vania-janet/multiturn-rag-retrieval-data huggingface dataset:
It uses the Isolate workloads with a secure private network tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the VLAN Spanning service.

Virtual Router Appliance Virtual Servers for Classic

+1

VLANs



* 2023-05-05



[Configure NAT for Internet access from a private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-nat-config-private)Configure NAT for Internet access from a private network

This tutorial presents the setup of Network Address Translation (NAT) masquerade on a Virtual Router Appliance (VRA) to connect to a secured subnet on the IBM Cloud private network. It builds on the Isolating workloads with a secure private network tutorial, adding a Source NAT (SNAT) configuration, where the source address is obfuscated and firewall rules are used to secure out-bound traffic. More complex NAT configurations can be found in the supplemental VRA documentation.

Virtual Router Appliance



* 2023-05-05



[Isolating workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure)Isolating workloads with a secure private network

This tutorial highlights how a Virtual Router Appliance (VRA) can be configured on the IBM Cloud to create a secure private network (enclosure). The VRA provides in a single self-managed package, a firewall, VPN gateway, Network Address Translation (NAT) and enterprise-grade routing. In this tutorial, a VRA is used to show how an enclosed, isolated network environment can be created on the IBM Cloud. Within this enclosure application topologies can be created, using the familiar and well known technologies of IP routing, VLANs, IP subnets, firewall rules, virtual and bare-metal servers.

Virtual Router Appliance



* 2023-05-05
Security in your VPC 

You can keep IBM Cloud® Virtual Private Cloud and workloads secure by controlling network traffic using security groups, by using network access control lists (ACLs), or by using both types of control.



 Security overview 

Security groups and access control lists (ACLs) provide ways to control the traffic across the subnets and instances in your IBM Cloud® Virtual Private Cloud, using rules that you specify. Security groups and ACLs add security to your subnets and instances:



* Traffic to and from a subnet can be controlled by Access Control Lists (ACLs).
* Security Groups can control the traffic at the virtual server instance level.
* Allow you to set up a public gateway for subnet access to the internet, guarded by ACLs.
* Allow you to implement a floating IP for virtual server instance access to the internet, guarded by SGs.



Zoom

![Figure showing how a VPC can be subdivided with subnets](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpc-connectivity-and-security.svg)

Figure 1. IBM VPC connectivity and security





 Definitions 

The sections that follow describe basic functions of ACLs and security groups, and the ways in which VPC supports end-to-end encryption.



 Access Control List 

An Access Control List (ACL) can manage (that is, it can allow or deny) inbound and outbound traffic for a subnet. An ACL is stateless, which means that inbound and outbound rules must be specified separately and explicitly. Each ACL consists of rules, based on a source IP, source port, destination IP, destination port, and protocol.

Every VPC has a default ACL that allows all inbound and outbound traffic. You can edit the default ACL rules, or create a custom ACL and attach it to your subnets. A subnet can only have one ACL attached to it at any time, but one ACL can be attached to multiple subnets.
Planning for virtual server instances 

When you're planning to provision virtual server instances for IBM Cloud VPC, use the following table to help you get the most out of your deployment.



 Planning to provision virtual server instances 

After a VPC is available, consider the following before you provision your instance.

The default VPC is selected automatically. If another VPC is not selected, the default VPC is attributed to the virtual server instance.



Table 1. Checklist for planning to provision a virtual server instance

 Item Considerations 

 Required IAM permissions Make sure that your account has the required user permissions. If you have authorization as an editor or admin on a VPC resource, then you also inherit authorization to create, delete, and modify virtual server instances within that virtual private cloud. 
 Account limits Check your [account limits](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas) for concurrent instances. 
 SSH key Make sure that your [SSH key](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keysssh-keys) is available. 
 Location Determine what region and zone to select. 
 Subnet Determine which subnets that you want the instance to connect to. 
 Profile Consider the popular [profile options](https://cloud.ibm.com/docs/vpc?topic=vpc-profilesprofiles) of vCPU and RAM combinations for your workload. Profiles contain preconfigured instances that are ready to use in a matter of minutes. It's important to make sure that your instances have the necessary resources to keep your workloads and your environment up and running. For IBM Cloud® Hyper Protect Virtual Server for IBM Cloud® Virtual Private Cloud instances and z/OS virtual server instances, see [s390x instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-vs-profiles).<br><br>Some profiles might not be available because the amount network interfaces in the virtual server exceed profile limits. You can remove network interfaces to select from more profiles.
Use the following information to understand a simple use case for planning, creating, and configuring resources for your VPC, and learn about more VPC overviews and VPC tutorials. [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)





 SAP HANA in IBM Cloud 

The IBM public cloud is an open, security-rich, and enterprise-ready public cloud for business. This design makes it easier for global enterprises to modernize and build new business applications in the cloud to meet the evolving needs of the business and its customers. IBM Cloud offerings include a broader portfolio of SAP-certified infrastructure, ranging from bare metal, VMware, VPC, and IBM Power® Systems Virtual Server products.





 SAP HANA defined 

SAP HANA (High-performance ANalytic Appliance) is a multi-model database that stores data in its memory instead of keeping it on a disk. This arrangement results in data processing that is magnitudes faster than processing of disk-based data systems, allowing for advanced, real-time [analytics](https://www.ibm.com/analytics/business-analytics).

Serving as a platform for enterprise resource planning (ERP) software and other business applications, SAP HANA can be placed on premises, in the cloud, or both, in a [hybrid cloud](https://www.research.ibm.com/hybrid-cloud/?lnk=leadspace) system. For more information, see [SAP HANA on IBM Cloud](https://www.ibm.com/topics/sap-hana).

The number of hosts in an SAP HANA system landscape determines the SAP HANA system type.

An SAP HANA system can be configured as either:



* A single-host system - One SAP HANA instance on one host.
* A distributed system (multiple-host system) - Multiple SAP HANA instances distributed over multiple hosts,







 Single-host SAP HANA system 

A single-host system is the simplest system installation type that runs an SAP HANA system entirely on one host. You can scale the system up as needed. The single-host system has these components:

Zoom

![Figure 1.
Virtual private endpoints (VPE) 

Worker nodes can communicate with the Kubernetes master through the cluster's [virtual private endpoint (VPE)](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).

A VPE is a virtual IP address that is bound to an endpoint gateway. One VPE gateway resource is created per cluster in your VPC. One IP address from one subnet in each zone where your cluster has worker nodes is automatically used for the VPE gateway, and the worker nodes in this zone use this IP address to communicate with the Kubernetes master. To view the VPE gateway details for your cluster, open the [Virtual private endpoint gateways for VPC dashboard](https://cloud.ibm.com/vpc-ext/network/endpointGateways) and look for the VPE gateway in the format iks-<cluster_ID>.

Note that your worker nodes automatically use the VPE that is created by default in your VPC. However, if you enabled the [public cloud service endpoint for your cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_vpc_basicsvpc-workeruser-master), worker-to-master traffic is established half over the public endpoint and half over the VPE for protection from potential outages of the public or private network.

Do not delete any IP addresses on your subnets that are used for VPEs.





 Network segmentation 

Network segmentation describes the approach to divide a network into multiple sub-networks. Apps that run in one sub-network can't see or access apps in another sub-network. For more information about network segmentation options for VPC subnets, see [this cluster security topic](https://cloud.ibm.com/docs/openshift?topic=openshift-securitynetwork_segmentation_vpc).

Subnets provide a channel for connectivity among the worker nodes within the cluster. Additionally, any system that is connected to any of the private subnets in the same VPC can communicate with workers.
With IBM Cloud VPC, you can use the UI, CLI, and API to manually provision virtual server instances for VPC with high network performance. VPC infrastructure contains a number of Infrastructure-as-a-Service (IaaS) offerings, including Virtual Servers for VPC. Use the following information to understand a simple use case for planning, creating, and configuring resources for your VPC, and learn about more VPC overviews and VPC tutorials. For more information about VPC, see [Getting started with Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).





 SAP on IBM Cloud 

SAP NetWeaver is the core foundation of the SAP technology stacks and is the platform that is used for ABAP and Java applications. The SAP system can be installed and configured in IBM Cloud for various system and database types.

For more information about SAP system architectures on IBM Cloud VPC, see the infrastructure reference architectures for SAP for each supported database type. For example, [SAP NetWeaver 7.x on UNIX with ASE SYB on IBM Cloud VPC](https://cloud.ibm.com/docs/sap?topic=sap-sap-refarch-nw-sybase) is the dedicated reference architecture for this SAP solution.





 SAP Additional Application Server Instance 

You can install one or more additional application server instances for an existing SAP system. Additional application server instances are optional and can be installed on separate hosts.

An additional application server instance can run on:



* The host of any instance of the existing SAP system
* On a dedicated host - distributed on additional IBM VPC (VSI instance)



Zoom

![Figure 1. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-hana-single-host-all.svg)

Figure 1. SAP NetWeaver 7.x with SAP HANA database single-host installation with AAS
SAP NetWeaver deployment to Intel Virtual Server on VPC Infrastructure that uses Windows Server 

A Quick Study, someone who is able to learn new things quickly.

These Quick Study Tutorials provide a single sample configuration, with less detailed instructions, as an introduction for customers who prefer hands-on tasks to increase their pace of learning.

The following information provides an introduction for customers who are new to IBM Cloud® Virtual Private Cloud (VPC) environment. Two sample configurations are provided to help you through the ordering process to the start of the SAP installation.

The first configuration sample is simple, a single node 128 GB, 32 vCPU virtual server instance (VSI). The second is an advanced configuration of two nodes by adding a second VSI to the landscape. The sample layouts might not be your preferred layout. The purpose of this guidance is to show you two possibilities if you are not experienced with the Windows® operating system or with VPC.

Although we want to start quickly, you first must be able to log in to IBM Cloud and make sure that you have access to important SAP resources. Read the Pre-Requisites for SAP Workloads topic group, under [Necessary account credentials for SAP and IBM Cloud](https://cloud.ibm.com/docs/sap?topic=sap-necessary-credentials).

This tutorial contains instructions to complete the deployment - a detailed explanation of the navigation through the IBM Cloud console and all available options that you can use, you find in the topic [Deploying your infrastructure](/docs/sap?topic=sap-vs-set-up-infrastructure).
{: note}



 Step 1: Securing Access 

Security is one of the biggest concerns when you run your business-critical applications in a cloud environment. To secure your connection to your IBM® Virtual Servers, a public SSH key can be uploaded to your account, per region. These public keys are deployed to your VSIs to allow access to them.

Before you continue, create an SSH public key that you can upload later to the region of your choice when you are creating the VSI. Follow the steps that are [documented here](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys).
It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.



 Before you begin 

Follow the instructions to [install Terraform and the IBM Cloud Provider plug-in for Terraform](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform) on your workstation.





 Provision a single virtual server instance 

Before deploying a more complex architecture and in order to validate the Terraform provider installation, let's deploy a single virtual server instance with a floating IP and then access this server through SSH.

Check the [main.tf](https://github.com/IBM-Cloud/vpc-tutorials/blob/master/vpc-app-deploy/tfinstance/main.tf) file for a terraform script. It utilizes the environment variables defined earlier.



1. Change to the terraform script folder for this example:

cd $CHECKOUT_DIR/vpc-app-deploy/tfinstance
2. Initialize Terraform:

terraform init
3. Apply the Terraform plan:

terraform apply

The script creates a VPC, a VSI and enable SSH access.
4. View the output generated by the plan:

terraform output
5. You could copy paste the output of the previous command or you can use terraform output as follow to SSH into the VSI

$(terraform output -raw sshcommand)

Using outputs in Terraform can become quite handy when you want to reuse resource properties in other scripts after you have applied a Terraform plan.
6. Remove the resources created by Terraform:

terraform destroy







 Provision subnets and virtual server instances 

The set of Terraform files under the vpc-app-deploy/tf folder of the vpc-tutorials repository implements the architecture of the Public frontend and private backend in a Virtual Private Cloud tutorial.
Shared nodes are usually less costly than dedicated nodes because the costs for the underlying hardware are shared among multiple customers. However, when you decide between shared and dedicated nodes, you might want to check with your legal department to discuss the level of infrastructure isolation and compliance that your app environment requires.

Some classic worker node flavors are available for only one type of tenancy setup. For example, m3c VMs can be provisioned in a shared tenancy setup only.





 How does bandwidth allocation work for VPC Gen 2 worker nodes? 

Note that IBM Cloud Kubernetes Service doesn't support adjusting the bandwidth profile that is associated with the underlying VPC instance profile.

When you provision a worker node on a VPC Gen 2 cluster, you get the default bandwidth allocation for that instance profile. For more information, see [Bandwidth profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-bandwidth-allocation-profiles).





 How does storage work for VMs? 

Every VM comes with an attached disk for storage of information that the VM needs to run, such as OS file system, container runtime, and the kubelet. Local storage on the worker node is for short-term processing only, and the storage disks are wiped when you delete, reload, replace, or update the worker node. For persistent storage solutions for your apps, see [Planning highly available persistent storage](https://cloud.ibm.com/docs/containers?topic=containers-storage-plan). Additionally, classic and VPC infrastructure differ in the disk setup.



* Classic VMs: Classic VMs have two attached disks. The primary storage disk has 25 GB for the OS file system, and the auxiliary storage disk has 100 GB for data such as the container runtime and the kubelet. For reliability, the primary and auxiliary storage volumes are local disks instead of storage area networking (SAN). Reliability benefits include higher throughput when serializing bytes to the local disk and reduced file system degradation due to network failures. The auxiliary disk is encrypted by default.
* VPC compute VMs: VPC VMs have one primary disk that is a block storage volume that is attached via the network.
: In this release, you can customize node titles in dialog.





 22 December 2016 

Node title section
: In this release, dialog nodes display a new section for node title. The ability to customize the node title is not available. When collapsed, the node title displays the node condition of the dialog node. If there is not a node condition, "Untitled Node" is displayed as the title.





 19 December 2016 

Dialog editor UI changes
: Several changes make the dialog editor easier and more intuitive to use:



* A larger editing view makes it easier to view all the details of a node as you work on it.
* A node can contain multiple responses, each triggered by a separate condition. For more information see [Multiple responses](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-responses).







 5 December 2016 

Updates
: This release includes the following updates:



* New languages are supported, all in Experimental mode: German, Traditional Chinese, Simplified Chinese, and Dutch.
* Two new system entities are available: @sys-date and @sys-time. For details, see [System entities](https://cloud.ibm.com/docs/assistant?topic=assistant-system-entities).







 21 October 2016 

Updates
: This release includes the following updates:



* The Watson Assistant service now provides system entities, which are common entities that can be used across any use case. For details, see [Defining entities](https://cloud.ibm.com/docs/assistant?topic=assistant-entities) and search for Enabling system entities.
* You can now view a history of conversations with users on the Improve page. You can use this to understand your bot's behavior. For details, see [Improving your skill](https://cloud.ibm.com/docs/assistant?topic=assistant-logs).
* You can now import entities from a comma-separated value (CSV) file, which helps with when you have a large number of entities.
This documentation is for the classic Watson Assistant experience. To see the documentation for the new Watson Assistant, please go [here](https://cloud.ibm.com/docs/watson-assistant).



 Modifying a dialog using the API 

The Watson Assistant REST API supports modifying your dialog programmatically, without using the Watson Assistant tool. You can use the /dialog_nodes API to create, delete, or modify dialog nodes.

Remember that the dialog is a tree of interconnected nodes, and that it must conform to certain rules in order to be valid. This means that any change you make to a dialog node might have cascading effects on other nodes, or on the structure of your dialog. Before using the /dialog_nodes API to modify your dialog, make sure you understand how your changes will affect the rest of the dialog. You can make a backup copy of the current dialog by exporting the conversational skill in which it resides. See [Downloading a skill](https://cloud.ibm.com/docs/assistant?topic=assistant-skill-tasksskill-tasks-download) for details.

A valid dialog always satisfies the following criteria:



* Each dialog node has a unique ID (the dialog_node property).
* A child node is aware of its parent node (the parent property). However, a parent node is not aware of its children.
* A node is aware of its immediate previous sibling, if any (the previous_sibling property). This means that all siblings that share the same parent form a linked list, with each node pointing to the previous node.
* Only one child of a given parent can be the first sibling (meaning that its previous_sibling is null).
* A node cannot point to a previous sibling that is a child of a different parent.
* Two nodes cannot point to the same previous sibling.
* A node can specify another node that is to be executed next (the next_step property).
* A node cannot be its own parent or its own sibling.
* A node must have a type property that contains one of the following values. If no type property is specified, then the type is standard.
[Example dialog](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/dialog_api_1.png)

We can create a new node by making a POST request to /dialog_nodes with the following body:

{
"dialog_node": "node_8"
}

The dialog now looks like this:

![Example dialog 2](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/dialog_api_2.png)

Because node_8 was created without specifying a value for parent or previous_sibling, it is now the first node in the dialog. Note that in addition to creating node_8, the service also modified node_1 so that its previous_sibling property points to the new node.

You can create a node somewhere else in the dialog by specifying the parent and previous sibling:

{
"dialog_node": "node_9",
"parent": "node_2",
"previous_sibling": "node_5"
}

The values you specify for parent and previous_node must be valid:



* Both values must refer to existing nodes.
* The specified parent must be the same as the parent of the previous sibling (or null, if the previous sibling has no parent).
* The parent cannot be a node of type response_condition or event_handler.



The resulting dialog looks like this:

![Example dialog 3](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/dialog_api_3.png)