vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To fix this issue, ask your host to allowlist all of the CIS IP ranges, listed [here](https://cloud.ibm.com/docs/cis?topic=cis-cis-allowlisted-ip-addresses).

All of these IPs must be allowlisted to avoid 522 errors. It's also worth checking to see if any IPs in these ranges are blocked.

522 errors can also be caused by network connectivity issues, so confirm that your server and network is generally healthy and not overloaded.

If after taking the above steps you still receive errors, contact IBM CIS support and confirm the following:



* You've allowlisted our IP ranges
* Your server/network is online and generally healthy



If you contact our support team, please provide a Ray ID from a recent 522 error. We can use this to determine which CIS data center you were hitting and run further tests.
* What is a proxied record and why do I need them?

Proxied records are records that proxy their traffic through IBM CIS. Only proxied records receive CIS benefits, such as IP masking, where a CIS IP is substituted for your origin IP to protect it:

$ whois 104.28.22.57 | grep OrgName
OrgName: IBM

If you would rather bypass CIS on a domain (we still resolve DNS), then non-proxying the record is a possible solution.
* I got a DNS Validation error: 1004; now what can I do?

For page rules to work, DNS needs to resolve for your zone. As a result, you must have a proxied DNS record for your zone.
* Can I add a CNAME for a root record?

Yes. IBM CIS supports a feature called "CNAME Flattening" which allows our users to add a CNAME as a root record. Our authoritative DNS servers enumerate the CNAME target's records and respond with those records instead of the CNAME itself, effectively hiding the fact that the user configured a CNAME at the root of the domain.
* What is the default health check timeout?

The default health check timeout for the Free Trial and Standard plans is 60 seconds.
--name and --exchange are the mandatory options.

$ ibmcloud dns resource-record-create $DNS_ZONE_ID --type MX --name mail --preference 10 --exchange exchange.example.com
Creating resource record in zone 'example.com:f7f40364-a5e6-48f7-9fc9-387434c579ae' for service instance 'DNS Services-km' ...
OK

ID MX:900750bf-881d-402f-a482-20447f2e64a2
Name mail.example.com
Type MX
Created On 2020-04-10 09:18:08.299278244 +0000 UTC
Modified On 2020-04-10 09:18:08.299278244 +0000 UTC
TTL 900
Data
preference 10
exchange exchange.example.com





 Creating type 'PTR' resource record 

Use ibmcloud dns resource-record-create command with --type PTR option to create a type PTR resource record. --name and --ptrdname are the mandatory options.

$ ibmcloud dns resource-record-create $DNS_ZONE_ID --type PTR --name 192.168.1.100 --ptrdname www.example.com
Creating resource record in zone 'example.com:f7f40364-a5e6-48f7-9fc9-387434c579ae' for service instance 'DNS Services-km' ...
OK

ID PTR:f20cfe91-b936-4bad-a8d1-f7afa4ac32a6
Name 192.168.1.100
Type PTR
Created On 2020-04-10 09:34:49.722454606 +0000 UTC
Modified On 2020-04-10 09:34:49.722454606 +0000 UTC
TTL 900
Data
ptrdname www.example.com





 Creating type 'CNAME' resource record
Any records that cannot be proxied through CIS, and that still use your origin IP, such as FTP, can be secured by creating additional obfuscation. In particular, if you require a record for your origin that cannot be proxied by CIS, use a non-standard name. For example, instead of ftp.example.com use [random word or-random characters].example.com. This obfuscation makes dictionary scans of your DNS records less likely to expose your origin IP addresses.





 Use separate IP ranges for HTTP and non-HTTP traffic if possible 

Some customers use separate IP ranges for HTTP and non-HTTP traffic, thereby allowing them to proxy all records pointing to their HTTP IP range, and to obscure all non-HTTP traffic with a different IP subnet.







 Best practice 2: Configure your security level selectively 

Your Security Level establishes the sensitivity of our IP Reputation Database. To prevent negative interactions or false positives, configure your Security Level by domain to heighten security where necessary, and to decrease it where appropriate.



 Increase the security level for sensitive areas to 'High' 

You can increase this setting from the Advanced Security page for your domain or by adding a Page Rule for administration pages or login pages, to reduce brute-force attempts:



1. Create a Page Rule with the URL pattern of your API (for example, www.example.com/wp-login).
2. Identify the Security Level setting.
3. Mark the setting as High.
4. Select Provision Resource.







 Decrease the security level for non-sensitive paths or APIs to reduce false positives 

This setting can be decreased for general pages and API traffic:



1. Create a Page Rule with the URL pattern of your API (for example, www.example.com/api/).
2. Identify the Security Level setting.
3. Turn Security Level to Low or Essentially off.
4. Select Provision Resource.







 What do security level settings mean? 

Our security level settings are aligned with threat scores that certain IP addresses acquire from malicious behavior on our network. A threat score above 10 is considered high.
Why is my domain still in Moved status? 

  What’s happening 

You have a domain that should be Active, but is still in the Moved status.

  Why it’s happening 

CIS becomes the authoritative DNS provider for your domain when your domain points to CIS nameservers. During the setup process CIS detects the nameservers and activates the domain.



*  If the nameservers no longer point to CIS, the system automatically mark your domain as Moved after 7 days. An email to inform you of this status change is sent to the email address on file. A domain in Moved status remains in the system for an additional 7 days before it is permanently deleted.
*  Conflicting NS records can cause a domain to change to Moved status.



  How to fix it 

To resolve the condition where your domain remains in Moved status longer than expected, take the following troubleshooting steps.



*  Check your DNS registrar and ensure that the NS records match with the NS records given by CIS.



*  Find the NS records in the CIS name servers section of the DNS tab in the Reliability page. For more information, see [Step 4. Configure your name servers with the registrar or existing DNS provider](https://cloud.ibm.com/docs/cis?topic=cis-getting-startedconfigure-your-name-servers-with-the-registrar-or-existing-dns-provider).



*  Run the activation check API again. You can use the [API endpoint](https://cloud.ibm.com/apidocs/ciszone-activation-check) first to initiate the recheck.



*  As long as the NS values for the domain are pointed in the correct direction by a dig, and the reactivation check is done by using the API, the domain should go from Moved status to Active.



*  Remove and replace any previous NS records with the CIS-provided records in your DNS registrar.



If the domain is still stuck in a Moved status after taking these steps, [open a Support](https://cloud.ibm.com/docs/cis?topic=cis-gettinghelp) case with details about which steps you took.
You must re-import the certificate with a different CRN, and then update the VPN server with the new certificate CRN.
* Can I use a customized hostname for the VPN server?

Yes, you can. You must create a CNAME DNS record and point it to the VPN server hostname in your DNS provider. After that, edit the client profile by replacing direct remote 445df6c234345.us-south.vpn-server.appdomain.cloud with remote your-customized-hostname.com.

445df6c234345.us-south.vpn-server.appdomain.cloud is an example VPN server hostname.

If you are using [IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-getting-started) as your DNS provider, refer to [CNAME Type record](https://cloud.ibm.com/docs/cis?topic=cis-set-up-your-dns-for-ciscname-type-record) for information about how to add a CNAME DNS record.
* What information should I provide in an IBM Support case if I need help?

Supply the following content in your [IBM Support case](https://cloud.ibm.com/docs/get-support?topic=get-support-open-case):



1. Your VPN server ID.
2. Your VPN client and operating system version.
3. The logs from your VPN client.
4. The time range when you encountered the problem.
5. If user-ID-based authentication is used, supply the username.
6. If certificate-based authentication is used, supply the common name of your client certificate.

To view the common name of your client certificate, use the OpenSSL command openssl x509 -noout -text -in your_client_certificate_file in the subject section.



* How do I assign the VPN client role using IAM access management tags in the API?
* UI
* CLI
* API







 Managing DNS records 

DNS records make the connection between human-readable names and IP addresses. We cover how to manage DNS records in the following sections.



 Using the IBM Cloud console 

Manage DNS records from the IBM Cloud® console, or the API. The following sections cover the console usage.



 Adding DNS records 



1. From the DNS zones table, click the zone name to which you want to add record(s). More details about the selected zone appear.
2. Click Add Record to display a panel where you can create a record.



You can use the Type menu to select the type of record that you want to create. Each DNS record type has a Name and Time-To-Live (TTL) associated with it.

When you enter a name in the Name field, a domain name is automatically appended if you did not add one manually. For example, if you type www or www.example.com in the Name field, the API handles both entries as www.example.com. If you enter the exact domain name into the name field, then it won't append to itself (for example, example.com is handled as example.com). However, the list of DNS records shows only the names, without the domain name added on. As a result, www.example.com displays as www and example.com as example.com.

The minimum supported TTL value is 1 min and the maximum is 12 hours. The default value of TTL is 15 min, but users can change it.



 A type record 

To add this record type, valid values must exist in the Name and IPv4 Address fields. Specify a TTL value from the list menu, with a default value of 15 min.

Required fields



* Name
* IPv4 Address
* TTL (Default value is 15 min)







 AAAA type record 

To add this record type, valid values must exist in the Name and IPv6 Address fields. Specify a TTL value from the list menu, with a default value of 15 min.

Required fields



* Name
* IPv6 Address
You can define subdomains within the zone later.
4. Click Create zone.
5. If the zone creation is successful, you are directed to the zone details page.







 Step 3: Add DNS resource records 



1. Select the zone from the table on the DNS Zones page.
2. Select the DNS records tab.
3. Click Add record.
4. In the panel that appears, select the type of DNS record you are adding from the Type menu.
5. Input the required data for the type of DNS record selected.
6. Click Add record.







 Step 4: Add a VPC as a permitted network to the DNS zone 



1. Select the zone from the table on the DNS Zones page.
2. Select the Permitted networks tab.
3. Click Add network.
4. Select the region from the Region drop-down menu to see the list of networks in that region.
5. Select the network from the list and click Add network.



Resources in the VPC can resolve records associated with the DNS zone (see [Step 3](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-getting-startedstep-3-add-dns-resource-records) to add records to the DNS zone). The DHCP server returns the DNS servers (161.26.0.7 and 161.26.0.8) provided by DNS Services in its responses. If you have DHCP disabled on a server in the VPC, it is your responsibility to configure the DNS server IP addresses statically on that server, according to your operating system's documentation.





 Step 5: Verify that DNS name resolution works from the VPC 

Test whether the zone resolution works using a dig from the virtal server instance on your VPC. The following command should yield a resolution as the result.

dig www.example.com





 Next Steps 

Follow the steps in these detailed guides to use the API for:
Managing DNS zone records 

After [adding a DNS zone](https://cloud.ibm.com/docs/dns?topic=dns-manage-dns-zonesadd-a-dns-zone), records can be added to the zone at any time.

To get to the DNS Edit Zone page:



1. From your browser, open the [IBM Cloud® console](https://cloud.ibm.com/) and log in to your account.
2. Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg), then click Classic Infrastructure.
3. From the Classic Infrastructure menu, select Network > DNS > Forward Zones to open the DNS Forward Zones page.
4. Click on the DNS zone to open the DNS Edit Zone page.





 Add a DNS zone record 

The type of records that can be added to a DNS zone include:



* A (Host) Records
* AAAA (Host) Records
* CNAME (Alias) Records
* MX (Mail Exchange) Records
* TXT (Text) Records
* SRV (Service) Records



To add a record to a DNS Zone from the DNS Edit Zone page, select the resource type from the Resource Type list, complete the requested fields, and click the Add Record button. Refer to the following table for information on which fields are required for the record type.

MX

TXT



Table 1. Fields required for A, AAAA, or CNAME records
Use the buttons before the table to change the context of the table. The column headers identify the fields required and their description.

 Field Description 

 Host Enter the hostname. 
 Points To Enter the IP address to which the host record points. 
 TTL Select the Time to Live (TTL) from the list menu. TTL defaults to 15 minutes. 







 Edit a DNS zone record
* After migration, open a support ticket to ensure that IBM Cloud decouples the NFS storage from the original instance. Then, the storage is not cancelled when the original instance is deleted.







 Can I reuse my existing Active Directory in the new vCenter Server instance? 

Most customers do not use the AD/DNS servers that are deployed with vCenter Server, but instead added their own domain controllers as an extra identity source to vCenter Server and NSX® Manager.

You can preserve the existing Active Directory™ (AD) controllers for ongoing use if you are aware of the following information:



* The new instance deploys new domain controllers that it must use for DNS and authenticating the IBM automation users.
* If you are using virtual machines (VMs), the domain controllers from the old instance can be migrated to the new instance. If you are using VSIs, the domain controllers from the old instance can be used by the new instance. If the new instance is deployed with a different root domain than the original instance, the domain controllers can be added as an identity source to vCenter Server and NSX Manager. So, if the old instance domain is example.cloud.local, the new instance can be named example.cloud2.local. The original AD can be configured to delegate DNS for this domain to the new AD, and users can log in using their existing user@example.cloud.local identities to access resource hostnames like instance1-vc.example.cloud2.local.
* If the original AD is deployed as a VSI, open a support ticket to ensure that IBM Support decouples the VSI from the original instance. This action ensures that the VSI is not cancelled when the original instance is deleted.
* In all cases, it is advised to back up the original controllers before you remove the original vCenter Server instance.







 Can I use vMotion with vSphere Encryption between the two vCenter Server instances? 

With VMware vSphere® encryption, it is possible to perform an advanced cross vCenter vMotion on vSphere–encryption–protected VMs. You need to upgrade the source vCenter to v7.0 and connect both vCenters to the same Key Management System (KMS) and assign it the same name.
Confirm your origin web server IP addresses with your hosting provider
2. Log in to your CIS account
3. Update the A records in the CIS DNS to the IP address confirmed by your hosting provider









 Error 1003 Access Denied: Direct IP Access Not Allowed 

The most common cause of 1003 errors is when a client or browser directly accesses a CIS IP address.



 Resolution 

Browse to the website domain name in your URL instead of the CIS IP address.







 Error 1004: Host Not Configured to Serve Web Traffic 

Common causes of 1004 errors are:



* CIS staff disabled proxying for the domain due to abuse or terms of service violations.
* DNS changes have not yet propagated or the site owner’s DNS A records point to CIS IP addresses.





 Resolution 

If the issue persists beyond 5 minutes, contact CIS support.







 Errors 1006, 1007, 1008 or 1106 Access Denied: Your IP address has been banned 

Common causes for errors 1006, 1007, and 1008 errors are:



* A CIS customer blocked traffic from your client or browser.
* Error 1006 also occurs in the CIS Edge Functions under the Preview tab when a customer uses Zone Lockdown or any other CIS security feature to block the Google Cloud Platform IPs that the Preview tab relies upon.





 Resolution 

Request the website owner to investigate their CIS security settings or allow your client IP address. Because the website owner blocked your request, CIS support cannot override a customer’s security settings.







 Errors 1009 Access Denied: Country or region banned 

A common cause of 1009 errors is when the owner of the website (for example, example.com) has banned the country or region your IP address in from accessing the website.



 Resolution 

Ensure your IP address is allowed under the IP Access Rules security feature.







 Error 1010: The owner of this website has banned your access based on your browser's signature 

A common cause of 1010 errors is when a website owner blocks your request based on your client's web browser.



 Resolution 

Notify the website owner of the blocking. If you cannot determine how to contact the website owner, lookup contact information for the domain via the Whois database.
Set up your DNS records (optional).
4. Configure your DNS information with the name servers provided.
5. Continue getting started with CIS by following a tutorial, or by setting up other features.





 Step 1: Open the IBM CIS application 

Open the [IBM Cloud catalog](https://cloud.ibm.com/catalog). Then, select the Networking category in the navigation pane. Click the Internet Services tile to open the IBM Cloud Internet Services application.



 The Overview screen 

After the CIS application starts up, you'll see the CIS Overview screen, and you'll find the tabs for Security, Reliability, and Performance.





 Which plan do I choose? 

There are several plans to choose from:



* Enterprise Usage
* Enterprise Package
* Enterprise GLB
* Enterprise Security
* Standard (Deprecated as of 30 April 2023)
* Standard Next (Replaces deprecated Standard plan)
* No-cost Trial



The No-cost Trial expires after 30 days, at which point you can upgrade to a plan that best suits your needs. A single Standard or Standard Next instance can manage one domain. You can create as many Standard or Standard Next service instances as you want within a single account, each managing a single domain. The Enterprise Plans allow you to manage multiple domains in a single service instance.

Before creating a Standard plan, remember that this plan is deprecated and will eventually reach end-of-support.

Select Create on the Overview screen to begin provisioning your account.

The No-cost Trial is limited to one instance per account.





 Begin provisioning 

You'll see the first screen of the CIS application, where you select Add Domain to begin.

Select Let's get started from the welcome page to begin setting up CIS.







 Step 2. Add and configure your domain 

Next, begin protecting and improving the performance of your web service by entering your domain or a subdomain.

Specify DNS zones. You can configure the name servers for these domains or subdomains at the domain's registrar or DNS provider. Do not use CNAMEs.
To add a new record, select Add Zone, complete the fields and select Add.
5. To remove a Secondary DNS record, or convert it to a primary record, use the Actions list menu on the right of the page and choose the appropriate option.







 Reverse records 

To manage reverse records:



1. From your browser, open the [IBM Cloud® console](https://cloud.ibm.com/) and log in to your account.
2. From the dashboard, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/86dadb3996e7fa2b119c2c09bda56dbc01297416/icons/icon_hamburger.svg) and select Classic Infrastructure to get to the Classic Infrastructure landing page.
3. In the Classic Infrastructure navigation, select Network > DNS > Reverse Records.
4. In the list menu, either select or type the IP address for which you wish to change reverse DNS, then select View IP
5. To add the record, enter the Hostname you want to use for the reverse DNS entry.
6. Set the TTL (Time to Live) for the record.
7. After you are certain of the information, select Save.



You can modify an entire subnet by clicking Edit RDNS for all IPs in this Subnet on the right of the page.



1. From this page, select the line for the IP you want to update.
2. Enter the information into the fields, and then select Update. The "notes" field is optional.
The following properties are necessary when creating a SoftLayer_Dns_Domain object.



* name: Domain name including the TDL
* resourceRecords: An array of at least one SoftLayer_Dns_Domain_ResourceRecord



$client = SoftLayer_SoapClient::getClient('SoftLayer_Dns_Domain', null, $apiUser, $apiKey);
$template = new stdClass();
$template->name = "createexample.com";
$template->resourceRecords = array();
$template->resourceRecords[0] = new stdClass();
$template->resourceRecords[0]->data = '127.0.0.1';
$template->resourceRecords[0]->host = 'server1';
$template->resourceRecords[0]->type = 'a';
$result = $client->createObject($template);
print_r($result);

SoftLayer_Dns_Domain::createObject Returns a fully populated SoftLayer_Dns_Domain object.





 Edit domains 

Modifying existing SoftLayer_Dns_Domain entries is not possible. Changes to zone names should be refactored to creation of new zones.





 Delete domains 

Removal of a zone is accomplished with SoftLayer_Dns_Domain::deleteObject. This method requires only an init parameter to be provided.

$domainId = 1545925;
 
$client = SoftLayer_SoapClient::getClient('SoftLayer_Dns_Domain', $domainId, $apiUser, $apiKey);
 
$result = $client->deleteObject();
print_r($result);

SoftLayer_Dns_Domain::deleteObject Returns a Boolean value: true for successful, false for failed.







 Records 



 List records