vania-janet/multiturn-rag-retrieval-data huggingface dataset:
VMware resources for vCenter Server instances (V1.9 and later) 

If the status of the vCenter Server instance is Available, you can modify the VMware virtual data center, cluster, switches, port groups, and customer Network File System (NFS) datastore names from the VMware vSphere Web Client.

Review the following restrictions:



* Do not change the vCenter Server instance name and the vCenter Server virtual machine name.
* Do not change the name of the management datastore from its default value. The default value is vsanDatastore for VMware vSAN™ instances and management-share for NFS instances.
* Do not change the names and do not delete any of the management subnets that are created for the vCenter Server instances.
* Do not change the name of the network uplinks that are created during provisioning.
* Do not rename or remove NSX-T components. These operations might generate add and remove failures or delays. The NSX-T components with the names that are documented in [Naming conventions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-nsx-t-designnsx-t-design-naming) are used when automation adds or removes hosts, clusters, and services.
* Do not change the VMware ESXi™ server names and the IP addresses because they are registered for Windows® DNS resolution. Changes might result in failure during deployment or failure of vCenter Server functions.







 VMware resources for vCenter Server instances (V1.8 and earlier) 

The following table lists the operations that might be impacted if the SSO administrator changes VMware vCenter Server resources outside of the IBM Cloud for VMware Solutions console. If a solution to recover is available, it is provided as well.

The following table is applicable to instances deployed in V1.8 and earlier, including the ones that were initially deployed in V1.8 and earlier and then upgraded to V1.9 or later.



Table 1. Operations that are impacted by changing VMware resources

 Attempted change Impacted operations Severity Recovery method 

 Change the VMware virtual data center name.
IBM Cloud Connect is only available to IBM clients within the US.
* How is network bandwidth billed?

IBM Cloud Classic environment: Inbound bandwidth is unlimited and not charged. Outbound bandwidth is charged per GB tier with bandwidth offered as an allotment for each month. As an example, for your compute instances, 250 GB is included with each monthly virtual server and 20 TB is included with each monthly bare metal server. Extra bandwidth can also be purchased per packages. For more information, see [Bandwidth packages](https://www.ibm.com/cloud/bandwidth).

IBM Power Systems Virtual Server environment: Inbound bandwidth is unlimited and not charged. Bandwidth is not charged when you use a public network. If you are using a private network with DirectLink Connect, you are charged IBM Cloud Classic environment rates.
* What monitoring services are available?

IBM does not provide status and performance monitoring for the Power Systems Virtual Server. Clients must use their own on-premises tools.
* What performance and capacity planning services do you provide for IBM i?

IBM uses the same tools that are on an on-premises system.
* IBM i and solution certification

You can find self-certification and listing information on the [IBM Global Solutions Directory](https://www.ibm.com/partnerworld/public/find-partner-solution).
* How do I delete a workspace?

To delete a workspace (and all its resources), use the left navigation to navigate the workspace page. Find the workspace to be deleted and click on the overflow menu on the top right corner of the tile. Click Delete and confirm the request from the pull-down menu by typing Delete in the text field. Finally, click the red Delete button to initiate the request.
* How do I delete a single virtual server instance?

There are two methods to delete a virtual server instance. Both deletion methods are manual processes. There is no way to delete all VSIs without deleting the workspace or deleting a subset of the virtual server instance.



* Delete a single virtual server instance from the Virtual server instances page.
IBM Cloud provides two solutions to help avoid the virtual servers being deployed on the same hypervisor.



1. Use a dedicated virtual server. This option allows you to own the entire hypervisor and control the placement of the virtual servers.
2. Use Placement Groups. Placement Groups is an anti-affinity feature. If virtual servers are marked in the same placement group, then these virtual servers are instantiated across different hypervisors. By putting the virtual servers in placement groups, availability is improved. For more information about dedicated servers and placement groups, refer to the IBM Cloud Documents, [About dedicated virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-dedicated-virtual-servers) and [Placement Groups](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-placement-groups).



Zoom

![virtual servers deployed with placement groups](https://cloud.ibm.com/docs-content/v1/content/df269b100c3499f1efcbb7d030dce8dec25c539b/ha-infrastructure/images/HA-vsi-placement.svg)

Figure 4. virtual servers deployed with placement groups are instantiated on different hypervisors which will give a higher availability than with virtual servers without placement groups.





 Network Services 

As part of the IaaS, it is not uncommon to deploy other types of network services for security or remote access. While these services do not help improve the overall availability of the application, they can be a SPOF as the traffic might transit through them. The document does not go into the design but addresses salient points in the context of high availability.



 Direct Link 

Direct link provides you with a way to connect your on-premises resources to IBM Cloud resources in classic infrastructure. There are different types of direct-link offerings that vary by pricing and capabilities.
SA-14 - Criticality Analysis 



  Control requirements 

SA-14 - 0
:   The organization identifies critical information system components and functions by performing a criticality analysis for [Assignment: organization-defined information systems, information system components, or information system services] at [Assignment: organization-defined decision points in the system development life cycle].





  Additional IBM Cloud for Financial Services specifications 



*  This control is required for ISVs.







  NIST supplemental guidance 

Criticality analysis is a key tenet of supply chain risk management and informs the prioritization of supply chain protection activities such as attack surface reduction, use of all-source intelligence, and tailored acquisition strategies. Information system engineers can conduct an end-to-end functional decomposition of an information system to identify mission-critical functions and components. The functional decomposition includes the identification of core organizational missions supported by the system, decomposition into the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by many components within and beyond the information system boundary. Information system components that allow for unmediated access to critical components or functions are considered critical due to the inherent vulnerabilities such components create. Criticality is assessed in terms of the impact of the function or component failure on the ability of the component to complete the organizational missions supported by the information system. A criticality analysis is performed whenever an architecture or design is being developed or modified, including upgrades.
FAQs: Hyper-V 



 What are the requirements to run Hyper-V? 

See [Hyper-V: Hardware requirements](https://cloud.ibm.com/docs/virtualization?topic=virtualization-hyper-v-hardware-requirements)





 What operating systems can be installed on a virtual machine? 

See [Obtaining installation media](https://cloud.ibm.com/docs/virtualization?topic=virtualization-setting-up-hyper-v&locale=enobtaining-installation-media)





 How many virtual machines can a server run? 

The number of virtual machines a server can run varies depending upon server processors, RAM, and hard disk space.





 Is the RAM customizable on each virtual machine? 

Yes. You can use Hyper-V to customize the system resources for each virtual machine, including memory.





 How much RAM does a virtual machine need? 

RAM needs vary based on requirements for the virtual machine. Check the system requirements for your guest operating system. The amount of memory that is provided to a virtual machine can be changed at any time.





 Can a virtual machine access to more than one processor? 

You can grant a virtual machine access to multiple processors with any Windows virtual machine. However, Linux virtual machines are limited to a single processor.





 Can hard disk sizes change after a virtual machine is created? 

Yes.





 Does each virtual operating system need to have a license? 

Windows virtual machines are licensed through IBM Cloud. Linux virtual machines are freely licensed and require no action.





 Will the virtual machines have access to the private network? 

Yes. Virtual machines can connect to both a public and private network.





 What advantages are there to providing private network access to virtual machines? 

Providing private network access to virtual machines allows virtual machines to communicate with each other. Private network access also allows virtual machines to communicate with other internal systems such as NAS and iSCSI and any other servers that you have with IBM Cloud.





 Can virtual machines use the secondary IP block that came with the server? 

No. The secondary IP that was provided with your server is routed specifically to work on the physical server and not a virtual machine. You need portable IP blocks to connect your virtual machine to the network.
From the Edit Guest Properties pane, locate the password in the Specify password field.
3. After a successful login with the initial password, return to the Edit Guest Properties pane to reset the password and log in again with the new password.









 vApps 

A vApp consists of one or more VMs that communicate over a network and use resources and services in a virtual data center. Create the vApp and then add VMs and networks.

You can now add VMs and networks to the vApp.

For more information about vApps, see [Working with vApps](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-AC48FB5E-4ADC-4835-AACE-B949B297A147.html).





 Networking 

Every VMware Shared virtual data center comes configured with one edge gateway with five public IP addresses and one private IBM Services network IP address. You can open an IBM Cloud Support ticket to request five more public IP addresses or an entire subnet for your virtual data center.

Include the following details in your support ticket:



* Virtual data center region and location
* Organization ID
* Virtual data center name
* Number of IP addresses required



For more information about opening a support ticket, follow the steps in [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support).

The edge gateway services are customer configurable and require configuration to allow network traffic in and out of their Organization virtual data center. Configuration is required for access to the internet and the IBM Services network. The five public addresses are used for public facing vApps for inbound and outbound public internet traffic.

The service address is used for access to a number of IBM Cloud infrastructure services on the IBM Cloud internal private network. The list includes the following services:



* NTP
* Windows operating system licensing and updates
* Red Hat operating system licensing and updates
* Cloud Object Storage
Overlay networking 

IBM Cloud® for VMware® Regulated Workloads uses NSX-T™ as the software-defined network overlay provider.

Zoom

![Regulated overlay network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vrw-v2-net.svg)

Figure 1. Cluster overlay network



 Management cluster 

The management cluster uses VLANs only to support the requirements of the management services. No overlay networking is enabled on the management cluster.





 Gateway cluster 

The optional gateway cluster does not employ any overlay networking and a physical FortiGate appliance is available to serve as the perimeter gateway in its place.

The vSRX running on the gateway cluster connects the management network to the private and public transit networks. The vSRX is configured to allow only traffic in or out of the management region that is necessary for proper operation and monitoring of the environment. The vSRX also isolates all traffic between the ESXi hosts in the clusters and vCenter Server. ESXi hosts within a cluster can communicate with each other and vCenter Server. ESXi hosts in one cluster (workload or management for example) are unable to communicate with the hosts of any other clusters. The limitation of cross-cluster traffic is enforced by vSRX and the configuration of the firewalls of the ESXi hosts.

The gateway cluster is the peering point for traffic between the on-premises SaaS provider and IBM Cloud for VMware® Regulated Workloads. It also serves as the demarcation for traffic from the SaaS consumer. The SaaS provider uses vSRX as the secure tunnel endpoint for its VPN.

Traffic from the SaaS consumer passes through the vSRX in an encrypted tunnel, which lands on the overlay network virtual edge device.





 Workload cluster 

The workload cluster network design requires both the overlay network that is delivered with NSX-T and two or more VLANs to support the infrastructure layer functions.
So, the customer-managed router places an address resolution protocol (ARP) frame for server A on source-VLAN. This broadcast frame is seen and picked up by the Network Extension Device/Function at the customer location, encapsulated in the L2TPv3 tunnel, and sent to the Network Extension Device/Function in the DR site. The frame is then placed on DR-VLAN where server A is running.

If the customer-managed router has static ARP table for Server A, this does not work or the static entry needs to be replaced.

While the previously mentioned is applicable to both internet and direct connected customers, the network design must consider the additional latency, due to the processing of the L2TPv3 tunnel, and the distance.

If this additional latency is somehow predictable within a range for directly connected clients with latency SLAs (the overall latency does not come from only the link latency), the internet connected customers might experience a different situation based on the unpredictable latency of the public internet.

The network design must also consider possible MTU adjustments or additional packet loss situations that the application running in the production site might demand in terms of requirements.





 Server to disaster recovery servers 

Consider the scenario where two servers have been failed over and are currently running at the DR data center in a partial failover situation (server A on DR-VLAN1 and server B on DR-VLAN2), while all the rest of the servers keep on running on premises.

In this scenario, even the main concepts are similar to what we have seen in user-to-server case. Since the customer routing and security service is still running on premises, each frame has an additional latency to be considered, as all the routing and security functions are performed on premises.

The more servers in partial failover mode, the greater the impact of latency on the customer routing and security functions.





 Continuously available class 

For [continuously available class](https://cloud.ibm.com/docs/overview?topic=overview-understanding-drplan-objectives), because of the short recovery time, the best-suited DR solution is to adopt application clustering and an application-aware data replication to have a continuously available infrastructure ready to be activated in the case of an emergency.
The vSRX is configured to allow only traffic in or out of the management region that is necessary for proper operation and monitoring of the environment. The vSRX also isolates all traffic between the ESXi hosts in the clusters and vCenter Server. ESXi hosts within a cluster can communicate with each other and vCenter Server. ESXi hosts in one cluster (workload or management for example) are unable to communicate with the hosts of any other clusters. The limitation of cross-cluster traffic is enforced by vSRX and the configuration of the firewalls of the ESXi hosts.

The gateway cluster is the peering point for traffic between the SaaS provider on-premises and the IBM Cloud for VMware Regulated Workloads. It also serves as the demarcation for traffic from the SaaS consumer. The SaaS provider uses the vSRX as the secure tunnel endpoint for its VPN.

Traffic from the SaaS consumer passes through the vSRX in an encrypted tunnel, which lands on the overlay network virtual edge device.





 Workload cluster 

The workload cluster network design is closely aligned to that of a traditional vCenter Server deployment. VLANs and subnets are provisioned to support vMotion, vSAN, VTEPS for the Software-Defined Networking (SDN) network, and workload cluster host management functions.

Within the workload clusters, NSX-T™ provides a highly secure and flexible software defined network to support the application requirements. NSX-T management is external to the workload cluster thus ensuring that network and security changes are not possible by anyone other than the designated administrators. All north-south network access in the workload cluster is done through private and secure connections by using IPsec or IBM Direct Link. The workload clusters are protected by the same gateway cluster with the vSRX or the physical FortiGate that protects the management plane.





 IBM Cloud networking 

The physical network of IBM Cloud is separated into two distinct networks: public and private. The private network also contains the management Intelligent Platform Management Interface (IPMI) traffic to the physical servers.

Zoom

!
1. In Load Balancing, click Servers.
2. Click Add.
3. Enter the name of the server (for example, Web1).
4. Enter the IP address of the server.
5. Leave the Traffic Domain field blank, because you are only concerned with using the default traffic domain in this scenario.
6. Enter any comments you want about this server.
7. Click Create.



Repeat this procedure for all servers in the pool.

To keep servers easily identifiable, use a similar naming convention for servers within the same pool (for example, Web1, Web2, Web3, and so on).





 Creating services 

Next, create your services. You will be creating a service for each server that you just entered. The service is what configures the connection between the NetScaler and the servers in the pool. Each service has a name and specifies an IP address, a port, and the type of data that is served.



1. Click Traffic Management > Load Balancing > Services.
2. Click Add.
3. Create a service for each server you created earlier, utilizing the same information.



Next, create a virtual server. The virtual server is a sort of virtual connection between the VIP used for the load-balanced servers and services you created earlier.



1. Click Traffic Management > Load Balancing > Virtual Servers.
2. Click Add.
3. Name the virtual server.
4. Designate the protocol that you are balancing (HTTP).
5. Leave the IP address type as the default (IP Address). The IP address field is where you enter the VIP that you are using as the entry point for all of your users.
6. Designate the port. The default is port 80.
7. Click OK.







 Binding services 

Now, bind the services you created to your virtual server.



1. On the Virtual Servers screen, click the No Load Balancing Virtual Server Service Binding link.
2. Bind each of the previously created services to the virtual server.
3. Click Done.
4.
CP-8 - Telecommunications Services 



  Control requirements 

CP-8 - 0
:   The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether there are at least # instances of Direct Link in an account







  NIST supplemental guidance 

This control applies to telecommunications services (data and voice) for primary and alternate processing and storage sites. Alternate telecommunications services reflect the continuity requirements in contingency plans to maintain essential missions/business functions despite the loss of primary telecommunications services. Organizations may specify different time periods for primary/alternate sites. Alternate telecommunications services include, for example, additional organizational or commercial ground-based circuits/lines or satellites in lieu of ground-based communications. Organizations consider factors such as availability, quality of service, and access when entering into alternate telecommunications agreements.
HCX Network Extension Virtual Appliance 

The third component is known as the HCX Network Extension Virtual Appliance (HCX-NE) and is part of the Network Extension Services. The HCX-NE is the VM that allows the extension of on-premises data center networks to the IBM Cloud. The HCX-NE stretches on-premises VLANs or VXLANs. Each HCX-NE can stretch up to 4096 VLANs. Each HCX-NE, when paired with its on-premises partner can provide up to 1 Gbps per “flow” and up to an aggregate of 4 Gbps per VLAN (or VXLAN). Deployment of more HCX-NE appliances is supported if more network throughputs are required.

Direct-Link is used to deploy the HCX-NE appliance so that you can stretch multiple VLANs and VLXANs into the IBM Cloud over the internet or through the private network. The sizing specification of the HCX-NE appliance on the IBM Cloud is listed in the following table.



Table 7. HCX Network Extension Virtual Appliance sizing

 Component Configuration 

 CPU 8 vCPU 
 RAM 3 GB 
 Disk 2 GB VMDK on shared storage 



The HCX-NE appliance is deployed on the management VLAN and on the public VLAN. The public interface is used for application traffic that bound for the source of the extended network. More connections, such as the extended networks, are created and attached to the HCX-NE appliance after the source administrator initiates the network extension into the IBM Cloud.





 Related links 



* [Source architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx-archi-port-req)