---
name: deployable-reference-architectures-deploy-arch-ibm-slz-vsi-quickstart
title: The Landing zone for applications with virtual servers - Quickstart (Financial Services edition) variation
description: The Quickstart (Financial Services edition) variation of the Landing zone for applications with virtual servers deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides virtual servers in a secure VPC for your workloads. The Quickstart (Financial Services edition) variation is designed to deploy quickly for demonstration and development.
last-updated: 2024-09-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/deployable-reference-architectures?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# The Landing zone for applications with virtual servers - Quickstart (Financial Services edition) variation
{: #vsi-ra-qs}
{: toc-content-type="reference-architecture"}
{: toc-industry="Banking,FinancialSector"}
{: toc-use-case="Cybersecurity"}
{: toc-version="8.15.1"}

The Quickstart (Financial Services edition) variation of the Landing zone for applications with virtual servers deployable architecture creates a fully customizable Virtual Private Cloud (VPC) environment in a single region. The solution provides virtual servers in a secure VPC for your workloads. The Quickstart (Financial Services edition) variation is designed to deploy quickly for demonstration and development.

## Architecture diagram
{: #ra-vsi-qs-architecture-diagram}

![Architecture diagram for The Landing zone for applications with virtual servers - Quickstart (Financial Services edition) variation](vsi-quickstart.drawio.svg "Architecture diagram of Landing zone for applications with virtual servers deployable architecture"){: caption="The Landing zone for applications with virtual servers - Quickstart (Financial Services edition) variation" caption-side="bottom"}{: external download="vsi-quickstart.drawio.svg"}

## Design requirements
{: #ra-vsi-qs-qs-design-requirements}

![Design requirements for Landing zone for applications with virtual servers](heat-map-deploy-arch-slz-vsi-quickstart.svg "Design requirements"){: caption="Figure 2. Scope of the design requirements" caption-side="bottom"}


## Components
{: #ra-vsi-qs-components}

### VPC architecture decisions
{: #ra-vsi-qs-components-arch}

| Requirement | Component | Reasons for choice | Alternative choice |
|-------------|-----------|--------------------|--------------------|
| * Provide infrastructure or application administration access to monitor, operate, and maintain the environment  \n * Limit the number of infrastructure or application administration entry points to help ensure security audit. | Management VPC service | Create a separate VPC service where SSH connectivity from outside is allowed | |
| * Provides compute, storage, and network services to support hosted applications and operations that deliver services to the consumer. \n * Ensure you can reach IBM Cloud services, Workload VPC, and Management VPC | Workload VPC service|Create a separate VPC service as an isolated environment, without direct public internet connectivity and without direct SSH access | |
| Create a virtual server instance to support hosted applications | Workload virtual server instance | Create a VPC virtual server instance that can act as a workload server to support hosted applications. Configure ACL and security group rules allow access to IBM Cloud services, Workload and Management VPCs | |
| Create a virtual server instance as the only management access point to the environment | Jump box host VPC instance | Create a Linux VPC instance that acts as a jump box host. Configure ACL and security group rules to allow SSH connectivity (port 22). Add a public IP address to the VPC instance. | |
| * Set up network for all created services \n * Isolate network for all created services \n * Ensure all created services are interconnected | Secure landing zone components | Create a minimum set of required components for a secure landing zone | Create a modified set of required components for a secure landing zone in preset |
{: caption="Architecture decisions" caption-side="bottom"}

### Network security architecture decisions
{: #ra-vsi-qs-components-arch-net-sec}

| Requirement | Component | Reasons for choice | Alternative choice |
|-------------|-----------|--------------------|--------------------|
| * Isolate management VPC and allow SSH network connections from public network  \n * All other connections from or to management VPC are forbidden except for IBM services and VPC | ACL and security group rules in management VPC|Open following ports by default: 22 (for limited number of IPs)  \n All ports to other VPCs are open |More ports might be opened in preset or added manually after deployment |
| * Isolate workload VPC and allow only a limited number of network connections  \n * All other connections from or to workload VPC are forbidden | ACL and security group rules in workload VPC | Allow connectivity for IBM Cloud services, Workload VPC and Management VPC | More ports might be opened in preset or added manually after deployment |
| Enable floating IP on jump box host | Floating IPs on jump box host in management VPC|Use floating IP on jump box host for administration access | |
{: caption="Network security architecture decisions" caption-side="bottom"}

### Key and password management architecture decisions
{: #ra-vsi-qs-components-arch-key-pw}

| Requirement | Component | Reasons for choice | Alternative choice |
|-------------|-----------|--------------------|--------------------|
| * Use public SSH key to access virtual server instances by using SSH | Public SSH key provided by customer | Ask customer to specify the key. Accept the input as secure parameter. | |
{: caption="Key and passwords management architecture decisions" caption-side="bottom"}

## Next steps
{: #ra-vsi-qs-next-steps}

- Read about [IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about&format=markdown)

- To deploy this architecture, understand [Deploying a landing zone deployable architecture](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-deploy&format=markdown) steps.