diagram shows the high-level view of the solution architecture.

Zoom

![Immutable backup solution architecture](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/veeam-cr-sa-ib.svg)

Figure 1. Immutable backup solution architecture

The following components are prerequisites for the immutable backup solution architecture:



* vCenter Server instance - The management or consolidated cluster in the vCenter Server instance provides the compute and network resources to host the management appliances and your customer workloads. If the vSAN option in the vCenter Server instance order is used, then the vCenter Server instance also provides the storage resources. The vCenter Server instance consists of one or more clusters that host vSphere® ESXi hosts. The following VMs are hosted on the consolidated or management cluster:



* Customer workloads are your VMs that are being backed up by the Veeam service and that you want some or all of them to use immutable backup.
* The vCenter server appliance manages the vSphere resources and provides a single management plane.
[VMware Shared](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_overview) This offering provides standardized and customizable deployment choices of VMware® virtual data center environments. 
 [VMware vSphere®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereclusteroverview) This offering provides a customizable virtualization service that combines VMware-compatible bare metal servers, hardware components, and licenses, to build your own IBM-hosted VMware environment. 
 [VMware vCenter Server](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview) This offering allows you to deploy a VMware virtual environment by using custom compute, storage, and network resources to best fit your business needs. 
 [VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-overview) This offering includes a secure-by-default architecture that follows IBM's unique policy controls framework, it provides continuous compliance monitoring, and the highest level of data encryption (FIPS 140-2 Level 4). 
 [Cyber Recovery](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-cr_overview) This offering provides air-gapped protection, immutable storage, and rapid recovery of applications and data for ransomware protection. 







 Add-on services 

Review and choose services for your deployment.



 Security and compliance services 

The following table describes the security and compliance services that are available.



Table 3. Security and compliance services

 Service name Description