vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Replace the worker VSIs with [Red Hat OpenShift on IBM Cloud and VPC load balancer](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-lbaas).
* Force all out bound traffic through the firewall in the transit VPC and through [Public gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-public-gateways) .







 Related content 



* [IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services)
* Tutorial: [Best practices for organizing users, teams, applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applicationsusers-teams-applications)
* [How to deploy isolated workloads across multiple locations and regions](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-multi-region)
* [Public front end and private backend in a Virtual Private Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-public-app-private-backend),
* [Network Function Virtualization](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf)
* [Private hub and spoke with transparent VNF and spoke-to-spoke traffic](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vnf-ha)
Filtering routes using Transit Gateway prefix filtering 

If you use IBM Cloud Transit Gateway with IBM Cloud Direct Link, you can filter direct link routes using the Transit Gateway prefix filtering capability. For example, if you have a direct link connected to a transit gateway, you can place the filters on the transit gateway or direct link connection as shown in Figure 1. This allows you to control what prefixes are learned by the transit gateway and is advantageous if you have dozens of on-premises prefixes, but only want the VPC connection to be able to talk to one prefix (or a select few).

The prefix filter only filters prefixes into the transit gateway. There is no prefix filter to block prefixes learned by the transit gateway out to networks that are connected to it. This means that the direct link sees all the prefixes from all the networks participating in the transit gateway.

Zoom

![Filtering routes using Transit Gateway prefix filtering](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/prefix-filter-transit-gateway1.svg)

Figure 1. Filtering routes using Transit Gateway prefix filtering

Direct Link BGP route filters work effectively with Transit Gateway prefix filters. You can use both filters at the same time. For more information about Transit Gateway prefix filters, see [Adding and deleting prefix filters](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-adding-prefix-filters&interface=ui).
* [Components and architecture of an NLB 2.0](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer-aboutplanning_ipvs)



* [Traffic flow in a single-zone cluster](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer-aboutipvs_single)
* [Traffic flow in a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer-aboutipvs_multi)





[Classic: Setting up basic load balancing with an NLB 1.0](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancerloadbalancer)



* [Setting up an NLB 1.0 in a multizone cluster](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancermulti_zone_config)
* [Setting up an NLB 1.0 in a single-zone cluster](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancerlb_config)
* [Enabling source IP preservation](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancerlb_source_ip)



* [Adding edge node affinity rules and tolerations](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancerlb_edge_nodes)
* [Adding affinity rules for multiple public or private VLANs](https://cloud.ibm.com/docs/containers?topic=containers-loadbalanceredge_nodes_multiple_vlans)





[Classic: Setting up DSR load balancing with an NLB 2.0](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer-v2loadbalancer-v2)



* [Prerequisites](https://cloud.ibm.com/docs/containers?topic=containers-loadbalancer-v2ipvs_provision)
The following will display help:

./apply.sh
5. You could apply all of the layers configured by executing ./apply.sh : :. The colons are shorthand for first (or config_tf) and last (vpe_dns_forwarding_rules_tf). The -p prints the layers:

./apply.sh -p : :

It will look something like:

directories: config_tf enterprise_tf transit_tf spokes_tf test_instances_tf transit_spoke_tgw_tf enterprise_link_tf firewall_tf all_firewall_tf spokes_egress_tf all_firewall_asym_tf dns_tf vpe_transit_tf vpe_spokes_tf vpe_dns_forwarding_rules_tf
6. If you don't already have one, obtain a [Platform API key](https://cloud.ibm.com/iam/apikeys) and export the API key for use by Terraform:

export IBMCLOUD_API_KEY=YourAPIKEy
7. In this first step apply in config_tf, enterprise_tf, transit_tf and spokes_tf:

./apply.sh : spokes_tf







 Step 2: Create test instances 

VPC Virtual Server Instances, VSIs, are provisioned to test the network connectivity. A test instance will be added to each of the worker subnets (one per zone) in the enterprise, transit and each of the spokes. If the default configuration of 3 zones and 2 spokes is used then 12 instances will be provisioned.

Zoom

![Test Instances](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-test-instances.svg)

Test Instances



1. Create the test instances
For more information, see [Creating an Unbound Generic Routing Encapsulation tunnel connection](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-unbound-gre-connection).
* Direct Link creates a network connection to and from Direct Link gateways so that there is a secure connection to on-premises networks and other resources connected to the transit gateway.

If you select Direct Link, you must also log in to the [Direct Link console](https://cloud.ibm.com/interconnectivity/direct-link) and specify Transit Gateway as the type of network connection for your direct link.



2. After you select a network connection, choose a connection reach option:



* Add new connection in this account - Enter an optional connection name and any other required information for your connection.
* Request connection to a network in another account - Enter either the IBM Cloud ID or Cloud Resource Name (CRN) of the account that manages the network where you want to connect. Then, complete any remaining information. All resources connected to that transit gateway will be accessible from the other network. For more information, including how to obtain the Cloud ID or CRN, see [Adding a cross-account connection](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-adding-cross-account-connections&interface=ui).



* IBM Cloud ID - Required by Classic infrastructure and Unbound GRE connections.
* CRN - Required by VPC and Direct Link connections.







8. Optionally, you can create prefix filters to permit or deny specific routes on specific connections. For prefix filtering considerations and step-by-step instructions, see [Adding and deleting prefix filters](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-adding-prefix-filters).

To begin, expand the drop-down arrow in the upper right of the Prefix filtering section, and complete the following information:



1. Select the default filter that you want to use. You can either permit (default) or deny all prefixes.

The default filter is applied only if you don't create prefix filters that bypass this default setting.
AC-4 (6) - Metadata 



  Control requirements 

AC-4 (6) - 0
:   The information system enforces information flow control based on [Assignment: organization-defined metadata].





  Additional IBM Cloud for Financial Services specifications 



*  This control is required for ISVs.







  NIST supplemental guidance 

Metadata is information used to describe the characteristics of data. Metadata can include structural metadata describing data structures (e.g., data format, syntax, and semantics) or descriptive metadata describing data contents (e.g., age, location, telephone number). Enforcing allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata with regard to data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., ensuring sufficiently strong binding techniques with appropriate levels of assurance).
* NSX Manager provides a graphical user interface (GUI) and REST APIs for creating, configuring, and monitoring NSX-T Data Center components such as segments, logical routers, and firewalls. NSX Manager provides a system view and it is the management component of NSX-T Data Center.
* NSX Host Transport Nodes participate in an NSX-T Data Center overlay or NSX-T Data Center VLAN networking. Each provisioned ESXi host in the VPC must be enabled to be a Transport Node.
* NSX Edge Transport Nodes are service appliances, which are dedicated to running centralized network services that cannot be distributed to the hypervisors. Edge Nodes are grouped in one or several gateway clusters, representing a pool of capacity.



When deployed on IBM Cloud VPC, the VMware virtual machines (VMs) hosted on IBM Cloud bare metal server for IBM Cloud VPC can be connected to NSX-T overlay segments. NSX-T segments are logically abstracted network segments in a defined Transport Zone. A Transport Zone is a container that defines the potential reach of Transport Nodes, Hosts, or Edges. The NSX-T segments support line-rate switching and distributed routing in the ESXi hosts. Also, it uses Geneve encapsulation for this overlay traffic to identify and isolate L2 segments over a common L3 infrastructure. In this design, Geneve traffic traverses between the defined Transport Nodes that use IBM Cloud VPC as the underlying transport network.

In addition to basic software defined overlay networks, NSX-T brings many embedded advanced features. The features are Network Address translation, site to site IPsec VPNs, firewall policies, inclusion of guest introspection within firewall policies, and advanced netflow tracking. Describing these features in detail is beyond the scope of this document. For more information about NSX-T, see [VMware NSX-T Data Center Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html).





 NSX-T data center deployment architecture 



 vSphere distributed switch deployment
route](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_vpc_routing_table_routesargument-reference) resources<br> * Support tags argument for [ibm_is_security_group](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_security_groupargument-reference) resources<br> * Support security-groups argument for [ibm_is_lb](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_lbargument-reference) resources and [ibm_is_lb](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_lb) data sources<br> * Support public_key argument for [ibm_is_ssh_key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/is_ssh_key) data sources<br> * Support default_network_acl_name, default_security_group_name,
By default, T0 does not know about the segments that are attached to T1, and this is where route advertisement is needed.

If you want to route natively with IBM Cloud VPC subnets and other connected service without using NAT in T1, enable route advertisement of "All Connected Segments & Service Ports" in the specific T1. You must not configure a routing protocol or static routes between T1 and T0 logical routers. After you enable the route advertisement, NSX-T creates routes automatically. With this approach, you have all connected segments on your T1 routed to T0, and then you can decide how to proceed with the public and private traffic in T0.





 Public traffic between Tier-0 and VPC 

The second architectural decision to be made for your solution is public traffic. If your workloads need direct public traffic and have inbound public traffic without using any network translation, you must provision the public uplink subnet and public T0 uplink VLAN interfaces. Also, you must configure your T0 with public uplinks as described in the topic [Tier-0 logical router](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-nsx-t-logical-routersvpc-ryo-nsx-t-logical-routers-edge-tier-0) previously. As the NSX-T T0 uses Active-Standby, the HA VIP provides high availability for the routing of public traffic between VPC, T0 and your NSX-T workloads. When you need public IPs, you can order floating IP address to the HA VIP VLAN interface. Each floating IP is a single /32 IP address, and you can order as many as you need within VPC [Quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas).



Table 3. Public uplink HA VIP to be used for Public floating IPs

 Interface name Interface type VLAN ID Subnet Allow float Allow IP spoofing Enable infra NAT NSX-T interface Segment name
Traffic traverses a dedicated connection, or through a service provider with a dedicated connection.
* By bypassing the public internet, your traffic takes fewer hops, so there are fewer points of failure where your traffic might get dropped or disrupted.
* Move data to and from your on-premises data centers into the IBM Cloud with uninterrupted, consistent network performance while protecting sensitive, business-critical data.
* Save on data transfer rates to and from servers in every IBM Cloud data center across our private network, avoiding bandwidth fees.







 Routing considerations for IANA-registered IP assignments 

IBM Cloud VPC supports the use of RFC-1918 and Regional Internet Registry (RIR) assigned addresses privately as VPC subnets. The following use cases require additional route configurations to designate the Internet Assigned Numbers Authority (IANA) assigned ranges for use in a VPC when a floating IP or a public gateway is attached to a resource within the VPC.



* Use case 1: VPC is connected to your Enterprise with IBM Cloud Direct Link and requires communication with IANA-assigned networks on that Enterprise.
* Use case 2: VPC is connected to another VPC through IBM Cloud Transit Gateway and requires communication to IANA-assigned networks in the connected VPCs.
* Use case 3: VPC is connected to a classic infrastructure network by using BCR peering to announce IANA-assigned ranges to the classic network.



In these scenarios, each subnet in the VPC must have a routing table attached with routes designating the IANA-assigned ranges as targets for private routing, or all traffic to these publicly routable ranges is forwarded toward the public backbone, and not toward the intended private network destination. This applies to VPC subnets using RFC-1918 "and" IANA assigned prefixes. As with all custom route additions, the routing table must include a route for each Availability Zone (AZ) requiring connectivity.

Options include:



* If the VPC default (egress) routing table is attached to all VPC subnets, create a route for each IANA prefix or aggregate per zone in the VPC default table with the Delegate-VPC action. This defers to the VPC system routing table for forwarding action.
Therefore, backing out of a migration means moving the VMs back or restretching the networks. As a result, you do not need a large part of migration planning and some parallelism in the planning process might occur. After you select the applications to move and create a high-level network design, the applications can begin migration with minimal configuration on the cloud instance while the final network connectivity and design is worked out.





 Stretched networks 

The network stretch components of the HCX fleet are stable. One customer has greater than 20 VLANs that are stretched into the IBM Cloud® across 1 Gbps WAN shared with other traffic and HCX migration tunnels. This configuration does not have any application issues that are attributed to the network. The network links are up for greater than 6 months in this way.

More stretched networks were added and removed without issue. Picking an IBM Cloud data center that is close (<6 ms latency for this particular customer) also plays into network stability of stretched networking. Leaving the stretched networks up long term, is not a negative factor in your design given you have enough bandwidth and low enough latency for your applications.





 Migration lifecycle 

The following sections describe the phases within a typical HCX migration lifecycle, denoting where work streams can be done in parallel.





 vSphere inventory 



* Coarse-grained assessment of VMs within an application to be migrated. Coarse grained implies understanding the VMs that participate in an application, without delving into the details.
* If you plan to migrate many VMs and network bandwidth is limited between the source and cloud sites, further group VMs by VLAN or VXLAN if NSX is employed at the source. This allows for a cascading HCX migration plan where groups of VMs by VLAN are migrated and the L2 networks they reside upon are stretched only until the point the VLANs are released.



This means that the initial group of related L2 stretched networks can be unstretched only when the cloud side network design is finalized and deployed. Unstretching implies swinging the particular VXLAN traffic to now route through the cloud instance NSX infrastructure.





 Baseline network configuration 

Create a secured perimeter network within the cloud side vSphere instance. This usually consists of an NSX DLR or Edge appliance.
* [Enabling Proxy protocol](https://cloud.ibm.com/docs/cis?topic=cis-enable-proxy-protocol)



* [Using service endpoints to privately connect to CIS](https://cloud.ibm.com/docs/cis?topic=cis-service-endpoints)
* Working with TLS



* [Setting Transport Layer Security (TLS) options](https://cloud.ibm.com/docs/cis?topic=cis-cis-tls-options)
* [Using mutual TLS](https://cloud.ibm.com/docs/cis?topic=cis-mtls-features)
* [Authenticated origin pull](https://cloud.ibm.com/docs/cis?topic=cis-authenticated-origin-pull)



* Working with WAFs



* [WAF actions and rule sets](https://cloud.ibm.com/docs/cis?topic=cis-waf-settings)
* [Using the CIS Security Events capability](https://cloud.ibm.com/docs/cis?topic=cis-using-the-cis-security-events-capability)



* Working with firewall rules



* [Creating, editing, and deleting firewall rules](https://cloud.ibm.com/docs/cis?topic=cis-about-firewall-rules)
* [Assigning firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)
* [Using fields, functions, and expressions](https://cloud.ibm.com/docs/cis?topic=cis-fields-and-expressions)
* [Prioritizing options](https://cloud.ibm.com/docs/cis?topic=cis-priority)



* Working with global load balancers



* [Configuring a global load balancer](https://cloud.ibm.com/docs/cis?topic=cis-configure-glb)
* Global load balancer features
Assess migration complexity 

In this step of the process, you can check the source NSX-V environment and use a number of parameters to categorize the migration project. The possible three complexity categories are Low, Medium, or High.

The following diagram depicts the parameters and shows how the values of these parameters map to the complexity assessment.

Zoom

![Complexity categories](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/v2t-diagrams-criteria.svg)

Figure 1. Complexity categories

You can use the following assessment approach:



1. For each parameter, review your source NSX-V environment and select a complexity classification.
2. Work through all the parameters.
3. At the end of the process, see in which complexity column most of your parameter complexity classifications are aligned with, for example:



1. If all are aligned with Low complexity, then the migration complexity is Low. In this case, go to step 5.
2. If most is aligned with Medium complexity but the minority is High, then the migration complexity at this stage is Medium. Go to step 4.



4. For those parameters that are not aligned in one column completely, review them and consider the impact on the classification by using the guidance on key parameters in the following sections. For instance, a key parameter might tip the assessment into a High complexity.
5. The assessment is complete.



Depending on the source environment complexity and the skills, experience and time commitments of your team, you might want to engage professional services. This action is done to plan and run the migration for you.



 Zone deployment 

Your source vCenter Server® instance with NSX-V environment is in one of the following deployment patterns:



* Simple - one single zone, with all VMware ESXi™ hosts deployed in one data center.
* Medium - two or more single zones, often used as production in one zone and development or DR in another zone.
Comparing Layer-2 and Layer-3 connections for Direct Link 

IBM Cloud® Direct Link accepts OSI Layer-2 and Layer-3 partner interconnections from network service providers (NSPs). Some network service providers offer services for both of these layers on different networks, however, some providers might choose not to interconnect all of their networks into IBM Cloud.

When planning your IBM Cloud Direct Link deployment, consider the characteristics that are associated with Layer-2 and Layer-3 connections, so you can create a deployment that best suits your needs.



 Considerations for Layer-2 connections 

For each VLAN-based virtual circuit, which you create with a Layer-2 partner interconnection, you must configure and establish a BGP session between your on-premises routers and the IBM Cloud XCR. IBM Cloud provides you with a /31 IPv4 assignment to establish a BGP session with your router.



* Layer-2 networks offer options for simple one-to-one connections between enterprises and IBM Cloud.
* Layer-2 services rely on VLANs instead of IP addresses.
* Layer-2 services might be lower cost and lower latency, and they might consume less overhead than Layer-3 services.
* Layer-2 networks do not impose restrictions on the Layer-3 features that an enterprise can enable.







 Considerations for Layer-3 connections 

For Layer-3 connections, for each virtual circuit, your service provider establishes a BGP session between IBM Cloud XCRs and the provider's edge routers. You do not need to configure BGP with IBM Cloud for your on-premises router because your service provider manages the BGP configuration to IBM Cloud. This means when you order Direct Link Connect via the IBM Portal, you need to populate the Layer 3 providers ASN for the BGP session, not your customer ASN



* Layer-3 IP VPN or AVPN networks enable "any-to-any" connectivity.
* Layer-3 networks require the network service provider to maintain a BGP session between the enterprise and IBM Cloud.
* Certain network service providers might restrict certain functionalities across their network when using Layer-3 connections, such as ASN prepend, GRE tunneling, and so forth.