vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Anti-affinity: Use this option to identify one or more storage pools that you want to exclude from getting selected to place the boot voulmes based on one or more existing PVM instances (VMs) or storage volumes from your account. While choosing a storage pool to create the custom image storage volume(s), the storage pools in which the list of anti-affinity object(s) reside will not be selected. If you are using PVM instances as the anti-affinity objects, the storage pools are excluded depending on each PVM instance’s root (boot) volume that you specified.



For more information about affinity and anti-affinity policy, see [What does it mean to set an affinity or anti-affinity rule?](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-power-iaas-faqsaffinity).

If you add volumes to be created and attached to your new VM during creation then all the volumes will be placed in the same selected storage pool. Volumes can be created in different storage pools after the VM has been provisioned.
10. Finally, define your Network interfaces by adding a public network, private network, or both. When adding an existing private network, you can choose a specific IP address or have one auto-assigned.

For an AIX VM, network interface controllers (NICs) are assigned based on the order in which you specify them during creation. To display information about all of the network interfaces after provisioning, open the AIX console and type ifconfig -a.
11. Accept the Terms of Use and click Create instance to provision a new Power Systems Virtual Server. To view your boot images, go to Boot images after you provision the instance.



Refer to the following table for more information on each Power Systems Virtual Server instance field.



Table 2. Power Systems Virtual Server instance fields

 Field Description 

 General Instance name: Specify an apt name for your virtual server instance. <br>Number of Instances : Specify the number of instances that you want to create for the Power Systems Virtual Server. You can apply placement groups only when you are creating a single VM instance.
The following section describes the physical network that is provided by the IBM Cloud as it relates to attached storage.



 IBM Cloud network overview 

The physical network of IBM Cloud is separated into three distinct networks: Public, Private, and Management. For more information about the public, private, and management networks, see [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview).

For more information about the IBM Cloud network, see [IBM Cloud global data centers](https://www.ibm.com/cloud/data-centers/).

Review the following information for a description of the services network that is part of the private network.





 Private services network 

IBM Cloud has a private services network that provides common services such as block storage, file storage, Object Storage, DNS resolvers, and NTP servers. This private network is separate from the customer private network and it enables environments to seamlessly connect to services located in the IBM Cloud. The private network is multitiered in that servers and other infrastructure are connected to aggregated back-end customer switches (BCS). These aggregated switches are attached to a pair of separate routers such as back-end customer routers or BCR, for L3 networking. The private network also supports the ability to use jumbo frames, such as, MTU 9000, for physical host connections.





 VLANs 

For more information about the VLANs, see the Physical network design section in [Physical infrastructure design](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-design_physicalinfrastructure).







 Physical storage design 

The following section describes the configuration of the attached storage device that is present in the IBM Cloud. The attached storage device complements the existing vCenter Server solution. As a result, locally attached disks that are internal to the physical hosts aren't presented.





 Attached storage performance 

Performance and Endurance storage are IBM Cloud storage solutions that are designed to support high I/O applications that require predictable levels of performance.
* Optionally, enter a destination port.
* Optionally, enter a description. A description can be useful to identify the SNAT rule later.
* Set to Enabled.
* Optionally, enable logging. Logs are not preserved. If you want to have historical data, you must set up a syslog server.







 Create the Organization virtual data center network firewall rule to allow access to the IBM Cloud Services Network 

From the virtual data center for that edge gateway, create the network firewall rule. For more information, see [Add an NSX data center for vSphere Edge Gateway firewall rule](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-97ADAF42-598B-44B2-80EF-8B215B743C78.html).

Review the following notes for creating the Organization virtual data center network firewall rule to allow access to the IBM Cloud Services Network.



* For Source you can use an IP address, a range of addresses, or an object.
* In the Browse objects of Type menu, select Org Vdc Networks. Select the Organization virtual data center network that you created as the Source cell. Click the right arrow to move the Organization virtual data center network into the Filter column.
* The destination can be an IP address, a range of addresses, or an object. In the Destination column, click the + in the upper right of the cell when you hover your mouse in the field. In the Browse objects of Type menu, select Gateway Interfaces. Select the service network available to your virtual data center. Click the right arrow to move the service network into the right side filter column.
* For Action, select Accept.
* To define a destination IP address or range, click the IP in the destination cell and set the IP address or range to allow everything on that subnet. For example, 192.168.100.2 or 192.168.100.0/24.







 Source NAT definitions to the IBM Service Network (Private)
While the vSphere administrator holds responsibility for proper operation of the underlying ESXi hosts that form the gateway cluster, the VMware administrator has no access rights to the vSRX appliance nodes that run on them. There is no software-defined network applicable to the gateway cluster, so the NSX-T administrator has no access to the vSRX appliance nodes.

The security administrator is solely responsible for the configuration, operation, and maintenance of the vSRX gateway cluster. Only the security administrator has the right to implement configuration changes that impact the security stance of the IBM Cloud for VMware Regulated Workloads management layer.

Where a physical appliance such as the FortiGate appliance is used in place of the gateway cluster, the security administrator retains responsibility for its operation though no role for the virtual platform administrator exists.





 Workload cluster 

The vSphere administrator is responsible only for the proper operation of the workload hosts that deliver virtualized compute, storage, and networking services for consumption by the client applications.

The security administrator responsible for the management layer does not retain any responsibility for the security of the SaaS applications beyond the requirement that appropriate policies are in place. These policies protect the infrastructure upon which the SaaS consumer deploys their applications and protect the network perimeter to which NSX-T passes north-south traffic.

The SaaS provider might designate one or more NSX-T tenant network administrators to provision and manage network services that are delivered through NSX-T to support the requirements of the applications deployed into the workload clusters. Limited access and scope are assigned to the tenant network administrator by the platform network administrator. The scope that is assigned might include the ability to deploy and modify security policies that impact the workload scope but that do not extend beyond the workload context.





 Related links 



* [IBM Cloud compliance programs](https://www.ibm.com/cloud/compliance)
For example, imagine that you order 20 TB of bandwidth on the 15th of the month. The allocation that is shown on the bandwidth summary page will show 10 TB until the next billing cycle. Then, the allocation displays the full amount of what was ordered.





 What is the maximum number of devices that I can attach to a bandwidth pool? 

You can attach an unlimited number of devices to a bandwidth pool.





 Is there a charge for traffic on the Classic Private Network? 

There is no charge for traffic between Virtual Servers for Classic or Bare Metal Servers for Classic, on the Classic Private network, within the same Classic account.





 Where do I find detailed analytics about my bandwith usage on particular devices? 

There are bandwidth graphs per device in the IBM Cloud console, but these graphs only shows bandwidth use over time. They don't proide information about which IP addresses or ports are using bandwidth. Depending on your operating system or device, you can install tools or utilize pre-installed tools to monitor the per-IP and per-port details of your traffic.

If you need help installing or using these tools, or if you can't locate the bandwidth graphs per device in the portal, contact IBM Cloud support.
internet-svcs.tiered-caching.update Enable or disable tiered caching. 







 List of events: Certificate packs 

The following table lists the actions that are related to certificate packs and generate an event:



Table 9. Actions that generate certificate pack events

 Action Description 

 internet-svcs.certificate-packs.create Order a dedicated wildcard or custom certificate. 
 internet-svcs.certificate-packs.delete Delete a dedicated wildcard or custom certificate. 







 List of events: Custom certificates 

The following table lists the actions that are related to custom certificates and generate an event:



Table 10. Actions that generate custom certificate events

 Action Description 

 internet-svcs.custom-certificates.create Upload a custom certificate. 
 internet-svcs.custom-certificates.update Update a custom certificate. 
 internet-svcs.custom-certificates.delete Delete a custom certificate. 







 List of events: Origin certificates 

The following table lists the actions that are related to origin certificates and generate an event:



Table 11. Actions that generate origin certificate events

 Action Description 

 internet-svcs.origin-certificates.create Create an origin certificate. 
 internet-svcs.origin-certificates.delete Revoke an origin certificate. 







 List of events: Edge functions 

The following table lists the actions that are related to edge functions and generate an event:



Table 12. Actions that generate edge functions events

 Action Description 

 internet-svcs.edge-functions-scripts.create Create an edge functions script. 
 internet-svcs.edge-functions-scripts.update Update a new version of edge functions script. 
 internet-svcs.edge-functions-scripts.delete Delete an edge functions script. 
 internet-svcs.edge-functions-routes.create Create an edge functions route. 
 internet-svcs.edge-functions-routes.update Update an edge functions route. 
 internet-svcs.edge-functions-routes.delete Delete an edge functions route. 







 List of events: Range applications 

The following table lists the actions that are related to range applications and generate an event:



Table 13. Actions that generate range events

 Action Description
For more information, see [Public and private network endpoints](https://cloud.ibm.com/docs/text-to-speech?topic=watson-public-private-endpoints).





 Virtual private endpoints 

IBM Cloud

IBM Cloud® Virtual Private Endpoints for Virtual Private Cloud (VPC) are available with certain plans. Virtual private endpoints enable you to connect to supported IBM Cloud services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC. Virtual private endpoints are an evolution of the private connectivity to IBM Cloud services. They are virtual IP interfaces that are bound to an endpoint gateway created on a per service or service instance basis.

Virtual private endpoints are supported only for paid plans. Check the plan information for your service to learn about the plans that support virtual private endpoints. For more information, see [Virtual Private Endpoints](https://cloud.ibm.com/docs/text-to-speech?topic=watson-virtual-private-endpoints).





 CORS support 

The service supports Cross-Origin Resource Sharing (CORS). By using CORS, web pages can request resources directly from a foreign domain. CORS circumvents the same-origin security policy, which otherwise prevents such requests. Because the service supports CORS, a web page can communicate directly with the service without passing the request through the web server that hosts the page.

For instance, a web page that is loaded from a server in IBM Cloud can call the customization API directly, bypassing the IBM Cloud server. For more information, see [enable-cors.org](https://enable-cors.org/).





 Signed URLs 

Signed URLs provide authentication information as a query string. Although signed URLs provide access for a limited time and with limited permissions, they allow any user with such a URL to access the service, regardless of whether that user has an account. The Text to Speech service does not support signed URLs.





 FISMA support 

IBM Cloud Pak for Data
The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. Refer to [Activity Tracker](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-network-security-group) for information on what events are tracked in VPC and [Getting Started with Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).





 Flow Logs 

IBM Cloud Flow Logs for Virtual Private Cloud (VPC) enable the collection, storage, and presentation of information about the Internet Protocol (IP) traffic going to and from network interfaces within your VPC. Flow logs can help with a number of tasks, including troubleshooting why specific traffic isn't reaching a virtual server instance to diagnose security group rules as well as enabling the adhering to compliance regulations. refer to [About Flow Logs](https://cloud.ibm.com/docs/vpc?topic=vpc-flow-logs) for further information.

A flow log is a summary of the network traffic between two virtual network interface cards (vNICs), within a time window. A flow log describes traffic that security groups or network ACLs accepts or rejects. A flow log contains header information and payload statistics for Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) traffic, but not Internet Control Message Protocol (ICMP) traffic. The key components are as follows:



* Collection - Flow log collectors are configured to collect flow data and the the collectors can be configured with different scopes:



* VPC - Collects data for all network interfaces on a specific VPC.
* Subnet - Collects data for all network interfaces on a specific subnet.
* Instance - Collects data for all network interfaces on a specific virtual server.
* Interface - Collects data for a specific network interface on a specific virtual server.



* Storage - Flow logs are stored in an IBM Cloud Object Storage (COS) bucket. This bucket is configured during the setup of the flow log collector.
* Presentation - IBM Cloud SQL Query is IBM's serverless SQL service on data on COS, and is used to create queries on the flow logs stored in COS.
By leveraging the key management service, your regulated workloads are protected with the envelope encryption mechanism.

For more information about the key management service, see [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-importing-keys) and [Protecting your data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption).
* Using the GREP11 and PKCS #11 APIs Hyper Protect Crypto Services provides a set of cryptographic functions that are run in the cloud HSM. You can perform cryptographic operations such as key generation, data encryption, and signature verification. To do so, you can access the cloud HSM with either the PKCS #11 API or the Enterprise PKCS #11 over gRPC (GREP11) API. These operations ensure that your private keys and data are protected by the HSM that meets the regulatory requirements.

Both the PKCS #11 API and the GREP11 API access the EP11 library that is enabled by the Hyper Protect Crypto Services cloud HSM to execute cryptographic functions. Comparing with the GREP11 API, the implementation of the standard PKCS #11 API enables portable applications and provides a wider range of cryptographic operations.

For more information about these two APIs and how they differ, see [Introducing cloud HSM](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsm).







 Regulated workloads use cases 

The following use cases show how Hyper Protect Crypto Services can work with other IBM Cloud services to manage your regulated workloads. For a complete list of IBM Cloud services that can integrate with Hyper Protect Crypto Services, see [Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).



 Managing VMware regulated workloads with Hyper Protect Crypto Services
These aggregated switches are attached to a pair of separate routers, FCR, for L3 networking.

This multitier design allows the network to scale across racks, rows, and pods within an IBM Cloud data center.





 Private network 

All IBM Cloud data centers and PoPs are connected by the private network backbone. This private network is separate from the public network, and it enables connectivity to services in IBM Cloud data centers around the world. Moving data between IBM Cloud data centers is done through multiple 10 Gbps or 40 Gbps connections to the private network.

Similar to the public network, the private network is multitiered in that servers and other infrastructure components are connected to aggregated back-end customer switches (BCS). These aggregated switches are attached to a pair of separate back-end customer routers (BCR) for L3 networking. The private network also supports the ability to use jumbo frames (MTU 9000) for physical host connections.





 Host management 

On the private network, each IBM Cloud server is connected for management by using the private primary network subnet. This connection allows Intelligent Platform Management Interface (IPMI) access to the server independently of its CPU, firmware, and operating system, for maintenance and administration purposes.





 Primary and portable IP blocks 

IBM Cloud allocates two types of IP addresses to be used within the IBM Cloud infrastructure:



* Primary IP addresses are assigned to devices, bare metal, and virtual servers that are provisioned by IBM Cloud. Do not assign any IP addresses in these blocks.
* Portable IP addresses are provided for you to assign and manage as needed. vCenter Server provisions several portable IP ranges for its use. Use only the portable IP address ranges that are assigned to specific NSX®-T components and specified for customer use. For example, Customer EDGE.



Primary or portable IP addresses can be made routable to any VLAN within your account when the account is configured as a Virtual Routing and Forwarding (VRF) account.





 Virtual Routing and Forwarding 

The IBM Cloud infrastructure customer portal account must be configured as a Virtual Routing and Forwarding (VRF) account to enable automatic global routing between subnet IP blocks. All accounts with Direct-Link connections must be converted to, or created as, a VRF account.
It provides deep operational visibility and faster troubleshooting across physical, virtual, and cloud environments.

All systems that generate logs are configured to send their logs to VMware Aria Operations™ for Logs. Centralized collection of all logging enables a comprehensive view of all aspects of the IBM Cloud for VMware Regulated Workloads operation.VMware Aria Operations for Logs is also capable of forwarding logs to security scanning services such as IBM QRadar.

Zoom

![VMware Aria Operations for Logs integration](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-log-flow.svg)

Figure 2. VMware Aria Operations for Logs integration





 VMware Aria Operations for Networks 

[VMware Aria Operations for Networks](https://www.vmware.com/products/aria-operations-for-networks.html) helps you build an optimized, highly available, and secure network infrastructure across hybrid and multicloud environments. It provides network visibility and analytics to accelerate micro-segmentation security, minimize risk during application migration, optimize network performance and confidently manage and scale NSX deployments.

VMware Aria Operations™ for Networks monitors network components and management traffic throughout the entire IBM Cloud for VMware Regulated Workloads instance. The monitoring scope includes insight into the operation of the NSX-T™ overlay network. VMware Aria Operations for Networks is also used to help optimizing performance by eliminating network bottlenecks. VMware Aria Operations for Networks is an optional component that requires manual installation.







 Gateway cluster 

No operational tools are deployed to the gateway cluster. The gateway cluster is monitored and managed by using the tools that are deployed on the management cluster. All components of the gateway cluster are configured to deliver their log files to VMware Aria Operations for Logs, inclusive of the virtual gateway syslog facilities. If the physical FortiGate is deployed instead of the gateway cluster, its syslog facility must send logs to VMware Aria Operations for Logs.





 Workload cluster