vania-janet/multiturn-rag-retrieval-data huggingface dataset:
It could be any data (e.g., fuel consumption, driver details, ambient temperature, or anything else that can be measured as you cruise). For the purposes of this post, it will be the truck's ID and position (lat/long coordinates). Truck Tracker will store the data in various data stores and also show you the current position of the trucks on a map.

IBM Cloud Databases



* 2 hours
* 2022-03-03



[Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellite)Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite

IBM Cloud Satellite provides you with flexibility and scalability to bring your own infrastructures to IBM Cloud. You can run IBM Cloud services anywhere including on your on-prem data centers and other cloud providers. With IBM Cloud Satellite, you can connect your multiple environments to implement distributed cloud solutions to help your enterprise hybrid cloud transformation. Key Protect on Satellite allows you to fully control your encryption keys by using your on-prem hardware security module (HSM). Hyper Protect Crypto Services with Unified Key Orchestrator enables you to manage keys in various key management systems, including Key Protect on Satellite, from a single pane of glass.

Hyper Protect Crypto Services Key Protect

+3

Satellite,IBM Cloud Databases,Activity Tracker hosted event search



* 2 hours
* 2023-06-27



[Centralize communication through a VPC Transit Hub and Spoke architecture - Part two](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-transit2)Centralize communication through a VPC Transit Hub and Spoke architecture - Part two

A layered architecture will introduce resources and demonstrate connectivity. Each layer will add additional connectivity and resources. The layers are implemented in Terraform. It will be possible to change parameters, like number of zones, by changing a Terraform variable. A layered approach allows the tutorial to introduce small problems and demonstrate a solution in the context of a complete architecture.
Networking <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpc)<br> * [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-responsibilities)<br> * [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-tg-responsibilities)<br><br><br> 
 Storage <br><br> * [Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpc)<br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-responsibilities)<br><br><br> <br><br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-responsibilities)<br><br><br> 
 Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilities)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilities)<br><br><br> <br><br> * App ID [4]<br><br><br>
Networking <br><br> * [VPC infrastructure services](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)<br> * [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-ha-dr)<br> * [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ha-drhigh-availability)<br><br><br> 
 Storage <br><br> * [Block Storage for VPC](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)<br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo)<br><br><br> <br><br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo)<br><br><br> 
 Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dr)<br><br><br> <br><br> * [App ID](https://cloud.ibm.com/docs/appid?topic=appid-ha-dr)<br><br><br>
[Global routing](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/images/2-aboutLocalAndGlobalRoutingExample.png)

Figure 2. Combining local and global routing example

Regardless of the routing type specified, IBM Cloud Transit Gateway can connect to classic infrastructure networks located in any MZR. To achieve this, simply add the classic connection to your transit gateway.
* You can edit a gateway's routing type after it is provisioned. However, to change the routing type from global to local, you must first remove any global connections (that is, connections to resources that are not in the same location as the gateway). Note that connections to the IBM Cloud classic infrastructure are always considered local.
* When changing from Local to Global routing, you will be charged for all associated global connections. There is no impact to the network traffic when the routing type is changed.







 Route report considerations 



* Overlapping routes are a common issue when configuring a transit gateway. If the routes from two or more connections overlap, traffic might not be routed as intended. For more information, see [Addressing route conflicts](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-route-reports&interface=uiroute-conflicts).
* After a new virtual connection (VPC, Classic infrastructure, or Direct Link) reaches Active state, allow 5 minutes for the routes to be learned by your transit gateway. Generating a route report before all routes are learned results in a partial route report.
* If a connection exposes a route of 0.0.0.0/0, that route is ignored when computing overlapping prefixes.
* Only one report per gateway is available at any time. If you generate a new report, the old report is deleted.
* Older route reports might be inaccurate after you add or remove a connection. As a result, if you update routes within those connections, it is recommended that you generate a new route report.







 Service limits
About migration 

Your drive to migrate might come from many factors including modernization, cost reduction, consolidation, or data center closure. You also migrate to be more cloud native or adopt new technologies such as VPC. Regardless of the reason, migration can be as simple as migrating a single virtual server instance, or it can be as complex as migrating a piece of your application to a more complex environment where you need to migrate an entire pod or data center with all of the underlying components.

Zoom

![Migration approach](https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/migrate-process.svg)

Figure 1. Migration approach



 Migration approach 



Table 1. Migration approach

 Step Description 

 Assess Do you need to migrate instances to a new data center due to data center closures? Do you want to migrate your entire IBM Cloud® classic infrastructure to VPC? Assess your situation and identify your existing infrastructure to determine what components you have, how they are configured, and what you want to migrate. <br>Not only do you need to assess your current environment, but you need to assess the target environment to understand the capabilities, support, and differences between the two environments, if applicable. In this assessment step, you can get a general idea of the complexity of the migration so that you can develop a migration strategy. 
 Plan Spend time planning for your migration by analyzing your current infrastructure and determining whether your resources and components can be migrated or if there would be any disruptions to your current business environment. Understanding how much time is needed to migrate and whether it needs to be done in stages can help you simplify the migration journey. 
 Migrate After you have spent time assessing your existing infrastructure and planning for your migration, you can migrate your resources and components with ease and confidence. Depending on your migration needs, there are tools available to help you with the migration process. 
 Validate After you migrate your resources and components into your target infrastructure, and before you make your infrastructure live, you will want to validate and test your environment to ensure it is ready for production.
Layer 7 rules 

Layer 7 rules define a portion of the incoming traffic that is to be matched with specific values.



* If the incoming traffic matches the specified value of a rule, then the rule evaluates to true.
* Layer 7 rules are always associated with a Layer 7 policy. Multiple Layer 7 rules can be associated with the same Layer 7 policy.
* If multiple rules are associated with a policy, then each rule is evaluated to be true or false.
* If all the rules that are associated to a policy evaluate to true, then the policy action is applied to the request. Otherwise, the load balancer evaluates the next policy.



Rules have types, which indicate the portion of the Layer 7 traffic to be matched with the rule.



Rule types

 Type Field to be extracted and evaluated 

 HOST_NAME The hostname part of the URL (for example, api.my_company.com) 
 FILE_TYPE The end of the URL, representing the file type (for example, jpg) 
 HEADER A field in the HTTP header 
 COOKIE A named cookie in the HTTP header 
 PATH The part of the URL that follows the hostname (for example, /index.html) 



Rules also have a comparison type, which indicates how they are to be evaluated. Rules can have following comparison types:



Rule comparison types

 Comparison Type Type of evaluation 

 REGEX Match the extracted field (for example, hostname) with the supplied regular expression 
 STARTS_WITH Verify whether the extracted field starts with the supplied string 
 ENDS_WITH Verify whether the extracted field ends with the supplied string 
 CONTAINS Verify whether the extracted field contains the supplied string 
 EQUAL_TO Verify whether the extracted field is identical to the supplied string 



Not all rule types support all comparison types. For example, if you are using FILE_TYPE, it is best to use comparison types REGEX and ENDS_WITH.



 Layer 7 rule properties 



Rule properties

 Property Description 

 Type Specifies the type of rule. Rule types can be HOST_NAME, FILE_TYPE, HEADER, COOKIE, or PATH. 
 Comparison Type Comparison types are used in association with the rule type, key, and value to define a rule and classify traffic.
An NSX-T segment reproduces switching functions, broadcast, unknown unicast, multicast (BUM) traffic, in a virtual environment that is decoupled from the underlying hardware.



Table 10. NSX-T segments

 Segment name VLAN Transport zone Uplink teaming policy 

 vpc-zone-edge-tep default nsx-vlan-transportzone TEP * Failover order 
 vpc-zone-t0-public default nsx-vlan-transportzone 
 vpc-zone-t0-private default nsx-vlan-transportzone 
 vpc-zone-customer-t0-172-16-16-0 nsx-overlay-transportzone 
 vpc-zone-customer-t1-192-168-0-0 nsx-overlay-transportzone 
 vpc-zone-customer-t1-192-168-1-0 nsx-overlay-transportzone 









 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [IBM Cloud Transit Gateway overview](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)
* [IBM Cloud VPC VPN overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)
Layer 7 rule 

Layer 7 rules define a portion of the incoming traffic that is to be matched with specific values.



* Adding L7 rules is not allowed for any L7 policy with REDIRECT_HTTPS action.
* If the incoming traffic matches the specified value of a rule, then the rule evaluates to true.
* Layer 7 rules are always associated with a Layer 7 policy. Multiple Layer 7 rules can be associated with the same Layer 7 policy.
* If multiple rules are associated with a policy, then each rule is evaluated to be true or false.
* If all the rules that are associated to a policy evaluate to true, then the policy action is applied to the request. Otherwise, the load balancer evaluates the next policy.



Rules have types, which indicate the portion of the Layer 7 traffic to be matched with the rule.



 Type Field to be extracted and evaluated 

 HOST_NAME The hostname part of the URL (for example, api.my_company.com) 
 FILE_TYPE The end of the URL, representing the file type (for example, jpg) 
 HEADER A field in the HTTP header 
 COOKIE A named cookie in the HTTP header 
 PATH The part of the URL that follows the hostname (for example, /index.html) 



Rules also have a comparison type, which indicates how they are to be evaluated.



 Comparison Type Type of evaluation 

 REGEX Match the extracted field (for example, hostname) with the supplied regular expression 
 STARTS_WITH Verify whether the extracted field starts with the supplied string 
 ENDS_WITH Verify whether the extracted field ends with the supplied string 
 CONTAINS Verify whether the extracted field contains the supplied string 
 EQUAL_TO Verify whether the extracted field is identical to the supplied string 



Not all rule types support all comparison types. For example, if you are using FILE_TYPE, it is best to use comparison types REGEX and ENDS_WITH.





 Layer 7 rule properties 



 Property Description 

 Type Specifies the type of rule. Rule types can be HOST_NAME, FILE_TYPE, HEADER, COOKIE, or PATH. 
 Comparison Type Comparison types are used in association with the rule type, key, and value to define a rule and classify traffic.
[VPC-to-classic and BCR peering with Transit Gateway use case](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl/includes/vpc/includes/vpc/images/vpc-classic-transit-gateway.png)

VPC-to-classic and BCR peering with Transit Gateway use case

VPC A Networks



Table 14. VPC B Networks

 IP Origin 

 10.100.0.0/24 from VPC A subnet 
 13.100.0.0/24 from VPC A subnet 
 13.111.0.0/24 from Classic through Transit Gateway 



VPC A Default (Egress) Routing Table



Table 15. VPC A Default (Egress) Routing Table

 Destination Action Next Hop Location 

 13.0.0.0/8 Delegate-VPC <br><br> * <br><br><br> Dallas 1 
 13.0.0.0/8 Delegate-VPC <br><br> * <br><br><br> Dallas 2 
 13.0.0.0/8 Delegate-VPC <br><br> * <br><br><br> Dallas 3 









 Related links 

To learn about these offerings:



* [Get started with IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* [Get started with IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway)
* [Get started with VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn)
[Routing traffic from spoke to transit with an egress routing table](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-spoke-egress.svg)

Routing traffic from spoke to transit with an egress routing table

In the diagram below this is represented by the egress dashed line.

Zoom

![Egress traffic from spoke](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-spoke-egress-hi-fix.svg)

Egress traffic from spoke



1. Apply the spoke_egress_tf layer:

./apply.sh spokes_egress_tf
2. Run the test suite. Your expected results are: All tests pass.

pytest -m "curl and lz1 and (rz1 or rz2)"
3. Visit the [VPCs](https://cloud.ibm.com/vpc-ext/network/vpcs) in the IBM Cloud console. Select one of the spoke VPCs and then click on Manage routing tables click on the Egress routing table. With this change spoke traffic originating in a spoke in Dallas 2 remains in Dallas 2 as it flows through the firewall-router in the transit VPC.
4. Notice these routes in the spoke's egress routing table:



 Zone Destination Next hop 

 Dallas 1 192.168.0.0/16 10.1.0.196 
 Dallas 2 192.168.0.0/16 10.2.0.196
Transport nodes define the physical server objects or VMs that participate in the virtual network fabric. Uplink profiles provide a shared configuration for each transport node that uses it.



Table 8. NSX-T transport nodes

 Transport node type Uplink profile IP assignment 

 ESXi vpc-esxi-vpc-profile Static IP list 
 Gateway cluster Overlay : vpc-edge-vpc-profile <br>VLANs : vpc-edge-vpc-profile Static IP list 



The IP addresses for each NSX-T transport node must be defined manually, which maps to provisioned IBM Cloud bare metal server VLAN interface IPs.





 Uplink profiles and teaming 

An uplink profile defines policies for the links from hypervisor hosts to NSX-T logical switches or from NSX Edge nodes to top-of-rack switches.



Table 9. NSX-T uplink profiles

 Uplink profile name VLAN Teaming policy Active uplinks Standby links MTU 

 vpc-esxi-vpc-profile 400 Failover order uplink-1 Managed by vCenter Server 
 vpc-edge-vpc-profile default Failover order uplink-1 9000 



The VLAN ID used for Host TEPs is defined here. If you use a different VLAN ID, change the profile. The VLAN ID used for Edge TEPs is defined in the Edge TEP Segment (vpc-zone-edge-tep).





 VNI pools 

Virtual Network Identifiers (VNIs) are similar to VLANs for a physical network. VNIs are created automatically when a logical switch is created from a pool or range of IDs. This architecture uses the default VNI pool that is deployed with NSX-T.





 Segments 

An NSX-T segment reproduces switching functions, broadcast, unknown unicast, multicast (BUM) traffic, in a virtual environment that is decoupled from the underlying hardware.



Table 10. NSX-T segments

 Segment name VLAN Transport zone Uplink teaming policy 

 vpc-zone-edge-tep default nsx-vlan-transportzone TEP * Failover order 
 vpc-zone-t0-public default nsx-vlan-transportzone
This pattern requires a [gateway appliance](https://cloud.ibm.com/docs/gateway-appliance?topic=gateway-appliance-aboutfirewall) or [gateway cluster](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_orderinginstance-addl-clusters) with Juniper vSRX or other third-party device, which supports GRE. In this solution, GRE tunnel is established between this device and Transit GW Router in a specific Zone. NSX-T T0 advertises routes through vSRX (or other device) to Transit Gateway.

For more information about this architecture pattern, see [Architecture pattern for using Transit Gateway with a vCenter Server with NSX-T instance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-arch-pattern-nsx-t-transit-gw).





 Related links 



* [VMware vSphere overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereclusteroverview)
* [VMware NSX-T design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-nsx-t-design)
They use an IP address range or prefix, which is reachable through VPC route that points to the NSX-T Tier-0 private uplink VIP as described in [VMware NSX-T logical routing on VPC](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-nsx-t-vpc-routing). When you attach the VPC to a Transit Gateway, you must create a VPC prefix that matches the VPC route, which points to the NSX-T overlay. You must not define any subnets on the prefix. However, the prefix must exist so that the Transit Gateway can advertise the NSX-T overlay routes to other connections (VPCs, Classic, or Direct Link) that are attached to it.

Zoom

![Transit Gateway with VMware on VPC with NSX-T](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-tgw-nsx-t-arch.svg)

Figure 2. IBM Cloud Transit Gateway with VMware on VPC with NSX-T





 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vpc-ryo-overview)
* [IBM Cloud Direct Link overview](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
Getting started with IBM Cloud Transit Gateway 

Use IBM Cloud® Transit Gateway to interconnect IBM Cloud classic and Virtual Private Cloud (VPC) infrastructures worldwide, keeping traffic within the IBM Cloud network. With IBM Cloud Transit Gateway, organizations can define and control communication between resources on the IBM Cloud network, providing dynamic scalability, high availability, and private, in-transit data between IBM Cloud data centers. Transit gateways are commonly implemented to support hybrid workloads, frequent data transfers, private workloads, or to ease administration of the IBM Cloud environment.

With IBM Cloud Transit Gateway, you can connect:



*  VPCs in the same region (local routing)
*  VPCs in different regions (global routing)
*  VPCs to your IBM Cloud classic infrastructure
*  Networks using a Generic Routing Encapsulation (GRE) tunnel
*  On-premise networks using Direct Link to your IBM Cloud networks



To get started using IBM Cloud Transit Gateway:



1.  Review transit gateway features and use cases in [About IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about).
2.  Make sure that you have met the requirements listed in [Planning for IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips).
3.  Create a transit gateway. See [Ordering an IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway) for details.
[Incoming connections from the enterprise pass through the firewall](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-routing-green.svg)

Incoming connections from the enterprise pass through the firewall

This does not help with the traffic originating in the transit test instance passing through the Transit Gateway then back through ingress routing to the firewall-router. This connection gets stuck at the firewall-router (3) and will not get forwarded back to the worker as shown in red below. Traffic transit -> enterprise and transit -> spoke are failing.

Zoom

![Traffic between transit and enterprise and transit and spoke is failing](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-routing-red.svg)

Traffic between transit to enterprise and transit to spoke is failing

One possible solution is to stop sending traffic destined to the transit VPC to the firewall-router. The wide ingress routes for the transit are currently routing traffic to the firewall-router. More specific routes can be added for the transit to Delegate to the default behavior - send directly to the intended destination instead of the firewall-router.

This diagram shows the traffic flow that is desired for this step. Only the enterprise <-> spoke is passing through the firewall:

Zoom

![Only route enterprise to spoke through the firewall](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-part1-fw.svg)

Only route enterprise to spoke through the firewall



1.