vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about resource requirements and capacity checking for some services, see [Resource requirements for add-on services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-resource-requirements).

The following components are ordered and included in the FortiGate Virtual Appliance service:



 Virtual machines 



* All options include a pair of virtual machines (VMs).
* 2, 4, 8, 16, or 32 CPUs per VM. The number depends on the deployment size.
* 4, 6, or 12 GB RAM per VM. The number depends on the deployment size.







 High availability 

Two VMs are deployed and ready for HA or Virtual Router Redundancy Protocol (VRRP) configuration.





 Networking 

Access to the FortiGate console is provided through a private management network. When deployed to a management or consolidated cluster, FortiGate Virtual Appliance management addresses are drawn from the instance management private portable subnet. When deployed to a gateway cluster, a new private portable subnet is ordered for these addresses.





 License and fees 

License fees for each VM are applied to each billing cycle. The fees depend on the selected deployment size and monthly subscription license model.



 Notes 



* You cannot change the licensing level after service installation. To change the licensing level, you must delete the existing service and reinstall the service by using a different licensing option.
* If you receive expiration notifications about the FortiGate Virtual Appliance service license, you can ignore them. The license is automatically renewed annually before it expires.











 Uplink speeds, deployment sizes, and CPU models 

The following information describes the different considerations for the uplink speed, deployment size, and CPU when you install FortiGate Virtual Appliance.



 FortiGate Virtual Appliance on vCenter Server 7 with NSX-T 

On vCenter Server 7 with NSX-T, you can install FortiGate Virtual Appliance on the consolidated cluster or the gateway cluster.

On the consolidated cluster, note the following.



* You can choose a 10 Gb or 25 Gb uplink speed for the cluster.
This layer virtualizes the physical infrastructure through different VMware products:



* VMware vSphere virtualizes the physical compute resources.
* VMware NSX is the network virtualization platform that provides logical networking components and virtual networks.







 Virtualization management 

This layer consists of the following components:



* vCenter Server Appliance with embedded Platform Services Controller (PSC).
* For NSX-T - three NSX Manager or Controller nodes (total of three nodes).
* For NSX-V - one NSX Manager and three VMware NSX Controller™ nodes (total of four nodes).
* VMware NSX Edge™ Services Gateways (ESGs) - four for NSX-T (two on the management cluster and two on the workload cluster) and two for NSX-V.
* IBM CloudDriver virtual server instance (VSI). The CloudDriver VSI is deployed on demand as needed for certain operations such as adding hosts to the environment.



The base offering is deployed with a vCenter Server appliance that is sized to support an environment with up to 400 hosts and up to 4,000 VMs. The same vSphere API-compatible tools and scripts can be used to manage the IBM-hosted VMware environment.

In total, the base offering has the following requirements, which are reserved for the virtualization management layer.



* For NSX-T, 42 vCPU and 128 GB vRAM
* For NSX-V, 38 vCPU and 67 GB vRAM



The remaining host capacity for your virtual machines (VMs) depends on several factors, such as oversubscription rate, VM sizing, and workload performance requirements.

For more information about the architecture, see [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview).





 Technical specifications for vCenter Server instances 

The availability and pricing of standardized hardware configurations might vary based on the IBM Cloud data center that is selected for deployment.

The following components are included in your vCenter Server instance.



 Bare metal server
* Every tenant’s customer VRF is connected to the common shared services network to provide private reachability for those servers to use DNS, shared storage, monitoring, patching, and more.
* The customer VRF is a connectivity service that provides isolation among tenants. Any additional controls that are needed within a tenancy must be provisioned separately by using a gateway, security groups, or host-based controls.







 Routing consideration with VPC 

When routing on-premises subnets from the direct link through a VPC, you must create a route in the VPC routing table. For more information, see [Creating a route](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-route).





 Benefits of moving to VRF 

Moving to VRF includes the following primary benefits:



* Industry-proven and widely accepted multiple isolation separation technologies. Many cloud customers find the Level-3 VPN approach more palatable than ACLs to their auditors and compliance officers.
* IBM Cloud customers can extend or migrate the reach of their network significantly, due to addition of new sites or applications throughout the IBM network.
* Tenant-specific routing tables narrow the aperture for IP address overlap, without the risk of overlap with other tenants' subnets or other parts of the network that are not applicable.



Compared to the older ACL model, there are a few minor tradeoffs to take into account:



* Converting to a customer VRF requires a maintenance window, which causes a brief disruption of backbone traffic flows.
* Remote access by using the managed VPN services (SSL, IPsec) is limited to just SSL VPN into a data center; however, the shared ACL over the backbone allows global access from any entry point from either service.
* VLAN spanning is a feature of the shared tenancy model and is not available in a VRF; this will be disabled upon conversion to the Customer VRF.
* IPsec VPN managed service on IBM Cloud classic infrastructure remote access is not available.



Many IBM Cloud customers currently operate with a shared tenancy model on the IBM Cloud network. During conversion, your shared tenancy is converted to use a customer VRF, most commonly with a new Direct Link subscription.
The rest of the service dependencies use global services that are served from cross regional locations. Any solution that is not hosted on an MZR might require an associated MZR that hosts the control plane services.

For the key dimensions of compute, storage, networking, and authentication or authorization, we indicate the following dependencies.

Control planes
: Common dependencies for control planes are:



* The identity or platform data plane for authentication and authorization
* The audit tracking service
* Internal services that provide, for example, workflow, metadata storage, monitoring and logging
* Load balancers, VPN, and other network infrastructure services



Some control planes obviously have service-specific dependencies. For example, the compute control plane, when starting a bare metal or VM instance, depends on:



* Object Storage to retrieve the required system images
* Block Volumes control plane for provisioning and attaching the volumes
* Networking control plane to provision and attach NICs, subnets, and so on



Data planes
: Core service data planes follow the general principle that each data plane is designed to have minimal dependencies in order to achieve high availability, fast time to diagnosis, and fast time to recovery. Therefore, the systems continue to function (with some limitations, for example cannot provision, reboot, or decom) even when there is a control plane outage.

Network
: The networking data and control planes exist in every deployment unit.

Some services depend on others in the core, for example Compute services like bare metal and VM instances depend the Block Volumes data plane and the Networking data plane, and therefore will be impacted by the data planes for these services going down. But as stated before the control planes might suffer an outage and the Compute instances continue to function, if they do not require the associated service control plane (that is, increasing volume storage size, and so on)

Internal services
: All client facing internal or external services depend on the identity and platform data plane for authentication and authorization. Control planes for monitoring, logging, and IBM Cloud CLI and data plane services for security services depend on the identity platform data plane. (Specific configurations might vary.)

Storage
: The Object Storage data plane does not depend on Block Volumes or File Storage.
[VCenter] cloudvm Use this view to review logs that report allotment and distribution of resources between services. 
 [VCenter] content-library Use this view to review logs that report on the VMware Content Library Service. 
 [VCenter] dnsmasq Use this view to review logs from the dnsmasq lightweight DNS forwarder and DHCP server. 
 [VCenter] eam Use this view to review logs that report on the VMware ESX Agent Manager. 
 [VCenter] netdumper Use this view to review logs that report on the VMware vSphere ESXi Dump Collector. 
 [VCenter] perfcharts Use this view to review logs that report on the VMware Performance Charts Service. 
 [VCenter] rbd Use this view to review logs that report on the VMware vSphere Auto Deploy. 
 [VCenter] rhttpproxy Use this view to review logs that report on the VMware HTTP Reverse Proxy service. 
 [VCenter] sca Use this view to review logs that report on the VMware Service Control Agent service. 
 [VCenter] sps Use this view to review logs that report on the VMware vSphere Profile-Driven Storage Service. 
 [VCenter] vapi Use this view to review logs that report on the VMware vAPI Endpoint service. 
 [VCenter] vCenter - error logs Use this view to review logs that have the log level set to error. 
 [VCenter] vCenter - warning logs Use this view to review logs that have the log level set to warning. 
 [VCenter] vCenter logs Use this view to review all VCenter logs. 
 [VCenter] vha Use this view to review logs that report on the VMware vCenter High Availability service. 
 [VCenter] vmafdd Use this view to review logs that report on the VMware Authentication Framework LDAP service. 
 [VCenter] vmdird Use this view to review logs that report on the VMware Directory Service LDAP. 
 [VCenter] vmon Use this view to review logs that report on the VMware Service Lifecycle Manager service.
For vCenter Server with NSX-T™ instances, applying license updates is not supported. Also, not all add-on services are supported for NSX-T instances.





 vCenter Server with NSX-V architecture 

The following graphic depicts the high-level architecture and components of a three node vCenter Server with NSX-V deployment.

vCenter Server with NSX-V instances is available for V4.7 and earlier.

Zoom

![vCenter Server with NSX-V architecture](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vc_architecture.svg)

Figure 2. vCenter Server with NSX-V high-level architecture for a three-node cluster

For vCenter Server with NSX-V instances, if you purchased IBM-provided VMware licensing, you can upgrade the VMware NSX Base edition to Advanced or to Enterprise edition. Also, you can purchase more VMware components, such as VMware Aria® Operations™. You can also add IBM-Managed Services if you want to offload the day-to-day operations and maintenance of the virtualization, guest OS, or application layers. The IBM Cloud Professional Services team is available to help you accelerate your journey to the cloud with migration, implementation, planning, and onboarding services.





 Physical infrastructure 

This layer provides the physical infrastructure (compute, storage, and network resources) to be used by the virtual infrastructure.





 Virtualization infrastructure (Compute and Network) 

This layer virtualizes the physical infrastructure through different VMware products:



* VMware vSphere virtualizes the physical compute resources.
* VMware NSX is the network virtualization platform that provides logical networking components and virtual networks.







 Virtualization management 

This layer consists of the following components:



* vCenter Server Appliance with embedded Platform Services Controller (PSC).
* For NSX-T - three NSX Manager or Controller nodes (total of three nodes).
Upon completion of these tasks, your new network will be deployed and will appear in the networks tab. This may take a few seconds to complete. Repeat the process for the other two networks, or more if needed in your solution.





 Step 2: Create virtual machines and connect to the virtual machine using console 

In this step, you will create a few virtual machines inside your virtual data center and you will attach them to the virtual data center networks that were created in the previous step.

You will create the following virtual machines:



Virtual machines

 Virtual machine name Operating System Networks 

 jump-server-1 Windows Server 2022 net-application 
 application-server-1 RedHat Linux 8 net-application 
 db-server-1 RedHat Linux 8 net-db, net-isolated-db 



The first server will be used as a jump server, which you can optionally reach through the public Internet. The other two servers are examples of application and database servers.

To create a virtual machine:



1. In the top menu navigation click on Applications.
2. Click on Virtual Machines in the sub navigation tabs.
3. Click on New VM to launch the new virtual machine window.
4. Select the target virtual data center and click on Next to continue.
5. The new VM wizard will appear. There are five fields that must be filled out. Note depending on the size of your display you may need to scroll down to see all fields.



1. Name – jump-server-1
2. Computer name – This field is auto-populated from the name.
3. Templates – For this example the Windows 2022 template is used.
4. Storage policy – The values here depend on what was provisioned in the instance. In this example, 4 IOPS/GB is used (VDC Default).
5. NICs – Check the box for connected and then in the drop-down field below network select the network created in the first step. In this example, net-application is used. In the drop-down below IP mode, select Static-IP Pool.



6.
The IBM Cloud® Virtual Router Appliance also can be configured to perform stateful IPv4 and IPv6 filtering to protect your critical data.





 Virtual Private Network (VPN) gateway 

Connect your on-site data center or office to the IBM Cloud using VPN tunneling by provisioning your IBM Cloud® Virtual Router Appliance as a network gateway device. You can use an IPsec site-to-site VPN tunnel for secure communication from your enterprise data center or office to your IBM Cloud network. Other VPN options are; Remote access IPsec VPN (client-to-site), OpenVPN, GRE, L2TP and DMVPN.

Have a look at the Brocade VPN configurations guides in our [Supplemental VRA documentation section](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-supplemental-vra-documentation).





 Network Address Translation (NAT) 

With the IBM Cloud® Virtual Router Appliance, you can provision application and database servers without public network interfaces while still allowing your servers to access the internet using Source NAT. You can also hide your servers behind the gateway device with Destination NAT for enhanced security.





 Enterprise-grade routing 

For multi-tiered applications on different isolated networks, the IBM Cloud® Virtual Router Appliance gives you flexible ways to build connectivity between these networks. You can set up dynamic routing using BGP, which allows you to announce your own public IP space on the IBM Cloud routers. BGP also offers more flexibility for custom private network configurations when using various tunnels and direct link solutions.

Have a look at the Brocade BGP configurations guides in our [Supplemental VRA documentation section](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-supplemental-vra-documentation).
Service CRN service name Events 

 [IBM Cloud for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview) vmware-solutions [Global events](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at-eventsat-events) 
 [IBM Cloud® for VMware® Solutions Shared](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_overview) vmware-solutions [Location-based events](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at-eventsat-events-instance-mgmt) 
 [KMIP for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) vmware-solutions [Location-based events](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-at-eventsat-events-kmip) 







 VPC services 

You can provision a Virtual Private Cloud (VPC) in the IBM Cloud to run an isolated environment within the public cloud. VPC gives you the security of a private cloud, with the agility and ease of a public cloud. See [IBM Cloud® Virtual Private Cloud Gen 2](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

The following table lists VPC infrastructure services that send auditing events:



Table 13. List of VPC infrastructure services (generation 2)

 Service CRN service name Events
You can install the service to the management cluster or any workload cluster.



* Veeam v10a
* vRealize Operations v8.2 and Log Insight v8.2



Add-on services that support VMware vSphere 7.0 Update 1a
: The following add-on services support VMware vSphere 7.0 Update 1a.



* Caveonix RiskForesight
* VMware HCX
* HyTrust CloudControl
* Juniper vSRX
* Red Hat OpenShift
* Veeam
* vRealize Operations



DNS entries removal
: For several add-on services, if you installed the service before the IBM Cloud for VMware Solutions 4.0 release and you then delete the service, you must remove the DNS entries manually.

Caveonix RiskForesight
: RiskForesight v2.4 applies the following updates.



* Updates the regulated workload presets to order 50 licenses, rather than 10.
* Connects to NSX through FQDN, rather than to its IP address.



When you order RiskForesight, you can now select 10 - 25,000 VMs to license, in increments of 10. The RiskForesight license is valid for five years.

Juniper vSRX
: For vCenter Server instances, Juniper vSRX management and edge services cluster installations provide the following enhancements.



* Useful address book entries
* Security enhancements based on CIS guidelines
* vSRX logging to vRealize Log Insight if the vRealize Operations add-on service is already installed



KMIP for VMware
: Previously, KMIP for VMware provided a multitenant service that enables VMware vCenter Server to use IBM Key Protect for IBM Cloud (Key Protect) and IBM Cloud Hyper Protect Crypto Services (HPCS) as its key manager.

Newly created KMIP for VMware instances that are connected to HPCS now operate as single-tenant services. These services run within the HPCS service and benefit from the features of IBM Secure Service Containers on IBM LinuxONE servers. You can connect only a single KMIP for VMware instance to each HPCS instance.
Route mode for VNFs Yes (see [Setting up high availability for Virtual Network Functions (VNF)](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf)) No 
 Virtual Servers on VPC Yes Yes 
 Member type Virtual server instances Virtual server instances, Bare Metal, Power Systems Virtual Server 
 Power Systems Virtual Server instances connected over Direct Link No Yes (No support for instance groups) 





 High Availability mode 

The application load balancer is configured in active-active mode. All compute resources of the load balancer are actively involved in forwarding traffic.

High Availability (HA) is achieved by using a Domain Name Service (DNS). The Virtual IP (VIP) of each compute resource is registered to the assigned DNS. If any of the compute resources go down, the other resources continue to forward traffic.

An NLB is configured in active-standby mode. A single VIP is registered with DNS, and traffic is forwarded through that compute resource. If an active compute resource goes down, the standby takes over and the VIP is transferred to the standby.





 Multi-zone support 

Network load balancers can accept members across all three availability zones, but the NLB itself resides in one specific zone. A zone is identified by the subnet that is selected when a load balancer is created. Cloud Internet Services (CIS) Global Load Balancer or Private DNS can be used with multiple zonal network load balancers for multi-zone availability.

The application load balancer can also be configured to span multiple zones. The back-end servers can be in any zone within a region.





 Integration with private catalogs 

IBM Cloud Application Load Balancer and Network Load Balancer both integrate with private catalogs to centrally manage access to products in the IBM Cloud catalog and your own catalogs. You can customize your private catalogs to allow or disallow load balancer provisioning to specific users in your account. For more information, see [Customizing what's available in your private catalogs](https://cloud.ibm.com/docs/account?topic=account-restrict-by-user).





 Application load balancer data flow
* CASB (Cloud Access Security Broker) - This service provides visibility, compliance, data security, and threat protection for cloud-based services.
* Industrial security - This service provides signatures for common ICS/SCADA protocols.
* Security rating - This service provides audit capabilities to identify critical vulnerabilities and configuration weaknesses and implement best practice recommendations.





You can't change the monthly subscription license model after service installation. To change the monthly subscription license model, you must delete the existing service and reinstall the service by selecting a different license option.







 Related links 



* [FortiGate Virtual Appliance overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations)
* [Managing FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managingfortinetvm)
* [Ordering services for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservices)
* [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support)
* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
* [Fortinet website](https://www.fortinet.com/)
* [Fortinet Document Library](https://docs.fortinet.com/product/fortigate/6.2)