vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Inter-subnet, inter-zone data flows - For these flows, the implicit router function removes the VNI and forwards the packet in the VPC's MPLS VPN for transit across the cloud backbone. At the destination zone, the implicit router function tags the data packet with the appropriate VNI. Then, the packet is forwarded to the destination hypervisor, where the VNI is stripped off again so that the data packet can be forwarded to the destination virtual server instance.

Extra-vpc service data flows - Packets that are destined for IaaS or IBM Cloud Service Endpoint (CSE) services use the VPC's implicit router function. They also use a network address translation (NAT) function. The translation function replaces the virtual server instance address with an IPv4 address that identifies the VPC to the IaaS or CSE service that is requested.

Extra-vpc internet data flows - Packets that are destined for the internet are the most complex. In addition to using the VPC's implicit router function, each of these flows also rely on one of the implicit router's two network address translation (NAT) functions.



* An explicit one-to-many NAT through a public gateway function that serves all subnets that are connected to it.
* One-to-one NAT assigned to individual virtual server instances.



After NAT translation, the implicit router forwards these internet-destined packets to the internet, by using the cloud backbone.





 Life cycle of external IP addresses that are associated with public gateway functions 

As both external IP addresses and PGWs are bound to an availability zone. A public gateway function can have only a single external IP. This external IP has the following lifecycle:



* The external IP is allocated when the public gateway is created.
* The external IP is released when the public gateway is deleted.







 Classic access 

The [classic access](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure) feature for VPC is accomplished by reusing the VRF identifier from the IBM Cloud® classic infrastructure account as the VRF identifier for VPC.
VMware Solutions SDDC architecture 



 Common services components 

Common services provide the services that are used by other services in the cloud management platform. Common services include identity and access services, domain name services, and NTP services.

Zoom

![Common services](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/openshift-commonservices.svg)

Figure 1. Common services



 Identity and access services 

As part of the VMware® vCenter Server® automation, a Microsoft® Active Directory™ (AD) is employed for Identity Management. A single AD virtual server instance (VSI) is deployed. The vCenter is configured to use AD authentication and you can configure Red Hat® OpenShift® for LDAP authentication.





 Domain Name Services 

The vCenter Server deployment uses the deployed AD VSIs as DNS servers for the instance. All deployed components, such as, vCenter, PSC, NSX®, and ESXi™ hosts, are configured to point to AD as their default DNS.





 NTP services 

The vCenter Server deployment uses the IBM Cloud® infrastructure NTP servers. All deployed components are configured to use these NTP servers. Having all components within the design that uses the same NTP servers is critical for certificates and AD authentication to function correctly.







 Related links 



* [VMware vCenter Server and Red Hat OpenShift architecture overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-intro)
* [System context for vCenter Server and Red Hat OpenShift architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcs-openshift-syscontext)
FAQs 

You can read the following FAQs to help you with Hyper Protect Virtual Servers.



 Are there any backup functions provided for a virtual server? 

Hyper Protect Virtual Servers does not provide any backup functions for your virtual server instances. If you require backup capabilities, you need to configure your virtual server backup in your own responsibility.





 What is the purpose of the internal IP address? 

You must use the internal IP address when you connect to a virtual server from another virtual server, which is in the same virtual LAN (VLAN).





 How do I provide my applications in high availability? 

Do not rely on just one virtual server instance. Instead, run your application on multiple instances in combination with a load balancer to ensure high availability.

Ideally, these virtual servers are spread across multiple regions and data centers. With Hyper Protect Virtual Servers, virtual servers are provided within three regions (us-south, eu-de, au-syd) and nine data centers (Dallas 10, Dallas 12, Dallas 13, Frankfurt 02, Frankfurt 04, Frankfurt 05,Sydney 01, Sydney 04, Sydney 05, Washington 04, Washington 06, and Washington 07).





 Can I have more than five virtual servers within one data center? 

Currently, Hyper Protect Virtual Servers supports only five virtual server instances per account in each data center. To provision more instances, you can use multiple accounts or data centers, or both.





 Is a virtual server available 24 / 7? 

The virtual server is running on infrastructure that needs to be maintained. Before maintenance, stop the virtual servers. You are notified about maintenance schedules in advance. Service availability is defined within the [IBM Cloud® Service Description](https://www-03.ibm.com/software/sla/sladb.nsf/pdf/6605-17/$file/i126-6605-17_06-2019_en_US.pdf).





 Does the data center have an impact on performance and reliability of a virtual server? 

No, all of the data centers are of the same quality. For best availability, follow the hints in question [How do I provide my applications in high availability?]
VPC behind the curtain 

The following information presents a detailed conceptual picture of what's happening "behind the curtain" in VPC networking. Learn about network isolation, address prefixes, Cloud Service Endpoint source addresses, data packet flows, external IP address lifecycle, and Classic infrastructure access. Readers are expected to have some networking background.



 Network isolation 

VPC network isolation takes place at three levels:



* Hypervisor - The virtual server instances are isolated by the hypervisor. A virtual server instance can't directly reach other virtual server instances that are hosted by the same hypervisor if they are not in the same VPC.
* Network - Isolation occurs at the network level by using virtual network identifiers (VNIs). These identifiers are assigned to each subnet and scoped to a single zone. A VNI is added to all data packets that enter any zone of the VPC: entering either from the hypervisor, when sent by a virtual server instance, or entering the zone from the cloud, when sent by the implicit routing function.

A packet that leaves a zone has the VNI stripped off. When the packet reaches its destination zone, entering through the implicit routing function, the implicit router always adds the proper VNI for that zone.
* Router - The implicit router function provides isolation to each VPC by providing a virtual routing function (VRF) and a VPN with MPLS (multi-protocol label switching) in the cloud backbone. Each VPC's VRF has a unique identifier, and this isolation allows each VPC to have access to its own copy of the IPv4 address space. The MPLS VPN allows for federating all edges of the cloud: Classic Infrastructure, Direct Link, and VPC.







 Address prefixes 

Address prefixes are the summary information that is used by a VPC's implicit routing function to locate a destination virtual server instance, regardless of the availability zone in which the destination virtual server instance is located. The primary function of address prefixes is to optimize routing over the MPLS VPN, while pathological routing cases are avoided.
Configuration is required for access to the internet and the IBM Services network. The five public addresses are used for public facing vApps for inbound and outbound public internet traffic.

The service address is used for access to a number of IBM Cloud infrastructure services on the IBM Cloud internal private network. The list includes the following services:



* NTP
* Windows operating system licensing and updates
* Red Hat operating system licensing and updates
* Cloud Object Storage



Two types of Organization virtual data center networks are available in the VMware Shared virtual data center: routed and internal.



 Routed network 

Accessible only by the same Organization virtual data center. Only VMs in this Organization virtual data center can connect to this network. This network also provides controlled access to an external network. An organization administrator can configure Network Address Translation (NAT), firewall, and VPN settings to make specific VMs accessible from the external network.





 Internal or isolated network 

Accessible only by the same Organization virtual data center. Only VMs in this Organization virtual data center can connect to and see traffic on the internal Organization virtual data center network.

The isolated Organization virtual data center network provides an Organization virtual data center with an isolated, private network that multiple VMs and vApps can connect to. This network provides no connectivity to VMs outside the Organization virtual data center. VMs that are outside of the Organization virtual data center have no connectivity to VMs that are in the Organization virtual data center.





 Creating a network 

From the tenant portal, use the following procedures to create a sample network topology that includes: configuring DHCP services, defining Source NAT (SNAT) and Destination NAT (DNAT) rules, and creating firewall rules on the edge gateway to allow access to the internet. Complete these procedures from the tenant portal Data Centers tab.

Zoom

![IBM Cloud for VMware Solutions network topology](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vcd-sample-topology.svg)

Figure 1. IBM Cloud for VMware Solutions network topology
Six different types of virtual server instance data packet flows occur in a VPC. In ascending order of complexity, these flows are:



* Intra-subnet, intra-host (same hypervisor)
* Intra-subnet, inter-host
* Inter-subnet, intra-zone
* Inter-subnet, inter-zone
* Extra-VPC service (for IaaS or CSE access)
* Extra-VPC internet (for internet access)



Intra-subnet, intra-host data flows - These data packets are the simplest. Packets flow between the virtual server instances on the hypervisor, and no packets leave the hypervisor.

Intra-subnet, inter-host data flows - These flows involve packets that leave the hypervisor. Each packet is tagged with the proper VNI (virtualized network identifier) to maintain data isolation. The flows are then sent to the destination hypervisor that hosts the destination virtual server instance. The destination hypervisor strips off the VNI and forwards the data packet to the destination virtual server instance.

Inter-subnet, intra-zone data flows - These flows involve packets that use the VPC's implicit router function, which connects all subnets that are created in the VPC. It routes the data packet to the correct destination hypervisor. If the destination hypervisor is different from the source hypervisor, the data packet is tagged with the proper VNI and sent to the destination hypervisor. There, the VNI is stripped off and the data packet is forwarded to the destination virtual server instance. (These last steps are the same as described in the previous type of data flow.)

Inter-subnet, inter-zone data flows - For these flows, the implicit router function removes the VNI and forwards the packet in the VPC's MPLS VPN for transit across the cloud backbone. At the destination zone, the implicit router function tags the data packet with the appropriate VNI. Then, the packet is forwarded to the destination hypervisor, where the VNI is stripped off again so that the data packet can be forwarded to the destination virtual server instance.
* UI
* CLI
* API







 Creating a network load balancer for VPC with routing mode 

Virtual Network Function (VNF) devices are virtualized network services (such as routers and firewalls) running on virtual machines. With IBM Cloud VPC, you can provision VNF devices to gain better and more affordable scalability than you would by purchasing physical network devices.

Traffic destined for servers in IBM Cloud VPC must be delivered to healthy VNF devices; otherwise, traffic disruption occurs. You can use network load balancers with routing mode to perform health checks and to ensure that workloads only travel through healthy VNF devices. Because of this, network load balancers with routing mode support only VNF devices as back-end targets.

For detailed examples of various ways you can deploy your NLB with routing mode, refer to [HA VNF deployments](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf-ha&interface=ui).



 Prerequisites for NLB with routing mode 

To support routing mode, you must first create a service-to-service authentication policy for your NLB. To do, follow these steps:



1. From your browser, log in to [IBM Access Management](https://cloud.ibm.com/iam/authorizations/grant).
2. Click Authorizations, then click Create.
3. For the source service, select VPC Infrastructure Services. For scope access, select Resources based on selected attributes > Resource Type > Load Balancer for VPC.
4. For the target service, select VPC Infrastructure Services. For scope access, select Resources based on selected attributes > Resource Type > Virtual Private Cloud.
5. Select the Editor checkbox to give yourself Editor access, then click Authorize.







 Creating a network load balancer with routing mode using the UI 

To create and configure Network Load Balancer for VPC with routing mode using the IBM Cloud console, follow these steps:



1.
Overview 

Cyber recovery is one of five functions that are described in the [NIST Cybersecurity framework](https://www.nist.gov/cyberframework). It is defined as the development and implementation of appropriate activities to maintain plans for resilience and to restore any capabilities or services that are impaired due to a cybersecurity incident. The other four functions are identify, protect, detect, and respond.

This documentation describes two solution architectures that can be used to assist with your cyber-recovery requirements. The solution architectures use IBM Cloud® for VMware Solutions vCenter Server® and Veeam® Backup and Recovery for VMware vSphere®. The two solution architectures are named as Immutable backup and Isolated recovery environment.

Zoom

![Immutable backup overview](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/veeam-cr-sa-overview-ib.svg)

Figure 1. Immutable backup overview

The immutable backup solution architecture uses the Veeam Linux® hardened repository design as an immutable storage repository within the production environment. Key elements of the solution architecture include:



* A vCenter Server instance that provides compute, storage, and network resources for the virtual machines.
* The Veeam service that provides backup for the virtual machines.
* The Veeam service is enhanced with a Veeam Linux hardened repository that is hosted on an IBM Cloud® bare metal server.
* Optionally you can use Veeam technologies, such as vPower NFS Service and Mount servers to assist with cyber-recovery tasks.
* The solution architecture does not preclude any of the vCenter Server options, such as Caveonix, Entrust, and VMware Aria® Operations™.
* This solution is suitable for clients who want to extend their Veeam backup with immutability by minimizing costs and by using existing processes and resources.



Zoom

!
Ordering, viewing, and deleting services for vCenter Server with Hybridity Bundle instances 

You can order services for your VMware vCenter Server® with Hybridity Bundle instance, such as a disaster recovery solution. When you no longer need these services, you can delete them from your instance.



 Available services for vCenter Server with Hybridity Bundle instances 

The following services are available to VMware vCenter Server with Hybridity Bundle instances, together with the installed service versions.



Table 1. Available services for vCenter Server with Hybridity Bundle instances

 Service name Current version 

 [Caveonix RiskForesight](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerations) 4.1 
 [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations) BIG-IP VE 17.1 
 [FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations) 7.2.5 
 [Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview) 3.0 (23.1R2) 
 [Veeam](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview) 12 
 [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview) VMware Aria® Operations™ 8.12 and VMware Aria Operations™ for Logs 8.12 
 [Zerto](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-addingzertodr) 9.7u3
The following user interfaces are available for VMware vCenter.



* Web Client
* Thick Client
* VMware API
* VMware CLI





 VMware vCenter features 

VMware vCenter offers the folliwing features.



* Centralized control and visibility for all aspects within managed vSphere hosts and guest virtual machines.
* Provides a window interface view through the vCenter web client for compute network and storage management.
* Proactive Optimization. Enables allocation and optimization of resources for maximum efficiency across the vSphere hosts.
* Extended management function for other integrated add-ons and services such as NSX, vRealize, vSAN, and Site Recovery Manager (SRM).
* Monitoring, alerting, scheduling. Cloud admins can view events, alerts within the vCenter web client and configure scheduled actions.
* Automation engine. vCenter is the engine that performs the tasks that are given to it through the vSphere API web interface. VMware vRealize Automation and vRealize Orchestration are examples of applications that drive vCenter actions through the VMware API.









 VMware NSX 

VMware NSX offers Software-Defined Network (SDN) capabilities that are crucial to support cloud platform operations.

The following user interfaces are available for VMware NSX.



* vCenter Clients
* VMware API
* VMware CLI





 VMware NSX features 

VMware NSX offers the following features.



* Load balancing
* Firewalls
* Routing
* Logical switches
* VPN
* VxLAN segmentation and tunnel endpoints









 VMware vRealize 

The VMware vRealize Suite is an enterprise-ready, cloud management platform that you can use to manage a heterogeneous, hybrid cloud.

The following user interfaces are available for VMware vRealize.



* vCenter Clients
* VMware API
* VMware CLI



The license model for vRealize is per processor per month.



 VMware vRealize features 

VMware vRealize offers the following features.
Configuring services 

There are a variety of services running on the IBM Cloud® Virtual Router Appliance (VRA) that can be configured.

They include:

vyatta@vrouter set service

Possible completions include:

> connsync        Connection tracking synchronization (conn-sync) service
> dhcp-relay      Dynamic Host Configuration Protocol (DHCP) relay agent
> dhcp-server     Dynamic Host Configuration Protocol (DHCP) for DHCP server
> dhcpv6-relay    DHCPv6 Relay Agent parameters
> dhcpv6-server   DHCP for IPv6 (DHCPv6) server
> dns             Domain Name Server (DNS) parameters
> flow-monitoring Flow-Monitoring traffic monitoring configuration
> https           Enable/disable the Web server
> lldp            LLDP settings
> nat             Network Address Translation (NAT)
> netconf         NETCONF (RFC 6241)
> portmonitor     Portmonitor configuration
> sflow           sflow configuration for dataplane
> snmp            Simple Network Management Protocol (SNMP)
> ssh             Secure Shell (SSH) protocol
> telnet          Enable/disable Network Virtual Terminal Protocol (TELNET) protocol
> twamp           Two-Way Active Measurement Protocol
Show more

nat is configured as part of the service, and https controls access to the web GUI and the APIs. connsync defines how two VRAs can share connection tracking synchronization for things like stateful firewall failover.
: Provides compute, storage, and network services to enable the application application provider's administrators to monitor, operate, and maintain the environment.

Workload VPC
: Provides compute, storage, and network services to support hosted applications and operations that deliver services to the consumer.

Other key features to note:



* Supports a single tenant.
* Resides in one or more [multizone regions](https://cloud.ibm.com/docs/overview?topic=overview-locations).
* Gives two options for compute that can be mixed and matched: [IBM Cloud® Virtual Servers for Virtual Private Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-compute-vsi) and [Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-containers-openshift).
* Enables access to the management VPC from the application provider's enterprise environment through [IBM Cloud® Direct Link Dedicated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-direct-link) or [IBM Cloud® Virtual Private Network (VPN) for VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-vpn).
* Provides connectivity from the consumer's enterprise environment to the workload VPC through Direct Link or VPN for VPC.
* Connects management VPC and workload VPC by using [IBM Cloud® Transit Gateway](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-networking-transit-gateway).
Network services provided by Tier-0 and Tier-1 logical routers 

NSX-T™ Data Center supports network services such as IPsec Virtual Private Network (IPsec VPN), Network Address Translation (NAT) and Firewalls as shown in the following diagram.

Zoom

![Network Services provided by Tier-0 and Tier-1 Logical Routers](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-nsx-t-edge-services.svg)

Figure 1. Network Services provided by Tier-0 and Tier-1 Logical Routers

The topic provides a brief introduction to these capabilities and how they can be used in IBM Cloud® Virtual Private Cloud.



 VPN services 

IPsec Virtual Private Network (IPsec VPN) and Layer 2 VPN (L2 VPN) run on an NSX Edge node. IPsec VPN offers site-to-site connectivity between an NSX Edge node and remote sites. With L2 VPN, you can extend your data center by enabling virtual machines (VMs) to keep their network connectivity across geographical boundaries while using the same IP address.

When configuring NSX-T VPN service in IBM Cloud VPC, you can use the public /32 floating IP addresses as the VPN Endpoints both Tier-0 and Tier-1 Logical Routers. You can have multiple VPN endpoints, if needed. When VPN service is configured on Tier-1 Logical Router, ensure that the floating IP is correctly advertised between Tier-0 and Tier-1 Logical Routers.

For more information about VPN service, see [VMware Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-A8B113EC-3D53-41A5-919E-78F1A3705F58.html).





 Network Address Translation