---
name: pattern-pvs-ibmi-resiliency-networking-architecture
title: Architecture decisions for networking
description: '| Architecture decision |Requirement | Alternatives | Decision | Rationale | |-----|-----|-----|-----|------| | Bring Your Own IP and edge gateway | The capability that is needed for customers to provide isolation, security, and edge routing services. | Edge gateways: Palo Alto, Fortinet, and F5 with the client choice. | Gateway: Client choice \n IBM Cloud VPC facilitates Bring Your Own IP | Edge gateway is a client choice based on the requirements \n \n The client can bring their own subnet IP address range to an IBM Cloud® Virtual Private Cloud \n \n Generic Routing Encapsulation (GRE) Tunnel connecting the Power® Virtual Server to VPC for routes to be advertised across on-premises environment. | | Network segmentation and isolation | Deploy workloads in an isolated environment and enforce information flow policies. | - Subnets \n - Security groups \n - ACLs \n - Workspaces | VPCs and subnets \n \n Separate Power® Virtual Server LPARs | Native VPC isolation by using separate VPCs and subnets environments for separation of the workload \n \n Power® Virtual Server isolation \n \n Security group with inbound rule, address prefix, and subnet for Secure Automated Backup with Compass. | | Cloud native connectivity to cloud services | Provide secure connection to cloud services | - VPC Gateway and Virtual Private Endpoints (VPE) \n - Private cloud service endpoints \n - Public cloud service endpoints | VPC Gateway and Virtual Private Endpoints (VPE) | VPC Gateway and Virtual Private Endpoints enable connectivity to IBM Cloud services by using private IP addresses allocated from a VPC subnet.| | Cloud landing zone connectivity | Connect across multiple VPCs and to IBM Cloud classic and Power® Virtual Server environments | Transit Gateway (TGW) \n Power Edge Router (PER) \n Global Transit Gateway (GTGW) | Transit Gateway \n \n Power Edge Router (PER) | Transit Gateways (TGW) are used for interconnectivity between Power® Virtual Server and VPCs. Transit Gateways have built in redundancy. TGWs are regional and are deployed two per multi-zone region (MZR) within the same region. \n \n Power Edge Routers (PER) are also deployed as two per region. PER is used for interconnectivity between Power® Virtual Server and the TGW. For more information, see Getting started with PER.| | Cloud landing zone connectivity across regions | Connect across regions | Global Transit Gateway (GTGW) | Global Transit Gateway (GTGW) | Interconnects classic, VPCs, and Power® Virtual Server resources across regions. \n \n Connect to environments in other regions for resiliency data replication purposes.| | Domain Name System (DNS) | Ability to resolve DNS names on site | IBM Cloud DNS Services | IBM continues to forward or relay the DNS to client DNS Servers onsite | This is the default option in the absence of a specific customer requirement to manage DNS \n \n Name resolution for the backup server connections is required. |'
last-updated: 2024-10-18
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/pattern-pvs-ibmi-resiliency?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Architecture decisions for networking
{: #networking-architecture}

| Architecture decision |Requirement | Alternatives | Decision | Rationale |
|-----|-----|-----|-----|------|
| Bring Your Own IP and edge gateway | The capability that is needed for customers to provide isolation, security, and edge routing services. | Edge gateways: Palo Alto, Fortinet, and F5 with the client choice. | Gateway: Client choice \n IBM Cloud VPC facilitates Bring Your Own IP | Edge gateway is a client choice based on the requirements \n \n The client can [bring their own subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-configuring-address-prefixes&format=markdown) IP address range to an IBM Cloud® Virtual Private Cloud \n \n Generic Routing Encapsulation (GRE) Tunnel connecting the Power® Virtual Server to VPC for routes to be advertised across on-premises environment. |
| Network segmentation and isolation | Deploy workloads in an isolated environment and enforce information flow policies. | - Subnets \n - Security groups \n - ACLs \n - Workspaces | VPCs and subnets \n \n Separate Power® Virtual Server LPARs | Native VPC isolation by using separate VPCs and subnets environments for separation of the workload \n \n Power® Virtual Server isolation \n \n Security group with inbound rule, address prefix, and subnet for Secure Automated Backup with Compass. |
| Cloud native connectivity to cloud services | Provide secure connection to cloud services | - VPC Gateway and Virtual Private Endpoints (VPE) \n - Private cloud service endpoints \n - Public cloud service endpoints | VPC Gateway and Virtual Private Endpoints (VPE) | VPC Gateway and Virtual Private Endpoints enable connectivity to IBM Cloud services by using private IP addresses allocated from a VPC subnet.|
| Cloud landing zone connectivity | Connect across multiple VPCs and to IBM Cloud classic and Power® Virtual Server environments | Transit Gateway (TGW) \n Power Edge Router (PER) \n Global Transit Gateway (GTGW) | Transit Gateway \n \n Power Edge Router (PER) | Transit Gateways (TGW) are used for interconnectivity between Power® Virtual Server and VPCs. Transit Gateways have built in redundancy. TGWs are regional and are deployed two per multi-zone region (MZR) within the same region. \n \n Power Edge Routers (PER) are also deployed as two per region. PER is used for interconnectivity between Power® Virtual Server and the TGW. For more information, see [Getting started with PER](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-per&format=markdown).|
| Cloud landing zone connectivity across regions | Connect across regions | Global Transit Gateway (GTGW) | Global Transit Gateway (GTGW) | Interconnects classic, VPCs, and Power® Virtual Server resources across regions. \n \n Connect to environments in other regions for resiliency data replication purposes.|
| Domain Name System (DNS) | Ability to resolve DNS names on site | IBM Cloud DNS Services | IBM continues to forward or relay the DNS to client DNS Servers onsite | This is the default option in the absence of a specific customer requirement to manage DNS \n \n Name resolution for the backup server connections is required. |
{: caption="Architecture decisions for network" caption-side="bottom"}