vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Operating VMware Shared 



 VMware Cloud Director tenant portal overview 

The VMware® Cloud Director tenant portal is used for administration of your organization and to create and configure virtual machines (VMs), vApps, and networks within vApps.

You can also configure advanced networking capabilities that are provided by VMware NSX® for vSphere® within a VMware Cloud Director environment. With the tenant portal, you can also create and manage catalogs, vApps, and virtual data center templates.



 Roles, permissions, and users 

The tenant portal includes a preconfigured set of user roles and their privileges. The roles that can access the tenant portal are created by default when an organization is created along with other roles that are created by the organization administrator. Users who are assigned the following organization roles can access the tenant portal. The objects that they see and the actions that they can take depend on the privileges that are associated with a role.



* Organization Administrator
* Catalog Author
* vApp Author
* vApp User
* Console Access Only



For more information about roles and permissions, see [VMware Cloud Director tenant portal roles and rights](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-754BD24F-63C7-422F-83BC-BFA275CEDA8E.html).



 Managing users 

Use the tenant portal to create a user or change passwords or roles for an existing user. For more information about accessing the tenant portal, see [Log in to the VMware Cloud Director tenant portal](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-28972197-D45B-4156-A733-5966730B5E03.html).
About networking 

IBM Cloud® Virtual Private Cloud (VPC) is a virtual network that is linked to your customer account. It gives you cloud security, with the ability to scale dynamically, by providing fine-grained control over your virtual infrastructure and your network traffic segmentation.



 Overview 

Each VPC is deployed to a single region. Within that region, the VPC can span multiple zones.

Subnets in your VPC can connect to the public internet through an optional public gateway. You can assign floating IP addresses to any virtual server instance to enable it to be reachable from the internet, independent of whether its subnet is attached to a public gateway.

Subnets within the VPC offer private connectivity; they can talk to each other over a private link through the implicit router. Setting up routes is not necessary. Figure 1 shows how you can subdivide a virtual private cloud with subnets and each subnet can reach the public internet.

Zoom

![Figure showing how a VPC can be subdivided with subnets](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpc-experience-simple.svg)

Figure 1. IBM VPC connectivity and security





 Terminology 

To work with your VPC, review the basic concepts of region and zone as they apply to your deployment.



 Regions 

A region is an abstraction that is related to the geographic area in which a VPC is deployed. Each region contains multiple zones, which represent independent fault domains. A VPC can span multiple zones within its assigned region.





 Zones 

A zone is an abstraction that refers to the physical data center that hosts the compute, network, and storage resources, plus the related cooling and power, which provides services and applications. Zones are isolated from each other to create no shared single point of failure, improved fault tolerance, and reduced latency. Each zone is assigned a default address prefix, which specifies the address range in which subnets can be created.
* The customer VRF is a connectivity service that provides isolation among tenants. Any additional controls that are needed within a tenancy must be provisioned separately by using a gateway, security groups, or host-based controls.







 Benefits of moving to VRF 

Moving to VRF includes the following primary benefits:



* Industry-proven and widely accepted multiple isolation separation technologies. Many cloud customers find the Level-3 VPN approach more palatable than ACLs to their auditors and compliance officers.
* IBM Cloud customers can extend or migrate the reach of their network significantly, due to addition of new sites or applications throughout the IBM network.
* Tenant-specific routing tables narrow the aperture for IP address overlap, without the risk of overlap with other tenants' subnets or other parts of the network that are not applicable.



Compared to the older ACL model, there are a few minor tradeoffs to take into account:



* Converting to a customer VRF requires a maintenance window, which causes a brief disruption of backbone traffic flows.
* Remote access by using the managed VPN services (SSL, IPsec) is limited to just SSL VPN into a data center; however, the shared ACL over the backbone allows global access from any entry point from either service.
* VLAN spanning is a feature of the shared tenancy model and is not available in a VRF; this will be disabled upon conversion to the Customer VRF.
* IPsec VPN managed service on IBM Cloud classic infrastructure remote access is not available.



Many IBM Cloud customers currently operate with a shared tenancy model on the IBM Cloud network. During conversion, your shared tenancy is converted to use a customer VRF, most commonly with a new Direct Link subscription.

For specific information about how to initiate a VRF conversion for your account, refer to the conversion instructions for your IBM Cloud offering. For example:



* [Direct Link conversion instructions](https://cloud.ibm.com/docs/direct-link?topic=direct-link-what-happens-during-the-account-conversion-process)
Parallels Virtuozzo Containers 4.0 quick reference guide 

Use this information to find Virtuozzo container utilities and common terms.



 General utilities 

General utilities are for day-to-day maintenance tasks.



Table 1. General utilities

 General Utilities 

 vzctl Utility to control Containers. 
 vzlist Utility to view a list of Containers existing on the Node with additional information. 
 vzquota Utility to control Virtuozzo Containers disk quotas. 







 Licensing utilities 

Licensing utilities are used to install a new license, view the license state, or generate a license request for a new license.



Table 2. Licensing utilities

 Licensing Utilities 

 vzlicview Utility to display the Virtuozzo license status and parameters. 
 vzlicload Utility to manage Virtuozzo licenses on the Hardware Node. 
 vzlicupdate Utility to activate the Virtuozzo Containers installation, update the Virtuozzo licenses installed on the Hardware Node, or transfer the Virtuozzo license from the Source Node to the Destination Node. 







 Container migration utilities 

Container migration tools are used to migrate containers between hardware nodes or within one hardware node.



Table 3. Container migration utilities

 Container Migration Utilities 

 vzmigrate Utility for migrating containers from one hardware node to another. 
 vzmlocal Utility for the local cloning or moving of the containers. 
 vzp2v Utility to migrate a physical server to a container on the node. 
 vzv2p Utility to migrate a container to a physical server. 







 Container backup utilities 

Container backup utilities are used to back up and restore the container private areas, configuration files, action scripts, and quota information.



Table 4. Container backup utilities

 Container Backup Utilities 

 vzbackup Utility to back up Containers. 
 vzrestore Utility to restore backed up Containers. 
 vzabackup Utility to back up Hardware Nodes and their Containers. This utility requires the Parallels Agent software. 
 vzarestore Utility to restore backed up Hardware Nodes and Containers. This utility requires the Parallels Agent software. 







 Template management utilities 

Template management tools are used to create templates and to maintain and install applications into a container.



Table 5.
Fortinet FortiGate virtual machine (VM) overview 

IBM Cloud® for VMware Solutions offers various solutions to meet your network security requirements. The base offering includes VMware NSX–T™ for integrated virtual networking and security. More network security features are available with the FortiGate® VM offering, which provides Fortinet®’s next–generation firewall (NGFW) capabilities in the form of a highly available pair of virtual FortiGate appliances. In addition to the architecture for FortiGate VM, IBM Cloud® also offers a [FortiGate Security Appliance](https://cloud.ibm.com/docs/fortigate-10g) offering, which provides a perimeter firewall, NAT, and VPN services in the form of a physical appliance.

The solution is considered to be an extra component and extension of the VMware vCenter Server® offering on IBM Cloud. As a result, this document doesn’t cover the existing configuration of the foundation solutions on IBM Cloud. For more information about the foundation solution architecture, see [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview).



 Topologies 

You can deploy FortiGate VM according to several different strategies:



* FortiGate VM can be deployed as part of an ESXi™ gateway cluster that is directly integrated with the IBM Cloud customer routers. It provides firewall and gateway functions for your private and public IBM Cloud network VLANs.
* FortiGate VM can be deployed to your management and workload cluster. In this form, you can use FortiGate to provide firewall and gateway services between various networks. FortiGate VM provides controlled connectivity between:



* Public and private networks
* Private VLANs and NSX logical switches
* Several VMware NSX® logical switches





Additionally, FortiGate VM offers direct integration with NSX–T including service chaining and dynamic import of security groups.





 Key benefits 

Several licensing option bundles are available for FortiGate VM on IBM Cloud.



* Standard FW - This bundle includes the following services.



* Stateful packet inspection
With L2 VPN, you can extend your data center by enabling virtual machines (VMs) to keep their network connectivity across geographical boundaries while using the same IP address.

When you configure NSX-T VPN service in IBM Cloud VPC, you can use the public /32 floating IP addresses as the VPN Endpoints both Tier-0 and Tier-1 Logical Routers. You can have multiple VPN endpoints, if needed. When VPN service is configured on Tier-1 Logical Router, ensure that the floating IP is correctly advertised between Tier-0 and Tier-1 Logical Routers.

For more information on VPN service, see [VMware Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-A8B113EC-3D53-41A5-919E-78F1A3705F58.html).





 Network Address Translation 

Network Address Translation (NAT) is supported on Tier-0 and Tier-1 Logical Routers.

As example, the following types of NAT are supported.



* Source NAT (SNAT) translates a source IP address of outbound packets so that packets are shown as originating from a different network.
* Destination NAT (DNAT) translates the destination IP address of inbound packets so that packets are delivered to a target address into another network.



You can also disable SNAT or DNAT for an IP address or a range of addresses. If an address has multiple NAT rules, the rule with the highest priority is applied.

When configuring NSX-T NAT in IBM Cloud VPC, you can use the public /32 floating IP addresses as the public NAT IP addresses in both Tier-0 and Tier-1 Logical Routers. You can have multiple NAT IPs, if needed. When NAT is configured on Tier-1 Logical Router, ensure that the floating IP is correctly advertised between Tier-0 and Tier-1 Logical Routers.
More network bandwidth, storage capacity, OS, and third-party software are charged on an hourly or monthly basis, which depends on the instance type.
* Why do I need to choose hourly or monthly billing on the virtual server instance?

Your additional software, storage, and network selections need to be billed either hourly or monthly.
* What types of virtual servers are available for use?

IBM Cloud® offers a couple types of virtual servers within its Classic Infrastructure. The standard offering is a public-based virtual server, which is a multi-tenant environment that is suitable for various needs. If you're looking for a single-tenant environment, consider the dedicated virtual server offering. The dedicated virtual server option is ideal for applications with more stringent resource requirements. For more information about the current virtual server offerings, see [Getting started with virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-getting-started-tutorial).

IBM Cloud® Virtual Servers for Virtual Private Cloud (VPC) is the next generation of virtual servers. You create your own space in the IBM Cloud to run an isolated environment within the public cloud by using VPC. IBM Cloud VPC provides the security of a private cloud with the agility and ease of a public cloud. For more information, see [About virtual server instances for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-advanced-virtual-servers).
* Where can I find pricing information for public instance types?

For more information, see [Build your virtual server](https://www.ibm.com/cloud/virtual-servers).
* Where can I find pricing information for virtual public instances?

Estimating your cost for an IBM Cloud server to support your workload begins in the [IBM Cloud catalog](https://cloud.ibm.com/catalog). From the catalog, select Compute and choose the server type - Bare Metal Server, Virtual Server, or Virtual Server for VPC (Virtual Private Cloud). For more information, see the [Virtual servers provisioning calculator](https://www.ibm.com/cloud/virtual-servers/calculator/).
Virtualization 

You can use IBM Cloud® Virtualization to run multiple virtual machines in a single dedicated environment. Virtual machines that run on an IBM Cloud network can integrate with other physical and virtual devices that are on the network and are managed through both the IBM Cloud® console and API. For more information, see [Getting started with Virtualization](https://cloud.ibm.com/docs/virtualization?topic=Virtualization-getting-started).
Operator As an operator, you can view, list and restore block storage snapshots, but you can't modify them. 
 Viewer As a viewer, you can view and list block storage snapshots, but you can't modify them. 







 Subnet 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.subnet for the service name.

Platform roles

Actions



Table 99. Platform roles - Subnet
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Virtual Network Interface 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.virtual-network-interface for the service name.

Platform roles

Actions



Table 100. Platform roles - Virtual Network Interface
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As a Virtual Network Interface administrator, you can Read, List, Attach, Detach, Create, Update, and Delete Virtual Network resources on the account and provide policies to other users on the account. 
 Editor As a Virtual Network Interface editor, you can Read, List, Attach, Detach, Create, Update, and Delete Virtual Network resources.
* Network - create network resources such as DNS Services, Transit Gateway service, VPC and subnets.
* Shared - create VSI and block devices in the shared VPC. Create DNS records for shared services.
* Application1 - create VSI and block devices in the application1 VPC
* Application2 - create VSI and block devices in the application2 VPC.





 IAM Conceptual 



 Network Team 

A conceptual team ownership model was implemented. The network team administers all the network resources and hence most of what is shown in the diagram.

Zoom

![Architecture focusing on the Network team](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/network.png)

Architecture focusing on the Network team





 Shared Team 

The shared team creates the VSI in its isolated VPC. In addition, the team needs to write records into the DNS service since the IP addresses of the VSIs are determined at creation time. Operator access to the VPC, subnets and security groups are required to create a VSI.

Zoom

![Architecture focusing on the Shared team](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/solution-tutorials/includes/solution-tutorials/images/solution59-vpc-tg-dns-iam/shared.png)

Architecture focusing on the Shared team

The application teams needs the same access as the shared team except manager access to the DNS Services.

Application team access:

Zoom

!
Convert your IBM Cloud account to use [Virtual routing and forwarding (VRF) on IBM Cloud](https://cloud.ibm.com/docs/direct-link?topic=direct-link-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud), using the steps described in [Converting to virtual routing and forwarding](https://cloud.ibm.com/docs/direct-link?topic=direct-link-what-happens-during-the-account-conversion-process).

Enabling VRF permanently alters networking for your IBM Cloud account. Be sure that you have understood both the benefits and minor tradeoffs, which impact your account and resources. After you enable VRF, it cannot be disabled.
3. Enable the Cloud Service Endpoints (CSE) to provide a secure and unmetered connection to services on IBM Cloud from the IBM Cloud Classic Infrastructure private network. Follow the steps in [enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).

This is not the same as Virtual Private Endpoints (VPE), which is the upgraded equivalent functionality for IBM Cloud VPC Infrastructure environment; this has more benefits that include IAM access control, endpoint with IP in the Subnet Range of the VPC, and does not require Virtual routing and forwarding (VRF).







 Provisioning your VMware Software-Defined Datacenter 

The IBM Cloud® console requires a unique log-in ID, which is an IBMid. Use the following steps to order your IBM Cloud for VMware Solutions Dedicated. Additional information can be found under [Ordering IBM Cloud for VMware Dedicated, vCenter Server instance and vSphere clusters](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_orderinginstance).



1. Log in to the [IBM Cloud console](https://cloud.ibm.com) with your unique credentials.
2.
SC-3 - Security Function Isolation 



  Control requirements 

SC-3 - 0
:   The information system isolates security functions from nonsecurity functions.





  Additional IBM Cloud for Financial Services specifications 



*  This control is required for ISVs.







  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs)







  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether at least # Virtual Private Cloud (VPC)s have been created
*  Check whether at least # instances of Transit Gateway have been created







  NIST supplemental guidance 

The information system isolates security functions from nonsecurity functions by means of an isolation boundary (implemented via partitions and domains). Such isolation controls access to and protects the integrity of the hardware, software, and firmware that perform those security functions. Information systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including, for example, through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk, and address space protections that protect executing code. Information systems restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities. While the ideal is for all of the code within the security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions within the isolation boundary as an exception.
Offering comparison chart 

Review the following information to understand the differences in feature support between the various IBM Cloud® for VMware Solutions offerings.



 vCenter Server vs VMware vSphere 

Review the following table to understand the differences in feature support for VMware vCenter Server® instances and VMware vSphere® clusters.



Table 1. Supported functions for vCenter Server instances and VMware vSphere instances

 Feature vCenter Server VMware vSphere 

 Powered by IBM® advanced automation<br><br>[1] Yes No. Self-built and configured. 
 Storage options NFS or vSAN™ available with automation. <br>iSCSI available with manual configuration. NFS, vSAN, or iSCSI available with manual configuration 
 Number of ESXi™ servers in the initial cluster For vSAN, four servers. <br> <br>For NSX-T instances with an NFS cluster: <br>(1) Consolidated NFS clusters require at least three ESXi servers. <br>(2) Management NFS clusters require at least three ESXi servers. <br>(3) All other NFS clusters require at least two ESXi servers. No limitation. One or more ESXi servers as allowed on the console. For example, you can deploy a three node vSAN cluster with FTT=1. 
 Maximum number of ESXi servers<br><br>[2] 59 per cluster 96 per cluster 
 Cloud automated multisite deployment Supported for new instances Supported. Automated configuration not included. 
 Add ESXi servers Supported Supported. Automated configuration not included. 
 Remove ESXi servers Supported Supported. Automated configuration not included. 
 Multicluster support Maximum number depends on VMware® sizing guidelines Supported. Automated configuration not included. 
 Client-managed updating and patching of VMware stack Client-managed updates - Native VMware tools (VMware Update Manager™)<br><br>[3] Client-managed updates - Native VMware tools (VMware Update Manager) 
 Backup and restore Manually, by using Veeam® Backup and restore solution not included