vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The HTTP proxy server must be configured and available by using Virtual Routing and Forwarding (VRF) before the F5 BIG-IP installation can begin.

The BigIP Virtual Edition (VE) endpoints must be able to activate their license before they can become operational. After the BigIP VE endpoints are installed, they no longer require the use of the proxy server.

The F5 BIG-IP service cannot be added without a working proxy server at the time of service installation.





 F5 BIG-IP service configuration 

When you order the service, provide the following settings.



 Name 

Enter the service name.





 F5 license activation connection 

Select Public network or Private network for license activation. If the target cluster is configured with private-only network interfaces, only the Private network option is available. This selection determines how the F5 virtual servers contact the F5 license server, and it does not impact the workload data plane.

If you select Private network, specify the following settings:



* Proxy IP address The IPv4 address of the proxy server.
* Proxy port number The port number of the proxy server, usually 8080 or 3128.



Authenticated proxy is not supported.





 Maximum bandwidth 

Specify the maximum throughput of the F5 BIG–IP appliance.





 License model 

The license model for F5 BIG-IP offers the following options:



* Good - This offer uses the BIG-IP Local Traffic Manager™ (LTM) VE, operating as a full-proxy architecture, which provides:



* Intelligent local traffic management
* Complete SSL traffic visibility
* Analytics and health monitoring to ensure that application servers are always available to your users.



* Better - This offer is built on the benefits of the Good option, with the addition of BIG-IP DNS™, BIG-IP Advanced Firewall Manager™ (AFM), and BIG-IP Application Acceleration Manager™ (AAM) modules. It delivers global traffic management services, application performance optimization, and advanced network firewall and Distributed Denial of Service (DDoS) mitigation capabilities.
* Best - In addition to the Good and Better offers, BIG-IP Application Security Manager™ (ASM) provides:



* Comprehensive application protection against L7 DDoS
For more information about GREP11 API, see [Introducing EP11 over gRPC](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-grep11-intro).

With the PKCS #11 and GREP11 APIs, you can perform remote cryptographic procedure calls, and, by default, impose message size limits. The maximum receiving message size is 64 MB and the outgoing message size has no limit.





 Comparing the PKCS 11 API with the GREP11 API 

Both the PKCS #11 API and the GREP11 API access the EP11 library that is enabled by the Hyper Protect Crypto Services cloud HSM to execute cryptographic functions. The following diagram illustrates the two options to interact with the cloud HSM.

Zoom

![Performing cryptographic operations with the PKCS #11 API or the GREP11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-vs-grep11.svg)

Figure 1. Performing cryptographic operations with PKCS #11 API or GREP11 API

Comparing with the GREP11 API, the implementation of the standard PKCS #11 API enables portable applications and provides a wider range of cryptographic operations. The following table shows the main differences between the two options.



Table 1. Comparing the PKCS #11 API with the GREP11 API

 Perspective PKCS #11 API GREP11 API 

 Interface implementation Stateful interface. The result of your API request can vary depending on the implicit state such as session state and user login state. In the stateful case, data is stored on the host. Stateless interface. The result of your API request always stays the same. In the stateless case, no data is stored on the host. 
 Prior installation You need to install the PKCS #11 library on your local workstation first to access the Hyper Protect Crypto Services cloud HSM.
Integrating an application load balancer with instance groups 

IBM Cloud® Application Load Balancer for VPC (ALB) is used to attach [instance groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group) to a load balancer pool.

An instance group is a collection of virtual server instances. With them, you no longer need to manually manage your pool members. Attaching an instance group to a load balancer allows your pool back-end members to automatically scale up or down depending upon your usage and requirements.

You can choose to have a static number of instances or choose to dynamically scale instances according to your requirements. The pool members add/delete based on the application health checks and the instance group policies you configure.

For example, when application health checks fail, the system automatically adds a membership to the instance group to replace the bad member.

In addition, members can be added/deleted to the pool based on your CPU, network, and memory utilization scaling policies.

When you attach an instance group with a pool, it becomes a managed pool, and you no longer can add/delete/update members to it. However, updates to the pool are still allowed.

The maximum number of back-end members that are allowed in a load balancer pool is 50, and you cannot configure an instance group membership count beyond that limit.



 Creating managed pools and instance groups 

To create a managed pool, first create a regular pool and make sure that no members are attached to it. You can then attach an instance group.

To create an instance group, complete the following steps.



1. [Create an instance group template](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupcreating-instance-template).

An instance group template defines your back-end member instance configurations.
2. Next, [create an instance group](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group).
Workload migration with HCX 

You can use VMware HCX™ for the VMware NSX-V to NSX-T™ migration in IBM Cloud®. You can provision an optional HCX™ service in the new vCenter Server® instance with NSX-T, which is running in parallel with the existing vCenter Server with NSX-V. HCX deployment is fully automated in the new vCenter Server with NSX-T environment. After the HCX provisioning in complete, you need to deploy HCX Manager in the old environment and pair the environments. HCX is fully integrated with vCenter and NSX. HCX provides L2 Network Extension Service for the L2 network extension between environments and has various migration services (Bulk and vMotion) to help you move the workloads.

Zoom

![Migration with HCX](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/v2t-diagrams-hcx.svg)

Figure 1. Migration with HCX



1. Your existing NSX-V based instance was deployed previously and it hosts the current workloads and NSX-V network configurations. Before you start the migration, you need to have a thorough understanding of the environment, the workloads that are deployed, and the NSX-V and underlay network configurations.
2. You can deploy the new vCenter Server with NSX-T instance with new VLANs and a new POD, or you can use existing VLANs.
3. On the new NSX-T based vCenter Server instance, [order the HCX Service](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_ordering). You can use private deployment, as all HCX traffic between the environments uses private connectivity in IBM Cloud private network. You must have outbound internet connectivity for HCX registration and updates.
4.
You can deploy multiple T1s in the same gateway cluster, but that gateway cluster can have only one T0.





 VPC routing with Tier-0 logical routers 

When designing logical network topologies in IBM Cloud VPC hosted NSX-T, it is important to decide how to route the traffic of NSX-T segment attached workloads between NSX-T, IBM Cloud VPC, and public internet.

The following diagram presents an overview of the routing between NSX-T Logical Routers and VPC.

Zoom

![VPC routing with NSX-T Logical Routers](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-nsx-t-vpc-routing.svg)

Figure 3. VPC routing with NSX-T Logical Routers

If your design does not need direct inbound public access, you can customize this architecture. Various customization aspects of the connectivity architecture are discussed in the following topics.



 Routing between Tier-0 and Tier-1 logical routers 

The first architectural decision to be made for your solution is routing between T1 and T0. You can configure various route advertisements and static routes on a T1 logical router.

In this design, the workloads are connected to NSX-T overlay segments behind T1, and when T1 is connected to its parent T0, it has a default route that points to the T0. By default, T0 does not know about the segments that are attached to T1, and this is where route advertisement is needed.

If you want to route natively with IBM Cloud VPC subnets and other connected service without using NAT in T1, enable route advertisement of "All Connected Segments & Service Ports" in the specific T1. You must not configure a routing protocol or static routes between T1 and T0 logical routers. After you enable the route advertisement, NSX-T creates routes automatically.
Integrating an IBM Cloud Network Load Balancer for VPC with instance groups 

IBM Cloud® Network Load Balancer for VPC (NLB) can attach [instance groups](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-group) to a load balancer pool.

An instance group is a collection of virtual server instances. With them, there is no need to manually manage your pool members. Attaching an instance group to a load balancer allows your pool back-end members to automatically scale up or down depending upon your usage and requirements.

You can choose to have either a static number of instances or to dynamically scale instances according to your requirements. When dynamically scaling, the number of pool members increases or decreases based on the application health checks and instance group policies you configure.

For example, when application health checks fail, the system automatically adds a membership to the instance group to replace the bad member.

In addition, members can be added or deleted to the pool based on your CPU, network, and memory utilization scaling policies.

When you attach an instance group with a pool, it becomes a managed pool, and you no longer can add or delete members to it or update them. However, you can still make updates to the pool itself.

The maximum number of back-end members that are allowed in a load balancer pool is 50, you cannot configure an instance group membership count beyond that limit.

When you configure a listener with a [range of ports](https://cloud.ibm.com/docs/vpc?topic=vpc-nlb-port-ranges), the instance group's application port is only used for checking the health status of back-end members.



 Creating managed pools and instance groups 

To create a managed pool and attach an instance group, perform the following procedure:



1. [Create an instance group template](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-auto-scale-instance-groupcreating-instance-template).

This template defines your back-end member instance configurations.
2.
[Performing cryptographic operations with the PKCS #11 API or the GREP11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-vs-grep11.svg)

Figure 1. Performing cryptographic operations with PKCS #11 API or GREP11 API

Comparing with the GREP11 API, the implementation of the standard PKCS #11 API enables portable applications and provides a wider range of cryptographic operations. The following table shows the main differences between the two options.



Table 1. Comparing the PKCS #11 API with the GREP11 API

 Perspective PKCS #11 API GREP11 API 

 Interface implementation Stateful interface. The result of your API request can vary depending on the implicit state such as session state and user login state. In the stateful case, data is stored on the host. Stateless interface. The result of your API request always stays the same. In the stateless case, no data is stored on the host. 
 Prior installation You need to install the PKCS #11 library on your local workstation first to access the Hyper Protect Crypto Services cloud HSM. No extra installation is needed to access the Hyper Protect Crypto Services cloud HSM. 
 Application migration If your applications use the standard PKCS #11 API, you do not need to modify your existing applications specifically for EP11 or gRPC. In order to use the GREP11 API, you need to make sure that your applications are developed based on the EP11 requirements and gRPC specifications. 
 Authentication and access management The PKCS #11 library has a set of standard user types for authentication. You need to define these user types in an independent configuration file and assign different user types the corresponding IBM Cloud Identity and Access Management (IAM) roles for access management.
To check whether VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_vlan_spanning_get). You can't enable the private cloud service endpoint if you choose to enable VLAN spanning instead of VRF.









 Worker-to-master and user-to-master communication: Service endpoints 

A communication channel must be set up so that worker nodes can establish a connection to the Kubernetes master. You must enable the public cloud service endpoint in your cluster, and you can optionally enable the private cloud service endpoint. You can't have only the private cloud service endpoint, and after you create the cluster, you can't change the cloud service endpoints.

To secure communication over public and private cloud service endpoints, Red Hat OpenShift on IBM Cloud automatically sets up a Konnectivity connection between the Kubernetes master and the worker node when the cluster is created. Workers securely talk to the master through TLS certificates, and the master talks to workers through the OpenVPN connection.



 Public service endpoint only 

By default, your worker nodes can automatically connect to the Kubernetes master over the public VLAN through the public cloud service endpoint.



* Communication between worker nodes and master is established securely over the public network through the public cloud service endpoint.
* The master is publicly accessible to authorized cluster users only through the public cloud service endpoint. Your cluster users can securely access your Kubernetes master over the internet to run oc commands, for example.







 Public and private cloud service endpoints 

To make your master publicly or privately accessible to cluster users, you can enable the public and private cloud service endpoints. VRF is required in your IBM Cloud account, and you must enable your account to use service endpoints. To enable VRF and service endpoints, run ibmcloud account update --service-endpoint-enable true.



* Communication between worker nodes and master is established over both the private network through the private cloud service endpoint and the public network through the public cloud service endpoint.
The [IBM Cloud web console](http://cloud.ibm.com) is a good way to fully investigate the details of your your IBM® Cloud Foundry environments and deployments, it can give you all the same information as the CLI method. This page will not go into details using that method, since we do so below with the CLI method, but you can use this as a double check or if you prefer to do it that way.





 Investigating your application deployments 

These steps show you how to investigate your IBM® Cloud Foundry application deployments and capture data that you can use to evaluate how to set up your migration hosting target.

Run CLI commands to extract details related to what was returned by the IBM® Cloud Foundry Analysis Tool. These commands allow you to save the details to files to do examine.

Set up CLI access

If not installed previously on your local machine, [install the IBM® Cloud Foundry CLI plugin](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_cf). Ensure you can login to the IBM Cloud and access the appropriate IBM® Cloud Foundry regions. After confirming you have access, run ibmcloud cf apps, and the IBM® Cloud Foundry applications running on IBM Cloud are displayed for that Org and space.





 Application analysis categories and steps 

The following sections help you analyze your IBM® Cloud Foundry environment using various commands. The resulting data from thes steps will help you with the decisions you need to take for migration to a new IBM Cloud compute service.



 Prerequisite setup 

You need to connect to the proper MZR and Cloud Foundry Org and Space to be able to collect information, just like you do when you deploy an application.



 Commands 



1. Authenticate to the IBM Cloud and a specific domain.

ibmcloud target --cf-api mccp.us-south.cf.cloud.ibm.com
2. List the Orgs and Spaces in your account.

ibmcloud cf orgs

ibmcloud cf spaces
3. Target the proper Org and Space to target your additional commands.

ibmcloud target -o <ORG> -s <SPACE>







 Output
* [VMware vCenter Server Performance and Best Practices](https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/vmware-vcenter6-performance-white-paper.pdf)
* [Deploying and Configuring a vCenter Server Appliance (vCSA) with VMware vSphere](https://cloud.ibm.com/docs/vmware?topic=vmware-config-vcsa)







10. Non-VMWare servers. Identify and plan for any non-VMWare servers (virtual or Bare Metal) that are needed.
11. Storage
12. Develop a storage plan for the environment. Endurance 2 IOPS/GB with snapshot space for virtualization is a good starting storage plan, but if virtual databases or other high-performance applications are used, then the 4 IOPS/GB tier is a better fit. NFS storage is typically recommended.
13. Snapshot space is most commonly used as a secondary measure for point-in-time restores. 10% is a good starting place because the process is efficient and can be easily sized up.
14. Backups
15. Make sure that the existing backup strategy works. If a backup strategy does not exist, create one.
16. You can use your own backup solution. You can use the backup features that are included with vSphere Enterprise Plus licensing, optimized third-party solutions like VEEAM, or traditional IBM Cloud r1soft backups.
17. Develop a migration strategy:
18. Review [Best practices to install or upgrade to ESXi](https://kb.vmware.com/s/article/2109712).
19. Review the existing DNS and IP configurations and shorten the TTL as needed.
20. Develop a plan for VMs to include Source host, destination host, source IPs, destination IPs, and associated DNS entries.
21.
Planning the deployment 

Before you order an IBM Cloud® for VMware as a Service instance, ensure that you plan your deployment.



 IBM Cloud data center availability 

The following IBM Cloud data centers are available for VMware as a Service deployment.



Table 1. Available IBM Cloud data centers for deployment

 Geography Region Data center 

 North America Dallas Dallas 10 
 North America Dallas Dallas 12 
 North America Dallas Dallas 13 
 Europe Frankfurt Frankfurt 02 
 Europe Frankfurt Frankfurt 04 
 Europe Frankfurt Frankfurt 05 







 VMware deployment size 

Consider the size of the VMware® deployment required.

VMware deployments are sized based on the CPU, memory, and storage that are required to run the targeted workload. If you are planning a workload migration from on-premises to the cloud, the on-premises size is a good starting point. You can resize your VMware deployment at any time.





 Profile storage type 

You can select NFS only storage or vSAN™ storage with optional NFS storage.

NFS only clusters do not have local flash storage and cannot be configured for vSAN.

vSAN storage with optional NFS storage is available for instances in locations with 25 GbE availability. vSAN clusters use bare metal host profiles with local flash storage and a RAID 6, FTT=2 policy. This is a high-performance and high-resilience policy, and it requires at least 6 hosts. vSAN clusters can also use NFS storage.

If you want to save storage space, you can enable vSAN deduplication and compression to reduce redundant data within each disk group. This option can increase overall storage space based on the data type.

The vSAN deduplication and compression option is available for enablement only when you order a cluster.





 Bare metal server requirements 

You can select from various bare metal server CPU and memory sizes based on your selction of location and profile storage type.

For vSAN cluters, you can select Dual Intel 8260 Xeon (2 Sockets - 48 Cores, 768 GB RAM) with either 15 TB, 23 TB, or 30 TB of vSAN usable capacity.

The following options are available for NFS only clusters.
Removing access for inactive identities and inactive policies can reduce the risk of unauthorized access to your IBM Cloud resources and help you manage access more efficiently. For more information, see [Identifying inactive identities](https://cloud.ibm.com/docs/account?topic=account-id-inactive-identities) and [Auditing access policies](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies).





 What makes a good access group strategy? 

An access group is an organization of users, service IDs, and trusted profiles in a grouping that you can grant the same IAM access. All identities in a single access group inherit the same access.

A logical way to assign access to your resource groups and the included resources is by [creating one access group](https://cloud.ibm.com/docs/account?topic=account-groups) per required level of access. Then, you can map each access group to the previously created resource groups. For example, to control access to the CustApp project, you might create the following access groups:



* Auditor-Group
* Developer-Group
* Admin-Group



For the Auditor-Group, assign two access policies that grant viewer access to the CustApp-Test and the CustApp-Prod resources and resource groups. For the Developer-Group, assign two access policies that grant editor access to the CustApp-Dev and CustApp-Test resources and resource groups. For the Admin-Group, assign three access policies that grant administrator access to all three CustApp resource groups and their resources.

You can assign administrator access to everything in an account by creating an access group and assigning two policies to it. To create the first policy, select All Identity and Access enabled services with the Administrator platform role and Manager service role. To create the second policy, select All Account Management services with the Administrator role assigned.