| copyright |
|
||
|---|---|---|---|
| lastupdated | 2026-07-14 | ||
| keywords | power virtual server, public network, outbound connectivity, inbound connectivity, network setup | ||
| subcollection | power-iaas |
{{site.data.keyword.attribute-definition-list}}
{: #powervs-public-network-setup}
{{site.data.keyword.off-prem-fname}} in [{{site.data.keyword.off-prem}}]{: tag-blue}
In some {{site.data.keyword.powerSys_notm}} data centers, internet access is provided through alternative networking configurations as you cannot directly attach public subnets to the logical partition (LPAR) or virtual server instance (VSI) in these data centers. In these cases, you can use the virtual private cloud (VPC) infrastructure components and a transit gateway connection to provide both outbound and inbound network connectivity. {: shortdesc}
A transit gateway connects VPCs and {{site.data.keyword.powerSys_notm}} workspaces.
{: #setup-public-networking}
Complete the following steps to configure public network access for your LPAR or VSI:
-
Log in to the IBM Cloud catalog{: external} with your IBM credentials.
-
In the search box, type {{site.data.keyword.powerSys_notm}} and click the {{site.data.keyword.powerSys_notm}} tile.
-
In the navigation panel, click Workspaces. The Workspaces page with a list of existing workspaces is displayed.
-
Click your workspace in the list to open the virtual server instance page.
-
Create a VSI. For instructions, see Configuring a Power Virtual Server instance.
-
Configure the outbound networking for the VSI. For instructions, see Outbound network overview.
-
Configure the inbound networking for the VSI. For instructions, see Inbound network overview. You can configure inbound networking only after you configure outbound networking.
You must select the same region and zone as your VSI for all the configurations. {: note}
{: #outbound-overview}
{{site.data.keyword.powerSys_notm}} instances can access the internet through outbound network connections. The following architecture describes this setup:
- Connect the {{site.data.keyword.powerSys_notm}} workspace to a transit gateway. The transit gateway provides the connection between the {{site.data.keyword.powerSys_notm}} instance and the VPC infrastructure.
- Connect the transit gateway to a VPC that contains a network load balancer (NLB) that is configured in the route mode.
- Route internet traffic from {{site.data.keyword.powerSys_notm}} instances through a VPC subnet to the internet by using the NLB as a routing gateway. The VPC security groups that are associated with the NLB filter the traffic between the {{site.data.keyword.powerSys_notm}} instance and the internet.
- Attach the VPC subnet to a public gateway, which provides the actual internet connectivity.
The following diagram illustrates the outbound network architecture to show how traffic flows from {{site.data.keyword.powerSys_notm}} instances through the transit gateway, VPC, and NLB to reach the internet.
{: caption="Outbound network architecture" caption-side="bottom"}
When an LPAR or VSI in a {{site.data.keyword.powerSys_notm}} workspace sends traffic to the internet, it sends the data packets to the default gateway. The default gateway routes the traffic through the transit gateway to the VPC. The VPC routing table directs traffic to the NLB, which forwards the traffic through the public gateway to the internet. The return traffic follows the same path back to the {{site.data.keyword.powerSys_notm}} instance.
{: #consideration-outbound}
Planning the outbound connectivity for your {{site.data.keyword.powerSys_notm}} instance includes the following considerations:
- A workspace with no external connections restricts LPAR and VSI communication to resources within the same Power Virtual Server workspace only.
- A workspace that is connected to a transit gateway links to a VPC with internet access and enables outbound connectivity for the workspace resources.
- Your {{site.data.keyword.powerSys_notm}} instances inherit network connectivity from the workspace configuration. As a result, you need not configure network access for individual LPAR or VSI instances.
{: #outbound-network}
Complete the following steps to configure outbound network access for {{site.data.keyword.powerSys_notm}}:
Ensure that a VSI is created before you configure outbound network access. For more information, see Configuring public network for {{site.data.keyword.powerSys_notm}} instance. {: note}
{: #create-vpc}
-
Create a VPC and subnet. For instructions, see Creating a VPC and subnet{: external}.
When you create a VPC, set the following values:
- Select the same region as your {{site.data.keyword.powerSys_notm}} workspace.
- Ensure that you select the Create a default prefix for each zone checkbox.
If the Create a default prefix for each zone checkbox is selected, IBM Cloud automatically creates default subnets in each available zone. You can use these default subnets for the NLB or create a custom subnet.
-
Record the subnet ID and Classless Inter-Domain Routing (CIDR) range of the subnet. Use the subnet ID and CIDR range when you create an NLB. For more information, see Create NLB with routing mode.
-
Create a public gateway and attach the public gateway to the VPC subnet. For instructions, see Creating public gateways{: external}.
{: #create-nlb}
-
Create a private NLB in the route mode. For instructions, see Creating a network load balancer with routing mode by using the UI{: external}.
When you create the NLB, set the following values:
- Select the same VPC and VPC subnet that you created in Step 1: Create VPC infrastructure.
- In the details section, select the type as Private.
- Set Routing mode for VNFs to Enabled to enable the routing mode for virtual network functions (VNFs).
- Leave the Back-end pools and Front-end listeners sections empty.
- In the Security groups section, select the VPC default security group.
-
Create a back-end pool for your NLB. For instructions, see Working with network load balancer pools{: external}.
When you create the back-end pool for your NLB, set the following values:
- Leave the Instance group field empty.
- Select Bypass as the failsafe policy.
-
Configure a listener for your NLB. For instructions, see Working with listeners{: external}.
When you create the listener for your NLB, select the back-end pool for your NLB as the default back-end pool.
{: #create-transit-gateway}
-
Create a transit gateway. For instructions, see Creating a transit gateway{: external}.
When you create the transit gateway, set the following values:
- Select the default resource group.
- Ensure that GRE enhanced route propagation is set to Disabled.
- Select Local routing for a single region.
- Choose a location that matches your {{site.data.keyword.powerSys_notm}} workspace location.
- Create the transit gateway without adding network connections.
-
Connect the VPC to the transit gateway. For instructions, see Adding a connection{: external}.
When you connect the VPC to the transit gateway, set the following values:
- Select VPC as the network connection.
- Select Add new connection in this account as the connection reach.
- Use the same region, which is the region of the transit gateway.
- Select your VPC in the Available connection section.
-
Connect the {{site.data.keyword.powerSys_notm}} workspace to the transit gateway. For instructions, see Adding a connection{: external}.
When you connect the {{site.data.keyword.powerSys_notm}} workspace to the transit gateway, set the following values:
- Select Power Systems Virtual Server as the network connection.
- Select Add new connection in this account as the connection reach.
- Use the same region, which is the region of the transit gateway.
- Select your {{site.data.keyword.powerSys_notm}} workspace in the Available connection section.
{: #vpc-routing}
-
Create a custom routing table. For instructions, see Creating a routing table{: external}.
When you create the routing table, set the following values:
- Select your VPC.
- In the Traffic section, set the Transit gateway to on.
- Set Advertise to to On.
-
Create a route. For instructions, see Creating a route{: external}.
When you create the route, set the following values:
-
Select the same zone as your NLB.
-
Set Destination CIDR to the following value:
0.0.0.0/0 -
Set Priority to 2, Action to Deliver, and the Next hop (IP address) to the IP address of your NLB.
-
Set Advertise to On.
-
{: #outbound-connectivity}
From the {{site.data.keyword.powerSys_notm}} VSI console, run the following command to test the outbound connectivity:
ping -c4 <URL>
{: codeblock}
For example:
ping -c4 google.com
{: codeblock}
If your outbound connectivity is not working, check whether your VPC security group is configured correctly. You must review the rules that allow only the required TCP protocols. For more information about security groups, see About security groups{: external}. {: note}
{: #inbound-overview}
You can enable inbound network connectivity to allow external clients on the internet to initiate connections to your {{site.data.keyword.powerSys_notm}} instances. This inbound network connectivity requires the outbound network configuration. The following architecture describes this setup:
- Allocate and bind a public IP address range to your VPC in the same zone as your NLB.
- Configure a secondary network interface within the guest operating system on your {{site.data.keyword.powerSys_notm}} instance by using the public IP address.
- Configure VPC route tables to direct incoming internet traffic for the public IP address to the NLB.
- Forward internet traffic from the NLB through the transit gateway to your {{site.data.keyword.powerSys_notm}} workspace.
- Create a custom route in your {{site.data.keyword.powerSys_notm}} workspace to send internet traffic for the public IP address directly to the private IP address of your {{site.data.keyword.powerSys_notm}} instance.
The following diagram illustrates the inbound network architecture to show how internet traffic is routed through the VPC infrastructure to reach your {{site.data.keyword.powerSys_notm}} instances.
{: caption="Inbound network architecture" caption-side="bottom"}
When a client on the internet sends traffic to your public IP address, the VPC subnet routing table delegates the traffic to the VPC routing table. The VPC routing table forwards the traffic to the private IP address of the NLB. The NLB forwards the traffic through the transit gateway to {{site.data.keyword.powerSys_notm}}. The workspace routes the traffic directly to your {{site.data.keyword.powerSys_notm}} instance by using its private IP address. The {{site.data.keyword.powerSys_notm}} instance receives the traffic on the secondary interface that is configured with the public IP address.
The {{site.data.keyword.powerSys_notm}} instance sends the response from the public IP address on the secondary interface. {{site.data.keyword.powerSys_notm}} routes the response through the transit gateway to the VPC, which routes the response to the NLB. The NLB then forwards the response to the internet.
{: #inbound-network}
Configure the inbound network by using the same VPC and subnet that you created in Step 1: Create VPC infrastructure.
Ensure that a VSI is created and the outbound network access is configured before you configure the inbound network access. For more information, see Configuring public network for {{site.data.keyword.powerSys_notm}} instance. {: note}
{: #public-add-range}
If you have a public IP address that is attached to your VPC, do not perform this step and go to Step 2: Locate the NLB IP address. {: note}
-
Reserve a public address range and attach it to the VPC. For instructions, see Creating public address ranges{: external}.
When you create the public address range, set the following values:
-
Set the Size to the following value:
/32 (1 address) -
Retain the default value for Geography, Region, and Resource group.
-
Set Bind to on. Select your VPC to attach the public address range.
-
Set Zone to the same zone as the NLB that you created in Step 2: Create NLB.
-
-
Record the allocated public IP address. Use this IP address to access your {{site.data.keyword.powerSys_notm}} VSI from the internet.
{: #find-nlb}
Complete the following steps to locate the private IP address of the NLB that you created in Step 2: Create NLB.
If you have not created an NLB, create an NLB in the route mode. For instructions, see Step 2: Create NLB. {: note}
-
Log in to the IBM Cloud catalog{: external} with your IBM credentials.
-
From the Navigation menu, click Infrastructure > Network > Load balancers.
-
Select your NLB and record the private IP address.
{: #vpc-route-tbl-internet}
-
Create a routing table to direct incoming internet traffic for the public IP address to the NLB. For instructions, see Creating a routing table{: external}.
When you create the routing table, set the following values:
- Select your VPC.
- Set Traffic source to Internet.
- Set Advertise to to Off.
-
Create a route. For instructions, see Creating a route{: external}.
When you create the route, set the following values:
-
Set the Zone to the same zone as your NLB.
-
Set Destination CIDR to the following value:
1.2.3.4/32 -
Set Priority to 2, Action to Deliver, and the Next hop (IP address) to the IP address of your NLB.
-
Set Advertise to Off.
-
{: #inbound-transit-gateway}
The transit gateway that you created for outbound connectivity already connects the VPC and Power Virtual Server. For more information, see Step 3: Create transit gateway and connect to {{site.data.keyword.powerSys_notm}}.
{: #vpc-routing-config}
The transit gateway is already configured for outbound connectivity. For more information, see Step 4: Configure VPC routing.
{: #modify-route-table}
Route the incoming traffic for the public IP address to the VPC subnet. Configure the default routing table and create a route for your VPC. For instructions, see Creating a route{: external}.
When you create a route in the default routing table of your VPC, set the following values:
-
Set the Zone to the same zone as your NLB.
-
Set Destination CIDR to the following value:
1.2.3.4/32 -
Set Action to Delegate-VPC and Next hop (IP address) to the IP address of your NLB.
-
Set Advertise to Off.
Do not modify the routing table that you created in Step 4: Configure VPC routing. {: important}
{: #powervs-route}
Add a static route to your {{site.data.keyword.powerSys_notm}} workspace that points to your VSI. For instructions, see Creating and managing network routes in IBM Power Virtual Server workspaces.
When you create the static route, set the following values:
-
Set Destination to the following value:
1.2.3.4/32 -
Set Next hop to your VSI IP address.
-
Set Advertise and State to Enabled.
This static route configuration routes traffic for the public IP address directly to the VSI.
{: #vsi-network}
Because {{site.data.keyword.powerSys_notm}} does not support network address translation (NAT), you must configure the public IP address as a secondary interface in the guest operating system of your VSI. Retain the existing private interface for normal {{site.data.keyword.powerSys_notm}} subnet connectivity, and add the public IP address to a secondary interface.
Configure the secondary interface in the guest operating system on your VSI, and not in the {{site.data.keyword.powerSys_notm}} console. Complete this task in the operating system of your VSI that receives the routed internet traffic.
{: #configure-sg}
If the outbound connectivity is configured, the required security groups are already mapped to your NLB. Verify that the security groups allow the required inbound ports for your public IP address.
If the security groups that are mapped to your NLB do not permit the inbound internet traffic, configure the security groups to add the rules for inbound internet traffic. For instructions, see Defining security group rules{: external}.
For new outbound or inbound connections, map the required security groups to the NLB. You can also adjust the rules to match your security requirements. For more information about security groups, see About security groups{: external}.
{: #test-public-ip}
Test the public IP address from outside the IBM network by using a protocol that is allowed by your network security group.
For example:
ping -c4 <IP_ADDRESS>
{: codeblock}
or
ssh <IP_ADDRESS>
{: codeblock}
With outbound and inbound network connectivity configured, your {{site.data.keyword.powerSys_notm}} instance can communicate with external networks by using the VPC infrastructure and a transit gateway.