vania-janet/multiturn-rag-retrieval-data huggingface dataset:
6162/tcp ALLOW OUT Anywhere Veeam transport rule
2500/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
2501/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
Show more





 Stopping the instant recovery 

The instant recovery session can be stopped by using the following command Get-VBRInstantRecovery | Where-Object {$_.VMName -eq $RestoredVMName} | Stop-VBRInstantRecovery.

For a use case where a cyberadmin uses the Veeam data integration API to access the cyberbackup, see [create a Veeam Linux managed server](https://cloud.ibm.com/docs/vmwaresolutions/?topic=vmwaresolutions-veeam-cr-sag-lnxmgdsvr).





 Related links 



* [Cyber recovery with Veeam architecture overview](https://cloud.ibm.com/docs/vmwaresolutions/?topic=vmwaresolutions-veeam-cr-sa-overview)
All your classic networks in the region are advertised with Local routing option (or all with Global Option). Ensure that you advertise the required networks for establishing the BGP session and VXLAN traffic.
5. Configure MP-BGP with eBGP multihop and EVPN on your T0 router. Create a T0 VRF for each tenant as an EVPN tenant in NSX-T.
6. VXLAN or VNI is used for each tenant. Transport between your colocation router and NSX-T transport nodes and Tier-0 traverse through IBM Cloud classic infrastructure network and Direct Link.
7. Each tenant can have their own WANs or MPLS. You must arrange the network separation at colocation by using your routers and switches. Also, you must design and configure how to secure and separate the tenants and connect to tenant WANs.







 Considerations 

When you design or deploy this architecture pattern, consider the following steps:



* You are responsible for configuring EVPN between your T0 gateways and the routers in colocation.
* You can deploy additional NSX-T edge transport nodes manually on IBM Cloud side, if needed.
* EVPN uses its own address family in MP-BGP and NSX-T advertises EVPN type-5 routes.
* If you use vpnv4 unicast address-family in the connecting router to connect to MPLS VPNs, your router must be able to convert the advertisements between these two address families.
* Refer to your router vendor and VMware NSX-T documentation for EVPN interoperability and EVPN configuration details.







 Related links 



* [VMware vSphere overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereclusteroverview)
* [Getting started with IBM Cloud Direct Link (2.0)](https://cloud.ibm.com/docs/dl?topic=dl-get-started-with-ibm-cloud-dl)
* Select Manual-select IP to specify two of your own IP addresses (in CIDR format) from the ranges 10.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, or Public (a public IP address that you own). Manual-select is useful when trying to avoid conflicts with an existing subnet that is in use.
* Select Auto-select IP for IBM to assign an IP address from IP range 169.254.0.0/16.



Make sure that any self-provided BGP addresses do not conflict with blocks that are used by IBM, or by resources external to your Direct Link deployment. Also, if you plan to use GRE or IPsec tunneling with your direct link, you must select a BGP IP other than 169.254.0.0/16.
* For BGP ASN, use either the default value of 64999 or select an ASN from the specified allowed ranges. Allowed ASN ranges are:



* For a 2-byte range, enter a value between 1-64495 or the default 64999.
* For a 2-byte or 4-byte range, enter a value between 131072-4199999999.
* For a 4-byte range, enter a value between 4201000000-4201064511.



Excluded ASNs: 0, 13884, 36351, 64512, 64513, 65100, 65201‍–‍65234, 65402‍–‍65433, 65500, and 4201065000‍–‍4201065999.



9. In the Additional BGP settings section, you can activate one or more of these optional settings. Make sure to enable the switch for each section before configuring the settings.



* Verify data integrity with Message Digest 5 (MD5) - Add an extra layer of security between two BGP peers by verifying each transmitted message sent through the BGP session. When MD5 authentication is activated, BGP authenticates every segment sent over the TCP session from its peer and verifies the source of each routing update.

Important:
* Stretched L2 capable - It is possible to do the stretching of layer 2 NSX-T overlay segments across virtual data centers.
* Single edge cluster Tier-0 gateway for workloads - The automation deploys a single NSX-T edge cluster, consisting of a pair of edge appliances, hosting an active standby Tier-0 gateway for use by the workload VMs. These VMs provide connection between the overlay and underlay networks. For more information, see [Single-site - single-tenant](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-example-overlaysv2t-example-overlays-single-site-st) and [Single-site - multitenant](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-example-overlaysv2t-example-overlays-single-site-mt).
* Stretched edge cluster Tier-0 gateways for workloads per site - To enable an active-active data plane, a stretched edge NSX-T cluster is created manually by deploying an edge appliance in each site. This action enables access to the stretched L2 NSX-T overlay segments, which host the workload VMs if a failure occurs in one of the sites. For more information, see [Multisite - single-tenant](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-example-overlaysv2t-example-overlays-multi-site-st) and [Multisite - multitenant](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-v2t-example-overlaysv2t-example-overlays-multi-site-mt).
* Single-zone NFS storage - vSphere data stores that use IBM Cloud file storage of different IOPs ratings are available. IBM Cloud file storage can be accessed only from hosts in the same site as the vSphere hosts.
* For a physical backup proxy, consider a 20-core server with 48 GB RAM and dual 10 GB NICS.
* The traffic from the source to the backup proxy is not optimized, for example, compressed or de-duped. Therefore, 100% of the backup data is transferred over this connection.
* Between the backup proxy and backup repository, optimized data typically about 50% of the source data size is transferred over this connection.
* In the virtual appliance mode, Veeam uses the VMware SCSI HotAdd capability that allows attaching devices to a VM while the VM runs. During backup, replication or restore disks of the processed VM are attached to the backup proxy. VM data is retrieved or written directly from or to the data store, instead of going through the network.
* The virtual appliance or HotAdd mode is not efficient as the direct storage access mode. However, it provides better performance than the network mode.



The backup proxy can use different transport modes that enable traffic flow between the source and the backup proxy. The end-to-end traffic flow can be considered as:



* Source to backup proxy.
* Backup proxy to backup repository.



In order of the most efficient data transfer, the following backup proxy transport modes are preferred:



* Direct storage access allows the backup proxy to retrieve data directly from the storage by avoiding the vSphere® ESXi hosts and the network. The backup proxy can be physical or virtual if iSCSI or NFS connect storage. However, it must be physical for Fibre Channel SANs. This transport mode cannot be used for vSAN, VVols, or vSphere ESXi host local storage. Direct storage access has two modes:



* Direct SAN access is recommended for VMs whose disks are on shared VMFS SAN LUNs that are connected to vSphere ESXi hosts over FC, FCoE, iSCSI, and on shared SAS storage. Direct SAN access uses VMware VADP to transport VM data directly to and from the storage. As VM data travels over the SAN, by avoiding vSphere ESXi hosts and the network, the Direct SAN access mode provides the fastest data transfer speed.
Once a backup job is requested, Veeam Plug-in starts a Veeam Transport Agent on the SAP HANA server and on the backup repository, which transports data to the backup repository. For more information, see [How Veeam Plug-in for SAP HANA Works](https://helpcenter.veeam.com/docs/backup/plugins/sap_hana_plugin.html?ver=95u4).

At this time, Veeam is able to provision with IBM Cloud® for VMware Solutions Dedicated only.



 System considerations 

Veeam Backup & Replication has a very high-performance data mover engine embedded within its components that is used for



* Reading VM data from production storage
* Applying compression/de-duplication
* Writing the resulting data stream to backup storage



The efficiency that it performs these operations is impacted by available resources, including network bandwidth, storage performance, and server processing capacity.





 Systems requirements 



* vSphere. Veeam supports vSphere (ESXi) and vCenter environments v4.1 and greater. While Veaam is suited for backup of individual vSphere (ESXi) hosts, vCenter, if deployed, is the preferred interface into a vSphere environment. vCenter provides added configuration and ease of management.

Veeam supports all OS types compatible with VMware.

VMs with disks in the SCSI bus-sharing mode are not supported as VMware does not support snapshotting VMs with those types of disks.

The following disk types are skipped from processing automatically and are not supported:



* RDM virtual disks in physical mode,
* independent disks,
* disks connected via in-guest iSCSI initiator,
* and VMs with pass-through virtual disks.



* IBM Cloud Classic Virtual Servers. Veeam Backup & Replication components are provisioned on IBM Cloud Classic Virtual Servers. Minimum requirements are



* 4-core
* 8 GB RAM
* 1 Gb network uplink speed



Veeam supports Windows Server 2012 and later, however, Windows Server 2016 is recommended for the advanced storage optimization and efficiency presented by the Resilient File System (ReFS).
* Storage.
speech_to_text Number The maximum latency (in milliseconds) between when silence is detected in the caller's speech and when a final result from the Speech to Text service is received. This value is calculated from all Speech to Text recognition results related to the call. 







 realtime_transport_network_summary 

When RTCP is enabled, the realtime_transport_network_summary object provides statistics for the inbound stream in the inbound_stream object and statistics for the outbound stream in the outbound_stream object.

The following example shows the structure of the realtime_transport_network_summary object:

"realtime_transport_network_summary": {
"inbound_stream": {
"maximum_jitter": 5,
"average_jitter": 1,
"packets_lost": 0,
"packets_transmitted": 1000,
"canonical_name": "user@example.com",
"tool_name": "User SIP Phone"
},
"outbound_stream": {
"maximum_jitter": 5,
"average_jitter": 1,
"packets_lost": 0,
"packets_transmitted": 2000,
"canonical_name": "voice.gateway@127.0.0.1",
"tool_name": "IBM Voice Gateway/1.0.0.5"
}
}
Show more



The object for each stream contains the following properties:



Properties of the realtime_transport_network_summary object

 Properties Type Description 

 maximum_jitter Number The maximum jitter during the call. 
 average_jitter Number The average jitter, calculated over the duration of the call. 
 packets_lost Number An estimate of the number of packets that were lost during the call. 
 packets_transmitted Number An estimate of the total number of packets that were transmitted during the call. 
 canonical_name String A unique identifier for the sender of the stream, typically in @ format. 
 tool_name String The name of the application or tool where the stream originated. For the phone integration, the default is IBM Voice Gateway/.
US South us.icr.io Deprecated: registry.ng.bluemix.net 







 Allow outgoing network traffic from worker node to IAM 

Allow outgoing network traffic from your worker node to IBM Cloud Identity and Access Management (IAM). Your allowlist must be Layer 7 to allow the IAM domain name. IAM does not have specific IP addresses that you can allow. If your allowlist does not support Layer 7, you can allow all HTTPS network traffic on port 443.



* TCP port 443 FROM <each_worker_node_publicIP> TO https://iam.bluemix.net
* TCP port 443 FROM <each_worker_node_publicIP> TO https://iam.cloud.ibm.com







 Optional: Allow outgoing network traffic from the worker nodes to Monitoring and Log Analysis services 



* IBM Cloud Monitoring:



* TCP port 443, port 6443 FROM <each_worker_node_public_IP> TO <monitoring_public_IP>
* Replace <monitoring_public_IP> with the [Monitoring IP addresses](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints).



* IBM Log Analysis:



* TCP port 443, port 80 FROM <each_worker_node_public_IP> TO <logging_public_IP>
* Replace <logging_public_IP> with the [Log Analysis IP addresses](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api_public).









 Next steps 

If you use load balancer services, ensure that all traffic that uses the VRRP protocol is allowed between worker nodes on the public and private interfaces. Red Hat OpenShift on IBM Cloud uses the VRRP protocol to manage IP addresses for public and private load balancers.
Troubleshooting Citrix DaaS for IBM Cloud Classic 

Use this information to troubleshoot Citrix DaaS for IBM Cloud® on Classic.



 Connection timeouts or long login times 

If you are experiencing intermittent, long session login times, connection timeouts, or network instability, you can set a Citrix policy that disables the Citrix Enlightened Data Transport Protocol (EDT). For instructions, see [How to Configure HDX Enlightened Data Transport Protocol](https://support.citrix.com/article/CTX220732).

For a technical overview of EDT, see [Adaptive transport](https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/hdx/adaptive-transport.html) in the Citrix product documentation.





 Citrix connector failure 

If the Connectors are in spinning state, or if you get a message in the Citrix Cloud Connectivity Test that the connectivity could not be validated, either:



* The Background Intelligent Transfer Service (BITS) in Connectors do not have the correct proxy settings.
* The virtual machine master image might not have the correct proxy settings.





 Solution 1 - Background Intelligent Transfer Service (BITS) in Connectors do not have the correct proxy settings 

Citrix cloud connector downloads core component installer package by using the BITS service (Background Intelligent Transfer Service). If the BITS service does not pick up the correct proxy settings, it can't connect to internet and the file download fails.



1. Run the netsh winhttp import proxy source =ie on the cloud connector’s elevated command prompt. Restart the OS to make the changes effective.
2. Use the bitsadmin command on the Cloud Connector (elevated command prompt - Run As Admin) to ensure that BITS is using the proxy properly.

bitsadmin /util /setieproxy networkservice MANUAL_PROXY "proxy:port" "bypass list"

Replace the proxy:port and bypass list with actual proxy server, port, and bypass list in use here.
3. Wait for about 10 - 15 minutes (or restart the BITS service) and retest the connectivity test.
Deploy NSX-T Managers 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

This tutorial is part of [series](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmwarevpc-bm-vmware-objectives), and requires that you have completed the related tutorials in the presented order.

In this tutorial, NSX-T will be deployed on the VMware Cluster. This includes deploying NSX-T managers, adding compute manager and adding host and edge transport nodes. This phase is optional, if you plan to use NSX-T for your Virtual Machine networking.



 Objectives 

In the [previous tutorial](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-nsx-t-vlannicsvpc-bm-vmware-nsx-t-vlannics), you deployed required Bare Metal Servers for VPC VLAN interfaces. The management IPs were registered to the DNS Service, so that these can be resolved with a name. These IP addresses and FQDNs will be used throughout this tutorial.

In this tutorial, you will first deploy one NSX-T manager on a Bare Metal Servers for VPC running VMware ESXi. After the first NSX-T manager has been deployed, you will register the vCenter as a compute manager and you can then deploy the 2nd and 3rd NSX-T managers via the NSX Manager GUI. After the cluster formation, you can configure the NSX-T transport zones and various profiles based on your preference and add the Bare Metal Servers for VPC hosts as transport nodes as well as create the edge transport nodes and edge cluster.

Zoom

!
Architecture patterns for deploying a third-party router on a vCenter Server with NSX-T instance 

On [VMware vCenter Server®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_vcenterserveroverview) instance in IBM Cloud® classic infrastructure, your workloads are deployed and run on VMware NSX-T™ overlay networks. As part of the deployment, the automation deploys an example NSX-T topology. You can use the provisioned examples as your base or build your own topologies on overlay. These overlay networks are not automatically advertised to IBM Cloud classic infrastructure network.

vCenter Server instance is deployed at IBM Cloud classic infrastructure. By default, two IBM Cloud private VLANs and one IBM Cloud public VLAN (optional) are deployed. In addition to the VLANs, NSX-T T0 Gateway is deployed on them with two interfaces, to private and to public (optional). If you opt for a public, the public uplink interface is attached to your public VLAN and has direct internet access. Your T0's private interface is attached to the private VLAN and it is using IBM Cloud portable private IP.

The architecture patterns give an introduction to connectivity patterns to integrate a third-party router, firewall, or other network device. They run as a virtual appliance on VMware with the standard NSX-T based vCenter Server instance.



 Deploying third-party router in gateway cluster 

When you deploy a vCenter Server instance in your IBM Cloud classic infrastructure, you might optionally deploy a gateway cluster. This cluster can host a third-party router or firewall. You are able to control which VLANs are routed through the router or firewall running on it.

The gateway cluster must not be mixed with NSX-T edge cluster, which consists of NSX-T edge transport nodes.
Customers configure and manage the data their users can view, update and export within the Maximo Application Sutie applications, as well as determine which of their users is permitted direct read-only access to their database(s).

IBM purchases Professional Errors and Omissions including cyber risk insurance (see below) for IBM's liability arising out of actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission committed in the conduct of IBM’s professional services. This includes coverage for loss of intangible property, such as customer data, due to IBM’s negligence. This coverage is global in scope.





 DDoS Protection 

IBM Cloud provides DDoS (Distributed Denial of Service) protection for its environment, designed to protect the entire network. IBM Cloud uses automated DDoS mitigation controls and an in-house Network Operations Center (NOC) team to monitor network performance and security 24x7.





 Media Sanitization 

IBM securely sanitizes physical media intended for reuse prior to such reuse, and will destroy physical media not intended for reuse, consistent with National Institute of Standards and Technology, United States Department of Commerce (NIST) guidelines for media sanitization (see link below). [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf)





 Cyber Insurance 

IBM carries standard cyber risk insurance under its Professional Errors & Omissions policy. PE&O insurance provides coverage for actual or alleged breach of duty, neglect, error, misstatement, misleading statements or omission, solely for acts or omissions committed by IBM in providing professional services to our client(s). Coverage includes network security, unauthorized access, unauthorized use, receipt or transmission of a malicious code, denial of service attack, unauthorized disclosure or misappropriation of private information, privacy liability, notification costs, credit card monitoring, and fine & penalties incurred by the customer.

The PE&O Policy itself is IBM Confidential information.
For default service access roles that support creating EP11 keys, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following actions to the custom role:



* hs-crypto.keystore.listkeystoresbyids
* hs-crypto.keystore.listkeysbyids
* hs-crypto.crypto.generatekey
* hs-crypto.crypto.generatekeypair
* hs-crypto.keystore.storenewkey



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

Complete the following steps to create an EP11 key:



1. Select the EP11 keys tab in the side menu. You can see a list of existing EP11 keys with each having a unique ID.
2. Click Create key. In the Create EP11 key panel that is displayed, complete the following steps:



1. Specify the following key details on the Identifier page:



Table 2. Describes the Identifier page

 Setting Description 

 Key name A human-readable alias for easy identification of your key. The key name length can be 1-32 characters. To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. The key name might not be unique. You can assign multiple keys with the same name. However, it is suggested to assign a unique name to each key in the same keystore for easy identification. 
 Key type The type of the EP11 key that you want to manage in Hyper Protect Crypto Services. 
 Keystore The unique identifier of the keystore with the keystore type appended. Choose one that you want the key to be stored in from the list. For an asymmetric key pair, you need to specify the keystore separately to store the public key and the private key.
07 June 2022 

Private information in Continuous Delivery and toolchains can now be protected by the Customer Root Key as part of Bring Your Own Key.
: [Bring Your Own Key](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_professional_plan) is available only in a professional plan.





 23 May 2022 

Git Repos and Issue Tracking
: Upgraded to [GitLab 14.9.4](https://about.gitlab.com/releases/2022/05/02/security-release-gitlab-14-10-1-released/).





 18 May 2022 

New toolchain template demonstrates how to deploy a sample NodeJS application with [Code Engine](https://cloud.ibm.com/docs/codeengine) by using a Tekton pipeline.
: [Code Engine Template](https://cloud.ibm.com/devops/setup/deploy?repository=https%3A%2F%2Fgithub.com%2Fopen-toolchain%2Fcode-engine-toolchain&env_id=ibm:yp:us-south).





 5 May 2022 

Git Repos and Issue Tracking
: Upgraded to [GitLab 14.8.5](https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/).





 1 March 2022 

Git Repos and Issue Tracking
: Upgraded to [GitLab 14.7.4](https://about.gitlab.com/releases/2022/02/25/critical-security-release-gitlab-14-8-2-released/).





 17 February 2022 

Git Repos and Issue Tracking
: Upgraded to [GitLab 14.6.4](https://about.gitlab.com/releases/2022/02/03/security-release-gitlab-14-7-1-released/).





 24 January 2022