Data Catalog dynamic IP address frustrates IP address security filters in remote clouds and on-premise systems.

Work with Domenico Conia ... essentially each IBM data center has an IP range for outgoing connections.  We need to get that documented.

Hi David,
I did a good discussion and also some of these info was present in the deck
you saw 30min ago in the "Public Isolation" Webinar.

I don't have time today to prepare a good simple diagram
but here the answer to your question.

Short answer:  YES , as I said you before the traffic coming from a customer account is in the 90% of the cases simple to "white-list".

_________________________________________________
A- Customer account managed by IBM:
    Secure Perimeter can be Vyatta 5600 or Fortigate FW

B- Customer account managed by the customer
    Secure perimeter can be  Vyatta 5600 or Fortigate FW
    or any "customized" secure solution they want to put.
 
The main architecture is not changing, with Scenario B the customer is responsible to manage the security


There are 2 Scenarios available today :

1-Vyatta Based Perimeter     ==> Source NAT is always configured on the Vyatts by BMX network engineer
                                                  so all the out-coming traffic to internet has 1 or  a few specific public IPs as source
                                                  (configured on the Vyatta or equivalent firewall)
                                                  CF Accounts

2- Armada Based Perimeter  ==> Source NAT is still configured but on IP Tables
                                                  Project name: "BedRock" 
                                                 Fred Tucci is the lead architect for this project.
                                                 They use Front End Armada nodes as "secure perimeter" with IP Tables on board
                                                 Application runs on Back End Armada Nodes.
                                                 Armada Accounts

Both scenario (Vyatta-Vyatta less) MUST be monitor to avoid the risk of
missing-wrong firewall rules.
IPTables (scenario 2) can be a mess with a lot of clusters...so Fred is probably using automation
to deploy and monitor the IP Tables. IF one rule is wrong (e,g, they forgot any any any allowed)
an alarm is notified.

On Scenario 1-Vyatta- this is alsways included in the BMX security architecture (vyatta fw rules are monitored).

FUTURE Scenario:                         
3- Another scenario (not possible today, could be in a few months hopefully) is BYOP
    With BYOP the customer could assign speficic addresses as Source or his environment