vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The recommended way to run the scripts is from your deployment (bastion) server because the deployment (bastion) server has Terraform and Ansible already installed. If you want to run the scripts from your local workstation, you need to install Terraform and Ansible locally.

For both the deployment (bastion) server and local workstation, you must download the SAP kits to the temporary storage assigned to you on the deployment (bastion) server. Ansible installs the kits for you. You specify the location of the kits in the configuration files.





 Prerequisite, where to run the scripts 

Before you deploy any of the SAP automated solutions on IBM Cloud VPC, you create a bastion server VPC in your chosen region. The bastion server is used for downloading and storing specific SAP solution media that are needed for later automation deployment. The bastion server is used for both CLI deployment scenarios, as well for Schematics UI deployments. For more information about how to create the bastion server and its corresponding VPC, see [Automate SAP bastion server – SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server).

After bastion VPC deployment is complete, you must download the SAP kits to the temporary storage assigned to you on the bastion server. Ansible installs the kits for you. You specify the location of the kits in the configuration files.

This automation is offered free of charge however, the provisioned infrastructure comes at cost.

To save costs, the bastion server, with its SAP media dedicated storage, can be decommissioned after the SAP solutions are successfully implemented on IBM Cloud VPC. Or, you can keep the bastion server and use it as a jump host for that specific region.
VMware ESXi is automatically installed on each IBM Cloud bare metal server, but you are responsible for installing any additional VMware components like vCenter Server or NSX. While VMware vSphere ensures that VMware-compatible hardware is ordered based on the VMware components selected, no automation exists to configure and start the VMware environment. You are responsible for designing and architecting the IBM-hosted environment.
* How can I view a list of all notifications?

To view the complete notification history, click Notifications from the left navigation.
* What if I have issues with VMware Solutions?

If you need assistance with IBM Cloud for VMware Solutions, open an IBM Support ticket by following the steps in [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support).
* What is BYOL and is it supported for VMware perpetual licenses?

BYOL was a feature available to vCenter Server and VMware vSphere® instances in version 2.0 and later. IBM Cloud previously allowed clients to bring their own licenses (BYOL) when moving their existing on-premises VMware workloads to IBM Cloud. BYOL is no longer allowed by VMware. You can no longer bring your own licenses for any new hosts. This applies to all VMware products that are available through IBM Cloud.

Existing BYOL servers will be able to perform upgrades and migrations to refresh software and hardware.
* Can you use the BYOL feature for some VMware components and purchase monthly licenses for others?

Yes. You can continue to use the BYOL feature for clusters that already have BYOL. You must purchase licenses from IBM for any new combination of the four VMware components. The IBM Cloud for VMware Solutions console makes it straightforward for you to select the licensing option when you order your instance. Select I will provide, and enter your own license key only if you are performing an upgrade or migration of an existing BYOL cluster.
* For a specific VMware component, can you use BYOL for some licenses and buy the rest of licenses from IBM?

Yes.
You need to migrate network configurations from NSX-V to NSX-T and migrate workloads between instances. IBM Cloud provides extensive documentation for a validated approach and guidance for existing IBM Cloud for VMware Solutions customers with vCenter Server instances.





 How do I know whether my IBM Cloud bare metal server hardware is suitable for in-place vSphere 7.x upgrade? 

You can check whether your server and its hardware options are compatible with vSphere 7.x. For more information, see [VMware compatibility guide](https://www.vmware.com/resources/compatibility/search.php).

Alternatively, you can upgrade your vCenter, set up vSphere Update Manager (VUM) or vSphere Lifecycle Manager, and run Hardware Compatibility Checks for the upgrade.





 What are the different ways that I can use IBM Cloud bare metal servers for VMware workloads in IBM Cloud? 

You can use a VMware® platform on IBM Cloud in the following ways.



* Bare Metal - Use the Bare metal catalog for IBM Cloud Classic Infrastructure and order a bare metal server with vSphere as the Operating System. For more information, see [VMware for Classic](https://cloud.ibm.com/docs/vmware).
* VMware vSphere - Use the VMware Solutions console to provision IBM-hosted VMware hosts. For more information, see [VMware vSphere overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereclusteroverview).
* vCenter Server - Use the VMware Solutions console to provision an IBM-hosted private cloud based on vSphere, NSX, and optionally vSAN. For more information, see [vCenter Server overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview).



Upgrade and migration processes vary depending on the consumption model.





 What is the impact if I don't upgrade vSphere 6.x on my IBM Cloud bare metal hosts?
Caveonix RiskForesight on IBM Cloud overview 

Caveonix RiskForesight™ on IBM Cloud can help to manage cyberrisk and compliance risk with proactive monitoring and automated defense controls to protect against threats and to meet industry or government regulations. Caveonix RiskForesight on IBM Cloud is a non-IBM product that is offered under terms and conditions from Caveonix, not IBM.

IBM Cloud® for VMware Solutions offers promotions for some services. Promotional pricing offers a number of months without charge for a service license, if the service has license charges. For more information, see [Promotions for VMware Solutions services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-service-promotions).

The current Caveonix RiskForesight version that is installed is 4.1.

A Caveonix RiskForesight license is valid for five years. Ordering Caveonix RiskForesight for VMware® vCenter Server instances, VMware Regulated Workloads, and Security and Compliance Readiness Bundle instances differs. For more information, see [Licenses and fees](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-caveonix_considerationscaveonix_considerations-tech-specs-license-fee).



 Technical specifications for Caveonix RiskForesight 

For more information about resource requirements and capacity checking for some services, see [Resource requirements for services](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservicesvc_addingservices-resource-requirements).

The following components are ordered and included in the Caveonix RiskForesight service.



 vCenter Server resources 



* CPU - 8 CPUs
* RAM - 32 GB
* Disk - 100 GB







 Network 

A dedicated private subnet with 32 IP addresses is ordered.





 Licenses and fees 

A Caveonix RiskForesight license key is ordered for each instance of the service.
Integrating the infrastructure domain with the workload domain 

Integrating the IBM Cloud® for VMware Solutions infrastructure domain with the IBM Cloud for VMware Solutions workload domain is not recommended. You must allow the workload domain controllers that are connected to the underlay network to communicate with the infrastructure domain controllers that are connected to the underlay network. For more information, see the following documents.



* [Description of support boundaries for Active Directory over NAT](https://support.microsoft.com/en-us/help/978772/description-of-support-boundaries-for-active-directory-over-nat)
* [Steps to avoid registering unwanted NICs in DNS on a multihomed domain controller](https://support.microsoft.com/en-us/help/2023004/steps-to-avoid-registering-unwanted-nic-s-in-dns-on-a-mulithomed-domai)



However, if you need information about this integration, review the following models.



* IBM Cloud for VMware Solutions forest with parent-child trust.
* IBM Cloud for VMware Solutions forest with tree-root trust.
* Two-way forest trust.
* External trust.





 IBM Cloud for VMware Solutions forest with parent-child trust 

This model creates a single forest by using the existing IBM Cloud for VMware Solutions infrastructure domain as the parent and configuring a new IBM Cloud for VMware Solutions workload child domain. As all parent-child domains use transitive two-way trusts by default, vSphere SSO can access all users from either domain. The following diagram shows the Active Directory Domain Services topology for this IBM Cloud for VMware Solutions forest with parent-child trust model.

Zoom

![IBM Cloud for VMware Solutions forest with parent-child trust diagram](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/adds-forestwithparentchildtrust.svg)

Figure 1. IBM Cloud for VMware Solutions forest with parent-child trust diagram
Cancel the order, and then place a new order with the configuration that you want for a public IP address or public VLAN. You cannot add a public network after it was ordered as private network only.
* How do I request a RAM upgrade for ESXi hosts?

The account owner can increase the RAM on ESXi servers by following these steps:



1. Log in to the IBM Cloud console and go to the device list.
2. Select the ESXi server to be modified.
3. From the details page, click Modify next to RAM or memory.
4. Specify the higher limit. Then, confirm the change to place your order.
5. Repeat these steps, as needed, for each additional ESXi server.



An IBM Cloud representative confirms the billing change and contacts you to schedule a maintenance window for adding the memory.

You must manage the VMware Solutions components that are created in your IBM Cloud account only from the VMware Solutions console, not any other means outside of the console. If you change these components outside of the VMware Solutions console, the changes are not synchronized with the console.
* Does VMware vSphere use automation to install, configure, and start the VMware stack?

No. VMware vSphere does not use the advanced automation from the vCenter Server platform. Based on what you order, the platform delivers optional VMware licenses, ESXi servers, and, optionally, an HA-pair of FortiGate® physical firewalls. If a new cluster is created, three new VLANs are also provisioned: a public VLAN and two private VLANs.

VMware ESXi is automatically installed on each IBM Cloud bare metal server, but you are responsible for installing any additional VMware components like vCenter Server or NSX. While VMware vSphere ensures that VMware-compatible hardware is ordered based on the VMware components selected, no automation exists to configure and start the VMware environment. You are responsible for designing and architecting the IBM-hosted environment.
* How can I view a list of all notifications?

To view the complete notification history, click Notifications from the left navigation.
VMware Solutions workload domain 

Your customer workload virtual machines (VMs) are using the network overlay virtualized network with customer Bring Your Own IP (BYOIP) address space. Associate these IP ranges with the customer workload AD domain and not the IBM Cloud® for VMware Solutions infrastructure Active Directory™ (AD) domain. We recommend that the VMware Solutions infrastructure AD domain holds resources and user accounts for administration of the vCenter Server instance only. Resources and user accounts for your workload VMs are held in a separate forest or domain.

The infrastructure appliances and VMs, such as vCenter and NSX Manager, are deployed on the underlay network with an IP address space that is assigned by IBM Cloud. Unless configured, the customer workload VMs on the overlay networks are not able to reach the AD domain controllers on the underlay network. Also, the infrastructure appliances on the underlay network are not able to reach the customer workload AD domain controllers on the overlay networks.

VMware Solutions customers typically use one of the following models for their VMware Solutions workload domain.



* New stand-alone AD forest-domain.
* New AD forest with trusts to existing forest.
* Extend forest and create a new domain.
* Extended domain with AD sites model.
* Extend domain.





 New stand-alone AD forest-domain model 

This model deploys a stand-alone forest domain with no trust. In this deployment model, a new forest and VMware Solutions workload domain for your workloads that are hosted in your vCenter Server instance is configured. This domain is different and separate from an existing AD that is running on-premises. The main reason for selecting this model is to keep accounts and resources separate between the two forests or domains. In this model, the customer provisions a minimum of two domain controllers as VMs hosted in each vCenter Server instance. These VMs would be connected to an overlay network and the new domain controllers would have the primary domain controller role. All user credentials, service accounts, and computer objects are on in this IBM Cloud for VMware Solutions workload domain that is hosted on these domain controllers.
NSX-T Federation is a relatively new NSX-T feature and architecture. Before you plan to use it, you must know what [features are supported](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-29998FC5-C1AB-40BC-B669-6E8E9937F345.html), and how NSX Federation works for your use case. NSX-T Federation is not validated by IBM Cloud fully, but it is a solution and architecture that is supported by VMware.





 Regulated workloads offerings 

The regulated workloads offerings are suitable for clients that require a prescriptive reference architecture that matches the IBM Cloud Framework for Financial Services. For more information, see [VMware Regulated Workloads as a single site deployment](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-overview).

The following diagram can be used to compare and contrast the features that are offered by these offerings.

Zoom

![Regulated workload offerings](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/v2t-diagrams-platforms-rw.svg)

Figure 2. Regulated workload offerings

In the previous diagram, the following terms require some additional comments:



* Single SSO and root domain - A single instance of Active Directory and Domain Name Services is deployed with replication between the dual domain controllers automatically.
* Single vCenter - The automation deploys a single vCenter appliance.
* vCenter HA - vCenter High Availability (HA) protects vCenter against failures by using an active-passive architecture that uses a three-node cluster with active, passive, and witness nodes.
While VMware vSphere ensures that VMware-compatible hardware is ordered based on the VMware components selected, no automation exists to configure and start the VMware environment. You are responsible for designing and architecting the IBM-hosted environment.





 How can I view a list of all notifications? 

To view the complete notification history, click Notifications from the left navigation.





 What if I have issues with VMware Solutions? 

If you need assistance with IBM Cloud for VMware Solutions, open an IBM Support ticket by following the steps in [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support).





 Related links 



* [Notifications](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-notifications)
* [vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview)
* [Accessing the console](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-loginmethod)
* [User accounts and settings](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-useraccount)
* Can the FSA 10 Gbps span over multiple pods in a data center?

Not currently. FSA 10 Gbps is only able to protect VLANs for the pod it is deployed in.



Hardware Firewall



* What is a firewall?

A firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the server is reached.
* Why should I use a firewall?

The primary advantage of having a firewall is that your server only has to handle “good” traffic – this means your resource is solely being used for its intended purpose as opposed to handling unwanted traffic, too.
* What firewall products does IBM© offer?

You can find a detailed comparison of all firewall products offered in the IBM© Cloud by reviewing this [topic](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-exploring-firewalls).
* Is the Hardware Firewall compatible with IBM's load balancer products?

Yes. The Hardware Firewall is compatible with the cloud load balancing service, local load balancer, as well as the Citrix Netscaler VPX and MPX.
* Can portable IP’s be protected by the Hardware Firewall?

No. Portable IPs are not available for protection because they can be moved between servers. Exceptions are made on a case by case basis as there are numerous caveats and require additional details about the customer's system design.
* Can I have a Hardware Firewall and a Network Gateway associated with the same VLAN?

No, it is not possible to have a Hardware Firewall and a Network Gateway device assigned to the same VLAN. The expanded functionality of the Network Gateway device provides firewall features for your network in place of a standard firewall.
* Does public traffic pass through my load balancer or Hardware Firewall first?

Coming from the public internet in, the load balancing products are first, the Hardware Firewall products are next, and the NetScaler products are last (along with the customers servers).
* Does a server's uplink port speed need to match the Hardware Firewall?
* Considerations when you change passwords for NSX-T components

 Considerations when you change passwords for NSX-T components 



* Do not change the NSX Manager admin password for NSX-T.
* You can change the NSX Manager root password. This password is not displayed in the VMware Solutions console. However, the password is the same as the one for the root user for NSX Controllers, which is displayed in the console.
* You can change the passwords for the root user for NSX Controllers. The root credentials are displayed in the VMware Solutions console.
* You can change the passwords for the admin user and the root user for the customer-managed VMware NSX Edge Services Gateway (ESG). The admin credentials are displayed in the VMware Solutions console, but the root credentials are not displayed. The passwords for the root user and the admin user are the same.
* You can change the passwords for admin user and root user for management services NSX ESG. The admin credentials are displayed in the VMware Solutions console, but the root credentials are not displayed. The passwords for the root user and the admin user are the same.



* Considerations when you change passwords for NSX-V components

 Considerations when you change passwords for NSX-V components 



* You can change the NSX Manager password. This password is displayed on the Summary page of the instance in the VMware Solutions console.
* You can change the NSX Controller password. This password is not displayed in the VMware Solutions console, but you can set a new password without the old password. For more information, see [Change Controller password](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.2/com.vmware.nsx.admin.doc/GUID-2667DD9E-E2F5-4403-BAC2-C7D1BBC23228.html).
* You can change the password and the SSH settings for the customer-managed NSX ESG.
The Bastion server is used for both CLI deployment scenarios, as well for Schematics UI deployments. For more information about how to create the Bastion server and its corresponding VPC, see [Automate SAP Bastion server – SAP media storage repository](https://cloud.ibm.com/docs/sap?topic=sap-sap-bastion-server).

After bastion VPC deployment is complete, you must download the SAP Kits for the SAP AAS type and DB you want to deploy to the temporary storage assigned to you on the Bastion Server.

You need to have already deployed an SAP NetWeaver (ABAP) 7.X -standard or distributed installation on SUSE 15.3 /RHEL 8.4 with ASE SYB before you deploy SAP AAS of NetWeaver 7.x (ABAP stack) on SUSE/RHEL with ASE SYB 16 as distributed instance. SAP AAS has to be connected to an already running SAP NW 7.X with the same type and version running on a compatible DB version.

Ansible installs the kits for you. You specify the location of the Kits in the configuration files.

To save costs the Bastion server, with its SAP media dedicated storage, can be decommissioned after the SAP solutions are successfully implemented on IBM Cloud VPC cloud. Or, you can keep the Bastion server and use it as a jump host for that specific region.

This automation is offered free of charge however, the provisioned infrastructure comes at cost.
When you order a secondary instance, the VMware vSphere Web Client for the primary instance (linked to the secondary one) might be restarted after your secondary instance order is completed.



Next, you can view and manage the vCenter Server instance that you ordered.

You must manage the IBM Cloud for VMware Solutions components that are created in your IBM Cloud account only from the VMware Solutions console, not the IBM Cloud infrastructure customer portal, or any other means outside of the console. If you change these components outside of the VMware Solutions console, the changes are not synchronized with the console.

CAUTION Managing any IBM Cloud for VMware Solutions components (which were installed into your IBM Cloud account when you ordered the instance) from outside the VMware Solutions console can make your environment unstable. The following activities are considered management activities:



* Adding, modifying, returning, or removing components
* Expanding or contracting instance capacity through adding or removing ESXi servers
* Powering off components
* Restarting services

Exceptions to these activities include managing the shared storage file shares from the IBM Cloud infrastructure customer portal. Such activities include ordering, deleting (which might impact data stores if mounted), authorizing, and mounting shared storage file shares.







 Related links 



* [Adding clusters to vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingclusters)
* [Expanding and contracting capacity for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservers)