Dutch Tax and Customs Administration started migrating applications from AIX/Power to Bluemix Local System in 2013. While IBM BPM was deployed on the new platform first, internal WebSphere JEE applications and DB2 followed soon in 2014. More applications followed, including the IBM Connections internal collaboration platform for 30000 users. As Bluemix Local System has proven itself and a solid and strategic platform over the years, DTCA is now migrating their core business applications. This set of external-facing applications include the handling of tax returns by citizens and businesses in The Netherlands. In this presentation we will briefly visit the business case for Bluemix Local System at DTCA and highlight some of the technical challenges and decisions for the team. Migrating internet-facing applications presents presents even greater challenge, bringing public exposure, political attention and additional security risks. We will go over the steps that have been taken in order to be ready for DTCA to host the tax return campaign in March-May 2017.

1. How Dutch Tax Built Their
Core Business on Bluemix
Local System
IBM Cloud University 2017
Session BLUE010
Tom Moerman – to.moerman@belastingdienst.nl
IT architect, Dutch Tax Office
Hendrik van Run – hvanrun@nl.ibm.com
Executive IT Specialist, IBM

2. • Introduction to Dutch Tax Office
• IBM Bluemix Local System at Dutch Tax Office
• Understanding IBM Bluemix Local System offering
• Cloudbased hosting on IBM Bluemix Local System
• Implementation of Core Business applications
• Current Status and Outlook
Agenda
2

3. Introduction to Dutch Tax Office
Lines of business: Tax, Customs, Benefits and Fiscal Intelligence
3000 IT Staff
€ 243 billion in taxes
€ 12 billion in benefits
14 mio calls
2.2 mio fiscal investigations
12 mio shipping containers
to pass the Port of
Rotterdam each year
29.000 employees
Serving 11 mio citizens
Serving 1 mio companies
3

4. Total 5000 m2
3000 m2 Test/Lab
2000 m2 Production
Twin data center of Dutch Tax has been assigned as one
of four strategic data centers for the Dutch Government.
Introduction to Dutch Tax Office
Twin data center
1000 m2 Production
7140 m2
https://www.youtube.com/watch?v=FtjkLhlQufI
Data Center Q Data Center P
fiber
1000 m2 Production
4 km
4

5. • Organisational challenges
– Dependencies on various teams
– Software life-cycle management for existing
software
– Long time-to-market for new solutions
• Key requirements
– Private and on-premises cloud
– Increase in flexibility
– Red Hat Enterprise Linux x86-64 instead of AIX
IBM Bluemix Local System at Dutch Tax Office
Why?
5

6. IBM Bluemix Local System at Dutch Tax Office
Current and target strategic platforms
Current
HPT
Applications and middleware
z/OS
PR/SM
Z
AIX
VIO
P
Linux
VMWare
X
IBM
Bluemix
Local System
Cumulus
X
Windows Hosting
Platform
Toeslagen
Exadata /
Oracle
DBMS
Appliances
Applications and middleware
z/OS
PR/SM
Z
VMWare
X
IBM
Bluemix
Local System
Exadata /
Oracle
DBMS
Appliances
Linux Windows
Target 2018
x86-64
x86-64
6

7. • IBM Bluemix Local System is the successor of (Intel) IBM PureApplication System
– ”Cloud-in-a-box” rack appliance with built-in compute, networking, storage and software
• Not to be confused with IBM Bluemix Local
– Subscription to host on-premises Bluemix services
• IBM PureApplication continues to refer to
– Power based PureApplication System
– PureApplication Software
– PureApplication Service on SoftLayer
Understanding IBM Bluemix Local System offering
Relation with IBM PureApplication
IBM Bluemix Local System
Integrated Compute, Storage, Network, Virtualization
VMware
workloads
Cloud native &
Middleware workloads
IBM Cloud
Private
PureApplication
Software
Cloud enabled
workloads
ResourceManager
IBM Cloud
Automation
Manager
At Dutch Tax we use IBM
PureApplication Software
Suite on IBM Bluemix
Local System.
7

8. • PureApplication patterns are used to
deploy IBM software
– Provision VMs
– Install software
– Configure software
– Integrate with external systems
• Pattern is a “recipe” for infrastructure
– Scripts from
• Pattern Instance is a deployed instance of a
Pattern
– Also referred to as Virtual System Instance
Understanding IBM Bluemix Local System offering
IBM PureApplication patterns
VM VM
VM
Pattern
Pattern Instance
VM VM
VM
Pattern Instance
8

9. • Faster delivery of new environments for developers and testers
• Repeatable and consistent provisioning of environments
• No hoarding of environments
• Cost-effective as PureApplication Software Suite on Bluemix Local System includes
– IBM WebSphere
– IBM Db2
– Red Hat Enterprise Linux
– IBM Tivoli Monitoring and IBM Advanced Performance Monitoring
– IBM Spectrum Scale - also known as IBM General Parallel File System
– VMWare ESX and VMWare vSphere
• No VMware, storage or network expertise required
– This is taken care of within the IBM Bluemix Local System itself
– Simplifies and/or removes day-to-day operational tasks
– Software and firmware maintenance is taken care of by IBM
Cloudbased hosting on IBM Bluemix Local System
Benefits of platform using PureApplication patterns
9

10. Cloudbased hosting on IBM Bluemix Local System
Timeline
• First thoughts of PureApp
• Start of PoC PureApp
• GO! decision PureApp
2012 2013 2014 2015 2016 2017 2018
First BPM application
InfoSphere MDM & IS
First WAS J2E application
Aspera File Transfer
PoC IBM Mobile First
BPM ODM
Migrating internal applications
Migrated internet-facing
applications
Online Tax Declaration System
PoC IBM Control Desk
Employee Portal
Portal for Objections and
Appeals
New internal applications
New internet-facing applications
Dutch Customs Trader
Portal
First DB2 instance
IBM Connections
IBM WCM & Portal
IBM WSRR
PoC IBM Case Foundation
Content Navigator
Collaboration
platform within
Dutch Tax with over
30000 users.
Mission-critical,
internet-facing
applications
Proof-of-Concepts
10

11. Cloudbased hosting on IBM Bluemix Local System
Platform Growth
Internal Storage (TB)
Number of Cores
Number of VMs
0
500
1000
1500
2000
2500
2012
2013
2014
2015
2016
2017
11

12. Cloudbased hosting on IBM Bluemix Local System
Integration within the data center
Backup
Monitoring
OS maintenance
OS authentication
Virtual System
Support
Logfile management
Loadbalancing
Domain Name System
12

13. • Existing network consists of Cisco Nexus 7000, 5000 and 2000 switches
– Cisco Nexus 2000 are Fabric EXtenders (FEX)
• IBM Bluemix Local System comes with a pair of Lenovo RackSwitch G8272
“Top-of-Rack” switches
– Initially cabled into Cisco Nexus 2000 FEX – which is designed to connect servers
– After some lenghty discussion now cabled directly into Cisco Nexus 5000 switches
– IBM Bluemix Local System is not just a single server!
Cloudbased hosting on IBM Bluemix Local System
Network Integration
IBM Bluemix Local System
Produktie data VLAN
Acceptatie data VLAN
Test data VLAN
Ontwikkel data VLAN
Backup network (BNR) VLAN
System management VLAN
Produktie cloud management VLAN
Acceptatie cloud management VLAN
Test cloud management VLAN
Ontwikkel cloud management VLAN
Trunk
Trunk
Lenovo RackSwitch G8272 Cisco Nexus 5000
Stretched VLANs
spanning both data
centers
13

14. Cloudbased hosting on IBM Bluemix Local System
Platform Infrastructure
PurePlex
Datacenter Q
PurePlex and Multi-system
External Storage
Integration through
IBM SVC
Datacenter P
V7000 V7000
Lab Production
V7000
pure01
nodes 24
cores 384
pure05
nodes 14
cores 224
pure03
nodes 14
cores 224
pure04
nodes 14
cores 224
pure06
nodes 14
cores 224
pure02
nodes 14
cores 224
pure00
nodes 4
cores 64
14

15. • We use a lab system for changes that could
impact workloads on production systems
– External storage integration
– Firmware upgrades
– Integration with external IBM Installation Manager
repository
– Import and use of new content, pattern-types/system-
plugins
– Develop LDAP settings
– Pattern Development
Cloudbased hosting on IBM Bluemix Local System
Separation of production and non-production systems
15

16. • Team with your vendor – for the benefit of both
• Re-think your organisation – do justice to the
Cloud principles
• Team within your organisation – tell them what
you do, do what you tell them
• Establish a naming convention – with many
artefacts this will simplify things in the long run
Cloudbased hosting on IBM Bluemix Local System
Best Practices
16

17. • IBM substantially improved their support
– Permanent ”SWAT” support in Europe
– Doubled support staff in Europe
– Setup remote access to Dutch Tax systems for
IBM Support staff when needed
• Built-in storage unexpectedly went off-line on one system
– IBM support recovered this the same day
– It took almost a week to get all 200+ VMs restarted
• We have made improvements to our operational processes as a result
– IBM identified the root-cause and provided proof that no other system could suffer
from the same issue ever again
• Built-in IBM Tivoli Monitoring was initially plagued with issues
– Certificate that had been used to sign Java Web Start code expired
– ITCAM for WebSphere agent was not always configured as expected
– Single sign-on to Tivoli Enterprise Portal Server did not always work
– Historic metrics were not persisted beyond 24 hours
Cloudbased hosting on IBM Bluemix Local System
Some critical notes
All issues listed on
this slide have been
resolved by IBM.
Today IBM Bluemix Local System is ready to host Core Business applications!
17

18. Implementation of Core
Business applications

19. • Portal for Objections and Appeals
– IBM Digital Experience 8.5
• Online Tax Declaration System
– IBM WAS ND 8.5.5.11
– IBM Db2 10.5.0.8
• Dutch Customs Trader Portal
– IBM WAS ND 8.5.5.11
– IBM Db2 10.5.0.8
Implementation of Core Business applications
Applications in scope for 1H 2018
New
application
New
application
Migration
19

20. Implementation of Core Business applications
Approach
• Lift and shift of applications
– given the challenges that might be the highest achievable goal;
• But in essence one is polishing the legacy
– you ignore the newer technologies which Bluemix Local System offers;
WAS 8.0.x
7.1.x
x86-64
RHEL 6
Power7+
10.5.8
MQ 8.x
MQ 9.x
WAS 8.5.5.11
10.5.8
Migration
20

21. Implementation of Core Business applications
Approach
• But… most of the internal applications are standalone applications where the
internet-facing applications are an amalgam of about 13 applications with specific
tasks but neither of them is functional on its own;
• Starting point was the pattern used for the internal applications running
production since 2014;
21

22. Implementation of Core Business applications
Differences
• The AIX system uses a standard topology with DMZ and
business network zones
• On IBM Bluemix Local System, both internal and internet-
facing applications are in the same business network zone
different
environments but
on de same
network
external traffic
through a Web
Application
Firewall
22

23. Current Status and
Outlook

24. • Complete the following activities in order to…
– Attack and Penetration tests
– Audits
– Performance testing and tuning
– Refining the topology
• … bring these core-business applications in production
– Portal for Objections and Appeals
– Online Tax Declaration System
– Dutch Customs Trader Portal
Current status
Looking at 2018
New
application
New
application
Migration
24

25. • Attack and Penetration tests
• Audits
• Performance testing and
tuning
• Refining the topology
Current status
Where are we now?
sep oct nov dec jan feb mar apr may jun
2017 2018
implementation Portal for Objections and Appeals
implementation
implementation
Online Tax Declaration System
Dutch Customs Trader Portal
25

26. • Continue hosting mission-critical, internet-facing applications
– Portal for Objections and Appeals
– Online Tax Declaration System
– Dutch Customs Trader Portal
• Implementation of new mission-critical, internet-facing
applications
– Online Tax Declaration System for Businesses
– Online Payment provider (iDeal)
• New Technologies
– WebSphere Liberty Profile
– Kubernetes Container Technology using solutions like IBM Cloud Private
Current status
Looking at 2018 … and beyond
26

27. Your next steps
Networking drink… come and find us if you have any questions!
27

28. Questions?
Please complete your feedback,
session number is BLUE010
28

29. Notices and disclaimers
Copyright © 2017 by International Business Machines Corporation (IBM). No part of this
document may be reproduced or transmitted in any form without written permission from
IBM.
U.S. Government Users Restricted Rights — use, duplication or disclosure
restricted by GSA ADP Schedule Contract with IBM.
Information in these presentations (including information relating to products that have
not yet been announced by IBM) has been reviewed for accuracy as of the date of
initial publication and could include unintentional technical or typographical errors. IBM
shall have no responsibility to update this information. This document is distributed
“as is” without any warranty, either express or implied. In no event shall IBM be
liable for any damage arising from the use of this information, including but not
limited to, loss of data, business interruption, loss of profit or loss of opportunity.
IBM products and services are warranted according to the terms and conditions of the
agreements under which they are provided.
IBM products are manufactured from new parts or new and used parts.
In some cases, a product may not be new and may have been previously installed.
Regardless, our warranty terms apply.”
Any statements regarding IBM's future direction, intent or product plans
are subject to change or withdrawal without notice.
Performance data contained herein was generally obtained in a controlled,
isolated environments. Customer examples are presented
as illustrations of how those customers have used IBM products and
the results they may have achieved. Actual performance, cost, savings or other results in
other operating environments may vary.
References in this document to IBM products, programs, or services does not imply that
IBM intends to make such products, programs or services available in all countries in
which IBM operates or does business.
Workshops, sessions and associated materials may have been prepared by
independent session speakers, and do not necessarily reflect the
views of IBM. All materials and discussions are provided for informational purposes only,
and are neither intended to, nor shall constitute legal or other guidance or advice to any
individual participant or their specific situation.
It is the customer’s responsibility to insure its own compliance with legal requirements
and to obtain advice of competent legal counsel as to the identification and interpretation
of any relevant laws and regulatory requirements that may affect the customer’s
business and any actions
the customer may need to take to comply with such laws. IBM does not provide legal
advice or represent or warrant that its services or products will ensure that the customer
is in compliance with any law.
Information concerning non-IBM products was obtained from the suppliers of those
products, their published announcements or other publicly available sources. IBM has
not tested those products in connection with this publication and cannot confirm the
accuracy of performance, compatibility or any other claims related to non-IBM
products. Questions on the capabilities of non-IBM products should be addressed to the
suppliers of those products. IBM does not warrant the quality of any third-party products,
or the ability of any such third-party products to interoperate with IBM’s products. IBM
expressly disclaims all warranties, expressed or implied, including but not limited
to, the implied warranties of merchantability and fitness for a particular, purpose.
The provision of the information contained herein is not intended to, and does not, grant
any right or license under any IBM patents, copyrights, trademarks or other intellectual
property right.
IBM, the IBM logo, ibm.com, Aspera®, Bluemix, Blueworks Live, CICS, Clearcase,
Cognos®, DOORS®, Emptoris®, Enterprise Document Management System™, FASP®,
FileNet®, Global Business Services®,
Global Technology Services®, IBM ExperienceOne™, IBM SmartCloud®, IBM Social
Business®, Information on Demand, ILOG, Maximo®,
MQIntegrator®, MQSeries®, Netcool®, OMEGAMON, OpenPower, PureAnalytics™,
PureApplication®, pureCluster™, PureCoverage®, PureData®, PureExperience®,
PureFlex®, pureQuery®, pureScale®, PureSystems®, QRadar®, Rational®, Rhapsody®,
Smarter Commerce®, SoDA, SPSS, Sterling Commerce®, StoredIQ, Tealeaf®, Tivoli®
Trusteer®, Unica®, urban{code}®, Watson, WebSphere®, Worklight®, X-Force® and
System z® Z/OS, are trademarks of International Business Machines Corporation,
registered in many jurisdictions worldwide. Other product and service names might
be trademarks of IBM or other companies. A current list of IBM trademarks is available
on the Web at "Copyright and trademark information" at:
www.ibm.com/legal/copytrade.shtml.
29

30. Please note
IBM’s statements regarding its plans, directions, and intent
are subject to change or withdrawal without notice at IBM’s
sole discretion.
Information regarding potential future products is intended to
outline our general product direction and it should not be relied
on in making a purchasing decision.
The information mentioned regarding potential future products is
not a commitment, promise, or legal obligation to deliver
any material, code or functionality. Information about potential
future products may not be incorporated into any contract.
The development, release, and timing of any future features
or functionality described for our products remains at our sole
discretion.
Performance is based on measurements and projections
using standard IBM benchmarks in a controlled environment.
The actual throughput or performance that any user will
experience will vary depending upon many factors, including
considerations such as the amount of multiprogramming in
the user’s job stream, the I/O configuration, the storage
configuration, and the workload processed. Therefore, no
assurance can be given that an individual user will achieve
results similar to those stated here.
30