vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc).

IBM Cloud for Financial Services that stuff in About networking like Public Gateway and Floating IPs should not generally be used. -->





 Access control lists and security groups 

Access control lists (ACLs) and security groups provide ways to control the traffic across the subnets and instances in your VPC by using rules that you specify. ACLs control traffic to and from a subnet, while security groups control the traffic at the virtual server instance (VSI) level.

For more information, see [Security in your VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-security-in-your-vpc).







 Compute 



 Virtual Servers for VPC 

Virtual Servers for VPC gives you access to all of the benefits of IBM Cloud VPC, including network isolation, security, and flexibility. When you provision an instance, you select a profile that matches the amount of memory and compute power that you need for the application that you plan to run on the instance. Instances are available on the x86 architecture.

See [About virtual server instances for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers) for more details.





 Dedicated hosts 

Provision your virtual servers on a dedicated host. Dedicated hosts are used to carve out a single-tenant compute node, free from users outside of your organization. Within that dedicated space, you can create virtual server instances according to your needs. Additionally, you can create dedicated host groups that contain dedicated hosts for a specific purpose. Because a dedicated host is a single-tenant space, only users within your account that have the required permissions can create instances on the host.

See [Creating dedicated hosts and groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances) for more details.





 Red Hat OpenShift on IBM Cloud 

You can also use Red Hat OpenShift on IBM Cloud to run applications.
[Scale workloads in shared and dedicated VPC environments](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-scaling-dedicated-compute)Scale workloads in shared and dedicated VPC environments

Isolate workloads by provisioning a dedicated host, attaching an encrypted data volume to a VSI, expanding the attached data volume, and resizing the VSI after the fact.

Virtual Private Cloud (VPC) Databases For PostgreSQL

+2

Schematics,Object Storage



* 2 hours
* 2023-05-05



[Use a VPC/VPN gateway for secure and private on-premises access to cloud resources](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn)Use a VPC/VPN gateway for secure and private on-premises access to cloud resources

This tutorial provides the automation to create resources that demonstrate Virtual Private Network (VPN) connectivity between on-premises servers and cloud resources like IBM Cloud® Virtual Private Cloud Virtual Service Instances (VSIs) and IBM Cloud data services. DNS resolution to cloud resources is also configured. The popular strongSwan VPN Gateway is used to represent the on-premises VPN gateway.

Schematics Virtual Private Cloud (VPC)

+3

Object Storage,Databases For PostgreSQL,DNS Services



* 2 hours
* 2023-05-08
The VMware vRealize Suite is an enterprise-ready, cloud management platform that you can use to manage a heterogeneous, hybrid cloud.

The following user interfaces are available for VMware vRealize.



* vCenter Clients
* VMware API
* VMware CLI



The license model for vRealize is per processor per month.



 VMware vRealize features 

VMware vRealize offers the following features.



* vRealize Automation - Automated delivery of personalized infrastructure, applications, and custom IT services.
* vRealize Operations - Intelligent health, performance, capacity, and configuration management orchestration.
* vRealize Log Insight - Real-time log management and log analysis.
* vRealize Network Insight - Accelerated security management for applications and network infrastructures.









 VMware vSAN 

VMware vSAN enables local storage drives on each vSphere host to be aggregated and pooled into a shared-nothing storage device that is accessible to all hosts in a vSAN cluster.

The following user interfaces are available for VMware vSAN.



* vCenter Clients
* VMware API
* VMware CLI





 VMware vSAN features 

VMware vSAN offers the following features.



* Distributed host-based storage
* Shared-nothing architecture
* Scales up to 64 nodes
* Low latency
* Configurable fault tolerance









 VMware Site Recovery Manager (SRM) 

VMware Site Recovery Manager (SRM) enables application availability and mobility across sites that are in private cloud environments. By taking full advantage of the encapsulation and isolation of virtual machines, Site Recovery Manager enables simplified automation of disaster recovery to meet recovery time objectives (RTOs). SRM also helps reduce costs that are associated with business continuity plans, and achieve low-risk, predictable results for recovery of a virtual environment.

The following user interfaces are available for VMware SRM.



* vCenter Clients
* VMware API
* VMware CLI





 VMware SRM features: 

VMeare SRM offers the following features.



* Nondisruptive recovery testing
A private catalog provides a way for you to manage access to products for multiple accounts while those accounts are within the same enterprise. You can share any existing x86 virtual server custom image with a private catalog, except for an encrypted image. For more information about these limitations, see [VPC considerations when using custom images in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-custom-image-cloud-private-catalog&interface=api).

Any private catalog images available to your VPC can be found in Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images > Catalog images

To create a virtual server using a private catalog image, see one of the following:



* [Creating a virtual server instance with the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=uicreating-virtual-servers-ui)
* [Creating a virtual server instance with the CLI - provision with a private catalog image](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=cliinstance-create-from-private-catalog-image-cli)
* [Creating a virtual server instance with the API - provision with a private catalog image](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=apicreate-instance-private-catalog-image-api)
* [Creating an instance using Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=terraformcreate-instance-using-terraform)
Both PCI and VLAN interfaces can be attached to a VPC security group, and security group rules can be applied to these interfaces. Also, VPC ACLs can be used to control inbound and outbound traffic for a subnet to which these PCI and VLAN interfaces are attached.

For more information about the networking concepts, see [Networking overview for IBM Cloud Bare Metal Servers on VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-network).





 Storage design 

Physical storage design consists of configuring the disks that are locally attached to the IBM Cloud bare metal server and configuring the shared network-attached storage.

The disks attached to the physical hosts include the operating system (vSphere ESXi) and a variable number of extra disks. These SSDs can be used, for example, to virtualize storage with VMware vSAN, with which you can create a software-defined virtual storage of these locally attached SSDs.

With this architecture, you can use either VMware vSAN or shared network-attached storage that is provided by IBM Cloud VPC as the data store options for the hosted VMs. While shared storage for VMs isn't a prerequisite for VMware environments, a shared storage device provides many benefits for IT operations. Using shared storage devices can help you achieve high availability, distributed resource scheduler, efficient use of storage capacity, and simplified management through enabling the vSphere functions.



 Operating system disks 

The vSphere ESXi hypervisor is installed in a persistent location in IBM Cloud VPC. Each bare metal server or ESXi host employs at minimum two locally attached SATA M.2 mirrored drives that are allocated to the vSphere ESXi hypervisor.

You do not need to configure RAID for M.2 mirrored drives. The configuration is provided as part of the bare metal server provisioning.





 vSAN disks 

When provisioning a server for vSAN, select it from a profile, which includes the additional U.2 NVMe SSDs to match the required vSAN storage size.
Some network infrastructure and certain key resources are costly and require lengthly lead times and manual labor to set up. These resources benefit from enterprise-level centralization to avoid the costs and delays that would be incurred if deployed at an account level. These needs must be balanced against the desire for separation of concerns and blast radius reduction.





 Hyper Protect Crypto Services 

Hyper Protect Crypto Services (HPCS) instances are centrally located so they can be shared across the enterprise to reduce costs. Two instances are required to reach the scale requirements of this recommendation. Smaller organizations can start with a single instance and grow as needed. When services are provisioned in workload accounts, service to service policies (in the network and services hub account) enable those services to access HPCS.





 Centralized network services 

A Transit Gateway in the network and services hub account connects all VPCs in the environment to each other with private networking. This unified private network is then linked to the corporate network through Direct Link. Network isolation is achieved within this flat network through VPC security groups and network ACLs. For more detailed recommendations on securely configuring VPC networking, see [Financial Services Cloud Networking](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview).

Make sure that VPC network addresses do not overlap across the enterprise.

A firewall might be deployed in this account or within the corporate network to ensure that traffic from the production environment cannot reach the development environment.

Virtual Private Endpoints (VPE) for shared IBM Cloud services are configured within a VPC in the network and services hub account as VPEs might be attached at only one point in the flat address space. This VPC also includes a custom DNS resolver to ensure the centralized VPEs are properly DNS resolved from all VPCs in the environment.

Some details on how VPEs should be centralized are still being worked out. This document will be updated when that information is available.
For more information, see [About network interfaces](https://cloud.ibm.com/docs/vpc?topic=vpc-using-instance-vnicsabout-network-interfaces). 



5. For Advanced options, you can choose to complete more instance configurations.



Table 4. Instance provisioning advanced options selections

 Field Value 

 User data You can add user data that automatically performs common configuration tasks or runs scripts. For more information, see [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data). For more information about using a contract to specify user data when you create an IBM Cloud® Hyper Protect Virtual Server for IBM Cloud® Virtual Private Cloud instance, see [About the contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_se). User data is not supported for z/OS virtual server instances. 
 Metadata Disabled by default. Click the toggle to enable. This setting informs the instance to collect the instance configuration information and user data. For more information, see [About instance metadata for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-about). Metadata isn't supported for IBM Cloud® Hyper Protect Virtual Server for IBM Cloud® Virtual Private Cloud instances and z/OS virtual server instances. 
 Trusted profile (optional) If you enable the metadata service, you can select a trusted profile and link it to this instance. Click Select a trusted profile. In the side panel, select a trusted profile and click Select trusted profile to link it to the instance. A message displays if none exist or if you don't have access to link it. For more information, see [Create a trusted profile](https://cloud.ibm.com/docs/account?topic=account-trustedprofile-compute-tutorialtrusted-profile-compute-create).
To enable your VPC to connect securely to another private network, such as your on-premises network or another VPC, create a virtual private network (VPN).







 Next steps 

To learn how to create VPC resources, see these tutorials:



* [Using the IBM Cloud console to create VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console)
* [Creating VPC resources with CLI and API](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli)
* [Using Terraform: Provisioning a virtual server instance in a VPC](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-sample_vpc_config)



For a general overview of the VPC infrastructure and related compute, networking and storage concepts, see the following topics:



* [VPC overview](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpcabout-vpc)
* [About networking for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc)
* [About virtual server instances for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers)
* [About storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about)
* [Understanding IaaS basics](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-getting-started-tutorial)
* [IBM Cloud monitoring services](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-monitoring-iaas)
About Veeam 

You can use Veeam software to back up your storage data on a virtual server instance for IBM Cloud® Virtual Private Cloud.

You can use Veeam software backups to protect the following resources:



*  Individual volumes,
*  Folders and files.



The Veeam Agent for Linux® and the Veeam Agent for Microsoft® Windows® provides a stand-alone ability to do backups and restores for storage that is attached to individual virtual server instances. Additionally, with the Veeam Backup and Replication tool for Microsoft® Windows®, you can manage backup for multiple Linux® and Microsoft® Windows® virtual server instances through a single interface.



  Next steps 



*  [Ordering Veeam licenses](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-veeam-licenses)
*  [Using Veeam Agent](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-agent)
*  [Using Veeam Backup and Replication software](https://cloud.ibm.com/docs/vpc?topic=vpc-using-veeam-backup-replication-software)
Private network configuration when using agents 

The following diagram illustrates a possible agent deployment model on a cluster in an environment with multiple VPCs connected via a transit gateway. Here an agent, running Terraform and Ansible jobs, has direct access to cloud resources over the private cloud network. In this deployment model, your Terraform or Ansible automations' can directly configure your cloud resources using SSH, without the need for bastion hosts to gain access via the public network.

Zoom

![Schematics Agents connectivity](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/sc-agents-network.svg)

Schematics Agents connectivity

With agents you are in control of the network security policies of the Kubernetes cluster and any VPC Security Group or Access Control List policies for the running agent and therefore the ability of the Terraform and Ansible automations’ to access to your private cloud resources.





 Benefits of using Agents 

IBM Cloud® Schematics is a multi-tenant service supporting concurrent usage by a large number of users. The multi-tenant model imposes a number of restrictions to maintain fair usage across all users and maintain network isolation between users.

The following are some of the benefits of using agents with the IBM Cloud® Schematics service:



* Agent extends the benefits of using [Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-learn-about-schematics) in conjunction with [IBM Cloud Satellite®](https://cloud.ibm.com/docs/satellite?topic=satellite-getting-started): To provision and configure hybrid cloud resources, including private cloud resources, private data-center resources, and other public cloud resources.
VPE is an evolution of the private connectivity to IBM Cloud services. VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud.







 Networking - Interconnectivity 



 IBM Cloud Direct Link 

Use [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about) to seamlessly connect your on-premises resources to your cloud resources. The speed and reliability of Direct Link extends your organization’s data center network and offers more consistent, higher-throughput connectivity, keeping traffic within the IBM Cloud network. Direct Link is the most secure way to enable connectivity from on-premises environments to IBM Cloud.

Direct Link is required if not using Virtual Private Network (VPN) for VPC (see next section).





 IBM Cloud Transit Gateway 

As the number of your VPCs grow, you need an easy way to manage the interconnection between these resources across multiple regions. [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-about) is designed specifically for this purpose, and is the means for connecting your management VPC to your workload VPC.







 Storage 



 Block Storage for VPC 

[Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about) provides hypervisor-mounted, high-performance data storage for your virtual server instances that you can provision within a VPC. The VPC infrastructure provides rapid scaling across zones and extra performance and security.

Block Storage for VPC provides primary boot volumes and secondary data volumes. Boot volumes are automatically created and attached during instance provisioning.
When you create a VPC cluster and enable both the public and private cloud service endpoints during cluster creation, the public cloud service endpoint is used by default for access to components such as the Red Hat OpenShift web console for your cluster. In order for console pods to establish a secure, public connection over the internet through the public service endpoint, you must enable a public gateway on each VPC subnet that your worker nodes are deployed to.

When you create a VPC cluster and enable only the private cloud service endpoint during cluster creation, the private cloud service endpoint is used by default to access Red Hat OpenShift components such as the Red Hat OpenShift web console or OperatorHub. You must be connected to the private VPC network, such as through a VPN connection, to access these components or run kubectl commands on your cluster. Also, if an IBM Cloud service does not support private cloud service endpoints, your worker nodes must be connected to a subnet that has a public gateway attached to it. The pods on those worker nodes can securely communicate with the services over the public network through the subnet's public gateway. Note that a public gateway is not required on your subnets to allow inbound network traffic from the internet to LoadBalancer services or ALBs.

Within one VPC, you can create only one public gateway per zone, but that public gateway can be attached to multiple subnets within the zone. For more information about public gateways, see the [Networking for VPC documentation](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcpublic-gateway-for-external-connectivity).





 Virtual private endpoints (VPE) 

Worker nodes can communicate with the Kubernetes master through the cluster's [virtual private endpoint (VPE)](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).

A VPE is a virtual IP address that is bound to an endpoint gateway. One VPE gateway resource is created per cluster in your VPC.
Because a dedicated host is a single-tenant space, only users within your account that have the required permissions can create instances on the host.

See [Creating dedicated hosts and groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances) for more details.





 Red Hat OpenShift on IBM Cloud 

You can also use Red Hat OpenShift on IBM Cloud to run applications. It is also backed by virtual server instances, but, in that case, the virtual service instances are managed by IBM.

See [VPC reference architecture with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-openshift) for more details.







 Storage 

Block Storage for VPC provides hypervisor-mounted, high-performance data storage for your virtual server instances (instances) that you can provision within an IBM Cloud® Virtual Private Cloud (VPC). The VPC infrastructure provides rapid scaling across zones and extra performance and security.

Block Storage for VPC provides primary boot volumes and secondary data volumes. Boot volumes are automatically created and attached during instance provisioning. Data volumes can be created and attached during instance provisioning as well, or as stand-alone volumes that you can later attach to an instance. To protect your data, you can use your own encryption keys with Hyper Protect Crypto Services.

See [About Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about) for more details.





 Next steps 



* Take a deeper look at the [VPC reference architecture with virtual servers](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsi).
[Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at-eventsat-events-kmip) 







 VPC services 

You can provision a Virtual Private Cloud (VPC) in the IBM Cloud to run an isolated environment within the public cloud. VPC gives you the security of a private cloud, with the agility and ease of a public cloud. See [IBM Cloud® Virtual Private Cloud Gen 2](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

The following table lists VPC infrastructure services that send auditing events:



Table 16. List of VPC infrastructure services (generation 2)

 Service Service name Activity Tracker hosted event search offering Events 

 [Storage resources](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about) is.volume ![Checkmark](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker//images/checkmark-icon.svg) [Location-based events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-storage) 
 [Compute resources](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers) is.instance !