vania-janet/multiturn-rag-retrieval-data huggingface dataset:
VMware NSX-T design on VPC 

The topic provides an introduction to VMware® NSX-T™ deployment architecture that uses IBM Cloud® bare metal server for IBM Cloud VPC. An overview of this architecture is shown in the following diagram.

Zoom

![Architecture Overview of VMware with NSX-T on IBM Cloud VPC](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vpc-ryo-diagrams-aod-nsx-t-based.svg)

Figure 1. Architecture overview of VMware with NSX-T on IBM Cloud VPC



 VMware NSX-T overview 

VMware NSX-T is designed to address application frameworks and architectures that have heterogeneous endpoints and technology stacks. In addition to VMware vSphere®, these environments can include other hypervisors, KVM, containers, and IBM Cloud bare metal server. NSX-T is designed to span a software defined network and security infrastructure across platforms other than just vSphere alone. While it is possible to deploy NSX-T components without needing vSphere, this architecture focuses on NSX-T Data Center and its integration within a roll-your-own VMware vSphere Solution on IBM Cloud VPC. This deployment architecture focuses on NSX-T version 3.1 and later.

NSX-T consists of the following key components:



* NSX Manager provides a graphical user interface (GUI) and REST APIs for creating, configuring, and monitoring NSX-T Data Center components such as segments, logical routers, and firewalls. NSX Manager provides a system view and it is the management component of NSX-T Data Center.
* NSX Host Transport Nodes participate in an NSX-T Data Center overlay or NSX-T Data Center VLAN networking. Each provisioned ESXi host in the VPC must be enabled to be a Transport Node.
Regions and endpoints 

Review region and connectivity options for interacting with IBM Cloud Event Notifications.



 Available regions 

IBM Cloud Event Notifications is available in the following regions:



* Dallas (us-south)
* London (eu-gb)
* Sydney (au-syd)
* Frankfurt (eu-de)



You can create IBM Cloud Event Notifications resources in one of the supported IBM Cloud regions.





 Service endpoints 

Event Notifications offers two connectivity options for interacting with its service APIs.

Public endpoints
: By default, you can connect to resources in your account over the IBM Cloud public network. Your data is encrypted in transit by default that uses the Transport Security Layer (TLS) 1.2 protocol.

Private endpoints
: To further secure your connection, you can also enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=ui) for your infrastructure account. When you enable VRF for your account, you can [connect to Event Notifications by using a private IP](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-service-connection) that is accessible only through the IBM Cloud private network.



 Public endpoints 

The following table contains the base URLs for the IBM Cloud Event Notifications API endpoints. When you call the API, use the URL that corresponds to the region where your service instance is deployed. Add the path for each method to form the complete API endpoint for your requests.



Table 1. Public endpoints for interacting with Event Notifications by using APIs

 Location Endpoint URL 

 Dallas https://us-south.event-notifications.cloud.ibm.com/event-notifications/v1/instances/{guid} 
 London https://eu-gb.event-notifications.cloud.ibm.com/event-notifications/v1/instances/{guid}
They are automatically created when a logical switch is created from a pool or range of IDs. This design uses the default VNI pool that is deployed with NSX-T.





 Segments 

An NSX-T segment reproduces switching functions, broadcast, unknown unicast, multicast (BUM) traffic, in a virtual environment that is decoupled from the underlying hardware.



Table 10. NSX-T logical switches

 Segment name VLAN Transport zone Uplink teaming policy 

 edge-teps default tz-esxi-private TEP - Failover order 
 service-to-private default tz-edge-private 
 service-to-public default tz-edge-public 
 customer-to-private default tz-edge-private 
 customer-to-public default tz-edge-public 
 customer-t0-172-16-16-0 tz-vm-overlay 
 customer-t1-192-168-0-0 tz-vm-overlay 
 customer-t1-192-168-1-0 tz-vm-overlay 





 Gateway cluster 

Within this design, two virtual edge node clusters are provisioned, one for management and the other for customer workloads. A limitation of one T0 per Edge Transport Node exists, which means that a single Edge Node Cluster can support one T0 Gateway (in either active-standby or active-active).

The following figures show the functional components of an NSX-T gateway cluster.

Zoom

![Topology for the customer gateway cluster](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/nsx-t-3-ra-diagrams-customer-edge-cluster-t0-t1.svg)

Figure 4. Topology for the customer gateway cluster

Zoom

!
Open the [Virtual server instances for VPC](https://cloud.ibm.com/vpc-ext/compute/vs)
3. Stop traffic to the 0 firewall instance by specifying a security group that will not allow inbound port 80. Locate the instance with the suffix fw-z1-s3-0 and open the details view:



1. Scroll down and hit the pencil edit next to the Network Interface
2. Uncheck the x-fw-inall-outall
3. Check the x-fw-in22-outall
4. Click Save



4. Run the pytest again. It will indicate failures. It will take a few minutes for the NLB to stop routing traffic to the instance, at which point all tests will pass. Continue waiting and running pytest until all tests pass.



The NLB firewall is no longer required. Remove the NLB firewall:



1. Change these two variables in config_tf/terraform.tfvars:

firewall_nlb = false
number_of_firewalls_per_zone = 1
2. Apply all the layers through the all_firewall_asym_tf layer:

./apply.sh : all_firewall_asym_tf







 Note about NLB configured in routing mode 

NLB route mode will rewrite route table entries - always keeping the active NLB appliance IP address in the route table during a fail over. But this is only done for routes in the transit VPC that contains the NLB. The spoke has egress routes that were initialized with one of the NLB appliance IPs. The spoke next hop will not be updated on NLB appliance fail over!

It will be required to maintain an ingress route in the transit VPC which will be rewritten by the NLB to reflect the active appliance. The spoke egress route will deliver packets to the correct zone of the transit VPC. Routing within the transit VPC zone will find the matching ingress rule which will contain the active appliance.
Order an SSL certificate 

Secure Sockets Layer (SSL) is a technology that encrypts traffic between the client application and the server application, and is accomplished by using a public key/private key system that uses an SSL certificate.

SSL certificates contain the server’s public key, dates for which the certificate is valid, a host name for which the certificate is valid, and a signature from the certificate authority that issued it.

IBM Cloud® offers certificates that can be acquired and purchased without having to go through a third-party vendor/site.

IBM Cloud offers yearly and bi-yearly SSL certificates for customers that offer various benefits, including:



* Full authentication for business identity and domain ownership verification
* 40- to 256-bit encryption on all online transactions
* Daily website malware scanning to ensure that both your site and your customers are protected



If you are running multiple domains, an SSL certificate can be purchased for each domain.

For more information about SSL certificates refer to the following IBM Cloud articles:



* [About SSL certificates](https://cloud.ibm.com/docs/ssl-certificates?topic=ssl-certificates-about-ssl-certificates)
* [Introduction to SSL technology](https://cloud.ibm.com/docs/ssl-certificates?topic=ssl-certificates-introduction-to-ssl-technology)
* [Planning for SSL](https://cloud.ibm.com/docs/ssl-certificates?topic=ssl-certificates-planning-for-ssl)



To order an SSL certificate for use with your Citrix Netscaler VPX, perform the following procedure:



1. In VPX shell CLI, display the CSR text by opening the CSR file previously created in the step [Create keys and generate the Certificate Signing Request (CSR)](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-create-keys-and-generate-the-certificate-signing-request-csr-):

root@IBMADC690867-s6dr cat certreqnss6dr.csr
EP11_endpoint_port_number The port number of the EP11 API endpoint. It is located after the colon in the endpoint URL. 
 enable_mtls Valid values are true or false to indicate whether you want to enable mutual TLS to add a second layer of authentication for PKCS #11 API access for Hyper Protect Crypto Services Standard Plan. By default, set it false as EP11 requires server-only authentication. For more information about the mutual TLS connections, see [Enabling the second layer of authentication for EP11 connections](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11). 
 client_certificate If you enable mutual TLS connections, specify the file path of the client certificate that is uploaded to your instance by the certificate administrator. Otherwise, keep this field empty. 
 client_certificate_private_key If you enable mutual TLS connections, specify the file path of the client certificate private key that is used to sign the certificate. Otherwise, keep this field empty. 
 SO_user_name The name for the Security Officer (SO) user type. The PKCS #11 standard defines two types of users for login: the security officer (SO) and the normal user. For more information about the PKCS #11 user types, see <br><br>[PKCS #11 Cryptographic Token Interface Usage Guide Version 2.40 - Users](http://docs.oasis-open.org/pkcs11/pkcs11-ug/v2.40/cn02/pkcs11-ug-v2.40-cn02.html_Toc406759984). 
 normal_user_name The name for the normal user type. The PKCS #11 standard defines two types of users for login: the security officer (SO) and the normal user.
: Share data via APIs with global business partners to [drive omnichannel sales](https://cloud.ibm.com/docs/containers?topic=containers-cs_uc_retailuc_data-share).
: Optimize inventory expenses with [digital insights to sales behavior](https://cloud.ibm.com/docs/containers?topic=containers-cs_uc_retailuc_grocer).

Transportation Build and deploy HR site with AI [in less than 3 weeks](https://cloud.ibm.com/docs/containers?topic=containers-cs_uc_transportuc_airline). : Increase availability of worldwide systems for [business partners](https://cloud.ibm.com/docs/containers?topic=containers-cs_uc_transportuc_shipping).
For more information, see [Configure VLAN Tagging on a Distributed Port Group or Distributed Port](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-D5960C77-0D19-4669-A00C-B05D58A422F8.html)







 Step 6: Add edge transport nodes and create an edge cluster 

Edge nodes are grouped in one or several clusters, representing a pool of capacity.

Follow the recommended order of procedures to install edge transport nodes and form an edge cluster for your logical routers.



1. Install NSX Edges. When configuring the host TEP IPs, configure each host individually by using the [previously provisioned TEP IPs](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-nsx-t-hostsvpc-bm-vmware-nsx-t-vlannics) of the related IBM Cloud Bare Metal Servers for Virtual Private Cloud VLAN interface for TEP. For more information, see [Install an NSX Edge on ESXi Using the vSphere GUI](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/installation/GUID-AECC66D0-C968-4EF2-9CAD-7772B0245BF6.htmlGUID-AECC66D0-C968-4EF2-9CAD-7772B0245BF6).
2. Create an NSX Edge cluster.
HTTP/2 200
date: Tue, 28 Apr 2022 17:48:03 GMT
content-type: application/json; charset=utf-8
content-length: 1049
cf-ray: 69903d250c4966ef-DFW
cache-control: max-age=0, no-cache, no-store, must-revalidate
expires: -1
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="[uri...]"
pragma: no-cache
x-content-type-options: nosniff
x-request-id: 1fbe2384-6828-4503-ae7d-050426d1b11b
x-xss-protection: 1; mode=block
server: cloudflare
etag: W/xxxyyyzzz123
Show more
2. Make a PATCH /volumes/{volume_id} request. Specify the Etag-hash-string for the If-Match property in the header. Specify the user tags in the user_tags property.

You can also add tags when you make a POST /volumes call to create a volume and specify the user_tags property.

This example updates the volume by specifying user tags env:test and env:prod. The value that you obtained from the Etag parameter is specified in the If-Match header in the call.

curl -X PATCH "$vpc_api_endpoint/v1/volumes/50fda9c3-eecd-4152-b473-a98018ccfb10?version=2022-04-25&generation=2" -H "Authorization: Bearer" -H "If-Match: <_Etag-hash-string_>" -d {
"user_tags": [
"env:test",
"env:prod"
]
}'
target_port uint16 The TCP/UDP dest-port as it appears in first packet that is processed by this vNIC on this connection. 
 transport_protocol uint8 The Internet Assigned Numbers Authority (IANA) protocol number (TCP or UDP). 
 ether_type string Currently, IPv4 is the only value. 
 was_initiated bool The connection initiated in this flow log. 
 was_terminated bool The connection terminated (for example, timeout/RST/Final-FIN). 
 bytes_from_initiator uint64 The count of bytes on connection in this flow log’s time-window, from Initiator to Target. 
 packets_from_initiator uint64 The count of packets on the connection in this flow log’s time-window, from Initiator to Target. 
 bytes_from_target uint64 The count of bytes on the connection in this flow log’s time-window, from Target to Initiator. 
 packets_from_target uint64 The count of packets on the connection in this flow log’s time-window, from Target to Initiator. 
 cumulative_bytes_from_initiator uint64 The count of bytes since the connection was initiated, from Initiator to Target. 
 cumulative_packets_from_initiator uint64 The count of packets since the connection was initiated, from Initiator to Target. 
 cumulative_bytes_from_target uint64 The count of bytes since the connection was initiated, from Target to Initiator. 
 cumulative_packets_from_target uint64 The count of packets since the connection was initiated, from Target to Initiator. 



In most cases, you can find the direction field by comparing the vNIC’s private IP with the source and destination IPs. However, the field is convenient for queries.





 Example flow log object 

{
"version": "0.0.1",
"collector_crn": "crn",
"attached_endpoint_type": "vnic",
"network_interface_id": "crn",
"instance_crn": "crn",
A Direct Link connection allows an on-premises network to connect to other networks (for instance, VPC and classic infrastructure) that are connected to the same transit gateway.
: The beta release for this feature has ended. If you participated in this beta, you can continue to use the gateways that you created during the beta period.





 24 June 2021 

BGP Message Digest 5 authentication support
: Border Gateway Protocol (BGP) authentication enables routers to share information only if they can verify that they are talking to a trusted source, based on a key. TCP MD5 authentication adds an extra layer of security between BGP peers by verifying each transmitted message sent through a BGP session. You can store your keys in either Key Protect or Hyper Protect Crypto Services (HPCS).
[Why is the transport endpoint not connected?](https://cloud.ibm.com/docs/containers?topic=containers-cos_transport_ts_connectcos_transport_ts_connect)





 Portworx Storage 

[Debugging Portworx failures](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px)



* [Checking whether the pod that mounts your storage instance is successfully deployed](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px_deploy)
* [Restarting your app pod](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px_restart)
* [Verifying that the Portworx storage driver and plug-in pods show a status of Running](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px_driver_plugin)
* [Checking and updating the kubectl CLI version](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px_cli)
* [Updating Helm charts](https://cloud.ibm.com/docs/containers?topic=containers-debug_storage_pxdebug_storage_px_helm)



[Debugging your Portworx installation](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxdebug-portworx)



* [Step 1: Verifying the IBM Cloud catalog information](https://cloud.ibm.com/docs/containers?topic=containers-debug-portworxpx-verify-catalog)
Configuring this is beyond the scope of this tutorial.



1. Edit config_tf/terraform.tfvars.



* Change the value enterprise_phantom_address_prefixes_in_transit = true.



2. Configuration changes require all current layers to be re-applied

./apply.sh : :
3. Verify that all VPEs can be accessed from all test instances.

Your expected results are: enterprise -> spoke vpe cross zone will be FAILED:

pytest -m 'vpe or vpedns'







 Production Notes and Conclusions 

The [VPC reference architecture for IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-about) has much more detail on securing workloads in the IBM Cloud.

Some obvious changes to make:



* CIDR blocks were chosen for clarity and ease of explanation. The Availability Zones in the Multi zone Region could be 10.1.0.0/10, 10.64.0.0/10, 10.128.0.0/10 to conserve address space. Similarly the address space for Worker nodes could be expanded at the expense of firewall, DNS and VPE space.
* Security Groups for each of the network interfaces for worker VSIs, Virtual Private Endpoint Gateways, DNS Locations and firewalls should all be carefully considered.
* Network Access Control Lists for each subnet should be carefully considered.
* Floating IPs were attached to all test instances to support connectivity tests via SSH. This is not required or desirable in production.
* [Implement context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=ui) rules to further control access to all resources.



In this tutorial you created a hub VPC and a set of spoke VPCs. You routed all cross VPC traffic through a transit VPC firewall-router. DNS services were created for each VPC. DNS forwarding rules were created between the services for workloads and a virtual private endpoint gateways.
HTTP/2 200
date: Tue, 28 Apr 2022 17:48:03 GMT
content-type: application/json; charset=utf-8
content-length: 1049
cf-ray: 69903d250c4966ef-DFW
cache-control: max-age=0, no-cache, no-store, must-revalidate
expires: -1
strict-transport-security: max-age=31536000; includeSubDomains
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="[uri...]"
pragma: no-cache
x-content-type-options: nosniff
x-request-id: 1fbe2384-6828-4503-ae7d-050426d1b11b
x-xss-protection: 1; mode=block
server: cloudflare
etag: W/xxxyyyzzz123
2. Make a PATCH /volumes/{volume_id} request. Specify the Etag-hash-string for the If-Match property in the header. Specify the user tags in the user_tags property.

You can also add tags when you make a POST /volumes call to create a volume and specify the user_tags property.

This example updates the volume by specifying user tags env:test and env:prod. The value that you obtained from the Etag parameter is specified in the If-Match header in the call.

curl -X PATCH "$vpc_api_endpoint/v1/volumes/50fda9c3-eecd-4152-b473-a98018ccfb10?version=2022-04-25&generation=2" -H "Authorization: Bearer" -H "If-Match: <_Etag-hash-string_>" -d {
"user_tags": [
"env:test",
"env:prod"
]
}'
volumeMounts:
- mountPath: /host/var/log
name: host-log
volumes:
- name: host-log
hostPath:
path: /var/log
Show more
5. Create the DaemonSet in your cluster when the Transport endpoint is not connected. error occurs.

kubectl create -f ./inspectnode-ds.yaml
6. Get the name of the inspectnode pod.

kubectl get pods -n default -l app=ibm-inspectnode -o wide
7. Copy the logs from inspectnode pod to your local machine. In the copy command, give your directory a name so that you can identify which node the logs are from. For example, node-one.log. You might also use the node IP in the directory name, for example: 10.XXX.XX.XXX.log.

kubectl cp <inspectnode_pod_name>:/host/var/log ./<node_name>.log
8. Review the syslog and the s3fslog for information about the Transport endpoint error. [Open a support ticket](https://cloud.ibm.com/docs/containers?topic=containers-get-helphelp-support) and share the log files that you gathered.
9. Delete the ibm-inspectnode DaemonSet that you deployed.

kubectl delete daemonset ibm-inspectnode
To specify more than one path, use multiple options, such as -p /var/log/myApp1/&ast; -p /var/log/myApp2/&ast;. This value is required for log source application.

--syslog-protocol
: The transfer layer protocol that is used when the logging type is syslog. Supported values are tcp, tls, and the default udp. When forwarding to a rsyslog server with the udp protocol, logs that are over 1 KB are truncated.

-C, --app-container
: To forward logs from apps, you can specify the name of the container that contains your app. To specify more than one container, use multiple options, such as -C /var/log/myApp1/&ast; -C /var/log/myApp2/&ast;. If no containers are specified, logs are forwarded from all the containers that contain the paths that you provided. This option is only valid for log source application.

--skip-validation
: Optional: Skip validation of the org and space names when they are specified. Skipping validation decreases processing time, but an invalid logging configuration does not correctly forward logs.

--force-update
: Force your Fluentd pods to update to the latest version. Fluentd must be at the latest version to change your logging configurations.

--output json
: Optional: Prints the command output in JSON format.

-q
: Optional: Do not show the message of the day or update reminders.

Examples:

Example for log type syslog that forwards from a container log source on default port 514:

ibmcloud ks logging config create my_cluster --logsource container --namespace my_namespace --hostname 169.xx.xxx.xxx --type syslog

Example for log type syslog that forwards logs from an ingress source on a port different than the default:

ibmcloud ks logging config create --cluster my_cluster --logsource container --hostname 169.xx.xxx.xxx --port 5514 --type syslog
'uuid': '<UUID of the L7 Rule being updated>',
'type': 'FILE_TYPE',
'comparisonType': 'CONTAINS',
'value': 'some_newvalue',
'invert': 1
},
{
'uuid': '<UUID of the L7 Rule being updated>',
'type': 'PATH',
'comparisonType': 'EQUAL_TO',
'value': 'some_newvalue2',
'invert': 0
}
]

client = SoftLayer.Client()
networkLBaaSL7RuleService = client['SoftLayer_Network_LBaaS_L7Rule']

try:
result = networkLBaaSL7RuleService.updateL7Rules(policyUuid, rules)
pprint(result)
except SoftLayer.SoftLayerAPIError as e:
print("Unable to update multiple Layer 7 Rules attached to the same Layer 7 policy: %s, %s"
% (e.faultCode, e.faultString))
Show more





 Create a Layer 7 pool with servers, health monitoring, and session affinity 

import SoftLayer
from pprint import pprint

 UUID of load balancer to be updated
loadBalancerUuid = "set me"

 Layer 7 pool to be added
l7Pool = {
'name': 'image_pool',
'protocol': 'HTTP', only supports HTTP
'loadBalancingAlgorithm': 'ROUNDROBIN'
}

 Layer 7 Backend servers to be added
l7Members = [
{
'address': '10.131.11.46',
'port': 80,
'weight': 10
},
{
'address': '10.130.188.130',
'port': 81,
'weight': 11
}
]

 Layer 7 Health monitor to be added