vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Using VRF, IBM Cloud tenants are allowed to use remote IP addresses that normally would not be allowed to overlap in the Global table. IBM still reserves the following RFC 1918, link-local addresses, and multicast addresses, which are not routable from this VRF service:



* 10.0.0.0/14
* 10.200.0.0/14
* 10.198.0.0/15
* 169.254.0.0/16
* 224.0.0.0/4
* 166.9.0.0/16 (used by the private endpoint service)
* Any IP ranges assigned to your VLANs on the IBM platform.



IBM is moving forward with a next-generation Cloud deployment to enable Virtual Private Cloud (VPC) in our availability zones (AZs). This new VPC capability enables Bring-Your-Own-IP (BYoIP) in the VPC-enabled AZs, which are located in Dallas, Washington DC, London, Frankfurt, Tokyo, and Sydney.

For example, each tenant on the backbone who uses VRF can have only one customer VRF per Direct Link, which provides connectivity among all the tenant’s servers, regardless of location. However, an IBM Cloud tenant might have more than one Direct Link account that feeds into a single cross-connect router.



* A tenant’s servers in any VLAN, in any pod, in any data center worldwide can reach all of that tenant’s other servers globally.
* Every tenant’s customer VRF is connected to the common shared services network to provide private reachability for those servers to use DNS, shared storage, monitoring, patching, and more.
* The customer VRF is a connectivity service that provides isolation among tenants. Any additional controls that are needed within a tenancy must be provisioned separately by using a gateway, security groups, or host-based controls.







 Benefits of moving to VRF 

Moving to VRF includes the following primary benefits:



* Industry-proven and widely accepted multiple isolation separation technologies. Many cloud customers find the Level-3 VPN approach more palatable than ACLs to their auditors and compliance officers.
About VPN 

VPN access enables you to manage all servers and services that are associated with your account, remotely, over the IBM Cloud private network. A VPN connection from your location to the private network allows out-of-band management and server rescue through an encrypted VPN tunnel.

Communicating by using the private network is inherently more secure. It gives you the flexibility to limit public access while still being able to manage your servers. Any user on your account can be given VPN access, which is available as SSL. VPN interactions through the [IBM Cloud console](https://cloud.ibm.com/) allow for VPN access customization at the user level.



 What are some ways to use the SSL VPN? 

This out-of-band secure gateway gives you access to your server over the private network. Common uses are:



* Connect to your server's private IP address (10.x.x.x) for SSH or RDC.
* Connect to your IPMI card for remote console/access/monitoring.
* Mount drives in Windows or Red Hat from home or work PC for convenience.
* Shut down public interface on database servers and manage over the private network.
* Shut down public interface while setting up the server for the first time.
* Shut down public interface during critical security updates.
* Shut down public interface during security breach and resolve the issue over the private network.
* Establish a single person, short-lived, private network connection for occasional server and application management.



SSL VPN is a shared VPN service, which is free of charge. It is not recommended for production use.





 Key features 



* Our private network gives you a cost-free way to communicate with and manage servers. The VPN is the gateway to this private network.
* Access points throughout the world create the best and quickest access and interaction possible. IBM Cloud currently has VPN access points in many cities.
* See [Available VPN endpoints](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-available-vpn-endpoints) for a list of VPN access points to the IBM Cloud private network.
Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud.







 Variation with edge/transit VPC for public internet access 

You might want to allow consumers to access your service through the public internet. This base architecture can be adapted to securely enable this type of access as shown in the following diagram, which introduces a new edge VPC. The request from the consumer gets routed through a global load balancer, through a web application firewall in the edge VPC, and then to the public application load balancer within the workload VPC.

Zoom

![Detailed VPC reference architecture with edge VPC for the IBM Cloud for Financial Services](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/f5-bigip/vpc-single-region-edge.svg)

Figure 5. Single-region IBM Cloud for Financial Services reference architecture for VPC with BIG-IP

For complete details on this variation of the architecture, see [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workloadconsumer-provider-public-internet).





 Next steps 

If you plan to use Red Hat OpenShift on IBM Cloud, explore a more detailed view of the [VPC reference architecture with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-openshift)

If you don't plan to use Red Hat OpenShift on IBM Cloud, you can skip ahead to learn more about deployment in [Setup environment for deployment and configuration](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-deployment-setup-environment).
Using DNS Services with VPC 

IBM Cloud® DNS Services provide private DNS to Virtual Private Cloud (VPC) users. Private DNS zones are resolvable only on IBM Cloud, and only from explicitly [permitted networks](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-dns-conceptspermitted-networks) in an account. To get started, create a DNS Services instance in the IBM Cloud console.



  DNS Services overview 

By using DNS Services, you can complete the following tasks:



*  Create private DNS zones that are collections for holding domain names.
*  Create DNS resource records under these DNS zones.
*  Specify access controls used for the DNS resolution of resource records on a zone-wide level.



DNS Services also maintains its own worldwide set of DNS resolvers. Instances that are provisioned under IBM Cloud on an IBM Cloud network can use resource records that are configured through IBM Cloud DNS Services by querying DNS Services resolvers.

Resource records and zones that are configured through DNS Services are:



*  Separated from the wider, public DNS, and their publicly accessible records.
*  Hidden from machines outside of and not part of the IBM Cloud Private network.
*  Accessible only from machines that you authorize on the IBM Cloud Private network.
*  Resolvable only through the resolvers provided by the service.







  Before you begin 

To use DNS Services, you must have at least one virtual server instance in a VPC in the IBM Cloud. If you do not have one, learn how to [get started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

While the private DNS resolvers are required to resolve private DNS names, they also resolve public DNS names if the request is for a name that is not defined to be in a private DNS zone.

For more information, see [Getting started with DNS Services](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-started).
About attached storage for vCenter Server 

Attached storage is an extension of the VMware vCenter Server® offering. The attached storage solution architecture for the vCenter Server details the components of the solution and the high-level configuration of each component in the design.

For more information about the vCenter Server design, see [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview).



  Key benefits of attached storage for vCenter Server 

While attached storage isn't a prerequisite for VMware® environments, its use as a shared storage device provides many benefits to users for IT operations. Using shared storage devices can help you achieve high availability, distributed resource scheduler, efficient use of storage capacity, and simplified management through enabling the vSphere functions described in the following table.



Table 1. Functions description for attached storage for vCenter Server

 Function                                                   Description                                                                                                                                                                                                                                                   

 vSphere Distributed Resource Scheduler and Resource Pools  This feature allows for abstraction and flexible management of resources through load balancing and virtual machine (VM) placement. Resource pools can be grouped into hierarchies and used to hierarchically partition available CPU and memory resources.   
 vSphere High Availability                                  This feature provides HA for VMs (by pooling them) and for the hosts in a cluster. The hosts in the cluster are monitored. If a failure occurs, the VMs on a failed host are restarted on alternative hosts.                                                  
 vSphere Datastore Clusters                                 This feature provides a collection of datastores with shared resources and a shared management interface.                                                                                                                                                     
 vSphere Fault Tolerance                                    This feature provides continuous availability to VMs, by eliminating downtime and disruption, even if a complete host failure occurs.                                                                                                                         







  Related links 



*  [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview)
This tutorial walks you through creating your own IBM Cloud VPC with multiple subnets as required to support vSphere networking and the provisioning of IBM Cloud Bare Metal Servers for Virtual Private Cloud (BMS) for a basic VMware vSphere deployment. After the IBM Cloud VPC and Bare Metal Servers for VPC have been provisioned, the tutorial covers a manual deployment of the vCenter, creating VMware compute cluster with vSAN or NFS shared storage options. The tutorial also covers optional features, such as using IBM Cloud VPC network for VMware Virtual Machine networking.

![solution tutorial icon](https://cloud.ibm.com/media/docs/images/homepage/solution-tutorial.svg) [DevSecOps application lifecycle management](https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-deploy-arch-ibm-devsecops-alm)DevSecOps application lifecycle management Reference architecture

The DevSecOps deployable architecture creates a set of DevOps Toolchains and pipelines. DevSecOps uses Continuous Delivery (Git Repos and Issue Tracking, Tekton Pipelines, DevOps Insights, and Code Risk Analyzer), Secrets Manager, Key Protect, Cloud Object Storage, Container Registry and Vulnerability Advisor.

Deployable![ref architecture icon](https://cloud.ibm.com/media/docs/images/homepage/reference-architecture.svg) [DevSecOps Application Lifecycle Management](https://cloud.ibm.com/docs/devsecops-alm)DevSecOps Application Lifecycle Management Deployment guide

The DevSecOps Deployable Architecture creates a set of DevOps toolchains and pipelines.

Deployable![deployment guide icon](https://cloud.ibm.com/media/docs/images/homepage/deployment-guide.svg) [Enhance cloud security by applying context-based restrictions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cbr-enhanced-security)Enhance cloud security by applying context-based restrictions Solution tutorial
[KMIP for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) KMIP for VMware works together with VMware native vSphere encryption and vSAN encryption to provide simplified storage encryption management together with the security and flexibility of Key Protect or Hyper Protect Crypto Services customer-managed keys. [View docs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) 
 [Virtual Servers for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started) You can use Virtual Servers for VPC to create an instance that consists of your virtual compute resources and resulting capacity within an IBM Cloud VPC. [View docs](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console) 
 [Power Systems Virtual Server (Linux)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-getting-started) You can protect Linux Unified Key Setup (LUKS) encryption keys from being compromised by using Key Protect. [View docs](https://developer.ibm.com/tutorials/protect-luks-encryption-keys-with-ibm-cloud-hyper-protect-crypto-services/) 
 [Power Systems Virtual Server (AIX)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-getting-started) You can protect Linux Unified Key Setup (LUKS) encryption keys from being compromised by using Key Protect. [View docs](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-integrate-hpcsAIX-hpcs)
+1

DNS Services



* 1 hour
* 2023-05-05



[Use a VPC/VPN gateway for secure and private on-premises access to cloud resources](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn)Use a VPC/VPN gateway for secure and private on-premises access to cloud resources

This tutorial provides the automation to create resources that demonstrate Virtual Private Network (VPN) connectivity between on-premises servers and cloud resources like IBM Cloud® Virtual Private Cloud Virtual Service Instances (VSIs) and IBM Cloud data services. DNS resolution to cloud resources is also configured. The popular strongSwan VPN Gateway is used to represent the on-premises VPN gateway.

Schematics Virtual Private Cloud (VPC)

+3

Object Storage,Databases For PostgreSQL,DNS Services



* 2 hours
* 2023-05-08



[Team based privacy using IAM, VPC, Transit Gateway and DNS](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-tg-dns-iam)Team based privacy using IAM, VPC, Transit Gateway and DNS

Microservices are popular because they allow an enterprise to organize their development teams around the services they deliver. This tutorial walks you through the steps of creating infrastructure for a IBM Cloud® Virtual Private Cloud (VPC) based microservice architecture. In this architecture, VPCs are connected to each other using the IBM Cloud® Transit Gateway. A set of shared microservices is accessed through host names registered in the IBM Cloud® DNS Services. Each VPC is managed by a separate team isolated by IBM Cloud® Identity and Access Management. Optionally a IBM Cloud® Load Balancer can be used to scale out the shared microservice.

Virtual Private Cloud (VPC) Managing your account, resources, and access

+2

Transit Gateway,DNS Services



* 2 hours
* 2023-05-18
Step 1: Create virtual private clouds, subnets and virtual server instances 

In this section, you will create your own VPC in region 1 with subnets created in two different zones of region 1 followed by the provisioning of VSIs.



 Create a virtual private cloud 



1. Navigate to [Virtual private clouds](https://cloud.ibm.com/vpc-ext/network/vpcs) page and click on Create.
2. Enter vpc-region1 for the name of your VPC, select a Resource group and optionally, add Tags to organize your resources.
3. Uncheck Allow SSH and Allow ping from the Default security group. SSH access will later be added to a maintenance security group. The maintenance security group is added to an instance to allow SSH access from a bastion server. Ping access is not required for this tutorial.
4. Leave Enable access to classic resources unchecked and Create a default prefix for each zone checked.
5. Under Subnets change the name of the Zone 1 subnet. Click the pencil icon:



* Enter vpc-region1-zone1-subnet as your subnet's unique name.
* Select the same Resource group as the VPC resource group.
* Leave the defaults in the other values.
* Click Save



6. Under Subnets change the name of the Zone 2 subnet. Click the pencil icon:



* Enter vpc-region1-zone2-subnet as your subnet's unique name.
* Select the same Resource group as the VPC resource group.
* Leave the defaults in the other values.
* Click Save



7. Under Subnets delete the subnet in Zone 3. Click the minus icon.
8. Click Create virtual private cloud to provision the instance.







 Create a security group to allow inbound traffic to your application 

Enable inbound rules for HTTP (80) and HTTPS (443) ports to the application by defining rules in a security group. In later steps, you will add VSIs to the security group.



1. Navigate to Security groups.
2.
Deploying your infrastructure 

Use the following information to deploy and set up SAP HANA and SAP NetWeaver on IBM Cloud® Virtual Servers for Virtual Private Cloud.



 Setting up a Virtual Private Cloud (VPC) and subnet 

Before you can create a virtual server, you must create a VPC.

The following steps summarize the setup of VPC and subnets, which is detailed further in the [Create an IBM Cloud VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console).



1. Click Menu icon![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Network > VPCs
2. Click Create.
3. Enter a unique Name for the VPC.
4. Select a Resource group. Use resource groups to organize your account resources for access control and billing purposes. For more information, see [Best practices for organizing resources in a resource group](https://cloud.ibm.com/docs/account?topic=account-account_setup) and [What makes a good resource group strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setupresource-group-strategy).
5. Optional: Enter tags to help you organize and find your resources. You can add more tags later. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).
6. Select whether the Default security group allows inbound SSH and ping traffic to virtual server instances in this VPC. We'll configure more rules for the default security group later.
7. Optional: Classic access. Select whether you want to enable your VPC to access classic infrastructure resources.
When you access IBM Cloud services from VMware workloads, you can use VPE for VPCs as the endpoint for the service. Your VMware Workloads can either be attached to the VPC subnet, or to NSX-T™ overlay segments. VPE uses IBM Cloud private backbone network to access the specific service, and data remains within the private IBM Cloud backbone.

The following diagram presents an overview when using VPEs with VMware workloads on VPC subnets.

Zoom

![VPEs with VMware Workloads on VPC Subnets](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-vpe-sub-arch.svg)

Figure 1. VPEs with VMware Workloads on VPC Subnets

The following diagram presents an overview when using VPEs with VMware NSX-T.

Zoom

![VPEs with VMware Workloads with NSX-T](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-vpe-nsx-t-arch.svg)

Figure 2. VPEs with VMware Workloads with NSX-T

VPE is integrated with DNS Services. If your VMware workloads use IBM Cloud DNS Services, they can resolve your VPE FQDNs to your private IP address instances that are provisioned under IBM Cloud DNS Services. IBM Cloud network can use resource records that are configured through IBM Cloud DNS Services by querying DNS Services resolvers.

Therefore, the first architectural decision you must make is how your VMware Workloads resolve DNS queries.
This deployable architecture provides you with secure and customizable compute resources for running your applications and services.

This deployable architecture supports these features:



* All the features of the VPC landing zone deployable architecture
* VSIs: Creates and configures one or more virtual servers in an IBM Cloud VPC for workloads.
* Subnets for VSIs: Configures the subnets for the VSIs, and specifies which subnets the instances are deployed in.
* Security groups: Associates security groups with the VSIs to control inbound and outbound traffic to instances.
* SSH keys: Provisions and manages SSH keys for the VSIs so that you can securely administer the instances.



For more information about the concepts of using the VSI on VPC landing zone deployable architecture, see this [reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsi) from the IBM Cloud for Financial Services docs.





 Red Hat OpenShift Container Platform on VPC landing zone 

The Red Hat OpenShift Container Platform on VPC landing zone deployable architecture provides the tools to deploy a Red Hat OpenShift Container Platform cluster on IBM Cloud.

The deployable architecture deploys a Red Hat OpenShift cluster in a single VPC that is used to manage the platform in a VPC on IBM Cloud. The VPC is a multi-zoned, multi-subnet implementation that keeps your VPC secure and highly available. The deployable architecture provides the tools to deploy a Red Hat OpenShift Container Platform cluster on IBM Cloud.

This deployable architecture supports these features:



* All the features of the VPC landing zone deployable architecture
* Red Hat OpenShift Container Platform: Create a cluster in an IBM Cloud VPC. You can specify the version and cluster size.
* Worker pools: Creates worker pools in a container platform. With worker pools, you can group and manage worker nodes with similar configurations, such as compute resources and availability zones.
* Subnets for containers: Configures subnets for the cluster, and specifies the subnets to deploy the worker nodes in.