# Network security #

IBM watsonx provides network security mechanisms to protect infrastructure, data, and applications from potential threats and unauthorized access\. Network security mechanisms provide secure connections to data sources and control traffic across both the public internet and internal networks\.

<!-- <table> -->

Table 1\. Network security mechanisms for IBM watsonx

| Mechanism                                 | Purpose                                                                                                           | Responsibility                   | Configured on              |
| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | -------------------------------- | -------------------------- |
| [Private network service endpoints](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#private-network-service-endpoints)     | Access services through secure private network endpoints                                                          | Customer                         | IBM Cloud                  |
| [Access to private data sources](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#access-to-private-data-sources)        | Connect to data sources that are protected by a firewall                                                          | Customer                         | IBM watsonx                |
| [Integrations](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#integrations)                          | Secure connections to Third\-party clouds through a firewall                                                      | Customer and Third\-party clouds | IBM watsonx                |
| [Connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#connections)                           | Secure connections to data sources                                                                                | Customer                         | IBM watsonx                |
| [Connections to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#secure) | The Satellite Connector and Satellite location provide secure connections to data sources in a hybrid environment | Customer                         | IBM Cloud and IBM watsonx  |
| [VPNs](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#vpns)                                  | Share data securely across public networks                                                                        | Customer                         | IBM Cloud                  |
| [Allow specific IP addresses](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#allow-specific-ip-addresses)           | Protect from access by unknown IP addresses                                                                       | Customer                         | IBM Cloud                  |
| [Allow third party URLs](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#thirdpartyurls)                | Allow third party URLs on an internal network                                                                     | Customer                         | Customer firewall          |
| [Multi\-tenancy](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#multi-tenancy)          | Provide isolation in a SaaS environment                                                                           | IBM and Third\-party clouds      | IBM Cloud, Cloud providers |

<!-- </table ""> -->

## Private network service endpoints ##

Use private network service endpoints to securely connect to endpoints over IBM private cloud, rather than connecting to resources over the public network\. With Private network service endpoints, services are no longer served on an internet routable IP address and thus are more secure\. Service endpoints require virtual routing and forwarding (VRF) to be enabled on your account\. VRF is automatically enabled for Virtual Private Clouds (VPCs)\.

For more information about service endpoints, see:

<!-- <ul> -->

 *  [Securing connections to services with private service endpoints](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/endpoints-vrf.html?audience=wdp)
 *  [Blog: Introducing Private Service Endpoints in IBM Cloud Databases](https://www.ibm.com/cloud/blog/introducing-private-service-endpoints-in-ibm-cloud-databases?mhsrc=ibmsearch_a&mhq=private%20cloud%20endpoints)
 *  [IBM Cloud docs: Secure access to services using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview)
 *  [IBM Cloud docs: Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint)
 *  [IBM Cloud docs: Public and private network endpoints](https://cloud.ibm.com/docs/watson?topic=watson-public-private-endpoints&mhsrc=ibmsearch_a&mhq=public%20cloud%20endpoints)

<!-- </ul> -->

## Access to private data sources ##

Private data sources are on\-premises data sources that are protected by a firewall\. IBM watsonx requires access through the firewall to reach the data sources\. To provide secure access, you create inbound firewall rules to allow access for the IP address ranges for IBM watsonx\. The inbound rules are created in the configuration tool for your firewall\.

See [Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

## Integrations ##

You can configure integrations with third\-party cloud platforms to allow IBM watsonx users to access data sources hosted on those clouds\. The following security mechanisms apply to integrations with third\-party clouds:

<!-- <ol> -->

1.  An authorized account on the third\-party cloud, with appropriate permissions to view account credentials
2.  Permissions to allow secure connections through the firewall of the cloud provider (for specific IP ranges)

<!-- </ol> -->

For example, you have a data source on AWS that you are running notebooks on\. You need to integrate with AWS and then generate a connection to the database\. The integration and connection are secure\. After you configure firewall access, you can grant appropriate permissions to users and provide them with credentials to access data\.

See [Integrations with other cloud platforms](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-cloud.html)

## Connections ##

Connections require valid credentials to access data\. The account owner or administrator configures the type of credentials that are required, either shared or personal, at the account level\. Shared credentials make the data source and its credentials accessible to all collaborators in the project\. Personal credentials require each collaborator to provide their own credentials to use the data source\.

Connections require valid credentials to access data\. The account owner or administrator configures the type of credentials that are required at the account level\. The connection creator enters a valid credential\. The options are:

<!-- <ul> -->

 *  **Either shared or personal** allows users to specify personal or shared credentials when creating a new connection by selecting a radio button and entering the correct credential\.
 *  **Personal** credentials require each collaborator to provide their own credentials to use the data source\.
 *  **Shared** credentials make the data source and its credentials accessible to all collaborators in the project\. Users enter a common credential which was created by the creator of the connection\.

<!-- </ul> -->

For more information about connections, see:

<!-- <ul> -->

 *  [Adding connections to projects](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html)
 *  [Adding data from a connection to a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html)
 *  [Adding platform connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/platform-conn.html)
 *  [Managing your account settings](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/account-settings.html#set-the-credentials-for-connections)

<!-- </ul> -->

## Connections to data behind a firewall ##

Secure connections provide secure communication among resources in a hybrid cloud deployment, some of which might reside behind a firewall\. You have the following options for secure connections between your environment and the cloud:

<!-- <ul> -->

 *  [Satellite Connector](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#link)
 *  [Satellite location](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-network.html?context=cdpaas&locale=en#location)

<!-- </ul> -->

### Satellite Connector ###

A Satellite Connector uses a lightweight Docker\-based communication that creates secure and auditable communications from your on\-prem, cloud, or Edge environment back to IBM Cloud\. Your infrastructure needs only a container host, such as Docker\. For more information, see [Satellite Connector overview](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&interface=ui)\.

See [Connecting to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html##satctr) for instructions on configuring a Satellite Connector\.

Satellite Connector is the replacement for the deprecated Secure Gateway\. For the Secure Gateway deprecation announcement, see [IBM Cloud docs: Secure Gateway Deprecation Overview](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-dep-overview)

### Satellite location ###

A Satellite location provides the same secure communications to IBM Cloud as a Satellite Connector but adds high availability access by default plus the ability to communicate from IBM Cloud to your on\-prem location\. A Satellite location requires at least three x86 hosts in your infrastructure for the HA control plane\. A Satellite location is a superset of the capabilities of the Satellite Connector\. If you need only client data communication, set up a Satellite Connector\.

See [Connecting to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html#sl) for instructions on configuring a Satellite location\.

## VPNs ##

Virtual Private Networks (VPNs) create virtual point\-to\-point connections by using tunneling protocols, and encryption and dedicated connections\. They provide a secure method for sharing data across public networks\.

Following are the VPN technologies on IBM Cloud:

<!-- <ul> -->

 *  [IPSec VPN](https://cloud.ibm.com/catalog/infrastructure/ipsec-vpn): The VPN facilitates connectivity from your secure network to IBM IaaS platform’s private network\. Any user on the account can be given VPN access\.
 *  [VPN for VPC](https://cloud.ibm.com/vpc-ext/provision/vpngateway): With Virtual Private Cloud (VPC), you can provision generation 2 virtual server instances for VPC with high network performance\.
 *  The Secure Gateway deprecation announcement provides information and scenarios for using VPNs as an alternative\. See [IBM Cloud docs: Migration options](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-dep-migration-options#virtual-private-network)\.

<!-- </ul> -->

## Allow specific IP addresses ##

Use this mechanism to control access to the IBM cloud console and to IBM watsonx\. Access is allowed from the specified IP addresses only; access from all other IP addresses is denied\. You can specify the allowed IP addresses for an individual user or for an account\.

When allowing specific IP addresses for Watson Studio, you must include the CIDR ranges for the Watson Studio nodes in each region (as well as the individual client system IPs that are allowed)\. You can include the CIDR ranges in IBM watsonx by following these steps:

<!-- <ol> -->

1.  From the main menu, choose **Administration > Cloud integrations**\.
2.  Click **Firewall configuration** to display the IP addresses for the current region\. Use CIDR notation\.
3.  Copy each CIDR range into the **IP address restrictions** for either a user or an account\. Be sure to enter the allowed individual client IP addresses as well\. Enter the IP addresses as a comma\-separated list\. Then, click **Apply**\.
4.  Repeat for each region to allow access for Watson Studio\.

<!-- </ol> -->

For step\-by\-step instructions for both user and account restrictions, see [IBM Cloud docs: Allowing specific IP addresses](https://cloud.ibm.com/docs/account?topic=account-ips)

## Allow third party URLs on an internal network ##

If you are running IBM watsonx behind a firewall, you must allowlist third party URLs to provide outbound browser access\. The URLs include resources from IBM Cloud and other domains\. IBM watsonx requires access to these domains for outbound browser traffic through the firewall\.

This list provides access only for core IBM watsonx functions\. Specific services might require additional URLs\. The list does not cover URLs required by the IBM Cloud console and its outbound requests\.

<!-- <table> -->

Table 2\. Third party URLs allowlist for IBM watsonx

| Domain                                       | Description                                         |
| -------------------------------------------- | --------------------------------------------------- |
| \*\.bluemix\.net                             | IBM legacy Cloud domain \- still used in some flows |
| \*\.appdomain\.cloud                         | IBM Cloud app domain                                |
| cloud\.ibm\.com                              | IBM Cloud global domain                             |
| \*\.cloud\.ibm\.com                          | Various IBM Cloud subdomains                        |
| dataplatform\.cloud\.ibm\.com                | IBM watsonx Dallas region                           |
| \*\.dataplatform\.cloud\.ibm\.com            | CIBM watsonx subdomains                             |
| eum\.instana\.io                             | Instana client side instrumentation                 |
| eum\-orange\-saas\.instana\.io               | Instana client side instrumentation                 |
| cdnjs\.cloudflare\.com                       | Cloudflare CDN for some static resources            |
| nebula\-cdn\.kampyle\.com                    | Medallia NPS                                        |
| resources\.digital\-cloud\-ibm\.medallia\.eu | Medallia NPS                                        |
| udc\-neb\.kampyle\.com                       | Medallia NPS                                        |
| ubt\.digital\-cloud\-ibm\.medallia\.eu       | Medallia NPS                                        |
| cdn\.segment\.com                            | Segment JS                                          |
| api\.segment\.io                             | Segment API                                         |
| cdn\.walkme\.com                             | WalkMe static resources                             |
| papi\.walkme\.com                            | WalkMe API                                          |
| ec\.walkme\.com                              | WalkMe API                                          |
| playerserver\.walkme\.com                    | WalkMe player server                                |
| s3\.walkmeusercontent\.com                   | WalkMe static resources                             |

<!-- </table ""> -->

## Multi\-tenancy ##

IBM watsonx is hosted as a secure and compliant multi\-tenant solution on IBM Cloud\. See [Multi\-Tenant](https://www.ibm.com/cloud/learn/multi-tenant)

**Parent topic:**[Security](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-overview.html)

<!-- </article "role="article" "> -->