vania-janet/multiturn-rag-retrieval-data huggingface dataset:
vpc <br>Always included <br>VPCReference The VPC this subnet resides in. 
 zone <br>Always included <br>ZoneReference The zone this subnet resides in. 
 public_gateway <br>PublicGatewayReference The public gateway to use for internet-bound traffic for this subnet. 





Table 6. Retrieve status codes

 Status Code 

 200 The subnet was retrieved successfully. 
 404 A subnet with the specified identifier could not be found. 



For more information (including Java, Node, Python and Go examples), see "Retrieve a subnet" in the [VPC API reference](https://cloud.ibm.com/apidocs/vpc/latestget-subnet).
[Client VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview) Client VPN for VPC provides client-to-site connectivity, which allows remote devices to securely connect to the VPC network using an OpenVPN software client. [Platform metrics](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-monitoring) 



In addition, some VPC resources have quotas associated with them that you can monitor through the VPC resource quota overview dashboard. For more information, see [VPC resource quota overview](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-quota-metrics).
* GATEWAY: ID or name of the public gateway.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --name: New name of the public gateway.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is public-gateways 

List all public gateways.

ibmcloud is public-gateways [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME | --all-resource-groups] [--output JSON] [-q, --quiet]



 Command options 



* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --all-resource-groups: Query all resource groups.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------









 Routing tables and routes 

The following section gives details about the CLI commands that are available for working with VPC routing tables and routes.



 ibmcloud is vpc-default-routing-table 

View details of the default routing table of a VPC.

ibmcloud is vpc-default-routing-table VPC [--output JSON] [-q, --quiet]



 Command options 



* VPC: ID or name of the VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.
For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started protecting your VPC Infrastructure Services with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).



 How VPC Infrastructure Services integrates with context-based restrictions 

VPC Infrastructure Services is a composite service made up of a number of child services. Context-based restrictions can be created for IBM Cloud VPC or any of its child services; for example, [subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc), [virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practice), and [block storage volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=cli).

See the [rule creation section](https://cloud.ibm.com/docs/vpc?topic=vpc-cbrcbr-rules) for details on how you can create rules with the required attributes for each service.





 Creating network zones 

A network zone represents an allowlist of IP addresses where an access request is created. It defines a set of one or more network locations that are specified by the following attributes:



* IP addresses, which include individual addresses, ranges, or subnets
* VPCs
* Service references, which allow access from other IBM Cloud® services





 Service references 

A service reference, defined as part of a network zone, allows the given service to talk to the restricted resources or APIs that are targeted by a particular context-based restriction policy. The following table includes service references that need to be included when using context-based restrictions in the context of VPC Infrastructure Services.
* SUBNET: ID or name of the subnet.
* RESERVED_IP: ID or name of the reserved IP.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --name: The new name of the reserved IP.
* --auto-delete: Indicates whether this reserved IP member automatically deletes when either target is deleted, or the reserved IP is unbound. Must be false if the reserved IP is unbound. One of: true, false.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is subnet-reserved-ip-delete 

Release one or more reserved IPs.

ibmcloud is subnet-reserved-ip-delete SUBNET (RESERVED_IP1 RESERVED_IP2 ...) [--vpc VPC] [-f, --force] [--output JSON] [-q, --quiet]



 Command options 



* SUBNET: ID or name of the subnet.
* RESERVED_IP1: ID or name of the reserved IP.
* RESERVED_IP2: ID or name of the reserved IP.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --force, -f: Force the operation without confirmation.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------









 Virtual private clouds 



 ibmcloud is vpc 

View details of a VPC.

ibmcloud is vpc VPC [--show-attached] [--output JSON] [-q, --quiet]



 Command options
* ACL: ID or name of the network ACL.
* RULE: ID or name of the rule.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --name: New name of the rule.
* --direction: Direction of traffic to enforce. One of: inbound, outbound.
* --action: One of: allow, deny.
* --before-rule: The ID or name of the rule that this rule is inserted before.
* --reset-before-rule: Reset before rule. Specify this option to move this rule after all existing rules.
* --source: Source IP address or CIDR block.
* --dest: Destination IP address or CIDR block.
* --icmp-type: ICMP traffic type to allow. Valid values from 0 to 254. This option is specified only when protocol is set to icmp. If unspecified, all types are allowed.
* --icmp-code: ICMP traffic code to allow. Valid values from 0 to 255. This option is specified only when protocol is set to icmp. If unspecified, all codes are allowed.
* --source-port-min: Minimum source port number. Valid values are from 1 to 65535. This option is specified only when protocol is set to tcp or udp (default: 1).
* --source-port-max: Maximum source port number. Valid values are from 1 to 65535. This option is specified only when protocol is set to tcp or udp (default: 65535).
* --destination-port-min: Minimum destination port number. Valid values are from 1 to 65535. This option is specified only when protocol is set to tcp or udp (default: 1).
* --destination-port-max: Maximum destination port number. Valid values are from 1 to 65535. This option is specified only when protocol is set to tcp or udp (default: 65535).
For more options for image, see [Images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images).

 General VPC variables:
REGION = "eu-de" default value
ZONE = "eu-de-2" default value
VPC = "ic4sap"
SECURITYGROUP = "ic4sap-securitygroup"
SUBNET = "ic4sap-subnet"
SSH_KEYS = [ "r010-57bfc315-f9e5-46bf-bf61-d87a24a9ce7a" , "r010-3fcd9fe7-d4a7-41ce-8bb3-d96e936b2c7e" ]
PROFIL = "bx2-4x16" default value
IMAGE = "ibm-redhat-7-6-amd64-sap-applications-1" default value

 SAP Database VSI variables:
DB-HOSTNAME = "ep12db"
DB-VOLUME_SIZES = [ "40" , "32" , "64" , "128" ]

 SAP APPs VSI variables:
APP-HOSTNAME = "ep12app" default value
APP-VOLUME_SIZES= [ "40" , "128" ]

Show more



 Parameter Description 

 REGION The cloud region where the solution is deployed. The regions and zones for VPC are listed [here](https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc). 
 ZONE The cloud zone where the solution is deployed. 
 VPC The name of the VPC. The list of VPCs is available [here](https://cloud.ibm.com/vpc-ext/network/vpcs). 
 SECURITYGROUP The name of the Security Group. The list of Security Groups is available [here](https://cloud.ibm.com/vpc-ext/network/subnets) 
 SUBNET The name of the Subnet.
Also, a recovery guidance if an attacker makes it through defenses.



 Terms and definitions 

This documentation uses the following terms and definitions:



Table 1. Terms and definitions

 Term Definition 

 vCenter Server instance A VMware vSphere environment that is hosted on a minimum of three IBM Cloud bare metal servers and includes VMware NSX to provide a virtual network overlay. An instance includes a vCenter appliance and Microsoft® Windows® AD/DNS. For more information, see [vCenter Server overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview). 
 Veeam service A Veeam service is a deployment of Veeam Availability Suite that is associated with the vCenter server instance. For more information, see [Veeam Backup and Replication 12 overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview). 
 Server instance A server instance is an operating system that uses compute, storage, and network resources that host applications. 
 Virtual machine (VM) A VM is a server instance that runs on a vSphere hypervisor. 
 Virtual Server Instance (VSI) A VSI is a server instance that runs on the IBM Cloud hypervisor. 
 Bare metal server A bare metal server is a server instance that runs directly on the IBM Cloud x86 hardware. 
 Veeam Backup and Replication (BUR) The Veeam application that enables backups of server instances and the replication of VMs. While the Veeam product name includes "Replication", only the backup feature is used in these cyber-recovery architectures. 
 Air-gap An air gap is a term that is used to denote network isolation where the Linux backup repository is not accessible directly from the production networks. For backup transfer, the air gap is selectively unlocked and then locked when the transfer is complete. 
 Production environment The vSphere environment that hosts the production data. For the isolated recovery environment, the production environment can be in IBM Cloud or elsewhere. 
 Cyber-recovery site The location of the isolated recovery environment.
[Multiple peers VPN use case](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-multiple-peers.png)

Multiple Peers VPN use case







 Related links 

These links provide additional information about IBM Cloud VPN for VPC:



* [VPN CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencevpn-clis)
* [VPN API reference](https://cloud.ibm.com/apidocs/vpclist-ike-policies)
* [VPN Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_vpn_gateway)
* [Required permissions for VPN resources](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-calls)
* [Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-vpns)
* [FAQs for VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-faqs-vpn)
* [Troubleshooting VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-troubleshoot-gateway-unable-to-establish-vpn-connection)
* [VPN gateway quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotasvpn-quotas)
/instance vcpu The number of VCPUs assigned by way of a structure that includes count and architecture properties. 
 /instance volume_attachments A list of the virtual server instance's volume attachments. 
 /instance boot_volume_attachment Instance's boot volume attachment. 
 /instance vpc The VPC in which the virtual server instance resides. 
 /instance zone The globally unique name for the zone. 
 /instance_initialization default_trusted_profile The default trusted profile configuration that was specified at virtual server instance creation. 
 /instance_initialization keys A list of references to public SSH keys that were used at instance initialization. 
 /instance_initialization password The administrator password at initialization, encrypted using encryption_key, and returned base64-encoded. 
 /instance_initialization user_data User data that is made available when you set up a new virtual server instance. 
 /instance/network_interfaces network_interfaces A list of network interfaces. See /instance/network_interfaces/{id} for details. 
 /instance/network_interfaces/{id} allow_ip_spoofing Indicates whether source IP spoofing is allowed on this interface. If false, source IP spoofing is prevented on this interface. If true, source IP spoofing is allowed on this interface. 
 /instance/network_interfaces/{id} created_at The date and time that the network interface was created. 
 /instance/network_interfaces/{id} floating_ips Array of references to floating IP addresses associated with the network interface. 
 /instance/network_interfaces/{id} id The unique identifier for the network interface. 
 /instance/network_interfaces/{id} name The user-defined name for the network interface. 
 /instance/network_interfaces/{id} port_speed The network interface port speed in Mbps. 
 /instance/network_interfaces/{id} primary_ipv4_address The primary IPv4 address. 
 /instance/network_interfaces/{id} resource_type The resource type. 
 /instance/network_interfaces/{id} security_groups A list of security groups. 
 /instance/network_interfaces/{id} status The status of the network interface.
For more information regarding components that are defined in presets and the deployable architecture calling these presets, see [reference architecture for initial infrastructure deployment](https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-deploy-arch-ibm-pvs-inf-full-stack).



 Trusted zones specified by configurations 

When you provision this landscape by using the VPC landing zone presets, the following trusted zones are configured.



Table 1. Trusted zones

 Trusted zone name Trusted zone type Trusted zone purpose Isolation methods 

 Edge VPC VPC service Isolate network connectivity to all resources located outside of the provisioned environment Restrictions by network ACLs and VPC security groups 
 Management VPC VPC service Provide single entry point for landscape administrators Restrictions by network ACLs and VPC security groups 
 Workload VPC VPC service Provide an isolated environment for services that are running on VPC instances Restrictions by network ACLs and VPC security groups 
 SAP PowerVS PowerVS workspace Provide an isolated environment for SAP services that are running on PowerVS instances Restrictions by VPC services connected with PowerVS workspace (Edge VPC, Management VPC, Workload VPC) 







 Data flows specified by configurations 

When you provision this landscape by using the VPC landing zone presets, the following external data flows are configured. Additional data flows might be configured separately after deployment by managing VPC and PowerVS services directly.



Table 2. Data flow

 Source Zone Destination Zone Data Description Protocol Encryption Authentication method Direction 

 IBM Cloud Schematics IP addresses Management VPC SSH management connection SSH (port 22) SSH encryption chosen by customer private/public SSH key customer-sensitive 
 Edge VPC Internet or other customer environment OS and software patch management HTTP/HTTPS (ports 80 and 443) software dependent software dependent not customer-sensitive 







 Endpoints specified by configurations 

When you provision this landscape by using the VPC landing zone presets, the following endpoints are configured. Additional endpoints might be configured separately after deployment by managing VPC and PowerVS services directly.



Table 3. Endpoints configured for customer access

 Name Type Description Zone Exposed to zones Authentication 

 Management access SSH SSH access for Linux root user.
VPC ibmcloud is vpcs [List all VPCs](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencevpcs-list) 
 Subnet ibmcloud is subnets [List all subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencesubnets-list) 
 Zone ibmcloud is zones [List all regions](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencezones-list) 
 Placement groups ibmcloud is placement-groups [List all placement groups](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referenceplacement-groups-list) 



Use the following commands to determine the required information for creating a new instance.



1. List the regions that are associated with your account.

ibmcloud is regions

For this example, you see a response that is similar to the following output:

Name Endpoint Status
us-south https://us-south.iaas.cloud.ibm.com available
2. List the zones that are associated with the region.

ibmcloud is zones us-south

For this example, you see a response that is similar to the following output.

Name Region Status
us-south-1 us-south available
us-south-2 us-south available
us-south-3 us-south available
3. List the VPCs that are associated with your account.

ibmcloud is vpcs

For this example, you see a response that is similar to the following output.

ID Name Status Classic access Default network ACL Default security group Resource group
r134-35b9cf35-616e-462e-a145-cf8db4062fcf my-vpc available false immortality-casing-extoll-exit enhance-corsage-managing-jinx Default

If you do not have an available VPC, you can create one by using the ibmcloud is vpc-create command.
For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started protecting your VPC Infrastructure Services with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).



 How VPC Infrastructure Services integrates with context-based restrictions 

VPC Infrastructure Services is a composite service made up of a number of child services. Context-based restrictions can be created for IBM Cloud VPC or any of its child services; for example, [subnets](https://cloud.ibm.com/docs/vpc?topic=vpc-about-subnets-vpc), [virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practice), and [block storage volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=cli).

See the [rule creation section](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr&interface=clicbr-rules) for details on how you can create rules with the required attributes for each service.





 Creating network zones 

A network zone represents an allowlist of IP addresses where an access request is created. It defines a set of one or more network locations that are specified by the following attributes:



* IP addresses, which include individual addresses, ranges, or subnets
* VPCs
* Service references, which allow access from other IBM Cloud® services





 Service references 

A service reference, defined as part of a network zone, allows the given service to talk to the restricted resources or APIs that are targeted by a particular context-based restriction policy. The following table includes service references that need to be included when using context-based restrictions in the context of VPC Infrastructure Services.
Storage for VPC reference architecture 

Learn about the Financial Services Validated storage options that are used within the VPC reference architecture.



 IBM® Cloud Block Storage for Virtual Private Cloud 

[Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about) provides hypervisor-mounted, high-performance data storage for your virtual server instances that you can provision within a VPC. The VPC infrastructure provides rapid scaling across zones and extra performance and security.

Block Storage for VPC is used for both primary boot volumes and secondary data volumes. Boot volumes are automatically created and attached during instance provisioning. Data volumes can be created and attached during instance provisioning as well, or as stand-alone volumes that you can later attach to an instance. To protect your data, you should use KYOK encryption with Hyper Protect Crypto Services.

To start creating Block Storage for VPC volumes, see the following instructions:



* [Create and attach a block storage volume when you create a new instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-from-vsi)
* [Create a stand-alone block storage volume](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-standalone-vol)
* [Creating block storage volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption)







 IBM Cloud® Object Storage 

[Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cloud-object-storage) stores encrypted and dispersed data across multiple geographic locations. Object Storage is available with three types of resiliency: Cross Region, Regional, and Single Data Center. Cross Region provides higher durability and availability than using a single region at the cost of slightly higher latency. Regional service reverses those tradeoffs, and distributes objects across multiple availability zones within a single region.
VPC r006-212def4b-93f0-4b9a-a331-94178b99d474
Zone us-south-2
Profile bx2-2x8
Boot volume Name Capacity Profile IOPS Attachment name Auto delete Tags
- 100 general-purpose 0 illude-education-spotted-reanalyze true -

Primary Network Interface Name Subnet ID Security Groups Allow source IP spoofing Reserved IP Address Reserved IP ID Reserved IP Name Reserved IP Auto Delete
primary 0727-944126da-e46d-4104-8ba4-ab5a5832864b r006-2295f00e-8af0-4736-be11-94677955b6b2 false - - - -

Placement ID
r006-9994e3ab-18ae-49a7-95cf-25c77e09fa76

Created 2023-03-29T22:02:59+05:30

For more examples of the ibmcloud is instance-template-create command, see the [VPC CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referenceinstance-template-create).

When you create an instance template, validation steps are performed that ensure you can use your template to provision a virtual server instance. Need more help? You can always run ibmcloud is help instance-template-create to display help for creating an instance template.





 Next steps 

With your instance template created, you can provision a single virtual server instance, or you can provision multiple instances at the same time as part of an instance group. Optionally, you can set auto scaling policies for your instance group to dynamically add or remove virtual server instances from your group. For more information, see the following topics:



* [Bulk provisioning instances with instance groups](https://cloud.ibm.com/docs/vpc?topic=vpc-bulk-provisioning)