vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can enable virtual routing and forwarding (VRF) to move IP routing for your account and all of its resources into a separate routing table. If VRF is enabled, you can then enable IBM Cloud service endpoints to connect directly to resources without using the public network. [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
* Virtual Private Clouds (VPCs) are automatically enabled for virtual routing and forwarding (VRF). To enable service endpoints for your VPC, continue to [Enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).



To check if the account is VRF enabled, run the following command:

ibmcloud account show

To enable private endpoints, run the following command:

ibmcloud account update --service-endpoint-enable true





 Prereq 2. Check you have access to private endpoints 

If you want to use private endpoints, you must configure Activity Tracker Event Routing within the private network.

For example, to configure Activity Tracker Event Routing in your account, you can provision a VPC VSI. Then, from a terminal, you can run cURL commands to create a target and a route.

Complete the following steps to provision a VPC VSI so that you can run cURL commands to create a target and a route in your account:



1. [Generate an ssh key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).
2. [Create a VSI](https://test.cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers) in your account.
3. [Connect to the VSI](https://test.cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_linux) from a terminal in your local environment.
4.
* Install and update third-party software on the hosts.
* Upgrade virtual machine hardware, VMware Tools, and virtual appliances.



This document also describes the processes to maintain the following components of your vCenter Server instance:



* vCenter Server Appliance
* NSX®
* vSAN™



This document describes the use of a proxy server implementation, based on CentOS and Squid, to enable VUM to access the VMware repositories. When VUM requests a resource from the update server at VMware, the request is sent to the proxy server first and the proxy server then sends the request to the update server through the External Services Gateway (ESG). After the resource is obtained by the proxy server, it sends the resource to VUM.

Zoom

![Overview diagram](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vum-vcsproxy.svg)

Figure 1. Overview diagram

In vSphere 6.7, VUM is integrated within the vCenter Server Appliance (VCSA), and as the VUM client component is a plug-in that runs on the vSphere Web Client it is automatically enabled after deployment of the VCSA. However, VUM has no access to the internet to access the VMware repositories.

This documented configuration uses the “all-in-one”, internet-connected VUM deployment model that uses the IBM Cloud public network to provide internet access to download upgrades and patches.

Clients requiring the use of alternative internet connections must investigate the VMware vSphere Update Manager Download Service (UMDS), which is beyond the scope of this publication.

While VUM can be configured to import updates from a shared repository or import patches and extensions manually from a compressed file, these details aren't discussed in this document.
* Virtual network firewall software in the workload VPC to provide web application firewall (WAF) protection and layer 7 protection against denial-of-service (DoS) attacks.



See [VPC architecture with virtual servers](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsiedge-vpc-architecture) for more details on this variation.





 Financial Services Validated services 

Deploying the reference architecture depends upon VPC infrastructure and PaaS services that are [IBM Cloud for Financial Services Validated](https://cloud.ibm.com/catalog?search=label%3Afs_ready). This means that they have evidenced compliance to the controls of the IBM Cloud Framework for Financial Services. Financial Services Validated services are designed to help address the requirements of financial institutions for regulatory compliance, security, and resiliency. When properly configured and managed, services that are Financial Services Validated work together so you can deliver a solution that conforms to the best practices of the IBM Cloud Framework for Financial Services.

Generally speaking, you should strive to use only services which are Financial Services Validated in your solutions. However, depending on your circumstance there may be exceptions. See the best practice [Use only services that are IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-financial-services-validated-services) for more details and potential exceptions.



Table 1. Required and optional services for VPC reference architecture

 Category Required services Optional services
* UI
* CLI







 Enabling VRF and service endpoints 

When using the classic infrastructure, you connect to resources in your account over the IBM Cloud® public network by default. You can enable virtual routing and forwarding (VRF) to move IP routing for your account and all of its resources into a separate routing table. If VRF is enabled, you can then enable IBM Cloud service endpoints to connect directly to resources without using the public network.

Virtual Private Clouds (VPCs) are automatically enabled for virtual routing and forwarding (VRF). To enable service endpoints for your VPC, continue to [Enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uiservice-endpoint).



 Before you begin 

Before you begin, ensure that you meet the following criteria:



* You need a billable account to enable virtual routing and forwarding and IBM Cloud service endpoints.
* You must have access to IBM Cloud infrastructure in your account. Go to the Navigation menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Classic Infrastructure to verify that you have access.







 Enabling VRF in the console 

VRF allows multiple instances of a routing table to exist in a router and to work simultaneously. When you enable VRF, a separate routing table is created for your account, and connections to and from your account's resources are routed separately on the IBM Cloud network. VRF is enabled at the account level, so all resources are affected by this networking change. For more information about VRF technology and how it affects your account's network routing, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/dl?topic=dl-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud).

Enabling VRF permanently alters networking for your account.
Networking - VPC infrastructure <br><br> * [IBM Cloud® Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpc)<br> * [IBM Cloud® Application Load Balancer for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-alb)<br> * [IBM Cloud® Virtual Private Network (VPN) for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-vpn)[5]<br> * [IBM Cloud® DNS Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-dns-services)<br> * [IBM Cloud® Virtual Private Endpoints for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-vpe)<br><br><br> 
 Networking - interconnectivity <br><br> * [IBM Cloud® Direct Link (2.0)](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-direct-link)[6]<br> * [IBM Cloud® Transit Gateway](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-transit-gateway)<br><br><br>
* [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services)
* [KMIP for VMware](https://cloud.ibm.com/infrastructure/vmware-solutions/console/servicestandalonenew/KMIPAdapter)
* [Direct Link Dedicated](https://cloud.ibm.com/interconnectivity/direct-link)



The following services are included with VMware Regulated Workloads:



* [Veeam Backup and Replication](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
* [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations)
* [Entrust CloudControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
* [Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview). This service is included when you choose Gateway cluster with Juniper vSRX.
* [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview)



The following services are optional for VMware Regulated Workloads:



* [VMware HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)







 Related links
Service prerequisites 

The following services are required for VMware® Regulated Workloads:



*  [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services)
*  [KMIP for VMware](https://cloud.ibm.com/infrastructure/vmware-solutions/console/servicestandalonenew/KMIPAdapter)
*  [Direct Link Dedicated](https://cloud.ibm.com/interconnectivity/direct-link)





  Related links 



*  [Instance configurations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-inst-config)
*  [Procedure to order VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-procedure)
*  [VMware Regulated Workloads reference architecture overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-archi-overview)
For more information, see the following topics:



* [Ordering services for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservices)
* [Viewing services for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_viewingservices)
* [Deleting services from vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_deletingservices)
For more information, see [Creating a routed Organization virtual data center network](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_vcd-ops-guideshared_vcd-ops-guide-routed-organization) and [Connect the VMs to the network](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_vcd-ops-guideshared_vcd-ops-guide-connect-vm).
* You must have virtual routing and forwarding and service endpoints that are enabled on the account that the allow listed IP or subnet belong to. For more information, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).







 Collecting network IP addresses 

Collect the service network and private network IP addresses to configure the firewall and DNAT rules.



1. From the IBM Cloud for VMware Solutions console, click Resources > VMware Shared from the left navigation pane.
2. In the VMware Shared table, click the virtual data center to configure.
3. In the Private Network Endpoint section, collect the Service network IP address and Private network IP address.







 Configuring firewall rules for the VMware NSX Edge Services Gateway 

The firewall rule allows traffic from the private network IP to go through your Edge Service Gateway. You might need to repeat this process (steps 5 - 10) to allow different traffic to enter your virtual data center, depending on which ports and protocols you need to open up.



1. From the tenant portal, click Data Centers.
2. From the main page under Virtual Data Center, click the virtual data center where you would like to configure the private network.
3. In the left pane under Networking, click Edges.
4. In the right pane, select the network and click SERVICES.
5. Click the Firewall tab and click + to add a firewall rule.
6.
Common use cases 

The execution model that is offered by IBM Cloud® Functions supports various use cases. The following sections include typical examples. For a more detailed discussion of Serverless architecture, example use cases, pros and cons discussion, and implementation best practices, read the excellent [Mike Roberts article on Martin Fowler's blog](https://martinfowler.com/articles/serverless.html).



 Microservices 

Despite their benefit, microservice-based solutions remain difficult to build by using mainstream cloud technologies, often requiring control of a complex toolchain, and separate build and operations pipelines. Small and agile teams waste too much time with infrastructural and operational complexities such as fault-tolerance, load balancing, auto scaling, and logging. These teams want a way to develop streamlined, value-added code with programming languages they already know, love, and that are best suited to solve particular problems.

The modular and inherently scalable nature of Cloud Functions makes it ideal for implementing granular pieces of logic in actions. Cloud Functions actions are independent of each other and can be implemented by using various different languages that are supported by Cloud Functions and access various backend systems. Each action can be independently deployed and managed, is scaled independently of other actions. Interconnectivity between actions is provided by Cloud Functions in the form of rules, sequences, and naming conventions. This type of environment bodes well for microservices based applications.

Another important argument in favor of Cloud Functions is the cost of a system in a disaster recovery configuration. Compare microservices with PaaS or CaaS verses using Cloud Functions by assuming that you have 10 microservices, which use containers or Cloud Foundry runtimes. This comparison equates to 10 continuously running and billable processes in a single availability zone, 20 when run across 2 availability zones, and 40 when run across two regions with two zones each. To achieve the same goal with Cloud Functions, you can run them across as many availability zones or regions as you like, without having to pay a penny of incremental costs.





 Web apps 

Given Cloud Functions’s event-driven nature, it offers several benefits for user-facing applications, whereas the HTTP requests coming from the user’s browser serve as the events.
Common Services design 

Common Services provide the services that are used by other services in the Cloud Management platform. The common services of the solution include identity and access services, domain name services, NTP services, and certificate authority services.

Zoom

![Common services](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-overview-commonservices.svg)

Figure 1. Common services



 Identity and Access Services 



 vCenter Single Sign-On 

The VMware vCenter Server® includes a built-in identity provider, which is a service that manages identity sources and authenticates principals. Identity Source (Directory Service) stores and manages principals. Principals consist of a collection of attributes about a user or service account such as name, address, email, and group membership. The internal (local) LDAP repository in vCenter Server contains user identities, groups, and configuration data.





 Microsoft Active Directory 

Starting with VMware vSphere® 7.0, you can configure vCenter Server for an external identity provider by using federated authentication. In such a configuration, you replace vCenter Server as the identity provider, and Active Directory™ Federation Services (AD FS) can be used as the external identity provider. In this configuration, AD FS interacts with the identity sources on behalf of vCenter Server.

In this design, customers can use their own Microsoft® Active Directory (MS AD) for Identity Management for the vCenter and NSX-T™ managers. Your vCenter Server must be configured for MS AD authentication.

You have several options for reference to your existing domain as an identity source:



* If you have connectivity to your domain controllers in or from IBM Cloud® Virtual Private Cloud, you can reference them directly.
* You can deploy read-only replica controllers in IBM Cloud VPC.
* You can add one-way trust from the domain controllers that are deployed in IBM Cloud VPC to your domain controllers.
To do this step, you can use VMware clients, command line interface (CLI), existing scripts, or other familiar vSphere API-compatible tools. These options can be combined with IBM Cloud automation solutions, such as using IBM Cloud Terraform provider with Schematics.

For the required common services, such as NTP and DNS, you can use IBM Cloud VPC basic services and solutions. For Active Directory™, you can use IBM Cloud VPC compute resources to build your Active Directory in IBM Cloud VPC, or interconnect with your existing Active Directory infrastructure.

For connectivity needs, you can use IBM Cloud VPC and IBM Cloud interconnectivity solutions. For public internet network access capabilities, the options include floating IP addresses and Public Gateway configurations within your VPC.

On-premises connectivity over public internet can be arranged by using IBM Cloud VPC VPN services (site-to-site and client-to-site), or alternatively NSX-T built-in capabilities. For private networking, you can use IBM Cloud interconnectivity services to connect your VMware workloads with IBM Cloud classic infrastructure, other VPCs, and on-premises networks.



 Key responsibilities 

With the roll-your-own VMware Solutions in IBM Cloud VPC, you are responsible for ordering the VPC, prefixes, and subnets for it. Also, ordering the IBM Cloud bare metal server and setting up the vSphere clusters, including installing and configuring VMware vCenter Server®, vSAN, NSX-T, attaching file storage.

The IBM Cloud bare metal server for IBM Cloud VPC has the VMware ESXi™ 7.x hypervisor preinstalled.

For day two of operation, it is your responsibility to monitor and manage the vCenter and NSX-T, including backups, patching, configuration, and monitoring of the VMware software and the underlying vSphere hypervisor.





 Key benefits 

The architecture provides fundamental building blocks, which include VMware vSphere, vCenter Server, VMware NSX-T, and shared storage options, such as VMware vSAN or IBM Cloud VPC file share.
Add-on services 

You can select various add-on services for Cyber Recovery.

[Veeam Backup and Replication 12](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview) is a required service, which is automatically included in the Cyber Recovery instance. A Linux® hardened repository is already chosen for you.

An edge gateway is required. You can bring your own gateway appliance or choose from the following types:



*  Gateway cluster with Juniper® vSRX
*  Gateway cluster with FortiGate® Virtual Appliance
*  FortiGate Security Appliance



The [Caveonix RiskForesight™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations) service is recommended.

The following services are optional for Cyber Recovery.



*  [HCX™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
*  [Zerto](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-addingzertodr)
*  [Entrust CloudControl™](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
*  [F5® BIG-IP®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
*  [Red Hat® OpenShift® for VMware®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overview)
*  [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview)
Routing your VLANs 

The IBM Cloud® Virtual Router Appliance is able to route multiple VLANs over the same network interface (for example, dp0bond0 or dp0bond1). This is accomplished by setting the switch port into trunk mode and configuring virtual interfaces (VIFs) on the device.

For example:

set interfaces bonding dp0bond0 vif 1432 address 10.0.10.14/24
set interfaces bonding dp0bond0 vif 1693 address 10.0.20.1/24

The commands in the example create two virtual interfaces on the dp0bond0 interface for a stand-alone Virtual Router Appliances (VRA). The interface dp0bond0.1432 processes traffic for VLAN 1432 while the interface dp0bond0.1693 processes traffic for VLAN 1693. 10.0.10.1/24 and 10.0.20.1/24 are assumed to be the gateway IP addresses for 10.0.10.0/24 and 10.0.20.0/24 respectively, and are also assumed to be primary or secondary static/portable subnets from the [Subnets page](https://cloud.ibm.com/classic/network/subnets) in the console.



 High availability commands 

For a High Availability (HA) pair of VRAs, the commands are different. The VIF addresses are chosen by the user or made up from the 192.168.0.0/16 or 172.16.0.0/12 private space, and are only used for layer 2 connectivity between the VRAs. More specifically, that connection is used for VRRP advertisements. In addition, the virtual-addresses in the following examples are the gateway IP addresses for each of a customer's primary or secondary subnets. The vrrp-group number should match the group number shown in your gateway details page, as well as match the vrrp-group set in the rest of the default configuration.

The first command in this example can also be used on a single VRA that is not set up for HA.