vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Learn more](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-standalone-vpn-clients).
3. Configure a standalone SSL VPN client and open a connection:



For example, if you use the MotionPro Plus client for MacOS, to add a profile, click Add.

In the Basic section, enter a Title. Enter a Gateway, for example, for a bare metal in Dallas 10, enter vpn.dal10.softlayer.com. Enter your VPN user name. Check that the Port is set to 443. Then, click OK.

To open a secure connection, click Login.
3. Connect to a bare metal server by using SSH

You might require a VPN to access your system depending on your security setup and ssh configuration on the bare metal host.

You must ssh to the host by using your credentials, or the root credentials that are available from the IBM Cloud Console.

You will require root permissions in order to install the monitoring agent.

For example, you can complete the following steps to get the bare metal server information that you need to ssh into the server:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).
2. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/icon_hamburger.svg) > Classic Infrastructure > Device List.
3. Identify the bare metal server that you want to monitor. Copy the Public IP.
4. Click the bare metal server device name.
5. Select Passwords. Copy the password for the root user.

Then, from a terminal, run the following command:

ssh <USER_ID>@<IP_ADDRESS>

Where:
* [Step 3: Target the Hyper Protect Crypto Services private endpoint for the TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectiontarget-tke-private-endpoint)
* [Step 4: Initialize the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectionsecure-connection-key-ceremony)
* [Step 5: Target the Hyper Protect Crypto Services private endpoint for key management service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectiontarget-internal-endpoint)
* [Step 6: Test your private network connection](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectionTest-private-connection)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-secure-connectionsecure-connection-next)



[Auditing events for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-events)



* [Historical information regarding events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventshistorical-mapping-events)
* [Supported events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-supported-events)
* [Key Ring events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventskeyring-actions)
* [Viewing events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-eventsat-ui)
When this happens, you have to manually add an endpoints object and link it to the service.





 How can I expose my services on the Internet? 

You can create three types of services for external networking: NodePort, LoadBalancer, and Ingress.

You have different options that depend on your cluster type. For more information, see [Planning networking services](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningexternal).



* Standard cluster: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningexternal).
* Cluster that is made private by using Calico: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningprivate_both_vlans). You also must use a Calico preDNAT network policy to block the public node ports.
* Private VLAN-only standard cluster: You can expose your app by using a [NodePort, load balancer, or Ingress service](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningplan_private_vlan). You also must open the port for the service's private IP address in your firewall.



As you plan how many Service objects you need in your cluster, keep in mind that Kubernetes uses iptables to handle networking and port forwarding rules. If you run many services in your cluster, such as 5000, performance might be impacted.







 Securing apps 

As you plan and develop your app, consider the following options to maintain a secure image, ensure that sensitive information is encrypted, and control traffic between your app pods and other pods and services in the cluster.

Image security
: To protect your app, you must protect the image and establish checks to ensure the image's integrity.
This option becomes available by selecting TLS or Mutual Auth for your [Resource Authentication](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destdest-resource-auth). The name of the field will match the [type of destination](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destdest-types) you have chosen.

To reject any connection which is not authorized with the list of supplied CAs, check the box Reject unauthorized from the Cloud/On-Premises Authentication panel. Once the box is checked and the resource you are connecting to is using a self-signed certificate, you must upload it, or the connection will be rejected.

It is allows for up to 6 certificates to be uploaded in order to validate the certificate of the resource which you are connecting to. These files will be added to the CA of connection to the resource and should contain the certificate or certificate chain that your resource will be presenting.

The box Reject unauthorized is supported only when using Secure Gateway Client v1.8.4 or later, old Secure Gateway Client will still reject unauthorized even if this box is unchecked.

Uncheck the box Reject unauthorized will leave you vulnerable to Man-in-the-middle attack.





 Server Name Indicator (SNI) 

This option becomes available by selecting TLS or Mutual Auth for your [Resource Authentication](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destdest-resource-auth). It is the name of the host being connected to, and must be a host name, and not an IP address. It can be used to allow a separate hostname to be provided to the TLS handshake of the resource connection, or used by a multi-homed server to choose the correct certificate to present to the client. It is suggested to set this to be same as Resource Hostname.







 Client Certificate and Key
4. Click Next.



6. On the Specify security exit details page, Click Next.
7. On the Specify user identification details page:



1. Select the Enable user identification checkbox.
2. Ensure User identification compatibility mode is NOT selected.
3. In the Userid: field, type the MQ username gathered from User permissions of the MQ on Cloud Service.
4. In the Password field, select the Prompt for password radio button.
5. Click Next.



8. On the Specify SSL certificate key repository details page:



1. Select the Enable SSL key repositories checkbox.
2. Browse and select the key repository created in the prereq steps for both Trusted Certificate Store and Personal Certificate Store.
3. Click Next.



9. On the Specify SSL option details page:



1. Select the Enable SSL options checkbox.
2. In the CipherSpec field, select the value you want, for example ANY_TLS12_OR_HIGHER from the dropdown list.
3. Click Finish.
4. When prompted enter the password.



10. MQ Explorer should now connect to your queue manager for remote administration. All the operations on this queue manager will now run on a secured channel.







 Next step 



* [Connect securely from C MQI & JMS application](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_connect_app_ssl)
In this case, the SG Client will use this certificate/key pair for its outbound connection to the defined resource, the On-prem resource needs to add this certificate to its CA to communicate with the SG Client.

For a cloud destination, it will appear under [User Authentication](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destdest-user-auth) if a TLS protocol has been selected. In this case, the SG Client will use this certificate/key pair to create TLS listeners, the On-prem app needs to add this certificate to its CA to communicate with the SG Client.







 Configuring Network Security 

To prevent all but specific IP addresses from connecting to your cloud hosts and ports, you can choose to enforce iptables rules on your on-premises destination. ![Network Security Panel](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/networkSecurity.png?raw=true)

To enforce iptables rules, check the box Restrict cloud access to this destination with iptables rules from the Network Security panel. Once the box is checked, you can begin adding the IPs that should be allowed to connect. If no IPs are provided, all connections to this cloud hosts and ports will be rejected as long as the Restrict cloud access box is checked.

Note: The IPs or ports provided must be the external IP address that the Secure Gateway servers will see, not the local IP address of the machine making the request.



 Adding iptables rules 

When adding rules to iptables, you can provide individual IPs or an IP range along with either a single port or a port range. All ranges provided are inclusive. The following table has some examples as well as how they will resolve within iptables:



 IP Addresses Ports Results 

 1.2.3.4 5000 Only IP 1.2.3.4 from port 5000 will be allowed.
For more information, see [Obtaining the Key Protect endpoint](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-endpoint). 
 IBM Cloud Identity and Access Management endpoint The endpoint of IAM, which is https://iam.cloud.ibm.com. 
 Service instance ID on IBM Cloud The unique identifier that is assigned to your Key Protect service instance. For more information, see [Retrieving your instance ID and cloud resource name](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 Service ID API key A unique code that is passed to an API to identify the calling application. For more information, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys). 



6. Optionally, click Test connection to test the connection to the external keystore that you configure. When completed, click Next to continue.

Test connection is an optional step. You can complete the subsequent steps even if the test fails. To adjust the connection settings in case of a connection failure, check and adjust the connection properties.
7. Under Summary, view the summary of your Key Protect instance and the total estimated cost.
8. After you confirm the keystore details, click Connect to keystore to connect to the keystore.







 Step 3: Manage Key Protect keys through Unified Key Orchestrator 

Now you can use Unified Key Orchestrator to create and activate keys for Key Protect on Satellite to use. With the Keep Your Own Key (KYOK) feature, these keys are protected by master key within the FIPS 140-2 Level 4 HSM boundary and IBM cannot access your keys with technical assurance.



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Managed keys from the navigation and click Create key.
3. Under Vault, select a vault for the key for access control, and click Next.
2. Select the App ID service as your source service.
3. Select Key Protect as your target service.
4. Switch to Resources based on selected attributes, check Instance ID, select the Key Protect service instance created earlier.
5. Assign the Reader role under Service access.
6. Click Authorize to confirm the delegated authorization.



Now, Create an instance of the App ID service.



1. Navigate to the [App ID](https://cloud.ibm.com/catalog/services/AppID) service creation page.



1. Use the same location used for the previous services.
2. Select the Graduated tier as plan.
3. Set the Service name to secure-file-storage-appid.
4. Select a resource group same as the previous services.
5. Select the authorized Key Protect service name and the root key from the respective dropdowns.
6. Click Create.



2. Under Manage Authentication, in the Authentication Settings tab, add a web redirect URL pointing to the domain you will use for the application. The URL format is https://secure-file-storage.<Ingress subdomain>/oauth2-secure-file-storage-appid/callback. For example:



* with the ingress subdomain: mycluster-1234-d123456789.us-south.containers.appdomain.cloud
* the redirect URL is https://secure-file-storage.mycluster-1234-d123456789.us-south.containers.appdomain.cloud/oauth2-secure-file-storage-appid/callback.



App ID requires the web redirect URL to be https. You can view your Ingress subdomain in the cluster dashboard or with ibmcloud ks cluster get --cluster <cluster-name>.
3. In the same tab under Authentication Settings under Runtime Activity enable capturing events in Activity Tracker.
You can get the SIP URI for your phone integration from the phone integration configuration page.
6. If you plan to support call transfers, enable Call Transfer (SIP REFER) in your SIP trunk. If you expect to transfer calls to the public switched telephone network (PSTN), also enable PSTN Transfer on your trunk.
7. Select Numbers from the navigation bar for your SIP trunk, and then do one of the following things:



* Click Buy a Number.
* If you already have a number, you can click the plus sign (+) to provision a new phone number in your region.



8. Assign the number to the SIP trunk you created by going back to the SIP trunk and clicking the number sign (#) icon.



If you use a Lite or Trial Twilio account for testing purposes, then be sure to verify the transfer target.

You cannot enable SIP authentication if you choose Twilio as your SIP trunk provider. Twilio doesn't support SIPS for originating calls.





 Using other third-party providers 

You can ask for help setting up an account with another SIP trunk provider by opening a support request.

IBM has established relationships with the following SIP trunk providers:



* [Five9](https://www.five9.com/products/capabilities/contact-center-software)
* [Genesys](https://www.genesys.com/en-sg/definitions/what-is-a-trunk)
* [Vonage](https://www.vonage.com/communications-apis/sip-trunking/)
* [Voximplant](https://voximplant.com/)



The SIP trunk provider sets up a SIP trunk for your voice traffic, and manages access from allowed IP addresses. Most of the major SIP trunk providers have existing relationships with IBM. Therefore, the network configuration that is required to support the SIP trunk connection typically can be handled for you with minimal effort.



1. Create a [IBM Cloud case](https://cloud.ibm.com/unifiedsupport/cases/form).
2. Click Customer success as the case type.
3.
Please see [Configuring Mutual Authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-mutual-auth) and [Node.js TLS Mutual Authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-nodejs-tls-manodejs-tls-ma) for more information.





 Set IP Table Rules (For on-premises destination) 

The Secure Gateway cloud host and port of an on-premises destination is in the public space; therefore it is allowed everyone to access by default. To control the traffic accessing on Secure Gateway, set iptables rules to only allow access by a specific range of IPs and ports to secure on-premises resources. Please see [IP Table Rules](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-network-security) for more information about how to configure the iptables rules on Secure Gateway.





 Configure Access Control List (For on-premises destination) 

Configure Access Control List support to allow or restrict access to on-premises resources would make the on-premises destinations more secure by specifying the access right on the specific destination host and port. It is recommended to define the allowed or restricted HTTP/S routes on the ACL entries as well to enhance the security of on-premises destination. Please see [Access Control List](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-aclacl) and [HTTP/S Route Control using the ACL](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-aclacl-route-control) for more information.





 Set password on the Secure Gateway Client UI 

It is recommended to set the UI password to restrict the access of the Secure Gateway Client UI.
2. [Retrieve the key ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys) of the root key that is associated with the DEK.
3. Make an [unwrap request](https://cloud.ibm.com/apidocs/key-protectinvoke-an-action-on-a-key) to Key Protect. Note that if you specified additional authenticated data (AAD) in a previous wrap request, you must supply it in your unwrap request.
4. Use the returned base64 encoded plaintext to decrypt the data protected under the DEK.







 Integrating with IBM Cloud Services 

IBM® Key Protect for IBM Cloud® integrates with a number of IBM Cloud services to enable encryption with customer-managed keys for those services.

Associating a resource in your cloud data service with a root key in Key Protect allows your data to be protected at rest while having management control of the root key.

For more information on the services that offer integration with Key Protect, see [Integrating Services](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services).
Setting up classic VPN connectivity 

This VPN information is specific to classic clusters. For VPN information for VPC clusters, see [Setting up VPC VPN connectivity](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-vpnaas).

With VPN connectivity, you can securely connect apps in a Red Hat OpenShift cluster on Red Hat® OpenShift® on IBM Cloud® to an on-premises network. You can also connect apps that are external to your cluster to an app that runs inside your cluster.

To connect your worker nodes and apps to an on-premises data center, you can configure one of the following options.



* strongSwan IPSec VPN Service: You can set up a [strongSwan IPSec VPN service](https://www.strongswan.org/about.html) that securely connects your Red Hat OpenShift cluster with an on-premises network. The strongSwan IPSec VPN service provides a secure end-to-end communication channel over the internet that is based on the industry-standard Internet Protocol Security (IPSec) protocol suite. To set up a secure connection between your cluster and an on-premises network, [configure and deploy the strongSwan IPSec VPN service](https://cloud.ibm.com/docs/openshift?topic=openshift-vpnvpn-setup) directly in a pod in your cluster.
* IBM Cloud® Direct Link: [IBM Cloud Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about) allows you to create a direct, private connection between your remote network environments and Red Hat OpenShift on IBM Cloud without routing over the public internet. The IBM Cloud Direct Link offerings are useful when you must implement hybrid workloads, cross-provider workloads, large or frequent data transfers, or private workloads.
e.g., ssh -o ProxyCommand="ssh -W %h:%p root@<BASTION_FLOATING_IP_ADDRESS" root@<PRIVATE_IP_ADDRESS>







 Install software and perform maintenance tasks 

Once connected, you can install software on the virtual server or perform maintenance tasks.



1. First, update the software package information:

apt-get update
2. Install the desired software, e.g., Nginx or MySQL or IBM Db2.



When done, disconnect from the server with exit command.

To allow HTTP/HTTPS requests from the internet user, assign a floating IP to the VSI and open required ports (80 - HTTP and 443 - HTTPS) via the inbound rules in the security group of private VSI.





 Disable the maintenance security group 

Once you're done installing software or performing maintenance, you should remove the virtual servers from the maintenance security group to keep them isolated.



1. Navigate to Security groups and select vpc-secure-maintenance-sg security group.
2. Click Attached interfaces, then Edit interfaces.
3. Expand the virtual server instances and uncheck the selection in the Interfaces column for vpc-secure-private-vsi.
4. Click Save for the changes to be applied.









 Step 4: Remove resources 



1. Switch to Virtual server instances, Stop and Delete your instances by clicking the respective action menu.
2. Once the VSIs are gone, switch to Subnets and delete your subnets.
3. After the subnets have been deleted, switch to the VPCs tab and delete your VPC.



When using the console, you may need to refresh your browser to see updated status information after deleting a resource.





 Related content 



* [Public frontend and private backend in a Virtual Private Cloud](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-public-app-private-backendvpc-public-app-private-backend)
If you need a different configuration or predictable performance, you must opt for the configuration that is described in [Site-to-site VPN connectivity](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-vpn-connectivity) with redundant VPN connections.



* [Connecting to a Juniper vSRX peer](https://cloud.ibm.com/docs/vpc?topic=vpc-juniper-vsrx-config)
* [Connecting to a strongSwan peer](https://cloud.ibm.com/docs/vpc?topic=vpc-strongswan-config)
* [Connecting to a IBM Cloud VPC VPN Gateway peer](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-overview)







 Checking the status of the secure connection 

You can test the connection by doing a ping from a virtual server instance to a server in the on-premises network.







 Creating IKE and IPsec policies 

Before you create a VPN connection, you must set the IKE and IPsec policies. IBM provides default IKE and IPsec policies. You can also create custom policies based on your requirements.



 Adding a VPN IKE policy to a VPN connection 

You can use the default or custom IKE policies to define security parameters that will be used during Phase 1 of IKE negotiation. In this phase, credentials and security policies are exchanged between the VPN and peer device to authenticate with each other and to establish a secure communication channel that will be used for Phase 2 of IKE negotiation.

To create an IKE policy, complete the following steps:



1. Go to the Power Systems Virtual Server user interface and click VPN connections.
2. In the VPN connections page, click IKE policies to open the IKE policies tab.
3. Click Create policy.
4. In the New IKE policy page, enter the following details:



* Name: Specify a name for the IKE policy, such as 'powervs-vpn-ike1'. The maximum number of characters for the name is 47 characters.
* IKE version: Select the IKE version.