vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Secure access to services using service endpoints 

An increased focus on security is required by customers that use cloud-based services for production workloads. For many customers, accessing services in a secure manner is not only a sensible corporate policy, but in some cases required by compliance regulations. IBM has enhanced the connectivity options for customers who require isolated connectivity options for their workloads.

With IBM Cloud® service endpoints, you can connect to IBM Cloud services over the IBM Cloud private network. Moving these workloads from the public network offers two advantages:



*  Services are no longer served on an internet routable IP address. It is becoming increasingly common for cloud consumers to want limited or no access to the public internet from any of their services. Now with the service endpoint feature, service teams can create an interface over the private network for their service that customers can use to connect. Internet access is no longer a requirement for you to connect to IBM Cloud services.
*  There is no billable or metered bandwidth charges on the private network. In the past, you were billed for egress bandwidth when talking to an IBM Cloud service.



The following figure shows how traffic is routed through IBM Cloud's private network when accessing cloud services through service endpoints:

Zoom

![IBM Cloud Service Endpoint](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/CSE.png)

Figure 1. Traffic routed through a service endpoint

If you are using classic infrastructure, you must enable virtual routing and forwarding (VRF) in your account first. Then, you can enable the use of service endpoints. After both options are enabled, you can start creating services that support the use of VRF and service endpoints from the catalog. If you are using IBM Cloud® Virtual Private Cloud, then you don't need to enable VRF for your cloud account. For more information, see [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
The NTP time servers are connected to these GNSS and time synchronization appliance services, as depicted in Figure 1.

Zoom

![NTP service overview](https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/ntppublic.png)

Figure 1. NTP Service overview





 Software components 

NTP services provide a complete implementation of the Network Time Protocol (NTP) version 4, but retains compatibility with versions 1, 2, and 3 as defined by RFC 1059, RFC 1119, and RFC 1305, respectively.





 Security 

Only NTP time packets are allowed to transfer between the customer-accessible NTP servers (customer mirrors) and end users (IBM Cloud VPC and IBM Cloud Classic Infrastructure servers). It is important to note that the majority of attacks against an NTP server can be mitigated with proper configuration of the NTP server itself to limit functionality to only the required responses. NTP servers are restricted from public access, and only allowed networks are able to connect to the master time source in each environment. At each level, the information that NTP clients are allowed to receive from the NTP server is restricted.





 High availability 

The NTP service for customer workloads is backed by a highly available architecture. There are multiple GNSS devices deployed across IBM Cloud that rely on multiple satellites available on the GPS network. Each appliance, aside from the GPS source, has a local atomic clock device connected to it. Every NTP server providing services to customer workloads is configured to use any of the available Stratum 1 sources in case the closest one fails.
Managing Veeam for VMware Shared 

The Veeam Availability Suite™ and Veeam® Cloud Connect Replication services are available and ready to use in all virtual data centers. These services seamlessly integrate as a managed solution to help your enterprise achieve high availability. They provide recovery points for your applications and data. By using these services, you control both the backup and restore of all virtual machines (VMs) for your infrastructure directly from the Veeam console.

Service charges are incurred only if you choose to use the service.



 Veeam Availability Suite 

The Veeam Availability Suite has visibility to back up VMs from any virtual data center in the organization. It is available at the VMware® Cloud Director organization level for any VMware Cloud Director user with the Organization Administrator role.

When you use the Veeam self-service portal to create backup jobs, you can choose vApp and VM instances from any virtual data center in the organization.

You can access the Veeam portal on the virtual data center details page when the status of the virtual data center is Available. For more information, see [Procedure to view the virtual data center summary](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_viewing-vdc-summaryshared_viewing-vdc-summary-procedure) or [Procedure to view virtual data center details](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_viewing-vdc-detailsshared_viewing-vdc-details-procedure).



 Procedure to access the Veeam self-service portal from the virtual data center 



1. Under Recommended services on the virtual data center details page, click Veeam backups.
2. Use a user with the Organization Administrator role to log in to the Veeam self-service portal. A newly provisioned virtual data center's admin user has the role by default.
* Troubleshooting - A list of common alerts from the monitoring system that include step-by-step tasks for these alerts, and generic guidance on troubleshooting the service.
* Disaster recovery plans and procedures - Details on how to recover the service at another location due to a disaster at the primary location.
* Service level agreement - The agreed service parameters such as operational level agreements, key point indicators, availability goals, recovery point objectives, recovery time objective.





Most IT organizations have multiple runbooks that act as their reference manuals. This series of documentation is designed for use as a general runbook for your organization using vCenter Server instances. While every runbook's content is specific to the organization's needs, the methodology of runbook creation is fairly standard and uses the following two stages.



* The first stage is to decide which procedures need to be documented, and when listed, document each one with sufficient detail.
* The second stage is ongoing and consists of maintaining, updating, and correcting these procedures, adding new procedures and retiring procedures that are no longer needed.



IBM Cloud for VMware Solutions enables you to use you team's existing skills, toolsets, and runbooks you have on-premises to manage your instances in IBM Cloud.

The following list contains the most common procedures, guides, and tasks:



* Configuration tasks - These tasks are common activities that systems administrators need to perform to tailor the environment to suit the enterprise's needs and respond to service requests such as: add new VMs and increase capacity. These tasks are grouped into the following structure:



* Generic guidance
* VM procedures
* vCenter procedures
* vSphere ESXi™ host procedures
* Storage procedures
* Network procedures



* Alarms - VMware vSphere® includes an events and alarms subsystem, which tracks events that occur in the vSphere environment and makes this information available in vCenter. This section describes this subsystem and how to enable and use the alarms in your enterprise.
* Proactive daily checks - These checks enable system administrators to keep the environment healthy. When carried out daily, it prevents many common issues that are related to capacity and performance from impacting your workloads.
Function as a Service architecture 

IBM Cloud® Functions delivers OpenWhisk in a highly scalable, serverless environment. You can compare Cloud Functions serverless architecture and cost-effective computing with other architecture models.

Why go serverless?
: 

* No infrastructure management required
* Minimal maintenance
* Cost efficient
* Scales easily
* Fast!





 Comparison of OpenWhisk architectures 

The following OpenWhisk architectures are compared:



1. Function as a Service (FaaS) on [Cloud Functions](https://cloud.ibm.com/functions/). IBM is the only vendor to offer managed OpenWhisk. A good introduction to the serverless programming model by using a FaaS platform is available on [Martin Fowler's blog](https://martinfowler.com/articles/serverless.html), and you can see [uses cases](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-use_cases) for running OpenWhisk with a serverless design.
2. Infrastructure as a Service (IaaS) with OpenWhisk Roll Your Own (RYO). You can download OpenWhisk from Apache Incubation Project and run it on [IBM Cloud IaaS](https://cloud.ibm.com/catalog?category=compute).
3. Platform as a Service (PaaS) as a managed application runtime. A good example is the [Liberty for Java](https://cloud.ibm.com/catalog/starters/liberty-for-java) runtime that is managed by the IBM Cloud Foundry implementation.
4. Container as a Service (CaaS) as a managed container environment. A good example is the [IBM Cloud Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-getting-started).
5. Infrastructure as a Service (IaaS) with Java EE runtime. A good example is the [WebSphere Application Server VM on IBM Cloud](https://cloud.ibm.com/catalog/services/websphere-application-server).
Deployed as virtual machines (VMs) in mirrored pairs, the service mesh consists of the following components:



* Interconnect Appliance (HCX-IX) - The interconnect appliance creates encrypted tunnels that support vMotion and replication (bulk migration) traffic.
* WAN Optimizer Appliance (HCX-WAN) - HCX includes an optionally deployed Silver Peak™ WAN optimization appliance. It is deployed as a VM appliance. When deployed, the CGW tunnel traffic is redirected to traverse the WAN Optimizer. Since the WAN optimizer significantly decreases traffic across the WAN (typically 3:1 to 6:1 observed) while it increases connection reliability, it is recommended to deploy the WAN optimizer with the CGW. The added benefit of deploying the WAN optimizer is extended to limiting the WAN bandwidth used by VM migration traffic. The WAN optimizer management interface is not configured by default.
* Network Extension (HCX-NE) - Provides the Layer 2 network extension capabilities, enabling migrations between the on-premises location and the vSphere environment with the need to reassign IP addresses to the VMs.
* Proxy ESXi host - Whenever the HCX-IX is configured to connect to the cloud side HCX site, a proxy ESXi host appears in the vCenter Server outside of any cluster. This ESXi host has the same management and vMotion IP address as the corresponding HCX-IX appliance. As a result, the vSphere environment at both the client and the cloud side work as if it performs a local vMotion.



This method has the following benefits:



* The management IP ranges on either side might be overlapping with no loss in functionality.
* The cloud side has no vSphere visibility into the client side, which makes it more secure.







 HCX user portals 



* Client web user interface – The HCX client web portal is the main user interface for HCX. After the client-side HCX Manager is installed, it shows up as a snap-in to the vCenter web user interface.
Converting to virtual routing and forwarding 

Many IBM Cloud® customers currently operate with a shared tenancy model on the IBM Cloud network. During conversion, your shared tenancy is converted to use a customer VRF, most commonly with a new Direct Link on Classic subscription.

A "customer VRF" refers to multiple isolation network connectivity. For more information, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/direct-link?topic=direct-link-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud). {: note]



 The conversion process 

The conversion process involves a network disruption, while the VLANs and their subnets are detached from the ACL backbone and then attached to the customer VRF. This process results in a few moments of packet loss for traffic entering or exiting the VLANs. Packets within the VLAN continue to flow. In the cases where a network gateway, such as a FortiGate Security Appliance or Virtual Router Appliance is involved, no disruption occurs among the VLANs attached to that gateway. The servers see no network outage themselves, and most workloads automatically recover when the traffic flow resumes. The total duration of the disruption depends on the extent of the tenant’s topology, that is, the number of subnets, VLANs, and pods that your tenancy includes.

During migration, the VLANs are disconnected from the backbone and reconnected to the customer VRF. The duration of disruption varies, depending on the quantity of VLANs, pods, and data centers involved. Traffic among VLANs is disrupted, yet the servers stay connected to the network. The application might not be affected, depending on its sensitivity to packet loss.





 Initiating the conversion 

Existing IBM Cloud customers can [open an IBM Support case](https://cloud.ibm.com/unifiedsupport/cases/add) through the IBM Cloud console, requesting to be migrated to a VRF. The IBM Support case should state: “Private Network Question” and include the following text:

"We are requesting that account your account number is moved to its own VRF. We understand the risks and approve the change.
Multicluster support Maximum number depends on VMware® sizing guidelines Supported. Automated configuration not included. 
 Client-managed updating and patching of VMware stack Client-managed updates - Native VMware tools (VMware Update Manager™)<br><br>[3] Client-managed updates - Native VMware tools (VMware Update Manager) 
 Backup and restore Manually, by using Veeam® Backup and restore solution not included 
 Software-defined networking<br><br>[4] NSX DC SP Base, Professional, Advanced, or Enterprise Plus NSX DC SP Base, Professional, Advanced, or Enterprise Plus. Automated configuration not included. 
 NSX license upgrade options<br><br>[5] Upgrade available from NSX Advanced to Enterprise. None 
 vSAN license editions vSAN Advanced or Enterprise vSAN Advanced or Enterprise 
 Add-on services Supported<br><br>[6] Not supported by the automation of this solution. You can bring and install your own software. 







 vCenter Server vs VMware Regulated Workloads 

Review the following table to understand the differences in feature support for vCenter Server instances and VMware Regulated Workloads.



Table 2. Supported features for vCenter Server instances and VMware Regulated Workloads

 Feature vCenter Server offering Regulated Workloads offering 

 vCenter Server version 7.0 Update 3k 7.0 Update 3k 
 vSphere version 7.0 Update 3k 7.0 Update 3k 
 NSX edition NSX DC SP Base, Professional, Advanced, or Enterprise Plus NSX DC SP Advanced or Enterprise Plus 
 NSX networking solution <br><br>[7] NSX-T™ NSX-T 
 NFS Optional Not allowed 
 vSAN Optional Required 
 Consolidated cluster Optional Optional 
 Separate management cluster Supported Supported 
 Minimum number of ESXi servers For vSAN, 4 servers. <br>For NFS, 3 servers. 6 servers - 4 for the consolidated cluster and 2 for the gateway cluster. 
 Gateway cluster Optional Required. Juniper vSRX, FortiGate Virtual Appliance, Bring your own gateway, or FortiGate Security Appliance.
* VLAN spanning is a feature of the shared tenancy model and is not available in a VRF; this will be disabled upon conversion to the Customer VRF.
* IPsec VPN managed service on IBM Cloud classic infrastructure remote access is not available.



Many IBM Cloud customers currently operate with a shared tenancy model on the IBM Cloud network. During conversion, your shared tenancy is converted to use a customer VRF, most commonly with a new Direct Link subscription.

For specific information about how to initiate a VRF conversion for your account, see the conversion instructions for your IBM Cloud offering.



* [Direct Link conversion instructions](https://cloud.ibm.com/docs/dl?topic=dl-what-happens-during-the-account-conversion-process)
* [VPC conversion instructions](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure&interface=uihow-you-can-initiate-the-conversion)
* [IBM Cloud service endpoints conversion instructions](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint)
The generic plug-in uses the VMware APIs to connect to the VMware Cloud Director and extracts the workload-related information. After the information is available, the plug-in packages the payload and sends it to the Central Collector.
* vCD Network Data Collector - The plug-in extracts Netflow details from the VMware vCD. The generic plug-in uses the VMware APIs to connect to the VMware NSX and extracts Network, FW, Security Rules, and Security Groups. After the information is available, the plug-in packages the payload and send it to the Central Collector.
* Network Data Collector - A plug-in that extracts Netflow details from the VMware vCenter. The generic plug-in uses VMware APIs to connect to VMware NSX and extracts network, firewall, security rules, and security groups information. After the information is available, the plug-in packages the payload and sends it to the Central Collector.
* Remote Collector - Located in the tenant environment or another location where it has network access to the tenant VMs. It handles all compliance and cyberrisk scanning.
* Relational Datastore - Maintains the following types of metadata:



* Cloud Service Provider
* Tenant
* Assets
* Scan Results
* Software
* Daily or weekly aggregated data set



* Messaging Datastore - RiskForesight uses persistent messaging queue to provide zero data loss and offload-back pressure to the components.
* Index Datastore - It indexes and stores the incoming raw data for each tenant for further analysis to support the multitenant capability.
* Plug-ins – Located in the Application Routing server. Plug-ins include the setup and integration with VMware components to synchronize all VMs along with their tenant information.



The following table shows the ports and protocols that are required for each component.



Table 1. Ports and protocols

 Component Port numbers 

 UI 443 
 API 443, 1337 
 RiskForesight 8082, 8083, 8084 
 Central collector (cluster) 8080 
 Remote collector 8081 
 Relational datastore primary or secondary 5432 
 Messaging datastore cluster 9092
* Public and private networks
* Private VLANs and NSX logical switches
* Several VMware NSX® logical switches





Additionally, FortiGate VM offers direct integration with NSX–T including service chaining and dynamic import of security groups.





 Key benefits 

Several licensing option bundles are available for FortiGate VM on IBM Cloud.



* Standard FW - This bundle includes the following services.



* Stateful packet inspection
* VLAN protection and advanced logging
* Ingress or egress FW rules
* SSL or IPsec VPN termination
* Continuous support



* Standard FW + UTM - This bundle includes all standard firewall services in addition to the Advanced Malware Protection (AMP) service.



* Advanced malware protection
* NGFW IPS and web filtering
* Antispam
* Application control



* Standard FW + Enterprise This bundle includes all standard firewall and UTM services in addition to the following services.



* CASB (Cloud Access Security Broker) - This service provides visibility, compliance, data security, and threat protection for cloud-based services.
* Industrial security - This service provides signatures for common ICS/SCADA protocols.
* Security rating - This service provides audit capabilities to identify critical vulnerabilities and configuration weaknesses and implement best practice recommendations.









 Related links 



* [Solution design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortigate-design)
* [Implementation and management](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortigate-implementation)
* [Ordering VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_ordering)
* [Ordering Zerto](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-zerto_ordering)







 Results after you order services for vCenter Server instances 

When the installation of the service is completed successfully, you are notified by email, and the service is displayed on the Services page of the instance with the Installed status.





 Related links 



* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
+---------------+-----------+----------------------------------------------+---------------------------------------------------------+

OK

Show more







 Step 4: VPN administration 

The VPN administration tasks must be performed by a user who has a valid IBM Cloud user account and a valid secure network admin key pair (by using [these](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_networkmanage_adminkey) procedures).

The VPN administration involves the following tasks:



* [Setting up a VPN node](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_networksetup_vpnnode)
* [Setting up VPN trusted peers](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_networkset_vpnpeer)



See [Parameter specification](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_networkparam_limit) for details about some specifications that apply to some of the parameters of the secure network management CLI commands.



 Setting up a VPN node 

Use the secure network management CLI to send a request to the secure network management agent to configure a new VPN node on the virtual server. The VPN key pair is generated by the secure network management agent automatically on the virtual server. You must configure the VPN IP of the VPN node during the initialization command.
List of Power Systems Virtual Server infrastructure services

 Service CRN service name Events 

 [Images](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-deploy-custom-image) power-iaas [Location-based events](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-at-eventsat-actions-images) 
 [Networks](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-connecting-networks) power-iaas [Location-based events](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-at-eventsat-actions-networks) 
 [PVM-Instance](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-server) power-iaas [Location-based events](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-at-eventsat-actions-servers) 
 [Volumes](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-modifying-servermodifying-volume-network) power-iaas [Location-based events](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-at-eventsat-actions-volumes) 
 [VPN](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-vpn-connectivity) power-iaas [Location-based events](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-at-eventsat-vpn-connection)