Connecting to data behind a firewall
Connecting to data behind a firewall To connect to a database that is not accessible via the internet (for example, behind a firewall), you must set up a secure communication path between your on-premises data source and IBM Cloud. Use a Satellite Connector, a Satellite location, or a Secure Gateway instance for the secure communication path. * [Set up a Satellite Connector](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html?context=cdpaas&locale=ensatctr): Satellite Connector is the replacement for Secure Gateway. Satellite Connector uses a lightweight Docker-based communication that creates secure and auditable communications from your on-prem, cloud, or Edge environment back to IBM Cloud. Your infrastructure needs only a container host, such as Docker. For more information, see [Satellite Connector overview](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&interface=ui). * [Set up a Satellite location](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html?context=cdpaas&locale=ensl): A Satellite location provides the same secure communications to IBM Cloud as a Satellite Connector but adds high availability access by default plus the ability to communicate from IBM Cloud to your on-prem location. It supports managed cloud services on on-premises, such as Managed OpenShift and Managed Databases, supported remotely by IBM Cloud PaaS SRE resources. A Satellite location requires at least three x86 hosts in your infrastructure for the HA control plane. A Satellite location is a superset of the capabilities of the Satellite Connector. If you need only client data communication, set up a Satellite Connector. * [Configure a Secure Gateway](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html?context=cdpaas&locale=engateway): Secure Gateway is IBM Cloud's former solution for communication between on-prem or third-party cloud environments. Secure Gateway is now [deprecated by IBM Cloud](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-dep-overview). For a new connection, set up a Satellite Connector instead. Set up a Satellite Connector To set up a Satellite Connector, you create the Connector in your IBM Cloud account. Next, you configure agents to run in your local Docker host platform on-premises. Finally, you create the endpoints for your data source that IBM watsonx uses to access the data source from IBM Cloud. Requirements for a Satellite Connector Required permissions : You must have Administrator access to the Satellite service in IAM access policies to do the steps in IBM Cloud. Required host systems : Minimum one x86 Docker host in your own infrastructure to run the Connector container. See [Minimum requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&interface=uimin-requirements). Setting up a Satellite Connector Note: Not all connections support Satellite. If the connection supports Satellite, the IBM Cloud Satellite tile will be available in the Private Connectivity section of the Create connection form. Alternatively, you can filter all the connections that support Satellite in the New connection page. 1. Access the Create connector page in IBM Cloud from one of these places: * Log in to the [Connectors](https://cloud.ibm.com/satellite/connectors) page in IBM Cloud. * In IBM watsonx: 1. Go to the project page. Click the Assets tab. 2. Click New asset > Connect to a data source. 3. Select the IBM watsonx connector. 4. In the Create connection page, scroll down to the Private connectivity section, and click the IBM Cloud Satellite tile. 5. Click Configure Satellite and then log in to IBM Cloud. 6. Click Create connector. 2. Follow the steps for [Creating a Connector](https://cloud.ibm.com/docs/satellite?topic=satellite-create-connector). 3. Set up the Connector agent containers in your local Docker host environment. For high availability, use three agents per connector that are deployed on separate Docker hosts. It is best to use a separate infrastructure and network connectivity for each agent. Follow the steps for [Running a Connector agent](https://cloud.ibm.com/docs/satellite?topic=satellite-run-agent-locally). The agents will appear in the Active Agents list for the connector. 4. In IBM watsonx, go back to the Create connection page. In the Private connectivity section, click Reload, and then select the Satellite Connector that you created. In the [Satellite Connectors dashboard](https://cloud.ibm.com/satellite/connectors) in IBM Cloud, for each connection that you create, a user endpoint is added in the Satellite Connector. Set up a Satellite location Use the Satellite location feature of IBM Cloud Satellite to securely connect to a Satellite location that you configure for your IBM Cloud account. Requirements for a Satellite location Required permissions : You must be the Admin in the IBM Cloud account to do the tasks in IBM Cloud. Required host systems : You need at least three computers or virtual machines in your own infrastructure to act as Satellite hosts. Confirm the [host system requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-host-reqs). (The IBM Cloud docs instructions for additional features such as Red Hat OpenShift clusters and Kubernetes are not required for a connection in IBM watsonx.) Note: Not all connections support Satellite. If the connection supports Satellite, the IBM Cloud Satellite tile will be available in the Private Connectivity section of the Create connection form. Alternatively, you can filter all the connections that support Satellite in the New connection page. Setting up a Satellite location Configure the Satellite location in IBM Cloud. * [Task 1: Create a Satellite location](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html?context=cdpaas&locale=entask1) * [Task 2: Attach the hosts to the Satellite location](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html?context=cdpaas&locale=entask2) * [Task 3: Assign the hosts to