IBM's Bluemix Local provides customers the ability to deploy Bluemix applications and services behind their own firewall. The presentation discusses: 1) Bluemix Local uses an SSL tunnel originating from an inception VM at the customer site to securely connect the customer environment to IBM's infrastructure for platform deployment and maintenance. 2) Customers benefit from 24/7 monitoring of the local Bluemix environment by IBM as well as security management services like patching and threat assessment. 3) A customer example from Spain is discussed where the customer chose Bluemix Local to keep their Cloud Foundry environment up-to-date while also leveraging additional IBM services behind their firewall. 4) Common challenges like monitoring the SSL tunnel

1. CLD-6370: Bluemix Local – Relay
Options and Challenges
Michael Behrendt, Distinguished Engineer, IBM Cloud
Eduardo Patrocinio, Technical Leader, IBM Cloud
Andre Tost, Senior Technical Staff Member, IBM Cloud

2. Please Note:
1
• IBM’s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice at IBM’s sole
discretion.
• Information regarding potential future products is intended to outline our general product direction and it should not be relied on in
making a purchasing decision.
• The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any
material, code or functionality. Information about potential future products may not be incorporated into any contract.
• The development, release, and timing of any future features or functionality described for our products remains at our sole discretion.
• Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual
throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the
amount of multiprogramming in the user’s job stream, the I/O configuration, the storage configuration, and the workload processed.
Therefore, no assurance can be given that an individual user will achieve results similar to those stated here.

3. Agenda
• Bluemix Introduction / Level-set (Michael)
– Cloud Foundry vs Container Services vs VM Services
– Public vs Dedicated vs Local
– Relay Overview
• Relay Deep Dive (Andre) and Customer Benefits (Eduardo)
– Network connectivity
• IBM-to-Customer
• Customer-to-IBM
• Customer-to-Internet
– Platform deployment and maintenance
– Operational monitoring
– Security Monitoring and Maintenance
• Customer examples (Eduardo)
• Discuss Common Challenges and Outlook (all)
2

4. Bluemix: IBM’s Cloud Platform
• DevOps
• Big Data
• Mobile
• Watson
• Business Analytics
Bluemix service categories
• Database
• Web and application
• Security
• Internet of Things
• Cloud Integration
• API management &
Integration
Developer experience
• Rapidly deploy and scale
applications in any language.
• Compose applications quickly with
useful APIs and services and avoid
tedious backend config.
• Realize fast time-to-value with
simplicity, flexibility and clear
documentation.
Enterprise capability
• Securely integrate with existing
on-prem data and systems.
• Choose from flexible deployment
models.
• Manage the full application
lifecycle with DevOps.
• Develop and deploy on a platform
built on a foundation of open
technology.
Built on a foundation of open
technology.
Build, run, scale, manage, integrate & secure applications in the cloud

5. What can we do with Bluemix ?
• Extend existing applications
- Add multi-channel user experience for mobile, social
- Add new capabilities integrating other data/services
- Integrate with other internal & external services
• API enable applications
- Create scalable API layer on top of existing services
- Simplify how composite service capabilities are exposed via APIs
• New applications
- New 12-factor applications
- End-to-end DevOps
- Securely Integrate with on-premises data & services
Backend Systems and
Integration
API Creation & Management New Channels &
Opportunities

6. High-Level Structure of Bluemix

7. 1 | Public
Maximize on cloud
economics and agility.
2 | Dedicated
Everything is dedicated
and connected to you —
agility of public cloud, yet
feels like home.
3 | Local
Behind the firewall for the
most sensitive workloads.
Seamless Experience
Regardless of which
combination you choose,
you can expect a single,
seamless experience.
Hybrid Deployment: Multiple Deployment Models
Public, Dedicated, Local

8. 7
Bluemix Local provides secure remote management
Bluemix Local delivers the benefits of a fully managed platform, on-premises.
Installation and initial setup
Get up and running with new services and runtimes in
hours.
Platform monitoring
IBM provides proactive 24/7 platform support
Protected and audited access
IBM never has access to your applications or data.
Always current
Bluemix updates are automatically applied to environment
Leverage extensive testing in Bluemix Public
Take advantage of the intensive testing and validation in
IBM’s large scale public deployments
Maintain agility and security
IBM will leverage participation in open communities to
ensure higher quality

9. IBM
Con
fide
ntial
–
© IBM Corporation
System Information
Consolidated Services & Views Across Deployments
X
Compose Services using a blend of
Public, Private and Custom Services
View status across deployments
Seamless catalog experience
Security & Audit
Logs
User Management
Also:
Catalog Management
Capacity Views

10. IBM
Con
fide
ntial
–

11. Bluemix Introduction
Subhead

12. Michael to add content here
11

13. Bluemix Relay
Technical Deep-dive and benefit assessment

14. Bluemix core and services run in a private network
Public network
• Inception virtual machine(s) – Environment manage tools
• DataPower appliance – Publishes hosting URL’s
• Traditional Customer Services
Private network
• Bluemix core technology
• Local Bluemix Services
DataPower
Bluemix
Inception
Virtual Machine
13
Network
13

15. Bluemix Managed Service offering
SSL Tunnel for IBM local managed service
• Outbound SSL OpenVPN tunnel
• Originates from the inception virtual machine(s)
• Secured with certificates unique to each customer’s inception virtual machine
• Default traffic on this tunnel is IBM UrbanCode Deploy automation for construction, maintenance, and
servicing of the environment
• The tunnel will automatically re-establish a connection after a network interruption
Customer
DMZ
Bluemix
Single
Private
VLAN
NAT
Customer < Bluemix
Data Power
Wildcard
domain
Customer
Firewall
Inbound/ outbound
Applica tion tra ffic
IBM Outbound traffic
IBM
Internet
exposed
management
connection
(In SoftLay er) IBM Ma na gement tra ffic
Customer
INTERNET
Firewall
Customer
Firewall
Customer
INTRANET
14
Managed Relay
14

16. The Internet
Bluemix Local – Network Architecture
Customer Network
IBM Urban Code
Deploy
Softlayer Server
Bluemix
Platform
Stemcells
Releases
Manifests
BOSH CLI
Automated
Management
Processes
(Deploy, Upgrade etc.)
IBM Urban
Code Deploy
Relay
(per environment)
Customer Hardware & Infrastructure
Bluemix Core
Services• Monitoring & Logging
• Cache
• Cloudant (Data Store)
• Qradar EPS
• IEM Relay
Network
Isolation
Configuration
Store
(per customer)
Bluemix
Code &
Automation
Repository
Opensource Code
IBM Test & Staging
Validation
IBM Production
Deployment &Validation
IBM
Premises
Bluemix Local
Inception VM
UCD Agent
• Secure connection
• Connection originated
from customer premise
• Restricted access (agent-
only)
Cloud Foundry
Containers Openstack
ACE UI
Enterprise ITSM
Customer Services
Customer
Premises
On-premise data store
for logs, monitoring
data etc.
Bluemix Ops Console
IBM Cloud Security Services
Qradar Console IEM
Server
Bluemix Ops
Directory
Server
Nessus
Privileged ID
Governance
IPSec Tunnel
DataPower
• Customer’s Service
traffic
• Syndicated & 3rd party
service traffic
• App staging artifacts
• Inbound & outbound
user to app traffic
• LDAP
• Enterprise services
• Other SaaS services
• vCenter
Network
Isolation
15

17. Local Bluemix Interfaces Overview
e.g. 10.30.26.0/24 Customer Local Network
Local Bluemix VMWare ESXi Cluster
Inception
VM
Inception
VM (Backup) DataPower VM1 DataPower VM2
192.168.100.0/24 Bluemix Internal
Network
.11 .12 .21 .22
.31 .32 .33
System
Components
Applications Custom
Internal Bluemix
Local VMs
Virtual IPs

18. IBM Bluemix Inception Machine VM Firewall Rules: Outbound
• IBM VPN Network Range IPs (10.126.152.72/29):
• UCD Relay (10.126.152.72) TCP 20080, 20081, 7916
• Shared Repo (10.126.152.73) TCP 22 (ssh), 80 (http)
• SHARED:
• 10.126.152.74 TCP 22 (ssh), 4443 (BBO pub/sub comm), 11111 (data cache)
• 10.126.152.75 TCP 22 (ssh), 2379 (Backup), 4567 (Doctor bus comm), 4568 (etcd
registration), 5000 (Docker repo), 6479 (redis cache), 11111 (data cache)
• 10.126.152.76 TCP 22 (ssh)
• Internet (domains for webproxy – not complete):
• *.ng.bluemix.net
• *.cloudnat.com
• archive.ubuntu.com
• security.ubuntu.com
• ubuntu-cloud.archive.canonical.com
• changelogs.ubuntu.com
• nodejs.org
• laurel.apimdev.castironcloud.com
• rubygems.org
• rubygems.global.ssl.fastly.net
Inception VM

19. IBM Bluemix Inception Machine VM Firewall Rules: Inbound
• TCP 22 for SSH service & debug problems
• TCP 443 for HTTPS console access
Inception VM

20. IBM Bluemix DataPower VM Firewall Rules
• TCP 80 for HTTP
• TCP 9090 (https) for Administration
• TCP 4443 (https) for Loggregator
DataPower VM

21. IBM Bluemix DataPower Virtual IPs Firewall Rules
• TCP 80 for HTTP
• TCP 443 for HTTPS
System Components
Applications
Custom

22. Additional Requirements
• Network bandwidth for the Relay
– Recommended throughput is 5Mbps up & 5Mbps down
– Expected monthly data usage is 10GB
– Agreed upon window where large bundles of data will be delivered, these
can be as large at 4GB
• If you use a proxy to connect to Internet outbound, it must support web
sockets
21

23. Relay Benefits
• Time to market
– Ease and speed of deployment
– Platform currency
• Operational efficiency
– 24/7 Monitoring and Alert generation
• Security management
– Patch management
– Threat assessment
22

24. Client Examples

25. Client in Spain deploying Bluemix Local
• What’s the problem?
Keep CF up-to-date
• What drove the client to choose IBM?
Vision beyond a CF environment
• What are the challenges around Relay technology?
– VPN / SSH Tunnel
– Privileged User Management
– QRadar integration
24

26. Discussion
Common Challenges and Outlook

27. Common Challenges
• Monitoring of SSH tunnel / OpenVPN
• Use of OpenVPN versus IPSec
• Sensitivity of log data
• Integration with local systems for log analysis, threat assessment etc
– E.g. QRadar
• Temporary Relay?
– The answer is no 
• Trusted (IBM) user management and authentication
• Password and key management
– E.g. temporary VMware admin access?
• The answer is no 
26

28. Notices and Disclaimers
27
Copyright © 2016 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission
from IBM.
U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM.
Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of
initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS DOCUMENT IS
DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL IBM BE LIABLE FOR ANY DAMAGE ARISING FROM THE
USE OF THIS INFORMATION, INCLUDING BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFIT OR LOSS OF OPPORTUNITY.
IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided.
Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice.
Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers
have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary.
References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in
which IBM operates or does business.
Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials
and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or
their specific situation.
It is the customer’s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and
interpretation of any relevant laws and regulatory requirements that may affect the customer’s business and any actions the customer may need to take to comply with such
laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law

29. Notices and Disclaimers Con’t.
28
Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not
tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products.
Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the
ability of any such third-party products to interoperate with IBM’s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
The provision of the information contained h erein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual
property right.
IBM, the IBM logo, ibm.com, Aspera®, Bluemix, Blueworks Live, CICS, Clearcase, Cognos®, DOORS®, Emptoris®, Enterprise Document Management System™, FASP®,
FileNet®, Global Business Services ®, Global Technology Services ®, IBM ExperienceOne™, IBM SmartCloud®, IBM Social Business®, Information on Demand, ILOG,
Maximo®, MQIntegrator®, MQSeries®, Netcool®, OMEGAMON, OpenPower, PureAnalytics™, PureApplication®, pureCluster™, PureCoverage®, PureData®,
PureExperience®, PureFlex®, pureQuery®, pureScale®, PureSystems®, QRadar®, Rational®, Rhapsody®, Smarter Commerce®, SoDA, SPSS, Sterling Commerce®,
StoredIQ, Tealeaf®, Tivoli®, Trusteer®, Unica®, urban{code}®, Watson, WebSphere®, Worklight®, X-Force® and System z® Z/OS, are trademarks of International Business
Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at: www.ibm.com/legal/copytrade.shtml.

30. Thank You
Your Feedback is Important!
Access the InterConnect 2016 Conference Attendee
Portal to complete your session surveys from your
smartphone,
laptop or conference kiosk.