vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Data centers across multiple locations provide resilience in the case of a geographic failure and also bring workloads closer to globally distributed users reducing latency and increasing perceived performance. The [IBM Cloud network](https://www.ibm.com/cloud/data-centers/) enables users to link workloads hosted in secure private networks across data centers and locations.

This tutorial presents setup of a privately routed IP connection over the IBM Cloud private network between two secure private networks hosted in different data centers. All resources are owned by one IBM Cloud account. It uses the [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosuresecure-network-enclosure) tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the [VLAN Spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning) service.



 Objectives 



* Link secure networks within an IBM Cloud IaaS account
* Setup firewall rules for site to site access
* Configure routing between sites



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/01ccb31b85637ed5f03008c920c9596354caaf98/virtual-router-appliance/includes/solution-tutorials/includes/solution-tutorials/images/solution43-linking-secure-network-enclosures/vlan-spanning.png)

Figure 1. Architecture diagram of the tutorial



1. Deploy secure private networks
2. Configure VLAN Spanning
3. Configure IP routing between private networks
4. Configure firewall rules for remote site access







 Before you begin 

This tutorial is based on the tutorial, [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure).
The secure starter app includes coding examples of key secure coding practices that prevent XSS so you can start developing while you learn and apply XSS prevention techniques.





 How to use the secure sample app 

You can use the [secure starter app](https://github.com/IBM-Cloud/java-secure-app) as a starting point for new Liberty app development. Start by learning the XSS countermeasure code in the app and then apply it to the operations of the app API. The countermeasures in the secure starter app help prevent malicious user input from damaging your app both on the server and browser by mitigating or preventing XSS attacks.

First, download this secure starter app, then build and deploy it on IBM Cloud or locally the same way as you do with the [getting-started-java](https://github.com/IBM-Cloud/get-started-java) sample app. Go to [Getting started with Liberty on IBM Cloud](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-getting-started-liberty) to learn more about building and deploying apps on IBM Cloud. To get started, you can use these steps to clone, build, and run the app.

git clone https://github.com/IBM-Cloud/java-secure-app

cd java-secure-app

mvn install liberty:run-server

View the app at http://localhost:9080/GetStartedSecureJava/





 Enforce HTTPS on all pages in your app 

To enforce HTTPS instead of HTTP on all pages in your app, the following changes need to be made.

Modify your server.xml to enable the appSecurity-2.0 feature:

<featureManager>
<feature>appSecurity-2.0</feature>
</featureManager>

Modify your web.xml file to include the following security constraint:

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/</url-pattern>
System and Communications Protection (SC) [SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7 (4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) <br>[SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-10 Network Disconnect](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-10) <br>[SC-11 Trusted Path](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-11) 







 Next steps 



* [Performing operator actions through a bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion)
The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 keyID_or_alias Required. The unique identifier or alias for the root key that you want to use for wrapping. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key is a part of. If unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is recommended to specify the key ring ID for a more optimized request. Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. or more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 correlation_ID Optional.The unique identifier that is used to track and correlate transactions. 
 data_key Optional.The key material of the DEK that you want to manage and protect. The plaintext value must be base64 encoded.
IBM Cloud Security and Compliance Center Workload Protection 

Use IBM Cloud Security and Compliance Center Workload Protection to find and prioritize software vulnerabilities, detect and respond to threats, and manage configurations, permissions and compliance from source to run.

 Developer tools 

[API & SDK reference](https://cloud.ibm.com/apidocs/workload-protection)[CLI reference](https://cloud.ibm.com/docs/workload-protection-cli-plugin)

 Recommended content 

[Getting started with IBM Cloud Security and Compliance Center Workload Protection Use the IBM Cloud Security and Compliance Center Workload Protection CLI to configure your account to detect and respond to software vulnerabilities.](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started)[See what's new Read about the latest changes to IBM Cloud Security and Compliance Center Workload Protection. ](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-release-notes)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>!
Data centers across multiple locations provide resilience in the case of a geographic failure and also bring workloads closer to globally distributed users reducing latency and increasing perceived performance. The [IBM Cloud network](https://www.ibm.com/cloud/data-centers/) enables users to link workloads hosted in secure private networks across data centers and locations.

This tutorial presents setup of a privately routed IP connection over the IBM Cloud private network between two secure private networks hosted in different data centers. All resources are owned by one IBM Cloud account. It uses the [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosuresecure-network-enclosure) tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the [VLAN Spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning) service.



 Objectives 



* Link secure networks within an IBM Cloud IaaS account
* Setup firewall rules for site to site access
* Configure routing between sites



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution43-linking-secure-network-enclosures/vlan-spanning.png)

Figure 1. Architecture diagram of the tutorial



1. Deploy secure private networks
2. Configure VLAN Spanning
3. Configure IP routing between private networks
4. Configure firewall rules for remote site access







 Before you begin 

This tutorial is based on the tutorial, [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure). That tutorial and its prerequisites should be reviewed before commencing.
Key Protect and Hyper Protect Crypto Services allow one rotation per hour for each root key. The KMS replaces the key immediately upon your request. Use this option when you import a new root key to the KMS instance and want to rotate the key immediately.

For more information about these options, see [Comparing your key rotation options in Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotationcompare-key-rotation-options). For more information about setting a rotation policy in your KMS, see:



* Key Protect - [Managing rotation policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy)
* Hyper Protect Crypto Services - [Setting a rotation policy for root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy) and [Rotating root keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys).







 Root key metadata 

When you rotate your root key, key retains the same metadata and key ID. All that changed is the root key ciphertext and the keyVersion data.







 Prerequisites for key rotation 

To perform key rotation:



* Import one or more root keys to the KMS instance, or have the KMS generate one for you. See [Prerequisites for setting up customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-planningbyok-encryption-prereqs).
* Select one KMS for key rotation. Key rotation modifies key material within that instance.
* Any root key can be rotated, and if the key is protecting a resource, the key is rewrapped.
* If you initially imported a root key, you must provide new base64-encoded key material to rotate the key.
* Locate the KMS instance ID.
2019-19126](https://nvd.nist.gov/vuln/detail/CVE-2019-19126), [CVE-2020-12825](https://nvd.nist.gov/vuln/detail/CVE-2020-12825), [CVE-2019-5094](https://nvd.nist.gov/vuln/detail/CVE-2019-5094), [CVE-2019-5188](https://nvd.nist.gov/vuln/detail/CVE-2019-5188), [CVE-2019-2974](https://nvd.nist.gov/vuln/detail/CVE-2019-2974), [CVE-2020-2574](https://nvd.nist.gov/vuln/detail/CVE-2020-2574), [CVE-2020-2752](https://nvd.nist.gov/vuln/detail/CVE-2020-2752), [CVE-2020-2780](https://nvd.nist.gov/vuln/detail/CVE-2020-2780), [CVE-2020-2812](https://nvd.nist.gov/vuln/detail/CVE-2020-2812), [CVE-2019-12749](https://nvd.nist.gov/vuln/detail/CVE-2019-12749), [CVE-2019-19956](https://nvd.nist.gov/vuln/detail/CVE-2019-19956), [CVE-
Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager, both use the same password. Password is set to vCenter administrator password 
 Asset Repository Two Asset Repositories are configured; vCenter and NSX Manager, both use the same password. Type is set to vCenter for one repository and NSX for the other 
 Task Four tasks are set up; Asset Scan, NSX Flows, VMware® Infrastructure Scan, and VMware Vulnerability. ScanName is set to DC1AssetScan, NSXFlows, VMWInfraScan, VMWVulnScan 
 Task Four tasks are set up; Asset Scan, NSX Flows, VMware Infrastructure Scan, and VMware Vulnerability. Type is set to vCenter, NSX, VMwareInfrastructureScan, VMwareVulnerabilityScan 
 Task Schedule is set to hourly for DC1AssetScan and daily for the others
However, they have the following major differences:



* EP11 is built to allow high availability and scalability by design.
* EP11 is a stateless protocol, whereas PKCS #11 is stateful. The stateless design of EP11 allows for the use of external keystores as well as scaling to multiple backends.
* EP11 over gRPC (GREP11) defines a network protocol that can be directly used in cloud applications.



For more information, see

[Comparing the PKCS #11 API with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsmcompare-grep11-pkcs11).
* What EP11 mechanisms are supported by the GREP11 functions?

Mechanisms can vary depending on the level of firmware in the crypto card, see [Supported mechanisms](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-refgrep11-mechanism-list). For more information about the EP11 mechanisms, see the

[IBM 4768 Enterprise PKCS #11 (EP11) Library structure guide](https://www.ibm.com/security/cryptocards/pciecc3/library) and

[IBM 4769 Enterprise PKCS #11 (EP11) Library structure guide](https://www.ibm.com/security/cryptocards/pciecc4/library).
* What compliance standards does Hyper Protect Crypto Services meet?

Hyper Protect Crypto Services meets controls for global, industry, and regional compliance standards, such as GDPR, HIPAA, and ISO. As the HSM used by Hyper Protect Crypto Services, the IBM 4768 or IBM 4769 crypto card is also certified with Common Criteria EAL4 and FIPS 140-2 Level 4. For more information, see [Security and compliance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliance).
* Can I monitor my service instance?
About FortiGate Security Appliance 10 Gbps 

The FortiGate Security Appliance (FSA) 10 Gbps is a single tenant (dedicated), self-managed, high-throughput (10 Gbps) hardware firewall. It includes next-generation features, such as antivirus, intrusion prevention, and web filtering.

This firewall can be configured to protect traffic on multiple VLANs for both public and private networks. In the Customer Portal, it is referred to as a “Multi VLAN Firewall”.

As the demand for high-speed, in-cloud networks for enterprise grows, so does the customer need for securing workload and network. Big data, SAN, compute intensive servers, and highly scalable applications are pushing the bandwidth and network speed requirements for workloads in the cloud. IBM© recognizes that security solutions must evolve with the new demands in order to offer efficient protection. IBM’s new high-end high-throughput firewall offering is perfect for large businesses and enterprises who need a reliable and powerful way to manage and control high-speed network traffic in the cloud.

Except for IBM, no other cloud service provider currently offers hardware firewalls for robust perimeter security in the cloud. FortiGate Security Appliance 10 Gbps lets you grow you workload and networks in IBM Cloud.



  Overview of features 

Features of the FortiGate Security Appliance 10 Gbps include:



*  High throughput (up to 10 Gbps, 20 Gbps aggregated)
*  Public and private network connectivity
*  Ability to associate multiple VLANs to a single firewall device
*  [Intrusion prevention](https://www.fortinet.com/products/security-subscriptions/intrusion-prevention.html)
*  [Antivirus](https://www.fortinet.com/products/security-subscriptions/antivirus.html)
*  [Web filtering](https://www.fortinet.com/products/security-subscriptions/web-filtering.html)
Data centers across multiple locations provide resilience in the case of a geographic failure and also bring workloads closer to globally distributed users reducing latency and increasing perceived performance. The [IBM Cloud network](https://www.ibm.com/cloud/data-centers/) enables users to link workloads hosted in secure private networks across data centers and locations.

This tutorial presents setup of a privately routed IP connection over the IBM Cloud private network between two secure private networks hosted in different data centers. All resources are owned by one IBM Cloud account. It uses the [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosuresecure-network-enclosure) tutorial to deploy two private networks that are securely linked over the IBM Cloud private network using the [VLAN Spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning) service.



 Objectives 



* Link secure networks within an IBM Cloud IaaS account
* Setup firewall rules for site to site access
* Configure routing between sites



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/3fa5994ae9adccdcd1e1af1de40af9e12f188fef/vlans/includes/solution-tutorials/includes/solution-tutorials/images/solution43-linking-secure-network-enclosures/vlan-spanning.png)

Figure 1. Architecture diagram of the tutorial



1. Deploy secure private networks
2. Configure VLAN Spanning
3. Configure IP routing between private networks
4. Configure firewall rules for remote site access







 Before you begin 

This tutorial is based on the tutorial, [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure).
Key Protect and Hyper Protect Crypto Services (now available in certain [regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsregions)) use a common key provider API to provide a consistent approach for managing encryption keys. Behind the scenes, IBM Cloud data centers provide a dedicated hardware security module (HSM) to protect your keys. You can choose from the following options:



Table 1. Available key management service options

 Key Management Service HSM Encryption Certification 

 [Key Protect](https://cloud.ibm.com/docs/key-protect/concepts?topic=key-protect-getting-started-tutorialgetting-started-tutorial) FIPS 140-2 Level 3 compliance 
 [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedget-started) FIPS 140-2 Level 4 compliance 







 Preparing your environment 



1. You must have an upgraded account to use E2E encryption for virtual servers. For more information, see [Switching to IBMid and linking accounts](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).
2. Use your key management service to create and manage keys. The following example steps are specific to Key Protect, but the general flow also applies to Hyper Protect Crypto Services. If you're using Hyper Protect Crypto Services, see the [documentation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedget-started) for that service for corresponding instructions.



1. Provision the [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision) service.
2. [Install the IBM Cloud Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli).
Volume health gives a detailed description as mentioned in the [Managing block storage](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-monitoring&interface=uiblock-storage-vpc-health-states) doc.
* Resolves the following CVEs:



* [CVE-2022-42898](https://nvd.nist.gov/vuln/detail/CVE-2022-42898)
* [CVE-2022-41717](https://nvd.nist.gov/vuln/detail/CVE-2022-41717)
* [CVE-2022-41720](https://nvd.nist.gov/vuln/detail/CVE-2022-41720)









 Change log for version 5.0.2_1713, released 17 November 2022 



* Updates the storage-secret-sidecar image to v1.2.12
* Resolves the following CVEs:



* [CVE-2016-3709](https://nvd.nist.gov/vuln/detail/CVE-2016-3709)
* [CVE-2022-30698](https://nvd.nist.gov/vuln/detail/CVE-2022-30698)
* [CVE-2022-30699](https://nvd.nist.gov/vuln/detail/CVE-2022-30699)
* [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/CVE-2022-1304)









 Change log for version 5.0.1_1695, released 9 November 2022 



* Updates the storage-secret-sidecar image to v1.2.10
* Updates the csi-node-driver-registrar to v2.5.0
* Updates the livenessprobe to v2.6.0
* Updates the csi-provisioner to v3.2.1
High Availability and Resiliency on IBM Cloud 

High Availability and Resiliency topics are now in the High availability and resiliency for infrastructure repo. You should update any bookmarks that you have to high availability topics.

With IBM Cloud®, you can protect your critical workloads by building resilient highly available infrastructures. Using the backup, disaster recovery, and hhigh availability features, you can minimize your downtime if a severe failure condition happens. You can safeguard your classic or VPC application with multiple availability zones or regions. By creating cloud infrastructures that are protected against a single point of failure, and backing up your data, you keep your workloads and web applications highly available.



 What makes a cloud computing infrastructure resilient? 

In IBM Cloud, a resilient infrastructure keeps your cloud solution running at acceptable levels, even if one or more areas of the infrastructure experiences a minor or major problem:



* Power loss
* Planned or unplanned maintenance
* Hardware failure
* Network failure
* Natural disaster
* Ransomware



Resilient solutions are made up of multiple components. Different components can satisfy your business and technical requirements:



* High Availability - System designs that provide continuous service, often by using redundant components to protect against failure. Redundancy is using multiple identical resources in different locations to protect against a single point of failure.
* Back up - Continuous backup of critical data for recovery to continue to provide service if key data is lost or inaccessible.
* Disaster Recovery - Regaining access to the infrastructure after extreme events such as natural disasters, cyberattacks, or wide range power outages.







 IBM Cloud and customer responsibilities 

Zoom

![Building resilient and cost-effective infrastructure](https://cloud.ibm.com/docs-content/v1/content/df269b100c3499f1efcbb7d030dce8dec25c539b/ha-infrastructure/images/ha-building-resilient-infra.svg)

Figure 1. Building Resilient and Cost-Effective Infrastructure



 IBM Cloud VPC infrastructure provides by design Customer Selects