vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Scope of the design requirements





 Components 



 VPC architecture decisions 



Table 1. Architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Provide infrastructure and administration access<br> * Limit the number of infrastructure administration entry points to ensure security audit<br><br><br> Management VPC service Create a separate VPC service for management and maintenance of workload resources and access through a site-to-site VPN 
 <br><br> * Provide infrastructure for service management components like backup, monitoring, IT service management, shared storage<br> * Ensure you can reach all IBM Cloud and on-premises services<br><br><br> Workload VPC service Create a separate VPC service as an isolated environment to support hosted applications 
 Create virtual server instances to support management Management virtual server instances Create a VPC virtual server instance that can be used for management and maintenance of your hosted application. Configure ACL and security group rules to allow access to IBM Cloud services, and workload and management VPCs. 
 Create virtual server instances to support hosted applications Workload virtual server instances Create a VPC virtual server instance that can act as a workload server to support hosted applications. Configure ACL and security group rules to allow access to IBM Cloud services, workload and management VPCs. 
 <br><br> * Demonstrate compliance with control requirements of the IBM Cloud Framework for Financial Services<br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice
[Design requirements for VPC landing zone](https://cloud.ibm.com/docs-content/v1/content/bbc046343d620cb2210cb1c62a46d7601ae08e00/secure-infrastructure-vpc/includes/deployable-reference-architectures/terraform-ibm-landing-zone/includes/deployable-reference-architectures/terraform-ibm-landing-zone/heat-map-deploy-arch-slz-vpc-standard.svg)

Figure 2. Scope of the design requirements





 Components 



 VPC architecture decisions 



Table 1. Architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Provide infrastructure/application administration access to monitor, operate, and maintain the environment.<br> * Limit the number of infrastructure/application administration entry points to ensure security audit.<br><br><br> Management VPC service 
 <br><br> * Provide infrastructure for service management components like backup, monitoring, IT service management, shared storage<br> * Ensure you can reach all IBM Cloud and on-premises services<br><br><br> Workload VPC service 
 <br><br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Isolate management VPC and allow only a limited number of network connections<br> * All other connections from or to management VPC are forbidden<br><br><br> ACL and security group rules in management VPC More ports might be opened in preset or added manually after deployment
<br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC Open following ports by default: 53 (DNS service) <br>All ports to other VPCs are open More ports might be opened in preset or added manually after deployment 
 Enable floating IP on bastion host to execute deployment Floating IPs on bastion host in management VPC Use floating IP on bastion host from IBM Schematics to complete deployment 
 Load VPN configuration to simplify VPN setup VPNs VPN configuration is the responsibility of the customer 
 Collect and store Internet Protocol (IP) traffic information with Activity Tracker and Flow Logs Activity Tracker 
 Securely connect to multiple networks with a site-to-site virtual private network 









 Next steps 

If you plan to use Red Hat OpenShift on IBM Cloud, explore a more detailed view of the [VPC reference architecture with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-openshift)
[Design requirements for VPC landing zone](https://cloud.ibm.com/docs-content/v1/content/9610604e9f8dcd5f7b6b138dd22ba445300be7f5/deployable-reference-architectures/terraform-ibm-landing-zone/heat-map-deploy-arch-slz-vpc-standard.svg)

Figure 2. Scope of the design requirements





 Components 



 VPC architecture decisions 



Table 1. Architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Provide infrastructure/application administration access to monitor, operate, and maintain the environment.<br> * Limit the number of infrastructure/application administration entry points to ensure security audit.<br><br><br> Management VPC service 
 <br><br> * Provide infrastructure for service management components like backup, monitoring, IT service management, shared storage<br> * Ensure you can reach all IBM Cloud and on-premises services<br><br><br> Workload VPC service 
 <br><br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Isolate management VPC and allow only a limited number of network connections<br> * All other connections from or to management VPC are forbidden<br><br><br> ACL and security group rules in management VPC More ports might be opened in preset or added manually after deployment 
 <br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC More ports might be opened in preset or added manually after deployment
* Multiple SAP Systems that exchange large amounts of data * Database servers, which need to have low network latency and high network throughput to network block/file storage therefore need to avoid firewalls. However the database still needs protection for other systems and networks access.

To use segregation of networks effectively, interconnectivity must be allowed under specific conditions.



 VPC Infrastructure separation of subnets 

To separate traffic, use multiple subnets.

Each VPC for a region can contain multiple subnets. These subnets within the VPC are enabled to communicate with each other, unless blocked by a Network ACL or Security Group. Therefore, two virtual servers in VPC infrastructure can have a virtual network interfaces (vNIC) on different subnets from each other.

The Network ACL or Security Group would allow specific network interconnectivity flows across these separate subnets.

However, a virtual server in VPC infrastructure cannot have multiple virtual network interfaces (vNICs) assigned to multiple subnets.





 Classic infrastructure separation of subnets 

To separate traffic, use multiple VLAN and subnets therein.

Each VLAN is either public or private and is specific to the data center and the data center Pod. The VLAN can contain multiple subnets. These subnets within the VLAN are enabled to communicate with each other, unless blocked by a Gateway Appliance.

Therefore, two bare metal hosts in classic infrastructure might have physical network interface cards that are assigned to different VLAN and subnets from each other.

The Gateway Appliance would allow specific network interconnectivity flows across these separate subnets.

A bare metal server by default (can change depending on the hardware specifications) use physical network interface cards (NICs) and consume four ethernet ports:



* eth0 NIC / eth2 redundant NIC



* Public VLAN, as DMZ trunked to Gateway Appliance
* Public primary subnet



* Public IP behind DMZ





* eth1 NIC / eth3 redundant NIC



* Private VLAN, as DMZ trunked to Gateway Appliance
* Private primary subnet



* Private IP behind DMZ





* mgmt0 --- IPMI (Admin Network Zone)
* HTTPS
* Ping
* IBM i 5250 terminal emulation with SSL (port 992)









 Private network 



* Allows your Power Systems Virtual Server instance to access existing IBM Cloud resources, such as IBM Cloud Bare Metal Servers, Kubernetes containers, and Cloud Object Storage.
* Uses a Direct Link Connect connection to connect to your IBM Cloud account network and resources.
* Required for communication between different Power Systems Virtual Server instances.



For more information about the different options for configuring a private network, see [Configure a private network](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-configuring-subnet).
However, private networks on PER workspaces in a PER enabled datacenter, such as DAL10, use upgraded networking technology for higher performance, and seamless connectivity. See, [Configuring and adding a private network subnet](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-configuring-subnet) to perform a desired operation.

Use Transit Gateway only to configure the Virtual connections, as opposed to using Cloud Connection.

On a PER workspace, Cloud Connections and VPN connections options are not available in the left navigation of the user interface since they are not required or supported with PER.

On a PER workspace, you can perform the following actions:



1. Attach a network without any requirement of creating a separate cloud connection such as Direct Link.
2. Effortlessly attach a connection to the IBM cloud network by attaching the Transit Gateway with your PER workspace.
3. Connect to your on-premises network by creating a Direct Link and attaching it with the Transit Gateway present on the PER workspace.



You cannot delete PER workspaces that have Transit Gateway connections. You must delete the Transit Gateway connections first.



 Using IBM cloud services in a PER workspace 

From your PER workspace, you can create a virtual server instance and attach subnets to it. These virtual server instances can then access the IBM Cloud resources such as Cloud Object Storage (COS), Domain Name System (DNS), and other services that use the allocated IP addresses in the range 161.26.0.0/16. See [IaaS endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpcinfrastructure-as-a-service-iaas-endpoints) for more information.

You need to attach to the Transit Gateway if you want to connect your workspace with the VPC and classic infrastructure.





 Attaching Transit Gateway to a PER workspace 

Transit Gateway is required to connect with VPC and classic infrastructure.
The restriction limiting a VLAN ID in the allowed_vlans property to a single PCI [network interface on a bare metal server](https://cloud.ibm.com/apidocs/vpc/latestget-bare-metal-server-network-interface) has been removed. As a result, you can now move VLAN interfaces between PCI interfaces on the same bare metal server.







 26 July 2022 



 For all version dates 

Resource suspension for virtual server instances. The [list all instances](https://cloud.ibm.com/apidocs/vpc/latestlist-instances) and [retrieve an instance](https://cloud.ibm.com/apidocs/vpc/latestget-instance) methods now provide lifecycle_reasons and lifecycle_state properties. A virtual server instance that violates IBM Cloud’s [Acceptable Use Policy](https://www.ibm.com/services/us/imc/html/aup1.html) will now have its lifecycle_state property set to suspended. A suspended instance is automatically powered off and you cannot update, delete, or power it on. For more information, see [Viewing instance status and lifecycle_state in the API](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instances&interface=apiinstance-status-api) and [Resource suspension](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-suspension).







 5 July 2022 



 For all version dates 

Client VPN for VPC. Client-to-site connectivity is now available. This feature allows remote devices to securely connect to a VPC using an OpenVPN (or other compatible) software client. For more information about VPN client-to-site connectivity and how it complements the existing VPN site-to-site connectivity, see [About client-to-site VPN servers](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview).
For a complete list of prerequisites for using the API and CLI, see [Setting up your API and CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment).





 Creating and configuring a VPC 

To create and configure your VPC and other attached resources:



1. Create a VPC.
2. Create subnets in one or more zones. You can create subnets in suggested prefix ranges or in your own IP ranges that you bring to IBM Cloud.
3. Attach a public gateway if you want to allow all resources in a subnet to communicate with the public internet.
4. Configure an access control list (ACL) to limit the subnet's inbound and outbound traffic.
5. Create virtual server instances with the core and RAM configuration that's right for your workload. By default, a boot volume is attached to the instance. For most virtual server instances the default boot volume size is 100 GB. The default boot volume size for a z/OS virtual server instance is 250 GB.
6. If you want more storage, create block storage volumes and attach them to your instances.
7. To define the inbound and outbound traffic that's allowed for instances, configure their security groups.
8. If you want instances to be reachable from the internet, reserve and associate floating IP addresses.
9. Deploy your service or applications across the instances.
10. To distribute requests over multiple instances, create a load balancer.
11. To enable your VPC to connect securely to another private network, such as your on-premises network or another VPC, create a virtual private network (VPN).







 Next steps 

To learn how to create VPC resources, see these tutorials:



* [Using the IBM Cloud console to create VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console)
* You can now set [10 Gbps speed for Cloud connection](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-cloud-connections) by using the Power Systems Virtual Server GUI.
* You can now set [affinity policy for storage pools](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-creating-power-virtual-serverconfiguring-instance) by using the Power Systems Virtual Server GUI.







 October 2021 



* You can now use [Virtual private network (VPN)](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-VPN-connections) to connect an on-premises VPN gateway to an IBM Cloud™ VPN gateway that is created within a Power Systems Virtual Server VPN service.
* You can now use [Virtual tape libraries](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-virtual-tape-libraries) to backup IBM i data.







 September 2021 



* You can now use [Capturing and exporting a virtual machine](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-capturing-exporting-vm) to view the new Job feature and view restrictions for VM capture, image import, and image export.
* You can now use [Mixed storage](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-power-iaas-faqsmixed_storage) to attach storage volumes to a PVM instance from different storage tiers and pools.







 June 2021 



* You can now use [Placement groups](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-placement-groups) to add your servers into groups and apply affinity or anti-affinity policies.







 May 2021
You can then connect directly to this endpoint over the IBM Cloud private network rather than the public network. Because resources that use private network endpoints don't have an internet-routable IP address, connections to these resources are more secure. Follow the steps that are outlined in [Enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uiservice-endpoint). 
 <br><br> * Determine the interconnectivity solution for you<br><br><br> Virtual Private Networking (VPN) access enables you to manage all servers and services that are associated with your account, remotely, over the IBM Cloud private network. Depending on the infrastructure that you plan to use in IBM Cloud, there are a few options available for VPN:<br><br><br><br> * [VPN for classic infrastructure](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started)<br> * [Client-to-site VPN for VPC infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-client-to-site-overview)<br> * [Site-to-site VPN for VPC infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn)<br><br><br><br>Direct Link is an alternative to a traditional site-to-site VPN solution. It can provide higher-throughput connectivity between a remote network and IBM Cloud environments. Use this decision tree to help you decide which Direct Link solution works best for you. For more information, see [How do I know which Direct Link solution to order?](https://cloud.ibm.com/docs/direct-link?topic=direct-link-get-started-with-ibm-cloud-direct-linkget-started-solution-to-order)
Download and install the version that is appropriate to your environment, and then follow the steps to connect it to your Databases for PostgreSQL deployment.

Databases For PostgreSQL



* 30 minutes
* 2023-05-01



[Scale workloads in shared and dedicated VPC environments](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-scaling-dedicated-compute)Scale workloads in shared and dedicated VPC environments

Isolate workloads by provisioning a dedicated host, attaching an encrypted data volume to a VSI, expanding the attached data volume, and resizing the VSI after the fact.

Virtual Private Cloud (VPC) Databases For PostgreSQL

+2

Schematics,Object Storage



* 2 hours
* 2023-05-05



[Use a VPC/VPN gateway for secure and private on-premises access to cloud resources](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn)Use a VPC/VPN gateway for secure and private on-premises access to cloud resources

This tutorial provides the automation to create resources that demonstrate Virtual Private Network (VPN) connectivity between on-premises servers and cloud resources like IBM Cloud® Virtual Private Cloud Virtual Service Instances (VSIs) and IBM Cloud data services. DNS resolution to cloud resources is also configured. The popular strongSwan VPN Gateway is used to represent the on-premises VPN gateway.

Schematics Virtual Private Cloud (VPC)

+3

Object Storage,Databases For PostgreSQL,DNS Services



* 2 hours
* 2023-05-08



[Getting Started](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-getting-started)Getting Started

This tutorial is a short introduction to using an IBM Cloud® Databases for Redis deployment.

Databases For Redis



* 30 minutes
* 2023-04-27
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Add contextual entities ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Import, add, edit, or delete actions or action examples ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Edit system actions ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Open and view dialog nodes or action steps ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Add, move, edit, or delete dialog nodes, dialog folders, or action steps !
v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1getintent)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodegetintent)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javagetintent)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythongetintent) 
 Update intent Update an existing intent with new or modified data. You must provide component objects defining the content of the updated intent. v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1updateintent)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodeupdateintent)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javaupdateintent)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythonupdateintent) 
 Delete intent Delete an intent from a workspace. v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1deleteintent)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodedeleteintent)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javadeleteintent)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythondeleteintent) 
 List user input examples List the user input examples for an intent, optionally including contextual entity mentions.
v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1deleteintent)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodedeleteintent)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javadeleteintent)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythondeleteintent) 
 List user input examples List the user input examples for an intent, optionally including contextual entity mentions. v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1listexamples)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodelistexamples)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javalistexamples)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythonlistexamples) 
 Create user input example Add a new user input example to an intent. v1 [cURL](https://cloud.ibm.com/apidocs/assistant/assistant-v1createexample)[node](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=nodecreateexample)[java](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=javacreateexample)[python](https://cloud.ibm.com/apidocs/assistant/assistant-v1?code=pythoncreateexample) 
 Get user input example Get information about a user input example.