vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Getting started with Catalog Images on VPC 

When you provision IBM Cloud® Virtual Servers for Virtual Private Cloud on x86 architecture, you can select from the supported virtual server operating system stock images, the virtual server operating system bundle stock image, or a custom image that you import from IBM Cloud Object Storage. The image that you select determines the operating system that is provisioned for your instance. If the image you select is a virtual server operating system bundle stock image, the software that is part of that bundle is also included in your instance.

In [IBM Cloud console](https://cloud.ibm.com/login), go to Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images.

There are 3 different types of images for VPC.



* [Custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images) (includes [Image from volume](https://cloud.ibm.com/docs/vpc?topic=vpc-image-from-volume-vpc))
* [Stock images](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started-images-on-vpc-stock)
* Catalog images





 Images on VPC - Catalog images 

If you plan to share or publish a custom image to other accounts within your enterprise, you need to create a private catalog. A private catalog provides a way for you to manage access to products for multiple accounts while those accounts are within the same enterprise. You can share any existing x86 virtual server custom image with a private catalog, except for an encrypted image. For more information about these limitations, see [VPC considerations when using custom images in a private catalog](https://cloud.ibm.com/docs/vpc?topic=vpc-custom-image-cloud-private-catalog&interface=api).
The support package level of each component version is a key part of the stack and a unique identifier for the support package stack.





 Installation types 

The three installation types for SAP NetWeaver Application Server are:



* ABAP System– You can run ABAP programs and some SAP Java apps
* Java System– You can run only Java Platform, Enterprise Edition apps. No ABAP programs can be run on a Java system
* Dual Stack – You can run both ABAP and Java Platform, Enterprise Edition in separate instances









 Architecture diagram 

This diagram shows the SAP NetWeaver 7.X on MS SQL Server database integrated with IBM Cloud on the SAP NetWeaver 7.x architecture:

Zoom

![Figure 1. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-mssql-std-all.svg)

Figure 1. SAP NetWeaver 7.x with MS SQL Server standard installation with AAS





 Access from an external network 

Clients on the customer facing network (CFN) use a floating IP to access virtual server instances within the IBM Cloud. Virtual server instances are hosted in availability zones (data centers) within geographic regions.

Within the Public Subnet, the [SAP router](https://support.sap.com/en/tools/connectivity-tools/saprouter.html) and the jumphost provide secure connections to the virtual server instances. The SAP router is a software application that provides a remote connection between the customer's network and SAP. The SAP Router and jumphost are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from MS SQL Server database. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).
The support package level of each component version is a key part of the stack and a unique identifier for the support package stack.





 Installation types 

The three installation types for SAP NetWeaver Application Server are:



* ABAP System– You can run ABAP programs and some SAP Java apps
* Java System– You can run only Java Platform, Enterprise Edition apps. No ABAP programs can be run on a Java system
* Dual Stack – You can run both ABAP and Java Platform, Enterprise Edition in separate instances









 Architecture diagram 

This diagram shows the SAP NetWeaver 7.X on SAP HANA Server database integrated with IBM Cloud on the SAP NetWeaver 7.x architecture:

Zoom

![Figure 1. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-hana-single-host-all.svg)

Figure 1. SAP NetWeaver 7.x with SAP HANA database single-host installation with AAS





 Access from an external network 

Clients on the customer facing network (CFN) use a floating IP to access virtual server instances within the IBM Cloud. Virtual server instances are hosted in availability zones (data centers) within geographic regions.

Within the Public Subnet, the [SAP router](https://support.sap.com/en/tools/connectivity-tools/saprouter.html) and the jumphost provide secure connections to the virtual server instances. The SAP router is a software application that provides a remote connection between the customer's network and SAP. The SAP Router and jumphost are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from MS SQL Server database. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).
* The traffic source IP is not in any subnet associated with the VPC routing table. For example, the VPC routing table is associated with subnet A and includes a route whose next hop is a VPN connection. However, when the traffic reaches the VPN gateway, the source IP is not in subnet A or any other subnets that are associated with the routing table. Therefore, the VPN gateway drops the traffic.





Virtual Private Networks (VPN)



* What is IBM Cloud VPN?

IBM Cloud® VPN access is designed to allow users to remotely manage all servers securely over the IBM Cloud private network. A VPN connection from your location to the private network allows for out-of-band management and server rescue through an encrypted VPN tunnel. VPN tunnels can be created to any IBM Cloud data center or PoP providing geographic redundancy.

With VPN access, you can:



* Establish a VPN connection to the private network by using SSL or IPsec
* Access your server through its private 10.x.x.x IP address by using SSH or RDP
* Connect to your server’s IPMI IP address for server management or rescue needs.



Our SSL VPN gateway is a security product from Array Networks. The gateway itself runs radius to update users and passwords from our customer portal.
* What if I cannot connect to the SSL or IPsec VPN endpoint of my choice?

Geographic redundancy exists to allow access into your private network from anywhere in the world that you choose to connect from. If one location doesn't connect, you can use a different data center during the interruption. If multiple locations are failing to connect, visit our Troubleshooting section.
* Does the SSL VPN also perform IPsec or other VPN protocols?

Currently, the SSL VPN gateway uses a browser-based SSL VPN plug-in or a proprietary client for creating connections. We continue to bring more VPN connectivity options to the private network. The SSL VPN was selected for ease of use and compatibility.
* Can I mount the NAS/FTP server from my remote location over the SSL VPN gateway?
The management VPC is distributed across three zones in one [multizone region (MZR)](https://cloud.ibm.com/docs/overview?topic=overview-locationsmzr-table). Each zone contains two subnets that are protected by different ACLs.





 Subnets for management tools 

The top subnet in each zone is part of the default security group for the VPC. And, each of those subnets contains an arbitrary number of virtual server instances that use Block Storage for VPC. These instances are where your management tools run.

The lower subnets in the diagram relate to inbound connectivity, and we'll cover more about that in the next sections.





 Connectivity inbound to VPC 

Connectivity from your application provider's enterprise environment to the management VPC is accomplished by using IBM Cloud Direct Link Dedicated or IBM Cloud® Virtual Private Network (VPN) for VPC. You must use one or the other.

[Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about) is the most secure way to enable connectivity from the application provider's on-premises environment to the management VPC. The speed and reliability of Direct Link extends your organization’s data center network and offers more consistent, higher-throughput connectivity, keeping traffic within the IBM Cloud network. When using Direct Link, a private [Application Load Balancer for VPC (ALB)](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers) is used to distribute traffic among multiple server instances within the same region of your VPC.

An alternative connectivity pattern requires use of the [VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn) service to securely connect from your private network to the management VPC. VPN for VPC can be used as a static, route-based VPN or a policy-based VPN to set up an IPsec site-to-site tunnel between your VPC and your on-premises private network, or another VPC.
For example, you might use the Virtual Private Cloud VPN, IBM Cloud Transit Gateway, or IBM Cloud Direct Link to allow requests from an on-premises network, another VPC, or IBM Cloud classic infrastructure to apps that run in your cluster.
2. A DNS service resolves the route subdomain to the VPC load balancer hostname that is assigned to the services for the Ingress controller. In VPC clusters, your Ingress controller services' private IP addresses are floating, and are kept behind a VPC-assigned hostname. Note that though the DNS record for the route subdomain is registered in the public DNS system, the DNS resolution servers are reachable from the VPC.
3. The private VPC load balancer resolves the VPC hostname to an available private IP address of a Ingress controller service that was reported as healthy. The VPC load balancer continuously checks the IP addresses of the services that expose the Ingress controller in each zone in your cluster.
4. Based on the resolved IP address, the VPC load balancer sends the request to a Ingress controller service.
5. The Ingress controller checks the routing rules that are implemented by the Ingress controller for the myapp path. If a matching rule is found, the request is proxied according to the rules that you defined in the IngressController and the Route resource to the pod where the app is deployed. The source IP address of the packet is changed to the IP address of the worker node where the Ingress controller pod runs. If multiple app instances are deployed in the cluster, the Ingress controller load balances the requests between the app pods across all zones.
6. When the app returns a response packet, it uses the IP address of the worker node where the Ingress controller that forwarded the client request exists. The Ingress controller then sends the response packet through the VPC load balancer to the client.









 How can I customize routing?
Logging in to the CLI with a private endpoint 

You can log in to either a private endpoint for Classic or for VPC. To log in using Classic infrastructure, [log in](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) to a private endpoint by using the CLI by using the following command:

ibmcloud login -a private.cloud.ibm.com

To [log in](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) by using the VPC infrastructure, add the --vpc flag to the command:

ibmcloud login -a private.cloud.ibm.com --vpc





 Targeting a supported region (required for Classic use) 

To use private endpoints for deployments in the Classic environment, a region must be targeted when a private endpoint is set in the IBM Cloud CLI.

To [target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_target) a supported region, use the following command:

ibmcloud target -r [region]





 Configuring a private endpoint gateway (required for VPC use) 

To use private endpoints for deployments in the VPC environment, you must configure a virtual private endpoint gateway. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).

A list of all IBM Cloud services that are configurable through a virtual private endpoint gateway is at [VPE Supported Services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services).

To ensure basic CLI capability against the private endpoint, you must configure the gateway to include these services:



* Account Management: Endpoint URL (https://private.accounts.cloud.ibm.com)
FAQs for dedicated hosts 



 What elements do I need to create a dedicated host? 

Dedicated hosts in IBM Cloud VPC are created as part of a dedicated group. When you use IBM Cloud console to create a dedicated host, you create an initial dedicated group as part of the dedicated host provisioning process. If you are using the IBM Cloud CLI to create a dedicated host, you must first create a dedicated group. For more information, see [Creating dedicated hosts and groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-dedicated-hosts-instances).





 How much am I charged for a dedicated host? 

When you create a dedicated host, you are billed by the usage of the host on an hourly basis. You are not billed for the vCPU and RAM associated with instances that are running on the host.





 Why can I create only one dedicated host per region? 

When you provision dedicated hosts, the vCPU associated with your dedicated hosts counts toward the total vCPU for virtual server instances per region. The standard quota for virtual servers vCPU is 200. The dedicated host profile uses 152 vCPUs. To increase your vCPU quota, [contact Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). For more information, see [Quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotasvpcquotas).





 What are the advantages of provisioning instances on a dedicated group versus a dedicated host? 

Provisioning instances on a dedicated group allows your instances to move between hosts if the need ever occurs. For example, if you want to decrease the size of your dedicated host group, you can stop instances on one of the hosts and disable placement for the host that you want to decommission. Then, when you restart the instances they are started on another host in the group if capacity is available.





 How much instance storage is available on my dedicated host? 

In IBM Cloud console, if you look at the details page of a dedicated host that was provisioned with an instance storage profile, you see 6.4 TBs of instance storage.
* UI
* CLI
* API







 Getting started with SSH keys 

When you create a server, you must select an existing SSH key or generate an SSH key. SSH keys are used by servers to identify a user or device through public-key cryptography. SSH keys are made up of an alpha-numeric combination and are unique to the user or device to which they are assigned. You can create an SSH key by using the UI. You can add, edit, or delete SSH keys by using the IBM Cloud® console, CLI, and API. By adding an SSH key to a server, you can access the server with the corresponding private SSH key instead of a password. You can add SSH keys to a server only when you initially create the server. After a Linux® server is created, you can edit keys directly in the /.ssh/ directory of the server.

Creating a server with a password option for connecting isn't supported. You must specify an SSH key when you provision the server and use the private key to connect to the server.



 Supported SSH key types: RSA and Ed25519 in the UI 

IBM Cloud® Virtual Private Cloud supports two different types of public SSH keys.



* RSA
* Ed25519



On IBM Cloud VPC, RSA is the default SSH key type. You can select to change the key type to Ed25519. The Ed25519 SSH key type enables a slightly higher performance benefit because it can give the same level of security as the RSA SSH key type with a smaller key. You can create virtual server instances and bare metal servers with a mix of RSA and Ed25519 SSH keys.

In the [IBM Cloud console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/launch-glyph.svg)](https://cloud.ibm.com/login), you can go to menu icon !
For more information, see [If you have more than 100 domains](https://cloud.ibm.com/docs/dns?topic=dns-resellone-migrationresellone-startup-tier) and [specific FAQs](https://cloud.ibm.com/docs/dns?topic=dns-resellone-migrationresellone-startup-tier-faq).
* 500+ domains - OpenSRS is the default migration option. For more information, see [If you have more than 100 domains](https://cloud.ibm.com/docs/dns?topic=dns-resellone-migrationresellone-startup-tier) and [specific FAQs](https://cloud.ibm.com/docs/dns?topic=dns-resellone-migrationresellone-growth-tier-faq).





 Common FAQs 



 When will the IBM ResellOne End of Service take effect? 

End of Service takes effect on 1 November 2021. For more information, see the [End of Service announcement](https://cloud.ibm.com/docs/dns?topic=dns-resellone-eos).





 What are the benefits of migrating to Hover? 

As a Hover customer, you’ll benefit from a clean and intuitive domain management control panel. You'll also get an expanded selection of premium top-level domains, and great customer support.





 What are the benefits of migrating to OpenSRS? 

As a direct OpenSRS reseller, you’ll be able to fully manage your domains with greater ease. You'll get a greater selection of premium top-level domains and be able to offer your customers an expanded selection to automate your domain management experience. Post migration, you’ll benefit from improved availability of your business-critical domain services and additional features, including:



* Brandable end-user communications
* Scalability
* Exceptional reliability
* Flexible integration







 What service agreement do I follow after migration to Hover?
The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for CM-7 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 CM-7 (a) <br><br> * Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port<br> * Check whether Virtual Servers for VPC instance doesn't have a floating IP<br> * Check whether App ID Cloud Directory users aren't able to update their own accounts<br> * Check whether App ID email dispatchers are using HTTPS only<br> * Check whether Application Load Balancer for VPC has public access disabled<br> * Check whether Cloud Object Storage is accessible only through HTTPS<br> * Check whether OpenShift clusters are accessible only by using private endpoints<br> * Check whether Virtual Private Cloud (VPC) security groups have inbound ports that are open only to permitted IP addresses<br> * Check whether App ID lockout policy after failed # of sign-in attempts is enabled<br> * Check whether App ID social identity providers are disabled<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port<br> * Check whether Application Load Balancer for VPC is configured to convert HTTP client requests to HTTPS<br> * Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning<br> * Check whether App ID redirect URIs are not using wildcards (*)<br> * Check whether App ID webhooks are using HTTPS only<br> * Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled<br> * Check whether Virtual Private Cloud (VPC) classic access is disabled<br> *
The SAP Router and jumphost are within a single security group with rules for inbound and outbound traffic between the private subnets in the zone. SAP routers are used with traditional SAP products and analytics solutions and offerings that are acquired from MS SQL Server database. For a comprehensive list of which SAP Business Analytics products benefits from SAP router connections, see [SAP Note 1478974](https://launchpad.support.sap.com//notes/1478974).

A jumphost is used to access, manage, and administer SAP virtual server instances from the same customer ZONE directly from their premises. These SAP virtual server instances can be in a separate security zone but should be on same IBM Cloud region. The customer connection to the jumphost follows the same rules as the direct connection from customer premises to the virtual server instance SAP instances. The connection uses the CFN IP and security group 1 firewall rules from a designated public subnet. In this architecture, there are two security groups defined; this arrangement is the simplest method for separating the public and private subnets. You can add more security groups if you require more isolation.





 Virtual server instances on SAP NetWeaver 7.x with SAP HANA database 

The number of hosts in an SAP HANA system landscape determines the SAP HANA system type.

An SAP HANA system can be configured as either:



* A single-host system - One SAP HANA instance on one host.
* A distributed system (multiple-host system) - Multiple SAP HANA instances distributed over multiple hosts,





 Single-host HANA system 

A single-host system is the simplest system installation type that runs an SAP HANA system entirely on one host. You can scale the system up as needed. The single-host system has these components:

Zoom

![Figure 2. Standard installation](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/refarch-sap-hana-single-host-only.svg)

Figure 2. SAP NetWeaver 7.x SAP HANA single-host installation with AAS