Hi,

I'm setting up two VMs (datapower OVA, v10.0.5.x) as gateways in a apic cloud. The customer only have capacity for two VMs. The two datapower VMs are sitting behind a loadbalancer and both will be active. The requirement is also to separate internal and external api services. Each VM has separate interfaces for internal and external traffic + one for management.

So in each datapower VM I created two domains, one for internal and one for external (same domain names in both VMs). In each domain I created a gateway-service. I followed the documentation about configuration (Configuring DataPower API Gateway) and registered the gateway services in the cloud manager as 4 separate.

Their objective is to have two loadbalanced gateways for internal resp. external api traffic.

Questions:
-Is this is a valid setup?
-Do I need to create all peering object for each gateway-service? If not, how do I configure?
-What is the disadvantage with a setup like this? if it is valid... rate-limit could be one..?

Regards,
Rikard Almroth

Hi Richard,

Please see this article that discusses this setup:

https://chrisphillips-cminion.github.io/apiconnect/2022/10/19/APIC-DataPowerQuorum2Node0.html

Respective gateway peerings need to be configured between the two datapowers.

From my perspective you would need to implement some operational procedures to make this work well.

Regards

Hi Szymon,

Thank you, I have read this article - and maybe the second option is what I should go for.
But what if I choose to just configure them as separate gateway services - one internal and one external in each datapower vm. 
Would that be a valid setup? 

Regards,
Rikard

Hi Rikard,

This setup is also possible, but then you will be loosing all high-availability capabilities.

As for further reading, I can't recommend enough API Connect Deployment Whitepaper: https://community.ibm.com/community/user/integration/viewdocument/api-connect-deplyoment-whitepaper-v

It discusses patterns and anti-patterns in deploying API Connect and its gateways. This should also give you broader picture on how to best address your requirements.

Regards
Szymon

Hi Rikard 

Second Option would be a valid setup technically as long as the peering instances are also separate. 

It would be good to check with License perspective from IBM whether you are compliant as you mentioned capacity for 2VMs, 

Ideally it would be 2 gateway services on the cloud , not sure why 4 , gateways needs to be added as cluster and not as individual gateways. 

On top of that it would be good to isolate the internal and external traffic from a single appliance atleast for production load . 

Thanks

Deepak