vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: Depending on the service that you select, you can monitor how a rule affects access without enforcing it. With report-only mode, all attempts to access resources in the account are logged in Activity Tracker. If available, monitoring is recommended for 30 days before you enforce a rule.

Report-only mode is not available for all services, so review each service's documentation to learn about how they integrate with context-based restrictions.

You can monitor the impact of your enabled and report-only rules. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).





 Defining the scope of a rule 

Define the APIs that you want to protect to narrow the scope of a rule's restrictions. This way, you can specify granular protections for different APIs that have distinct access requirements.

For example, you might create a rule that targets a data plane API so that it is only accessible from a Kubernetes cluster, or wherever your compute infrastructure exists. Then, you can create a rule that targets your control plane API that interacts with the cloud console so that it is only accessible from behind your organization's VPN.

Only some services support the ability to scope a rule by API.

With some services, you can restrict the actions of all APIs on your resources by default, which includes all current and future APIs that the service might support. Or, select specific APIs. For example, [Kubernetes](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=uicbr-overview) has custom service APIs that you can restrict access to based on the context of the request. Review each service's documentation to learn more about how they integrate with context-based restrictions.

You can also skip APIs to restrict all operations on the service that you select.







 Contexts 

Contexts define where your resource can be accessed. A context is made up of the allowed endpoint types and network zones that you configure.



* If a context includes network zones, then access is granted only when the request is created from within one of those zones.
Manipulate how firewall rules perform using the following firewall-rules commands:



 ibmcloud cis firewall-rules 

Retrieve a list of currently existing firewall-rules for a given DNS domain.

ibmcloud cis firewall-rules DNS_DOMAIN_ID [--page PAGE] [--per-page PER_PAGE] [-i, --instance INSTANCE] [ ! ! ! ! ! ! --output FORMAT
<-- <section "id="section-list-firewall-rules-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--page: Page number of paginated results. The default value is 1.--per-page: Number of firewall rules per page. The minimum value is 5 and the maximum value is 100. The default value is 25.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-list-firewall-rules-options" "> --><-- <section "id="section-list-firewall-rules-examples" "> --> Examples List existing firewall-rules in domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis firewall-rules 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"
<-- </section "id="section-list-firewall-rules-examples" "> --><-- </section "id="section-list-firewall-rules" "> --><-- <section "id="section-show-a-firewall-rule" "> --> ibmcloud cis firewall-rule Retrieve a specific firewall-rule for a given DNS domain.
set firewall filter PROTECT-IN term IPSec-IKE from protocol udp
set firewall filter PROTECT-IN term IPSec-IKE from port 500
set firewall filter PROTECT-IN term IPSec-IKE then accept
set firewall filter PROTECT-IN term IPSec-ESP from source-address <VPN for VPC Gateway Small Public IP>/32
set firewall filter PROTECT-IN term IPSec-ESP from protocol esp
set firewall filter PROTECT-IN term IPSec-ESP then accept
set firewall filter PROTECT-IN term IPSec-4500 from source-address <VPN for VPC Gateway Small Public IP>/32
set firewall filter PROTECT-IN term IPSec-4500 from protocol udp
set firewall filter PROTECT-IN term IPSec-4500 from port 4500
set firewall filter PROTECT-IN term IPSec-4500 then accept
7. Configure a data plane firewall to allow traffic between on-prem and IBM VPC for a route-based VPN:

set security zones security-zone vpn-zone interfaces st0.2
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match source-address any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match destination-address any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match application any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn then permit
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match source-address any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match destination-address any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match application any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private then permit
8.
set security policies from-zone CUSTOMER-PRIVATE to-zone CUSTOMER-PUBLIC policy ALLOW_ICMP match source-address any destination-address any application junos-icmp

set security policies from-zone CUSTOMER-PRIVATE to-zone CUSTOMER-PUBLIC policy ALLOW_ICMP then permit



These are some of the attributes that can be defined in your policies:



* Source addresses
* Destination addresses
* Applications
* Action (permit/deny/reject/count/log)



Since this is a stateful operation, there is no need to allow return packets (in this case, the echo replies).

Use the following commands to allow traffic that is directed to the vSRX:

Standalone case:

set security zones security-zone CUSTOMER-PRIVATE interfaces ge-0/0/0.0 host-inbound-traffic system-services all

HA case:

set security zones security-zone CUSTOMER-PRIVATE interfaces reth2.0 host-inbound-traffic system-services all

To allow protocols, such as OSPF or BGP, use the following command:

Standalone case:

set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic protocols all

HA case:

set security zones security-zone trust interfaces reth2.0 host-inbound-traffic protocols all





 Firewall filters 

By default the IBM Cloud® Juniper vSRX allows ping, SSH, and HTTPS to itself and drops all other traffic by applying the PROTECT-IN filter to the lo interface.

To configure a new stateless firewall, follow these steps:



1. Create the firewall filter and term (the following filter allows only ICMP and drops all other traffic):

set firewall filter ALLOW-PING term ICMP from protocol icmp
set firewall filter ALLOW-PING term ICMP then accept
2. Apply the filter rule to the interface (the following command applies the filter to all private network traffic):

set interfaces ge-0/0/0 unit 0 family inet filter input ALLOW-PING
Assign firewalls to control traffic to and from the Internet.

set security zone-policy zone APP to OUTSIDE firewall APP-TO-OUTSIDE
set security zone-policy zone OUTSIDE to APP firewall OUTSIDE-TO-APP
commit
3. Validate the VSI in the APP zone can now access services on the Internet. Login to the local VSI using SSH:

ssh root@<VSI Private IP>

use ping and curl to validate icmp and tcp access to sites on the Internet:

ping 8.8.8.8
curl www.google.com







 Step 5: Remove resources 

Steps to take to remove the resources created in this tutorial.

The VRA is on a monthly paid plan. Cancellation does not result in a refund. It is suggested to only cancel if this VRA will not be required again in the next month. If a dual VRA High-Availability cluster is required, this single VRA can be upgraded on the [Gateway Details](https://cloud.ibm.com/classic/network/gatewayappliances) page.



1. Cancel any virtual servers or bare-metal servers
2. Cancel the VRA
3. [Cancel any VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-cancel-vlan)







 Related content 



* [VRA Network Address Translation](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vranetwork-address-translation-nat-)
* [NAT Masquerade](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-setting-up-nat-rules-on-vyatta-5400one-to-many-nat-rule-masquerade-)
Unlike the firewall rules applied for packets traversing through the VRA, the default action of firewall rules for traffic entering or leaving the control plane is Allow. Users must add explicit drop rules if the default behavior is not desired.

The VRA provides a basic CPP rule set as template. You can merge it into your configuration by running:

vyatta@vrouter merge /opt/vyatta/etc/cpp.conf

After this rule set is merged, a new firewall rule set named CPP is added and applied to the loopback interface. It is recommend that you modify this rule set to suit your environment.

Please note that CPP rules cannot be stateful, and will only apply on ingress traffic.





 Zone firewalling 

Another firewall concept within the IBM Cloud® Virtual Router Appliance is zone based firewalls. In zone-based firewall operation an interface is assigned to a zone (only one zone per interface) and firewall rule sets are assigned to the boundaries between zones with the idea that all interfaces within a zone have the same security level and are allowed to route freely. Traffic is only scrutinized when it is passing from one zone to another. Zones drop any traffic coming into them which is not explicitly allowed.

An interface can either belong to a zone or have a per-interface firewall configuration; an interface cannot do both.

Imagine the following office scenario with three departments, each department with its own VLAN:



* Department A - VLANs 10 and 20 (interface dp0bond1.10 and dp0bond1.20)
* Department B - VLANs 30 and 40 (interface dp0bond1.30 and dp0bond1.40)
* Department C - VLAN 50 (interface dp0bond1.50)



A zone can be created for each department and the interfaces for that department can be added to the zone. The following example illustrates this:

set security zone-policy zone DEPARTMENTA interface dp0bond1.10
set security zone-policy zone DEPARTMENTA interface dp0bond1.20
set security zone-policy zone DEPARTMENTB interface dp0bond1.30
[Deprecated] ibmcloud cis firewall-update FIREWALL_RULE_ID (-t, --type Type) (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) [-d, --domain DNS_DOMAIN_ID] [-i, --instance INSTANCE] [--output FORMAT]



 Command options 



* FIREWALL_RULE_ID: The ID of firewall rule. Required.



-t, --type
: Type of firewall rule to create. Valid values: access-rules, ua-rules, lockdowns. Required.



* access-rules: Access Rules are a way to allow, challenge, or block requests to your website. You can apply access rules to one domain only or all domains in the same service instance.
* ua-rules: Perform access control when matching the exact UserAgent reported by the client. The access control mechanisms can be defined within a rule to help manage traffic from particular clients. This enables you to customize the access to your site.
* lockdowns: Lock access to URLs in this domain to only permitted addresses or address ranges.



-d, --domain
: DNS Domain ID. For ua-rules and lockdowns type rule, it is a required parameter.

--json
: The JSON file or JSON string used to describe a firewall rule. Required.



* For --type access-rules: The JSON data describing a firewall access rule as follows.



* Option fields are mode, notes.



* mode: The type of action to perform. Valid values: block, challenge, whitelist, js_challenge.
* notes: Some useful information about this rule to help identify the purpose of it.







Sample JSON data:

{
"mode": "challenge",
"notes": "This rule is added because of event X that occurred on date xyz",
}



* For --type ua-rules: The JSON data describing a user-agent rule as follows.



* Required fields are mode, configuration.
IP firewall <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * Block is not available to Country filter<br> * 100 Domain lockdown rules<br> * 250 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> 
 Caching Basic caching options Browser cache minimum TTL 30 seconds Browser cache minimum TTL 30 seconds Browser cache minimum TTL 30 seconds Advanced caching options 
 Range No No Yes<br><br><br><br> * 10 unique FQDNs<br> * Overage fees incurred past 5 TB of traffic<br><br><br> Yes<br><br><br><br> * 10 unique FQDNs<br> * Overage fees incurred past 5 TB of traffic<br><br><br> Yes<br><br><br><br> * 10 unique FQDNs<br><br><br>
Regardless of the default setting, you can still permit or deny network traffic by creating prefix filters.
* To create a prefix filter, select Create prefix filter, then complete the following information:



* Select an action type: Permit or Deny.
* Enter the network prefix along with its subnet mask (for example, 10.0.0.0/16).
* Optionally, enter values for whether the network should be greater than or equal to the subnet mask you chose.
* Click Save to add the prefix filter.





Connections are denied or permitted based on the order of the filters in the list. Edit the prefix filter list to adjust the order in which prefixes are processed.
8. On the Add connection page, click Add to finalize the connection using the prefix filters.







 Adding prefix filters to an existing connection 

To add prefix filtering to an existing connection in the UI, follow these steps:



1. From the Transit Gateway page, click the name of the gateway where you want to add prefix filters.
2. The prefix filtering icon ![Prefix filter icon](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/images/prefix-filter-icon.png) shows if a connection already has prefix filters. Click View next to Prefix filters to show the prefix filter list.

To modify an existing prefix filter, click the Actions menu ![Actions menu](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway//images/overflow.png) and select Prefix filtering.
3. If the connection does not have existing prefix filters, click the Actions menu !
All VRAs are assigned random passwords visible only to the account holder. Passwords are easily changed, as are SSH public keys and admin IP access restrictions.
* Can I get VRA without a gateway appliance?

Yes, but it can only manage traffic between the VRA's public and private interfaces. VLANs and HA require the gateway appliance fixture.
* Is all network traffic sent through the VRA?

No. The gateway appliance allows you to select the private and public network segments (VLANs) that you want to route through the VRA. You can change and bypass VLAN selections at any time. VRA also allows you to define IP-based rules that apply to subnets or IP ranges. Such rules function only if the VLANs containing those subnets are routed through the VRA.
* Can a VRA or dedicated firewall prevent new server provisions?

Yes. Whenever possible, you shouldn't lock down your network until you've populated it with the servers you plan to use.

IBM support is forbidden by policy to examine or alter VRA or dedicated firewall configuration without a customer's explicit involvement, so in most cases support cannot know that a VRA is responsible for stalled or failed server provisions.

It is the customer's responsibility to ensure that the VRA or firewall is configured to permit automated server provisions before the server order is placed. Provisions that are blocked by a customer-managed VRA or firewall are the customer's responsibility to resolve. Such provisioning delays are not subject to SLAs or credits. Ordered systems can be returned to inventory (after customer data is expunged) if the customer does not respond quickly.

Likewise, if a VRA or firewall is bypassed after an order is placed, it's still likely that the order will fail. There might be a narrow window during which automation retries are attempted. It is best that the entire provision process proceed without network interference.
* What firewall products does IBM offer?
set security firewall name APP-TO-OUTSIDE rule 100 destination port 443

set security firewall name APP-TO-OUTSIDE rule 200 protocol icmp
set security firewall name APP-TO-OUTSIDE rule 200 icmp type 8
set security firewall name APP-TO-OUTSIDE rule 200 action accept
commit
Show more
2. Create firewall rules OUTSIDE-TO-APP

set security firewall name OUTSIDE-TO-APP default-action drop
set security firewall name OUTSIDE-TO-APP description 'Internet traffic to APP'
set security firewall name OUTSIDE-TO-APP default-log

set security firewall name OUTSIDE-TO-APP rule 100 protocol tcp
set security firewall name OUTSIDE-TO-APP rule 100 action accept
set security firewall name OUTSIDE-TO-APP rule 100 destination port 443

set security firewall name OUTSIDE-TO-APP rule 90 protocol tcp
set security firewall name OUTSIDE-TO-APP rule 90 action accept
set security firewall name OUTSIDE-TO-APP rule 90 destination port 80

set security firewall name OUTSIDE-TO-APP rule 200 protocol icmp
set security firewall name OUTSIDE-TO-APP rule 200 icmp type 8
set security firewall name OUTSIDE-TO-APP rule 200 action accept
commit
Show more







 Step 4: Create Zone and apply rules 



1. Create zone OUTSIDE to control access to the external Internet.

set security zone-policy zone OUTSIDE default-action drop
set security zone-policy zone OUTSIDE interface dp0bond1
set security zone-policy zone OUTSIDE description 'External Internet'
2. Assign firewalls to control traffic to and from the Internet.

set security zone-policy zone APP to OUTSIDE firewall APP-TO-OUTSIDE
set security zone-policy zone OUTSIDE to APP firewall OUTSIDE-TO-APP
commit
3. Validate the VSI in the APP zone can now access services on the Internet. Login to the local VSI using SSH:

ssh root@<VSI Private IP>

use ping and curl to validate icmp and tcp access to sites on the Internet:

ping 8.8.8.8
set firewall filter PROTECT-IN term IPSec-ESP from protocol esp
set firewall filter PROTECT-IN term IPSec-ESP then accept
set firewall filter PROTECT-IN term IPSec-4500 from source-address <VPN for VPC Gateway Public IP>/32
set firewall filter PROTECT-IN term IPSec-4500 from protocol udp
set firewall filter PROTECT-IN term IPSec-4500 from port 4500
set firewall filter PROTECT-IN term IPSec-4500 then accept
6. Configure a data plane firewall to allow traffic between on-premises and IBM VPC.

set security zones security-zone vpn-zone interfaces st0.2
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match source-address any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match destination-address any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn match application any
set security policies from-zone SL-PRIVATE to-zone vpn-zone policy private_to_vpn then permit
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match source-address any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match destination-address any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private match application any
set security policies from-zone vpn-zone to-zone SL-PRIVATE policy vpn_to_private then permit
7. Configure TCP MSS clamping on vSRX to avoid unnecessary fragmentation.

set security flow tcp-mss ipsec-vpn mss 1360
8. After the configuration file finishes running, you can check the connection status from the CLI using the following command:

run show security ipsec security-associations







 Creating a custom IPsec policy for Juniper vSRX
For more information, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

This payload creates a rule that targets the Security and Compliance Center service and allows only private endpoints from the specified network zone to access the service.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT-ID"
},
{
"name": "serviceName",
"value": "compliance"
}
]
}
],
"contexts": [
{
"attributes":
{
"name": "networkZoneId",
"value": "NETWORK-ZONE-ID"
},
{
"name": "endpointType",
"value": "private"
}
]
}
]
}





 Creating rules by using the CLI 

Review the following example to learn how to create rules for Security and Compliance Center by using the CLI. For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/account?topic=account-cbr-plugincbr-rules-cli).

This command creates a rule that targets the Security and Compliance Center service and allows only private endpoints from the specified network zone to access the service.

ibmcloud cbr rule-create --description 'Example Rule Description' --service-name compliance --context-attributes endpointType=private --zone-id ZONE_ID --enforcement-mode report

For the enforcement-mode option, the CLI accepts the values enabled, disabled, and report. If no enforcement is specified, the rule is enabled by default.







 Next steps 

Follow the creation or modification of zones or rules with adequate testing to ensure access and availability.

Users who attempt to access your resources outside of the defined zones receive HTTP error 403 when the appropriate rules are not established.
Release notes for IBM Cloud Hardware Firewall 

Find out about new and updated features in IBM Cloud Hardware Firewall.



  8 December 2021 

Managing permissions
:   Account administrators can now assign permissions to allow users to view and manage various parts of a hardware firewall. The following permissions can now be assigned:



*  Manage firewalls - Allows you to view your list of firewalls. It also allows you to view and manage the details of a specific firewall.
*  Manage firewall rules - Allows you to manage the rules of a specific hardware firewall.
*  Cancel services - Allows you to cancel a firewall.



:   For more information, refer to [Managing permissions](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-managing-permissions).
For more information about modifying the existing rules, see [Configure source and destination NAT on a Tier-0 logical router](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/2.4/administration/GUID-45949ACD-9029-4674-B29C-C2EABEB39E1D.html).





 Enabling the firewall rule for NSX-T 

NSX-T disables all traffic through the workload NSX edge rule by default. To allow VMs to use the SNAT rule described in the previous section, you must create a firewall policy and rule to define and allow the traffic. For more information about modifying the existing rules, see [Add a Gateway Firewall Policy and Rule](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-DE6FE8CB-017E-41C8-85FC-D71CF27F85C2.html).





 Enabling the SNAT rule for NSX-V 

If you want your workload VMs to have outbound access to the internet, you must enable the associated SNAT (Source Network Address Translation) rule. Enabling the SNAT rule allows internet access from your VMs to be translated to a single public IP address. Complete the following steps in the VMware vSphere® Web Client:



1. Click Home > Networking & Security.
2. On the navigator pane, click NSX Edges and double-click the edge that is named customer-nsx-edge.
3. Click Management > NAT to open the NAT tab.
4. Select the default SNAT rule in the table and click the green checkmark next to the table to enable the rule.