vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Add-on services 

When you order a VMware vCenter Server® instance, you can also order add-on services. Review services that are recommended and optional with your vCenter Server instance.



 Recommended services 

The following services are recommended with your vCenter Server instance. The recommended add-on services require configuration setup.



* [Veeam Backup and Replication](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
* [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations)







 Optional services 

Optionally, you can choose to install the following services:



* [VMware HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
* [Zerto](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-addingzertodr)
* [Entrust CloudControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
* [FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations)
* [Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview)
* [Red Hat OpenShift for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overview)
Hyper Protect Virtual Servers does not provide any backup functions for your virtual server instances. If you require backup capabilities, you need to configure your virtual server backup in your own responsibility.
* What is the purpose of the internal IP address?

You must use the internal IP address when you connect to a virtual server from another virtual server, which is in the same virtual LAN (VLAN).
* How do I provide my applications in high availability?

Do not rely on just one virtual server instance. Instead, run your application on multiple instances in combination with a load balancer to ensure high availability.

Ideally, these virtual servers are spread across multiple regions and data centers. With Hyper Protect Virtual Servers, virtual servers are provided within three regions (us-south, eu-de, au-syd) and nine data centers (Dallas 10, Dallas 12, Dallas 13, Frankfurt 02, Frankfurt 04, Frankfurt 05,Sydney 01, Sydney 04, Sydney 05, Washington 04, Washington 06, and Washington 07).
* Can I have more than five virtual servers within one data center?

Currently, Hyper Protect Virtual Servers supports only five virtual server instances per account in each data center. To provision more instances, you can use multiple accounts or data centers, or both.
* Is a virtual server available 24 / 7?

The virtual server is running on infrastructure that needs to be maintained. Before maintenance, stop the virtual servers. You are notified about maintenance schedules in advance. Service availability is defined within the [IBM Cloud® Service Description](https://www-03.ibm.com/software/sla/sladb.nsf/pdf/6605-17/$file/i126-6605-17_06-2019_en_US.pdf).
* Does the data center have an impact on performance and reliability of a virtual server?

No, all of the data centers are of the same quality. For best availability, follow the hints in question [How do I provide my applications in high availability?](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-faqsfaq3).
* How can I figure out in which data center a virtual server is located?
The server is attached to the application-network-1. You can access the virtual machine though the VM console, or using RDP though the DNAT rule created on the Edge Gateway.
6. One example virtual machine (application-server-1) is created on the application-network-1. The application-server-1 has an additional disk e.g. for logging. You can create more VMs or disks based on your needs.
7. One example virtual machine (db-server-1) is created on the db-network-1 and isolated-network-1 with two separate vnics. The db-server-1 has two additional disks e.g. for data and logging. You can create more VMs or disks based on your needs.
8. Source NAT (SNAT) and destination NAT (DNAT) rules are created for public network access. SNAT to public internet is configured for all routed networks and DNAT is configured to access the application server.
9. Firewall rules are provisioned to secure network access to the environment. To create firewall rules, Static Groups and IP Sets are created for networks and individual IP addresses.



This tutorial is divided into the following steps:



1. [Clone examples repo](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vmware-as-a-service-tfvmware-as-a-service-tf-clonerepo)
2. [Obtain the required information about your virtual data center](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vmware-as-a-service-tfvmware-as-a-service-tf-vdcinfo)
3. [Configure Terraform template variables](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vmware-as-a-service-tfvmware-as-a-service-tf-tfvars)
4.
Services 

Review services that are included with or optional for your VMware® Regulated Workloads.



 Included services 

The following services are included with your Regulated Workloads instance. Some of the included add-on services require configuration setup.



* [Veeam Backup and Replication](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
* [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations)
* [Entrust CloudControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-entrust-cc_considerations)
* [Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview), if you're using Gateway cluster with Juniper vSRX as your firewall appliance
* [FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations), if you're using Gateway cluster with FortiGate Virtual Appliance as your firewall appliance
* [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview)







 Optional services 

You can choose to install the following services:



* [VMware HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations). This service is available if you select to deploy a separate workload cluster.
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)
It doesn't include client metadata, the information that is used by IBM to provide services to the customer and support and operate the client account, services, and resources that are always considered to be shared responsibility between client and IBM.

Applications
: Customer-owned software components, such as executables, web applications, middleware, frameworks, libraries, and other software packages that the client developed or acquired by third parties and deployed in IBM Cloud.

Service instance
: An entity that consists of resources that are reserved for a particular service.

Operating systems
: The operating system software and configuration that are deployed in virtual or bare metal servers, such as Linux, Windows, or similar to the ones provided in [stock images](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images).

Virtual and bare metal servers
: The virtual or bare metal servers that are ordered and managed through IBM Cloud services.

Virtual storage
: The block, file, or Object Storage buckets ordered and managed through IBM Cloud.

Virtual network
: Network resources such as VLAN, VPC, subnets, or IPs provided by [classic infrastructure](https://cloud.ibm.com/docs/vlans?topic=vlans-getting-started) and [VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc) services that are ordered and managed through IBM Cloud.

Hypervisor
: The software and configuration that is deployed in physical servers to host and manage the lifecycle of virtual servers.

Physical servers and memory
: The physical compute devices and resources, such as cores, memory, and GPUs used to host the virtual or bare metal servers.

Physical storage
: The physical storage devices and resources, such as disks and storage devices that are used to host the virtual block, file, or Object Storage buckets.

Physical network and devices
: The physical network devices and resources, such as switches, routers, gateways, firewalls, and load balancers that are used to host the virtual network resources.

Facilities and data centers
: The physical data center buildings with power, cooling, and rooms for all the IBM Cloud physical equipment.
VMware as a Service overview 

IBM Cloud® for VMware as a Service provides the VMware Cloud Director™ platform as a managed service. IBM® performs the configuration, hosting, operations, and lifecycle management of the VMware® software so you can quickly deploy your VMware-based cloud computing environments.

Compute resources are available as dedicated hosts, by using IBM Cloud bare metal servers, with multiple host configurations available to address various workload requirements.

Zoom

![VMware as a Service architecture](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/vmware-service/images/vmware-aas-archi.svg)

Figure 1. VMware as a Service architecture



 VMware as a Service features and functions 

The VMware as a Service offering has the following features:



* VMware stack management up to the hypervisor level



* IBM-managed infrastructure
* IBM-managed VMware components and services



* Dedicated hosts and multiple host profiles for creating VMware vCenter clusters
* Multiple performance options for attached vSAN™ and Network File Storage (NFS v3)
* Optional data protection through the Veeam® Backup and Replication service
* Monthly billing
* Unique provider-managed encryption keys per instance with encrypted VMware storage profiles
* Single sign-on (SSO) with role-based authentication and authorization from IBM Cloud IAM (Identity and Access Management) to VMware Cloud Director
* Improved provisioning speed, availability, and resilience
* Regional-level High Availability through creating VMware Cloud Director provider virtual data centers (PVDCs) and vCenter clusters in multiple data centers in the same region.
* Full compatibility to run existing VMware workloads. Migration of existing IBM Cloud, on-premises or other workloads are fully supported.
* Each VMware as a Service instance contains the following VMware components:



* Dedicated VMware ESXi™ hosts
* Dedicated VMware vCenter
Veeam technologies used in the sandbox 

The following Veeam® technologies are discussed as:



* Veeam vPower NFS service.
* Veeam data integration API.





 Veeam vPower NFS service 

The virtual machines (VMs) that start with Instant VM Recovery, the vPower NFS service is used as a conduit to the backup files. The ESXi host uses NFS to connect to the service. vPower NFS service runs as a Windows® based service and runs on the Veeam backup server by default. However, it can be added to any Veeam managed Windows server. It cannot run on a Linux® server. For Linux-based repositories, it is recommended to configure vPower NFS on a managed Windows system as close as possible to the Linux repository.

The vPower NFS server is bound to a backup repository and the folder location is defined per server and can be changed through the mount server settings.

The ports that are used for this service are described in the following table:



Table 1. Used ports

 Source Destination Protocol Port Description 

 ESXi host Microsoft Windows server that runs vPower NFS Service TCP/UDP 111 Standard port used by the port mapper service. 
 ESXi host Microsoft Windows server that runs vPower NFS Service TCP/UDP 1058 Mount acceptor port of Power NFS service. 
 ESXi host Microsoft Windows server that runs vPower NFS Service TCP/UDP 2049 NFS acceptor port of Power NFS service. 



The following diagram shows the communication flow for the vPower NFS service.

Zoom

![Veeam vPower NFS](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/veeam-cr-sa-lhbr-vpwr.svg)

Figure 1. Veeam vPower NFS





 Veeam Data Integration API
internet-svcs.edge-functions-routes.create Create an edge functions route. 
 internet-svcs.edge-functions-routes.update Update an edge functions route. 
 internet-svcs.edge-functions-routes.delete Delete an edge functions route. 







 List of events: Range applications 

The following table lists the actions that are related to range applications and generate an event:



Table 13. Actions that generate range events

 Action Description 

 internet-svcs.range-apps.create Create a range application. 
 internet-svcs.range-apps.update Update a range application. 
 internet-svcs.range-apps.delete Delete a range application. 







 List of events: Logpush 

The following table lists the actions that are related to Logpush and generate an event:



Table 14. Actions that generate logpush events

 Action Description 

 internet-svcs.logpush-ownership.create Initiate logpush ownership challenge. 
 internet-svcs.logpush-ownership-validate.create Validate logpush ownership challenge. 
 internet-svcs.logpush-jobs.create Create a logpush job. 
 internet-svcs.logpush-jobs.update Update a logpush job. 
 internet-svcs.logpush-jobs.delete Delete a logpush job. 







 List of events: Custom error pages 

The following table lists the actions that are related to custom error pages and generate an event:



Table 15. Actions that generate custom error page events

 Action Description 

 internet-svcs.custom-pages.create Create a custom error page. 
 internet-svcs.custom-pages.update Update a custom error page. 







 List of events: Settings 

The following table lists the actions that are related to configuring settings and generate an event:



Table 16. Actions that generate settings events

 Action Description 

 internet-svcs.cache-level-setting.update Change caching level. 
 internet-svcs.browser-cache-ttl-setting.update Change browser cache TTL. 
 internet-svcs.development-mode-setting.update Enable or disable development mode.
: The physical storage devices and resources, such as disks and storage devices that are used to host the virtual block, file, or Object Storage buckets.

Physical network and devices
: The physical network devices and resources, such as switches, routers, gateways, firewalls, and load balancers that are used to host the virtual network resources.

Facilities and data centers
: The physical data center buildings with power, cooling, and rooms for all the IBM Cloud physical equipment.

IBM Cloud supports the following types of products and the corresponding shared responsibility models. For more information about each specific service, see the documentation for that service.



 Infrastructure-as-a-service 

Infrastructure-as-a-service (IaaS) products that are managed by IBM are multi-tenant, accessed remotely, hosted on IBM physical infrastructure, created in customer-owned accounts, and have control plane and data plane security that is owned by IBM. Examples of this product type are Virtual Servers and Bare Metal Servers with the related block volumes that are connected to the customer account private subnets. You can find a list of these types of products in the IBM Cloud catalog on the Services tab. Each product is in an infrastructure subcategory within the Compute or VPC infrastructure categories.



Table 1. Shared responsibilities for IaaS products

 Resource Incident and Operations Management Change Management Identity and Access Management Security and Regulation Compliance Disaster Recovery 

 Data Customer Customer Customer Customer Customer 
 Application Customer Customer Customer Customer Customer 
 Operating system Customer Customer Customer Customer Customer 
 Virtual and bare metal servers Shared Shared Shared Shared Shared 
 Virtual storage Shared Shared Shared Shared Shared 
 Virtual network Shared Shared Shared Shared Shared 
 Hypervisor IBM IBM IBM IBM IBM 
 Physical servers and memory IBM IBM Shared Shared IBM 
 Physical storage IBM IBM IBM IBM IBM 
 Physical network and devices IBM IBM IBM IBM IBM 
 Facilities and data centers IBM IBM IBM IBM IBM 



For areas marked as shared responsibilities, the customer is responsible for all the configurations, and IBM is responsible for all underlying management. For disaster recover, the customer is responsible for creating resources in a secondary region and managing the application and data disaster recovery.





 Managed products 

Products that are managed by IBM require customer responsibilities only for the data or applications that customers add to the service.
Configuring security groups 

The Virtual Network Function (VNF) data network interface is attached to a VPC security group. Ensure that the security group has inbound rules that allow traffic on the pool health port that is set up between the NLB and the VNF. For example, if the health check is set up for TCP on port 80 (HTTP), then create an inbound rule for that security group. Additionally, you can create rules to allow or restrict data traffic.



  Next step 

[Deploying a supported VNF](https://cloud.ibm.com/docs/vpc?topic=vpc-deploy-vnf)
For more information about VPC prefixes and about creating prefixes, see [Bring your own subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes).







 Network services provided by Tier-0 and Tier-1 logical routers 

NSX-T Data Center supports network services such as IPsec Virtual Private Network (IPsec VPN), Network Address Translation (NAT) and Firewalls as shown in the following diagram.

Zoom

![Network Services provided by Tier-0 and Tier-1 Logical Routers](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-nsx-t-edge-services.svg)

Figure 4. Network Services provided by Tier-0 and Tier-1 Logical Routers

This topic gives a brief introduction to these capabilities and how they can be used in IBM Cloud VPC.



 VPN services 

IPsec Virtual Private Network (IPsec VPN) and Layer 2 VPN (L2 VPN) run on an NSX Edge node. IPsec VPN offers site-to-site connectivity between an NSX Edge node and remote sites. With L2 VPN, you can extend your data center by enabling virtual machines (VMs) to keep their network connectivity across geographical boundaries while using the same IP address.

When you configure NSX-T VPN service in IBM Cloud VPC, you can use the public /32 floating IP addresses as the VPN Endpoints both Tier-0 and Tier-1 Logical Routers. You can have multiple VPN endpoints, if needed. When VPN service is configured on Tier-1 Logical Router, ensure that the floating IP is correctly advertised between Tier-0 and Tier-1 Logical Routers.
You can use the service access roles to define what users can do with Power Systems Virtual Server functions. The following table displays the IAM service access roles and the corresponding actions a user can complete with Power Systems Virtual Server:



Table 2. IAM service access roles

 Service access role Description of actions 

 Reader View all resources (such as SSH keys, storage volumes, and network settings). You cannot make any changes to the resources. 
 Manager You can configure all resources. The following are some of the actions you can perform:<br><br><br><br> * Create instances<br> * Increase storage volume sizes<br> * Create SSH keys<br> * Modify network settings<br> * Create boot images<br> * Delete storage volumes<br><br><br> 







 Access roles requirements for Power System Virtual Server 

Power Systems Virtual Server requires additional access for features such as Direct Link, Transit Gateway service, Virtual Private Cloud, and so on. You may require additional access based on your resource requirements. For example, to create a Cloud connection you will need Editor access to Direct Link service.

The following table displays the additional access roles required for the corresponding type of services that is allowed by Power Systems Virtual Server:



Table 3. Additional access roles

 Additional access role Resources Attributes 

 Editor, Manager, Operator, Reader, Viewer Power Systems Virtual Server service 
 Editor, Manager, Operator, Reader, Viewer, VPN Client VPC Infrastructure Services service 
 Editor, Operator, Viewer Transit Gateway service 
 Reader, Viewer All resources in account (Including future IAM enabled services) 
 Editor, Operator, Viewer Direct Link service 
 Viewer All resource group 







 User access scenarios 

See [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) for information on how to manage or assign access by using IAM policies.
Network topology: A VPN client can access a virtual server instance within a deployed MZR through the VPN server





 Use case 2: A VPN client can access the internet through the VPN server 

When the administrator enforces the VPN server in full-tunnel mode, all traffic from customer devices is sent to the VPN server, including internet traffic. The VPN server forwards the internet traffic to the IBM Cloud infrastructure Edge node and finally reaches the internet.

Zoom

![Network topology: A VPN client can access the internet through the VPN server](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-connect-to-internet.png)

Figure 3. Network topology: A VPN client can access the internet through the VPN server





 Use case 3: Integrating with a transit gateway 

Generally, it is recommended to provision VPC resources in multiple regions for redundancy. To access the resources in all regions from personal devices, one approach is to create one client-to-site VPN server per VPC, per region, and establish the VPN connection to all VPN servers. You must also maintain multiple VPN servers with this approach. This might be an inconvenience, but it is a more secure method. Another approach is to use a transit gateway to connect all these VPCs. As a result, only one VPN server is required to access the VPCs.

Zoom

![Network topology: Integrating with a transit gateway](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-server-use-case-tgw-integration.png)

Figure 4. Network topology: Integrating with a transit gateway