vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Once the Secure Gateway connection has been established MQ channels can be initiated from either the cloud or the on-premise side, enabling a wider set of MQ channel types..

Similar to direct connection, this solution supports end-to-end TLS sessions between the on-premises queue manager and cloud-based queue manager.

The [guidance on secure gateway connection](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_connect_onprem_gateway) will help you implement this solution.

![alt text](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_connect_onprem2.png)





 Connection via IBM MQ Internet Pass-thru 

Existing users of MQ Internet Pass-Thru will be familiar with this method of connectivity using HTTPS ( and particularly HTTPS tunnelling). A detailed overview of this approach is available at [MQ IPT Knowledge Base](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_latest/com.ibm.mq.ipt.doc/ipt0000_.htm).

This method may be most suitable for communication which must pass through a standard firewall configuration, and HTTP/HTTPS traffic is the most appropriate.

![alt text](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_connect_onprem3.png)
In the Policies section, specify the Internet Key Exchange (IKE) and Internet Protocol Security (IPsec) options to use for Phase 1 and Phase 2 negotiation of the connection.



* Select Auto if you want the gateway to try to automatically establish the connection.
* Select or create custom policies if you need to enforce particular security requirements, or if the VPN gateway for the other network doesn't support the security proposals that are tried by auto-negotiation.









 Adding a connection from the CLI 

Before you begin, make sure to [set up your CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).

To create a VPN connection by using the CLI, enter the following command:

ibmcloud is vpn-gateway-connection-create CONNECTION_NAME VPN_GATEWAY_ID PEER_ADDRESS PRESHARED_KEY
--local-cidr CIDR1 --local-cidr CIDR2 ...
--peer-cidr CIDR1 --peer-cidr CIDR2 ...
[--admin-state-up true | false] [--dead-peer-detection-action restart | clear | hold | none]
[--dead-peer-detection-interval INTERVAL] [--dead-peer-detection-timeout TIMEOUT]
[--ike-policy IKE_POLICY_ID] [--ipsec-policy IPSEC_POLICY_ID] [--output JSON] [-q, --quiet]

Where:



* CONNECTION_NAME - Name of the connection.
* VPN_GATEWAY_ID - ID of the VPN gateway.
* PEER_ADDRESS - The IP address of the peer VPN gateway.
* PRESHARED_KEY - The preshared key.
* --admin-state-up value - If set to false, the VPN gateway connection is shut down. One of: true, false. The default is true.
* --dead-peer-detection-action value - Dead Peer Detection actions. One of: restart, clear, hold, none. The default is restart.
* Use NSX ESGs, [IBM Cloud Vyatta](https://cloud.ibm.com/catalog/infrastructure/virtual-router-appliance), and Direct Link peering to plan for connectivity to workloads (Network Address Translation, Virtual Private Network, routing).
* If you implement Cross-vCenter NSX, ensure that your local segment ID ranges are not overlapping before you deploy any local workloads.







 Security planning and hardening 

You are responsible for securing, encrypting, and monitoring your VMware instance and workloads to meet your corporate, industry, and regulatory standards. Complete the following steps to ensure proper security.



* Change all passwords displayed in the IBM Cloud for VMware Solutions console and use your own password management system. IBM retains distinct user IDs needed for ongoing automation and support.
* Review password policies, such as complexity and expiration period, across all components.
* Review encryption settings across all components.
* Plan and implement appropriate physical or virtual firewall solutions, such as NSX Distributed Firewall (DFW), NSX ESGs, [FortiGate Virtual Appliance](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-fortinetvm_considerations), and [IBM Cloud Vyatta](https://cloud.ibm.com/catalog/infrastructure/virtual-router-appliance).
* Plan and implement appropriate application load balancing and security solutions, such as [F5 BIG-IP](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-f5_considerations).
* Plan and implement appropriate security information and event management (SIEM) solutions, such as [IBM QRadar](https://www.ibm.com/us-en/marketplace/hosted-security-intelligence).
* Plan and implement appropriate vulnerability scanning.
* Outbound calling
* Configuring backup locations
* Event forwarding to save call detail reports in the IBM Cloudant for IBM Cloud database service
* Reviewing the usage summary page. Use IBM Log Analysis instead. For more information, see [Viewing logs](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-phone-troubleshootingphone-troubleshooting-logs).



To migrate from Voice Agent with Watson to the Watson Assistant phone integration, complete the following steps:



1. From the Voice Agent with Watson page, copy the phone number or numbers that you used for your SIP account.
2. When you set up the Watson Assistant phone integration, add the phone number or set of numbers that you copied in the previous step.
3. From the phone integration setup page, copy the SIP uniform resource identifier (URI).
4. In your SIP trunk account, replace the Voice Agent with Watson URI that you specified previously with the URI that you copied from the phone integration setup page in the previous step.

For example, if you use a Twilio SIP trunk, you would add the assistant's SIP uniform resource identifier (URI) to the Twilio Origination SIP URI field.
5. If your SIP trunk provider is not already allowlisted with the Watson Assistant region you are migrating to, follow these [instructions](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-phone-configdeploy-phone-config-request-setup) to get access to your SIP trunk.







 Call routing details 

Incoming calls to your assistant follow this path:



1. A customer calls the customer support phone number that is managed by your Session Initiation Protocol (SIP) trunk provider.
2. The SIP trunk service sends a SIP INVITE HTTP request to your assistant's phone integration to establish a connection.
3. The phone integration connects to the speech services that are required to support the interaction.
4. After the services are ready, the connection is established, and audio is sent over the Real-time Transport Protocol (RTP).
Satellite Connector overview 

Satellite Connector provides secure TLS tunneling between applications and services that need to communicate in hybrid and multi-cloud environments.

A Satellite Connector is a deployment model that enables only the secure communications from IBM Cloud to on-prem resources with a light weight container, deployed on the client's container platform hosts, such as Docker hosts. This option brings all the security and auditability of Satellite communication, but with much less resources required.

Satellite Connector allows hybrid cloud connectivity for edge devices needing persistent connectivity. It enables advertising of trusted services that are capable of establishing secure end-point connectivity. With Satellite Connector, you can maintain data sovereignty with on-premises applications and services while connecting securely over a public network interface.

Here are some key concepts for Satellite Connector.

Connector
: A connector provides a secure connection between a specific remote location and IBM Cloud.

Agent
: Each connector needs an agent running on your location to establish the connection.

Endpoint
: An endpoint allows you to securely connect to a server, service, or app that runs in your Satellite location from a client that is connected to the IBM Cloud private network.

Access control list
: Access control list (ACL) controls which clients can access location endpoint resources. You can create ACL rules and use them to control which clients can use the endpoint to connect to the destination resource that runs in your location.



 Minimum requirements 

These minimum requirements are for running the agent image only and exclude what's needed to run the container platform.

To run the Satellite Connector agent image, your computing environment must meet the following minimum requirements.



* CPU: 0.40
* Memory: 500M
* Container platform must be on x86 architecture.
* The Connector agent image is for amd64 architecture and only runs on amd64 hardware or hardware that can emulate amd64. If you are on a Mac with Apple Silicon (arm64), the image will work if Rosetta is installed. If Rosetta is not installed on your Mac, you can install it via the softwareupdate --install-rosetta command.



Your environment must also meet the following network connectivity requirements.



* The Satellite Connector agent that runs in your environment needs public outbound connectivity to IBM Cloud.
Getting started with Secure Gateway 

IBM® Secure Gateway for IBM Cloud® service provides a quick, easy, and secure solution for connecting anything to anything. By deploying the light-weight and natively installed Secure Gateway Client, a secure, persistent connection can be established between your environment and the cloud. With this, you can safely connect all of your applications and resources regardless of their location. Rather than bridging your environments at the network level like a traditional VPN, Secure Gateway provides granular resource control operating with the principle of least privilege as its core tenet.

![Secure Gateway Architecture](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/diagramSGW.png?raw=true)

After creating an instance of the Secure Gateway service, get connected in just a few steps.



1.  [Add a gateway](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-sg-gw).
2.  [Add a Client](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-client).
3.  [Add a destination](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-dest).
Troubleshooting 



 Best practices for running the Secure Gateway Client 



* Run the Secure Gateway client on an operating system (OS) partition that has network visibility of the services that are bridged by the client itself. For instance, some hosted virtualization environments support multiple network connectivity modes, including NAT and Bridged. Be sure to choose the correct connection type that provides you with access to the IBM Cloud® services from the internet.
* Install the Secure Gateway into your IT environment where your corporate security policy allows. This would typically be in a protected yellow zone or DMZ where your company can institute the appropriate security controls to protect on-premises assets. Always follow your corporate security policies and instructions when you install the Secure Gateway client.
* Before you install a client into your environment, ensure that both the internet and your on-premises assets are accessible and all host names are resolvable by a DNS.







 Initial Troubleshooting Steps 



 Secure Gateway Client disconnected 

If the Secure Gateway Client have been disconnected, check the Secure Gateway Client logs



* If there is error when fetching configuration:

[DEBUG] The Secure Gateway client will fetch its configuration from https://sgmanager.<region>.securegateway.cloud.ibm.com/sgconfig/<gateway id>
[ERROR] The response is code: <Error Code>, message: <Error details>



* Please check whether your Secure Gateway Client have access to https://sgmanager.<region>.securegateway.cloud.ibm.com. For details, see [Network Requirements](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-requirementsnetwork-requirements).



curl https://sgmanager.<region>.securegateway.cloud.ibm.com
* If there is error when accessing tunnel server:

[DEBUG] The Secure Gateway tunnel is connecting for wss://<node>.securegateway.appdomain.cloud:9000/ws
[ERROR] The following error occurred on the Secure Gateway tunnel, <Error Code>
[INFO] The Secure Gateway tunnel was disconnected
Setting up Satellite as a Secure Gateway for on-prem solutions 

Deploy IBM Cloud Satellite as a secure solution for connecting resources in a protected on-premises environment to cloud resources.



 Satellite as a Layer 4 connection solution 

While you can set up many possible solutions to enable secure connections between your on-premises network and IBM Cloud, you can use Satellite to control client communications among your hybrid cloud deployments.

For example, you might use a minimal Satellite location deployment as an alternative to the [Secure Gateway solution](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-getting-started-with-sg). Satellite provides the same application-level transport through common ports as Secure Gateway, with greater client visibility and audit control. The Satellite Link functionality improves upon the Secure Gateway client experience with a highly available and secure-by-default communication between the cloud and on-premises networks, third-party clouds, or network edge.

On-premises setup with a Satellite location
: A minimum deployment of Satellite includes using three RHEL 7 or 8 hosts to set up a Satellite location control plane. These hosts might be in your on-premises network or in other clouds. Then, you can attach more hosts to your location and deploy IBM Cloud managed services to run on these hosts. For example, you can deploy a Red Hat OpenShift cluster to your on-premises hosts that are attached to your Satellite location. Then, you can deploy any apps that need secure access to IBM Cloud to your Red Hat OpenShift cluster.

Secure transport to IBM Cloud
: Next, your on-premises client that runs on the location hosts can use [Satellite Link](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-createlink-location) as Layer 4 application transport between the location and other services that run in IBM Cloud or your own applications that run within IBM Cloud. You can use Satellite Link to create location endpoints, which allow resources in IBM Cloud to securely access a resource in your on-premises Satellite location, and cloud endpoints, which allow resources in your on-premises Satellite location to access a resource that runs anywhere outside of the Satellite location. To allow access to a resource, authorization must granted in the Link endpoint's access control list.
Procedure to enable internet connectivity for Entrust KeyControl 



1. Complete steps 1 - 3 in the previous procedure.
2. Click Settings and then Interfaces. Note the IP address for the private uplink. This address is the new default gateway.
3. Click Home > Hosts and Clusters and find the Entrust VMs. Right-click one of the VMs and click Open Console.
4. Log in to the console by using the console credentials that you can find on the Entrust KeyControl service details page on the IBM Cloud for VMware Solutions console.
5. To get the current default gateway IP address from the VM, click Manage Network Settings > Show Current Network Configuration. Note the IP address that is listed for Gateway. This address becomes the gateway that is used for the static route.
6. To set a static route for the VM, click Manage Network Settings > Manage Static Routes > Add Static Route. Set Network address to 10.0.0.0/8 and Gateway to the IP address noted in the previous step.
7. To set the default gateway IP for the VM, click Manage Network Settings > Change Current Network Configuration. If you get a warning message, click OK, then click Custom Configuration. Set the Gateway field to the private uplink IP address noted in step 2 and click OK. Wait until the new network configuration is installed and the network services are restarted.
8. If you see a message that asks for Entrust SecureOS reauthentication, click OK and enter the IP address of the other Entrust VM for this installation. If you are asked for a 16-character passphrase, press Enter to return to the main menu. Verify the current network configuration to ensure that your changes are applied.
9. To confirm that the VM has access to the internet, ping a public IP address or website. Click Manage Network Settings > Network Diagnostic Tools > Test Inbound Ports of Another Server. Type a public website address, for example, www.ibm.com, click OK, type 80 443 for the ports (or any other ports you want to test).
5 API Keys will be generated for the client to use to move files in and out of the location. Additional keys can be ordered. To initiate this process, customers must submit a support case.

One Site-to-Site VPN is included in the order. To initiate the creation of this VPN, customers must submit a support case. At this time, the VPN is only available for LDAP integrations.

For clients wanting to use App Connect or File integration for other applications within the suite:



* AppConnect is included as an entitlement with the Maximo Application Suite, but SaaS does not implement or support this within the MAS-SaaS environment. The client is responsible for implementing AppConnect or beginning with version MAS v8.7, AppConnect SaaS will be supported.
* For clients wanting file integrations with applications other than Manage, this needs to be discussed with the Sales team and an appropriate solution implemented. COS is only included for the Manage application.
* [VMware Storage CSI Driver](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-class-refsat-storage-vmware-csi-sc-ref)









 Setting up Satellite as a Secure Gateway for on-prem solutions 

[Setting up Satellite as a Secure Gateway for on-prem solutions](https://cloud.ibm.com/docs/satellite?topic=satellite-sg-usecasesg-usecase)



* [Satellite as a Layer 4 connection solution](https://cloud.ibm.com/docs/satellite?topic=satellite-sg-usecasesg-alt)
* [Setting up a secure connection to IBM Cloud with Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-sg-usecasesg-alt-setup)



* [Step 1: Deploy Satellite to your on-premises environment](https://cloud.ibm.com/docs/satellite?topic=satellite-sg-usecasesg-example-loc)
* [Step 2: Set up secure communication channels by using Satellite Link](https://cloud.ibm.com/docs/satellite?topic=satellite-sg-usecasesg-example-link)









 Enhancing security 



 Managing access 

[Managing access overview](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam)



* [Locations and hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam-resource-loc)
* [Configuration, subscription, cluster, cluster group, and resource](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam-resource-config)
* [Link](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam-resource-link)
* [Other services](https://cloud.ibm.com/docs/satellite?topic=satellite-iamiam-resource-services)
Enabling IBM Key Protect through UI 

Follow these steps to launch key management system and encrypt your keys with Schematics.



1. Log in to your [IBM Cloud](https://cloud.ibm.com/) account by using your credentials.
2. From the IBM Cloud page, select Navigation menu > Schematics > Integrations > Connect.
3. Click Connect > Key Management from the drop down.
4. Select Service as Key Protect, or Hyper Protect Crypto Services.
5. Select an Choose existing instance instance. If your instance not created, select an Create a new instance to create IBM Key Protect, or IBM Cloud Hyper Protect Crypto Services. For more information, see [Create a key protect instance](https://cloud.ibm.com/docs/schematics?topic=schematics-kms-integrationkms-key-prerequisites).

You can view your instance in the service list, when the prerequisites are met. Or you can see a message No Keys found.
6. Select your Service and Root key that is configured for BYOK or KYOK.
7. Click Update to complete the integration of your keys with your Schematics resource deployment.
8. Click Launch icon to view your enabled keys in the Resource list.







 Enabling IBM Key Protect through CLI 

Follow the steps to integrate root keys with Schematics to encrypt the data through command-line.



1. [Download and install command-line](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. List all the KMS instance in your IBM Cloud account to find your Key Protect or Hyper Protect Crypto Services instances.

ibmcloud schematics kms instance ls --location LOCATION_NAME --scheme ENCRYPTION_SCHEME
3. Integrate the root key with Schematics to encrypt your data in the specified location.
However, you might want to play hold music if your assistant needs time to perform processing of some kind, such as calling a client-side action or making a call to a webhook.

The phone integration supports the following properties for the audio response type:



 Property Description 

 source The URL of a publicly-accessible .wav audio file. The audio file must be single channel (mono) and PCM-encoded, and must have an 8,000 Hz sampling rate with 16 bits per sample. 
 channel_options.voice_telephony.loop Whether to repeatedly restart the audio playback after it finishes. The default value is false. 



If you set channel_options.voice_telephony.loop to true, add a user-defined response with the vgwActForceNoInputTurn command. This command instructs the phone integration to initiate a turn with a vgwNoInputTurn text without waiting for an input from the caller. In the vgwNoInputTurn turn you can initiate a transaction while the caller is on hold. When the vgwNoInputTurn turn completes, the looped audio stops.

The following example shows an audio response with loop=true, and a user_defined response specifying the vgwActForceNoInputTurn command.

{
"output": {
"generic": [
{
"user_defined": {
"vgwAction": {
"command": "vgwActForceNoInputTurn"
}
},
"response_type": "user_defined"
},
{
"source": "https://upload.wikimedia.org/wikipedia/commons/d/d8/Random_composition3.wav",
"response_type": "audio",
"channel_options": {
"voice_telephony": {
"loop": true
}
}
}
]
}
}
Show more





 Enabling keypad entry 

If you want customers to be able to send information by typing it on their phone keypad instead of speaking, you can add support for phone keypad entry.