vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Isolation of development, test, and production environments on the same bare metal infrastructure
* Single Account multi-tenant clouds



NSX can be configured through the vSphere Web Client, a command line interface (CLI), and REST API. The core network services that are offered by NSX are:



 Logical switches 

A cloud deployment or a virtual data center might have various applications across multiple tenants. These applications and tenants require isolation from each other for security, fault isolation, and avoiding overlapping IP addressing issues. The NSX logical switch creates logical broadcast domains or segments (VXLAN vWires) to which an application or tenant virtual machine can be logically wired. This feature allows for flexibility and speed of deployment while still providing all the characteristics of a physical network's broadcast domains (VLANs) without physical Layer 2 sprawl. Logical switches allow for thousands of tenant networks to be provisioned onto a single IBM Cloud private network (VLAN). A logical switch is distributed and can span arbitrarily large compute clusters, even across pods within the same data center. This distribution allows for virtual machine mobility within the data center without limitations of physical Layer 2 (VLAN) boundaries across pods.





 Logical routers 

Dynamic routing provides the necessary forwarding information between Layer 2 broadcast domains (VXLAN, vWires, Logical Switches). This routing decreases Layer 2 broadcast domains and improve network efficiency and scale. NSX extends this intelligence where the workloads reside for providing East-West routing functions. This extension allows more direct virtual machine to virtual machine communication without the costly or timely need to extend hops. NSX also provides North-South connectivity inbound and outbound of IBM Cloud data centers, thus enabling tenants to access public networks securely and efficiently.





 Logical firewall 

Logical firewall provides security mechanisms for dynamic virtual data centers. The Distributed Firewall component of an NSX Logical Firewall allows users to segment virtual data center entities (virtual servers), vCenter objects (data centers and hosts), and traditional networking attributes like IP addresses and VLANs.
In this scenario, three virtual server instances are connecting to services and customers through a public gateway and floating IP address.

External service 1 and External service 2 (logging) receive outbound traffic from Virtual server instance 1 and Virtual server instance 2 through a single Public gateway connection. Floating IP address 1 associated with this public gateway connection allows the Virtual server instances to access External service 1 by IP address through a firewall. The External customer sends and receives traffic to and from Virtual server instance 3 through floating IP address 2:

Zoom

![Examples of external connectivity](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/public-gateway.svg)

Figure 1. Examples of external connectivity







 Related Links 

These links provide additional information about IBM Cloud public gateways.



* [VPC external connectivity options](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpcpublic-gateway-for-external-connectivity)
* [Create VPC resources with CLI and API](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-vpc-resources-with-cli-and-api&interface=cli)
* [Public gateway prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-create-public-gateways&interface=uipg-before-you-begin)
* [Create your public gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-create-public-gateways&interface=uipg-creating-api)
vCPU 8 
 Memory 32 GB 
 Disk (thin provisioned) 1 TB 







 Networking 

Deployment of the VMware Aria Operations for Networks appliance requires two IP addresses from the Tooling private portable subnet. Network connectivity VMware Aria Operations for Networks requires access to the following items:



* vCenter Appliance
* VMware Aria Operations for Logs Appliance
* NSX-T or NSX-V Appliances
* Tooling Expansion VXLAN
* Customer Networks
* NTP server (time.services.softlayer.com)
* IBM Cloud for VMware Solutions Active Directory/DNS







 Ports 



Table 2. VMware Aria Operations for Networks ports

 Description Port Protocol 

 Communication between the VMs of VMware Aria Operations for Networks 443 HTTPS 
 Services that require internet access <br>svc.ni.vmware.com <br>support2.ni.vmware.com <br>reg.ni.vmware.com 443 HTTPS 
 VMware Aria Operations for Logs Ingestion API 9000 TCP 
 VMware Aria Operations for Logs Ingestion API over SSL 9543 TCP 
 User Interface 80,443 TCP 
 NTP 123 UDP 
 SMTP 25 TCP 
 DNS 53 UDP 
 LDAP/LDAPS 389, 636 TCP 
 ESXi 2055 TCP 
 VMware vSphere® and NSX 443 TCP 







 Authentication 

VMware Aria Operations for Networks user authentication is directly with an Active Directory Server.
Ensuring isolation between Satellite management functions and workload functions 

A key aspect of the IBM Cloud Framework for Financial Services is to separate user workloads from system management functions and isolate security functions from nonsecurity functions. The network infrastructure of the Satellite location can be used to provide physical and logical separation between the Satellite management control plane and your workloads.

Network flow rule design should follow the IBM Cloud Framework for Financial Services's [information flow guidelines](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-boundary-protection) by using a "deny by default" approach.



 Before you begin 



1. Complete the work for [account setup and management](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-account-setup).
2. Complete [Satellite location setup](https://cloud.ibm.com/docs/satellite?topic=satellite-locations).







 Identify network areas for control plane hosts and workload hosts 



1. Place control plane hosts into a separate network segment. Control plane hosts support various management and security-related components of the Satellite location. To facilitate effective network flow restrictions within the Satellite location, it is recommended to place control plane hosts into a separate network segment (whether physical or virtual) that can enable clear identification of source or destination of the network flows related to control plane functionality. The control plane hosts can be deployed to different physical locations, but the address space they are assigned to should provide an easy way to identify this group of hosts (for example, CIDR blocks).
2. Designate a separate network segment for each group of Satellite hosts assigned to Red Hat OpenShift on IBM Cloud workload clusters. Satellite hosts that are assigned to Red Hat OpenShift on IBM Cloud workload clusters (workload hosts) should use their own network segments that would enable network flow control and monitoring between workload hosts, control plane, and other components outside of the Satellite location. It is recommended to designate a separate network segment (virtual subnet, VLAN, or a similar entity) for each group of Satellite hosts assigned to the same workload cluster.
3.
In IBM Cloud VPC, you can create two types of network interfaces on a bare metal server.



* PCI (Peripheral Component Interconnect) interface represents a physical network interface. It is possible to include up to 8 PCI interfaces on a bare metal server.
* VLAN (Virtual LAN) interface represents an interface that is associated with a PCI interface through the VLAN ID. The VLAN interface automatically tags traffic that is routed through it with the VLAN ID. Inbound traffic that is tagged with a VLAN ID is directed to the appropriate VLAN interface. You can have as many VLAN interfaces as you want.



In a VMware solution, PCI interface is used as the vSwitch uplink and as a management VMkernel adapter. An important difference between PCI interfaces and VLAN interfaces is that a VLAN interface can be set to floatable. The key function of the VMware workloads requires vMotion between the IBM Cloud bare metal server. This capability is used with VMware management workloads such as vCenter® or NSX® managers to allow them to be moved between hosts for high availability (HA) or distributed resource scheduler (DRS).

In this architecture, VLAN interfaces are used in many ways:



* For VMkernel adapters, such as vMotion, vSAN, and NSX-T™ TEPs.
* For VMware management appliances, such as vCenter and NSX-T managers.
* For VMware virtual machines (VMs) attached to VPC subnets.



Both PCI and VLAN interfaces can be attached to a VPC security group, and security group rules can be applied to these interfaces. Also, VPC ACLs can be used to control inbound and outbound traffic for a subnet to which these PCI and VLAN interfaces are attached.

For more information about the networking concepts, see [Networking overview for IBM Cloud Bare Metal Servers on VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-network).





 Storage design
The VPC network is fully software-defined, so you can configure it through the GUI, CLI, API, or by using IBM Cloud Terraform provider.





 Physical network segmentation 

The VMkernel networking in VMware provides connectivity to hosts, and handles the standard system traffic of vSphere vMotion, IP storage, Fault Tolerance, vSAN™, and others. It is recommended to take appropriate security measures to prevent unauthorized access to the management and system traffic in your vSphere environment. In IBM Cloud VPC, you can do logical segmentation or isolation in many ways. The built-in capabilities in VPC and the bare metal server network interfaces are used to secure VMkernel networking by following the VMware best practices.





 IBM Cloud bare metal server network interfaces 

The IBM Cloud bare metal server and the VMware workloads that are hosted on the bare metal server can connect with IBM Cloud virtual server instances on the VPC. The IBM Cloud bare metal server for VPC supports vMotion (for live migration of instances between ESXi hosts), IP failover capabilities and the use of VMware vSphere Distributed Resource Scheduler (DRS).

The IBM Cloud bare metal server in IBM Cloud VPC uses SmartNICs. Each physical host has a redundant 100 Gb network connection for network access to IBM Cloud VPC. The high availability for physical network connectivity is handled by IBM Cloud, and you do not have to configure anything additional. The 100 Gb bandwidth is shared by the network interfaces that are configured and currently active on the bare metal server.

A network interface in a bare metal server is an abstract representation of a network interface card, and a network interface connects a bare metal server to a VPC subnet.

In IBM Cloud VPC, you can create two types of network interfaces on a bare metal server.



* PCI (Peripheral Component Interconnect) interface represents a physical network interface. It is possible to include up to 8 PCI interfaces on a bare metal server.
* VLAN (Virtual LAN) interface represents an interface that is associated with a PCI interface through the VLAN ID. The VLAN interface automatically tags traffic that is routed through it with the VLAN ID.
: Two new endpoints are now available in the Toronto location for the KMIP for VMware service.

Veeam on vSphere 6.5 - deprecated
: New installations of Veeam are no longer supported for new or existing deployments of vCenter Server instances with VMware vSphere 6.5. You can still use or delete existing Veeam installations on your existing vSphere 6.5 instances.

REST APIs
: REST API support is now available for the F5 BIG-IP and FortiGate Virtual Appliance services and for adding edge services clusters to vCenter Server instances.

New and updated documentation
: The following documentation updates are available.



* Upgrading vCenter Server vSphere software from VMware vSphere 6.5 or 6.7 to 7.0 now includes important considerations and a section for updating licenses.
* FAQ is updated to clarify how service license charges are being calculated.







 5 April 2021 

VMware Solutions Shared - support for Zerto
: Starting with the 4.1 release, the Zerto service is available and ready-to-use to provide disaster recovery for critical workloads in your virtual data center instances. Additionally, you can order the Zerto Cloud Connector (ZCC) service after you deploy your virtual data center instance. Use ZCC to replicate your on-premises virtual data centers to IBM Cloud.

Charges are incurred only if you choose to use the services.

VMware Solutions Shared - network type options
: The option to select a private only network or a public and private network is now available when you order VMware Solutions Shared instances.

VMware Solutions Dedicated - upgrade support for vSphere 7.0 instances
: For VMware vCenter Server instances with VMware vSphere 6.5 or vSphere 6.7, in-place upgrade to vSphere 7.0 is now supported for select configurations. Not all hardware configurations are supported, and the upgrade cannot help you migrate from VMware NSX-V to NSX-T or from a nonconverged NSX-T topology to a converged NSX-T topology.

You must contact IBM Cloud for VMware Solutions Support before and after you upgrade your instance.
For more information about recommended services details, see [Managing Veeam for VMware Shared virtual data centers](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_veeam) and [Managing Zerto for VMware Shared virtual data centers](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_zerto-portal).





 Related links 



* [Creating a private network endpoint](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_creating-endpoints)
* [Resizing your virtual data centers](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_resize)
* [Deleting VMware Shared virtual data centers](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_deletinginstance)
* [Accessing the VMware Cloud Director Management console](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_accessing-vcd-console)
* [VMware Cloud Director](https://www.vmware.com/ca/products/cloud-director.html)
* [Cyber recovery with Veeam architecture overview](https://cloud.ibm.com/docs/vmwaresolutions/?topic=vmwaresolutions-veeam-cr-sa-overview)
* [Juniper vSRX overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview)
* [Managing Juniper vSRX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-managing)
* [Juniper Networks vSRX deployment and operation with vCenter Server on IBM Cloud](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vcsvsrx-intro)
* [Managing VLANs with a gateway appliance](https://cloud.ibm.com/docs/gateway-appliance?topic=gateway-appliance-managing-vlans-and-gateway-appliances)
* [IBM Cloud IP ranges](https://cloud.ibm.com/docs/gateway-appliance?topic=cloud-infrastructure-ibm-cloud-ip-ranges)
* [VLANs and subnets in IBM Cloud® for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-vlans-subnets)
* [Ports that are used for deployment and Day 2 operations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-deploy-day2ops)
* [Ports used by IBM Cloud for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-vmwareuses)
About virtual servers 

IBM Cloud® Virtual Servers are scalable virtual servers that are purchased with cores and memory allocations. These servers are a great option if you are looking for compute resources, that can be added in minutes, with access to features like image templates. For more information about image templates, see [Image templates](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-image-templates).

Virtual servers are deployed to the same VLANs as physical servers, which spread workloads across virtual servers and bare metal servers, while interoperability is maintained. Virtual servers are fully customizable when you order them, with options to scale up as your compute needs grow.

Newer version available! Try our Virtual Servers for VPC. For more information, see [Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started).

When you create a virtual server, you can choose between a public (multi-tenancy) environment or a dedicated (single-tenancy) environment. You can also choose between hourly or monthly billing, and high-performance local disks or enterprise SAN storage.

The hypervisor is fully managed by IBM Cloud and you can perform configuration and management tasks by using both the IBM Cloud console and the SoftLayer API.



 Key features 

The following information lists the key features that are included with virtual servers.



 Seamless integration 

Virtual servers are deployed to the same POD and network as bare metal servers and network appliances. This type of deployment gives you the flexibility to use the best technology for each workload. Multiple virtual servers are commonly deployed behind a load balancer to serve web traffic. These servers can have direct layer 2 private network access to bare metal database servers and other more intensive workloads.





 Fully customizable 

You can build-to-suit any virtual server with a number of options. With no pre-defined package requirements, you can tune each server to the workload it supports.





 Rapid provisioning 

Virtual servers are provisioned in as few as 5 minutes, giving you minimal wait time between order and provisioning.





 Remote management
You cannot access some endpoint networks (services and infrastructure services) from your Power Systems Virtual Server subnets. The types of endpoint networks are as follows:



* Service endpoints - Allows connection to IBM Cloud services available through DNS names in the cloud.ibm.com domain and resolves to 166.9.x.x addresses.
* Infrastructure services - Allows connection to IBM Cloud services from the adn.networklayer.com domain and resolves to 161.26.0.0/16 addresses. Services that you can reach include:



* DNS resolvers - 161.26.0.10 and 161.26.0.11 (Windows VS is set up with 161.26.0.7; Linux with 161.26.0.7 and 161.26.0.8)
* Ubuntu and Debian mirrors - mirrors.adn.networklayer.com or 161.26.0.6
* NTP - time.adn.networklayer.com or 161.26.0.6. This is the same IP address as the Ubuntu and Debian mirrors.
* IBM Cloud Object Storage





4. Create Virtual Private Endpoints (VPEs) for services of interest such as DNS, NTP, and IBM Cloud Object Storage. For more information, see [VPE supported services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services).
5. If you want to access the endpoint network, use a VPC virtual server instance to proxy the any required endpoint services that do not support VPEs.



Each IBM Cloud Direct Link service is not redundant, however, diversity can be engineered by using multiple Direct Links and BGP. For more information, see [Models for diversity and redundancy in Direct Link (2.0)](https://cloud.ibm.com/docs/dl?topic=dl-models-for-diversity-and-redundancy-in-direct-link).





 Connecting to on-premises by using Megaport
Network architecture diagrams 

This topic describes typical network architectures that are used in the Power® Systems Virtual Server network architecture and is not an exhaustive list of Power Systems Virtual Server connection methods.

IBM Cloud Direct Link (2.0) Connect is available in all current locations. IBM clients can always contact Megaport connectivity services directly to procure their services.



 Power Systems Virtual Server networking environment 

When you create a Power Systems Virtual Server, you can select a private or public network interface. For more information, see [Public and Private networks](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-about-virtual-serverpublic-private-networks).

Power Systems Virtual Server network architectures consist of one or more of the following networks:



* IBM Cloud infrastructure networks - While the following infrastructure network environments offer different features and are managed separately, they can be connected to each other to provide layer-3 IPv4 traffic flow:



* Classic - Classic network resources include VLANs, subnets, and SSL Virtual Private Network (VPN) access. See [Network security architecture](https://www.ibm.com/cloud/architecture/architectures/network-security-arch/) for a description of the classic network components. Bring Your Own IP (BYOIP) is not supported.
* Virtual Private Cloud (VPC) - VPC network resources include subnets, floating IPs, security groups, and VPN gateways. For more information, see [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc). See [Advanced networking for IBM Cloud VPC](https://www.ibm.com/cloud/architecture/content/course/advanced-networking-for-vpc/) for a one-hour course on VPC networking. BYOIP is supported.
* Power Systems - Network resources include subnets. BYOIP is supported.



* Overlay networks - These networks exist in the IBM Cloud VMware Shared and VMware Dedicated offerings.
Managing network interfaces 

After you create a virtual server instance, you can add new network interfaces or edit the interfaces that are already associated with the instance. When you edit a network interface, you can change its name, associate or unassociate a floating IP address, or access the security group that is associated with an interface.



 About network interfaces 

A network interface connects a virtual server instance to a network. When you create a virtual server instance, you can use network interfaces to assign multiple IP addresses.

The following list highlights how network interfaces work with your instance.



* You can create and assign multiple network interfaces for each virtual server instance. The number of network interfaces that you can assign to a virtual server instance depends on the vCPU count that is included in the [profile](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles) that is used to provision an instance.



* 2 - 16 vCPUs: Up to five network interfaces
* 17 - 48 vCPUs: Up to 10 network interfaces
* 49 or more vCPUs: Up to 15 network interfaces



* You can attach each network interface to a different subnet in the same zone.
* Each network is assigned a unique and immutable Media Access Control (MAC) address and receives a private IP address from the subnet range.
* You can attach one floating IP address to the virtual server instance. The floating IP address must be attached to the primary network interface to establish the data path. By default the primary interface is eth0 in IBM Cloud console.
* If you want to assign a floating IP address to a secondary NIC (eth1), you can use the [CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencefloating-ips-cli-ref).
* You can associate and unassociate a single floating IP address for the instance.
* You can assign security groups to each network interface.
* You can change the name of any existing network interface.



Bandwidth is distributed across the network interfaces that are attached to the virtual server instance.