vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The following services are optional for VMware Regulated Workloads:



* [VMware HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
* [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations)







 Related links 



* [VMware Regulated Workloads overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-overview)
* [Ordering VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-req)
* [Viewing and deleting VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-view-delete-instance)
* [VMware Regulated Workloads reference architecture overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-archi-overview)
More specifically, that connection is used for VRRP advertisements. In addition, the virtual-addresses in the following examples are the gateway IP addresses for each of a customer's primary or secondary subnets. The vrrp-group number should match the group number shown in your gateway details page, as well as match the vrrp-group set in the rest of the default configuration.

The first command in this example can also be used on a single VRA that is not set up for HA.

For more information on a full HA configuration, including setting the sync-group for the VIF's, see [Associated VLAN subnets with VRRP](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-working-with-high-availability-and-vrrpassociated-vlan-subnets-with-vrrp).

On the first (or only) VRA, run the following commands:

set interfaces bonding dp0bond0 vif 1432 address 192.168.132.1/30
set interfaces bonding dp0bond0 vif 1432 vrrp vrrp-group 1 virtual-address 10.0.10.1/24
set interfaces bonding dp0bond0 vif 1693 address 192.168.193.1/30
set interfaces bonding dp0bond0 vif 1693 vrrp vrrp-group 1 virtual-address 10.0.20.1/24

Then, on the second VRA, run:

set interfaces bonding dp0bond0 vif 1432 address 192.168.132.2/30
set interfaces bonding dp0bond0 vif 1432 vrrp vrrp-group 1 virtual-address 10.0.10.1/24
set interfaces bonding dp0bond0 vif 1693 address 192.168.193.2/30
set interfaces bonding dp0bond0 vif 1693 vrrp vrrp-group 1 virtual-address 10.0.20.1/24
Intel Virtual Server certified profiles on VPC infrastructure for SAP NetWeaver 



 Profiles list 

The published names are subject to change.

The following list gives you an overview of the SAP-certified profiles with Virtual Servers for VPC:



Table 1. IBM Cloud Virtual Servers for VPC certified for SAP NetWeaver

 Profile vCPU Memory (RAM GiB) SAPS 

 Compute 
 cx2-2x4 2 4 2,238 
 cx2-4x8 4 8 4,475 
 cx2-8x16 8 16 8,950 
 cx2-16x32 16 32 17,900 
 cx2-32x64 32 64 35,800 
 cx2-48x96 48 96 53,700 
 cx2-64x128 64 128 71,600 
 cx2-96x192 96 192 107,400 
 cx2-128x256 128 256 143,200 
 Balanced 
 bx2-2x8 2 8 2,306 
 bx2-4x16 4 16 4,613 
 bx2-8x32 8 32 9,225 
 bx2-16x64 16 64 18,450 
 bx2-32x128 32 128 36,900 
 bx2-48x192 48 192 55,350 
 bx2-64x256 64 256 81,685 
 bx2-96x384 96 384 122,528 
 bx2-128x512 128 512 163,370 
 Memory optimized 
 mx2-2x16 2 16 2,571 
 mx2-4x32 4 32 5,141 
 mx2-8x64 8 64 10,283 
 mx2-16x128 16 128 20,565 
 mx2-32x256 32 256 41,130 
 mx2-48x384 48 384 56,970 
 mx2-64x512 64 512 81,015 
 mx2-96x768 96 768 121,523 
 mx2-128x1024 128 1,024 162,030 
 Very High Memory
Windows Active Directory Private primary subnet <br>Infrastructure VMs IBM Cloud infrastructure WSUS service IBM Cloud infrastructure services network 80 TCP Use IBM Cloud infrastructure WSUS service HTTP 
 Windows Active Directory Private primary subnet <br>Infrastructure VMs IBM Cloud infrastructure Windows KMS service IBM Cloud infrastructure services network 1688 TCP Use IBM Cloud infrastructure Windows KMS service 
 ESXi host Private primary subnet IBM Cloud infrastructure NTP service IBM Cloud infrastructure services network 123 UDP Use IBM Cloud infrastructure NTP service 
 vCenter Server Infrastructure VMs IBM Cloud infrastructure NTP service IBM Cloud infrastructure services network 123 UDP Use IBM Cloud infrastructure NTP service 
 NSX Manager Infrastructure VMs IBM Cloud infrastructure NTP service IBM Cloud infrastructure services network 123 UDP Use IBM Cloud infrastructure NTP service 
 NSX Manager Infrastructure VMs TEP subnet TEP traffic 443 
 NSX Manager Infrastructure VMs Customer edge subnet Customer edge private traffic 443 
 ESXi host shared storage ESXi shared storage IBM Cloud infrastructure endurance storage IBM Cloud infrastructure services network 111, 635, and 2049 TCP and UDP Use IBM Cloud infrastructure endurance storage 
 IBM CloudDriver <br>Windows Active Directory (VSI) Private primary subnet IBM Cloud infrastructure engine IBM Cloud infrastructure services network 80 TCP Provision IBM CloudDriver and Windows Active Directory (VSI) 
 IBM Cloud infrastructure engine IBM Cloud infrastructure services network <br>IBM CloudDriver <br>Windows Active Directory (VSI) Private primary subnet Any TCP and UDP Provision IBM CloudDriver and Windows Active Directory (VSI) 
 IBM Cloud infrastructure engine IBM Cloud infrastructure services network ESXi host management0 Private primary subnet 623 TCP and UDP IBM Cloud infrastructure IPMI 
 IBM CloudDriver IBM Cloud Service <br>10.221.68.39 514 TCP 
 IBM CloudDriver Internet HTTPS 





 Related links 



* [Ports used by VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-vmwareuses)
Working with High Availability (HA) and VRRP 

IBM Cloud® Virtual Router Appliance (VRA) supports Virtual Router Redundancy Protocol (VRRP) as a high availability protocol. The deployment of devices is done in an active/passive manner, where one machine is master and the other is the backup. All interfaces on both machines are a member of the same "sync-group", so if one interface experiences a fault, the other interfaces in the same group also fault, and the device stops being master. The current backup detects that the master is no longer broadcasting keepalive/heartbeat messages, assumes control of the VRRP virtual IPs, and becomes master.

VRRP is the most important part of the configuration when provisioning gateways. High availability functionality depends on the heartbeat messages, so making sure that they are not blocked is critical.



 VRRP Virtual IP (VIP) addresses 

The VRRP virtual IP for dp0bond1 or dp0bond0, or VIP, is the floating IP address that changes from master to backup device when failover happens. When a VRA deploys, it has a public and private bonded network connection and real IPs assigned on each interface. A VIP is assigned on both interfaces as well, whether the device is stand-alone, or in an HA pair. Traffic that has a destination IP in subnets in VLANs associated with the VRA is sent directly to these VRRP VIP's through a static route on the FCR/BCR.

You should neither change VRRP virtual IP addresses for any gateway group nor should you disable the VRRP interface. These IP addresses are the method by which traffic is routed to the gateway when a VLAN is associated. As a result, if they are down, VLAN traffic is also down. If the IP address is not present, then the traffic cannot be forwarded from the BCR/FCR to the VRA itself. This virtual-address or VIP is not changeable at this time. This limitation might change in the future, but currently neither the migration of a VRA between PODs/FCRs/BCRs nor changing the VIP are supported.
In classic clusters, if you have multiple VLANs for your cluster, multiple subnets on the same VLAN, or a multizone classic cluster, you must enable a [Virtual Router Function (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) for your IBM Cloud infrastructure account so your worker nodes can communicate with each other on the private network. To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command. If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).

--public-vlan PUBLIC_VLAN
: The ID of the public VLAN. This value is required if you want to expose workloads on the nodes to the public after you create the cluster. It must match the public VLAN ID of one or more of the worker nodes in the cluster for the zone. To see the VLANs that you have available, run ibmcloud oc cluster get --cluster <cluster> --show-resources. New worker nodes are added to the VLAN that you specify, but the VLANs for any existing worker nodes are not changed. If you don't have a private or public VLAN in that zone, don't specify this option.
Port 443 must be allowed between both devices for config-sync to work, and VRRP must be allowed to be sent and received, including the multicast range of 224.0.0.0/24.





 Associated VLAN subnets with VRRP 

For any VIF configuration with VRRP, you require a virtual IP address (the first usable IP in the subnet, the gateway IP to which everything in that subnet will route) and also a real interface IP address for the VIF on both devices. To conserve usable IPs, it is recommended that the real interface IPs use an out-of-band range, such as 192.168.0.0/30, where one device has the .1 and the other device has the .2 address. You can have multiple VRRP virtual IPs, but you need only one real address on each VIF.

Here is an example of a VRRP configuration with two private VLANs and three subnets:

set interfaces bonding dp0bond0 address '10.100.11.39/26'
set interfaces bonding dp0bond0 mode 'lacp'
set interfaces bonding dp0bond0 vif 10 address '192.168.255.81/30'
set interfaces bonding dp0bond0 vif 10 description 'VLAN 10 - Two private subnets/VIPs'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 advertise-interval '1'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 priority '254'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 virtual-address '10.100.105.177/28'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 virtual-address '10.100.38.1/26'
An alternative connectivity pattern requires using the VPN for VPC service to securely connect from your private network to the management VPC. VPN for VPC can be used as a static, route-based VPN or a policy-based VPN to set up an IPsec site-to-site tunnel between your VPC and your on-premises private network, or another VPC.

The following diagram shows the VPN for VPC connection pattern.

Zoom

![Consumer on-premises to workload VPC using VPN for VPC](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/network-connectivity/consumer-to-workload-same-account/vpc-architecture-consumer-on-prem-to-provider-same-account-VPN.svg)

Figure 3. Consumer on-prem to workload VPC using VPN for VPC

For more information, see:



* [About VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn)
* [Creating a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-gateway)









 Consumer in different organization than application provider 



 Connecting from public internet 

There are many valid cases where you might want to allow consumers to access your service through the public internet. The base architecture can be adapted to securely enable this type of access as shown in the following diagram which introduces a new edge VPC. The request from the consumer gets routed through a global load balancer outside of the edge VPC, through a web application firewall (WAF) in the edge VPC, and then to the public application load balancer within the workload VPC. This is shown in the following diagram.

Zoom

!
The global routing capability is well suited for transitioning workloads across disaster recovery sites, or seamlessly migrating to a new deployment in a geographic area that can serve your audience better.



Table 3. Global IP address availability

 Availability IPv4 IPv6 

 Public Network Yes Yes 
 Private Network No No 









 Product-specific considerations when ordering subnets 

When ordering your subnets, make note of the following product-specific considerations.



 Hardware Firewall 

By default, portable subnets are not protected by firewalls. If you need this feature, discuss it with your IBM Sales representative. Secondary subnets larger than /29 cannot be routed through this firewall offering.





 Virtual Router Appliance 

When ordering subnets for a VLAN behind a High Availability (HA) Virtual Router Appliance (VRA), ensure that the subnet is configured correctly to allow for fail-over between the two appliances. For more information, see [Working with High Availability (HA) and VRRP](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-working-with-high-availability-and-vrrp).
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 priority '254'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 virtual-address '10.100.105.177/28'
set interfaces bonding dp0bond0 vif 10 vrrp vrrp-group 1 virtual-address '10.100.38.1/26'
set interfaces bonding dp0bond0 vif 11 address '192.168.255.89/30'
set interfaces bonding dp0bond0 vif 11 description 'VLAN 11 - One private subnet/VIP'
set interfaces bonding dp0bond0 vif 11 vrrp vrrp-group 1 advertise-interval '1'
set interfaces bonding dp0bond0 vif 11 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding dp0bond0 vif 11 vrrp vrrp-group 1 priority '254'
set interfaces bonding dp0bond0 vif 11 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding dp0bond0 vif 11 vrrp vrrp-group 1 virtual-address '10.100.212.65/26'
set interfaces bonding dp0bond0 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding dp0bond0 vrrp vrrp-group 1 priority '254'
set interfaces bonding dp0bond0 vrrp vrrp-group 1 'rfc-compatibility'
set interfaces bonding dp0bond0 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding dp0bond0 vrrp vrrp-group 1 virtual-address '10.100.11.5/26'
set interfaces bonding dp0bond1 address '169.110.20.28/29'
set interfaces bonding dp0bond1 mode 'lacp'
Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 VPN Server for VPC 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use is.vpn-server for the service name.

Platform roles

Service roles

Actions



Table 104. Platform roles - VPN Server for VPC
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 IBM Key Protect 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use kms for the service name.

Service roles

Actions



Table 105. Service roles - IBM Key Protect
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.

 Role Description 

 KeyPurge Role for purging key. 
 Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources.
* [HCX](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerations)
* [Veeam](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-veeamvm_overview)
* [PrimaryIO HDM](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managing_pio)
* [Zerto](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-addingzertodr)







 Featured workload solutions services 



* [Dizzion](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-dizzion-overview)
* [IBM Security Services for SAP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managing-ss-sap)







 Other services 



* [Managed Disaster Recovery Services by Kyndryl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managing_zerto_services)
* [Red Hat OpenShift for VMware](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-ocp_overview)
* [VMware Aria Operations and VMware Aria Operations for Logs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrops_overview)
vpc is.vpc.vpc-route.delete Route was removed from VPC 







 VPN gateway events 

The following table lists the actions that are related to site-to-site VPN gateways and the generation of events.



Table 11. Actions that generate events for site-to-site VPN gateways

 Resource Action Description 

 vpn is.vpn.vpn-gateway.create VPN gateway was created 
 vpn is.vpn.vpn-gateway.delete VPN gateway was deleted 
 vpn is.vpn.vpn-gateway.update VPN gateway was updated 
 vpn is.vpn.vpn-gateway.read VPN gateway was retrieved 
 vpn is.vpn.vpn-gateway.list VPN gateways were listed 
 vpn is.vpn.vpn-connection.create VPN connection was created on VPN gateway 
 vpn is.vpn.vpn-connection.delete VPN connection was deleted from VPN gateway 
 vpn is.vpn.vpn-connection.update VPN connection was updated on VPN gateway 
 vpn is.vpn.vpn-connection.read VPN connection was retrieved from VPN gateway 
 vpn is.vpn.vpn-connection.list VPN gateway connections were listed 
 vpn is.vpn.vpn-connection_local-cidr.create Local subnet was created on VPN gateway connection 
 vpn is.vpn.vpn-connection_local-cidr.delete Local subnet was deleted from VPN gateway connection 
 vpn is.vpn.vpn-connection_local-cidr.read Local subnet was retrieved from VPN gateway connection 
 vpn is.vpn.vpn-connection_local-cidr.list Local subnets were listed from VPN gateway connection 
 vpn is.vpn.vpn-connection_peer-cidr.create Peer subnet was created on VPN gateway connection 
 vpn is.vpn.vpn-connection_peer-cidr.delete Peer subnet was deleted from VPN gateway connection
In classic clusters, if you have multiple VLANs for your cluster, multiple subnets on the same VLAN, or a multizone classic cluster, you must enable a [Virtual Router Function (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf) for your IBM Cloud infrastructure account so your worker nodes can communicate with each other on the private network. To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf). To check whether a VRF is already enabled, use the ibmcloud account show command. If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).

Review the following scenarios in which VLAN spanning is also required.

The VLAN spanning option is disabled for clusters that are created in a VRF-enabled account. When VRF is enabled, all VLANs in the account can automatically communicate with each other over the private network. For more information, see [Planning your cluster network setup: Worker-to-worker communication](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_basicsworker-worker).



 Enabling routing between primary subnets on the same VLAN 

When you create a cluster, primary public and private subnets are provisioned on the public and private VLANs.
See [Device tasks](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-virtual-serversdevice-tasks) for relevant tasks.





* You can interact with servers in the IBM Cloud console in both the snapshot view (a summary of your device) and on the device's details page (a fully detailed list). To view and interact with your server in the snapshot view, click the arrow next to the Device Name to expand the view. To view and interact with your server on the device's details page, click the Device Name of the server.
* You can add notes to a device at any time from the Configuration tab. Notes can help identify details about the device, its use, and actions that were taken on the device.







 Device tasks 

The following are relevant tasks that you can do from the Actions menu as described the previous steps.



 Rebooting a device 

A reboot is one of the most basic device actions. Rebooting a device results in the immediate powering off and then back on of your device. Device reboots can take place from both the Device List and from the Device View of an individual device. Virtual Servers can be rebooted at any time.

A reboot is helpful when you experience an issue in which the server cannot boot to the operating system because of a configuration issue. You can also boot into rescue mode. After it boots into rescue mode, you can mount the drives of your server, and then fix the configuration issue. When the issue is fixed, reboot the server from the command line, and the server reboots into the default kernel for your server.





 Powering a device On or Off 

If the device is powered off, the device remains powered off and must be manually powered on by repeating the previous steps. Users can't interact with a powered off device. If the virtual server supports the suspend billing feature, billing is suspended for some compute resources. You can't complete all management actions on an instance until billing is resumed. For more information, see [Suspend billing](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-requirements).