vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If yes, the public IP address of the VRA will be required to configure the third party service to limit access to the service.





 Step 2: NAT masquerade to Internet 

Follow the instructions here to configure external Internet access for hosts in the APP zone using NAT masquerade.



1. SSH into VRA and enter [edit] (config) mode.

SSH vyatta@<VRA Private IP Address>
configure
2. Create the SNAT rules on the VRA, specifying the same <Subnet Gateway IP>/<CIDR> as determined for the APP zone subnet/VLAN in the prior VRA provisioning tutorial.

set service nat source rule 1000 description 'pass traffic to the Internet'
set service nat source rule 1000 outbound-interface 'dp0bond1'
set service nat source rule 1000 source address <Subnet Gateway IP>/<CIDR>
set service nat source rule 1000 translation address masquerade
commit







 Step 3: Create Firewalls 



1. Create firewall rules for APP-TO-OUTSIDE

set security firewall name APP-TO-OUTSIDE default-action drop
set security firewall name APP-TO-OUTSIDE description 'APP traffic to the Internet'
set security firewall name APP-TO-OUTSIDE default-log

set security firewall name APP-TO-OUTSIDE rule 90 protocol tcp
set security firewall name APP-TO-OUTSIDE rule 90 action accept
set security firewall name APP-TO-OUTSIDE rule 90 destination port 80

set security firewall name APP-TO-OUTSIDE rule 100 protocol tcp
set security firewall name APP-TO-OUTSIDE rule 100 action accept
set security firewall name APP-TO-OUTSIDE rule 100 destination port 443

set security firewall name APP-TO-OUTSIDE rule 200 protocol icmp
set security firewall name APP-TO-OUTSIDE rule 200 icmp type 8
set security firewall name APP-TO-OUTSIDE rule 200 action accept
commit
Show more
2. Create firewall rules OUTSIDE-TO-APP

set security firewall name OUTSIDE-TO-APP default-action drop
An IP address that is allowed by context-based restrictions can still be denied by the bucket firewall.



 About legacy bucket firewalls 

There are some rules around setting a firewall:



* A user that sets or views a firewall must have the Manager role on the bucket.
* A user with the Manager role on the bucket can view and edit the list of allowed IP addresses from any IP address to prevent accidental lockouts.
* The Object Storage Console can still access the bucket, provided the user's IP address is authorized.
* Other IBM Cloud services are not authorized to bypass the firewall. This limitation means that other services that rely on IAM policies for bucket access (such as Aspera, SQL Query, Security Advisor, Watson Studio, Cloud Functions, and others) will be unable to do so.



When a firewall is set, the bucket is isolated from the rest of IBM Cloud. Consider how this may impact applications and workflows that depend on other services directly accessing a bucket before enabling the firewall. This can be avoided by using [service references and context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis&interface=uiservice-attribute) instead.

Access from a VPC environment can pass allowed_network_type checks, and VPC-zone underlay IP addresses can be added to the allowed_ip list. It is not possible to restrict access to an overlay IP for an individual VPC VSI or bare-metal server.

First, make sure that you have an instance of Object Storage and have provisioned at least one bucket. If not, follow the [getting started tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) to obtain the prerequisites and become familiar with the console.



 Set a list of authorized IP addresses using a legacy firewall 



1. Start by selecting Storage to view your resource list.
2. Next, select the service instance with your bucket from within the Storage menu. This takes you to the Object Storage Console.
3.
For example, if you want all inbound traffic to be allowed to the IP range 192.168.0.0/24 in your subnet, specify Any as the source and 192.168.0.0/24 as the destination. However, if you want to allow inbound traffic only from 169.168.0.0/24 to your entire subnet, specify 169.168.0.0/24 as the source and Any as the destination for the rule.
* Specify the rule's priority. Rules with lower numbers are evaluated first and override rules with higher numbers. For example, if a rule with priority 2 allows HTTP traffic and a rule with priority 5 denies all traffic, HTTP traffic is still allowed.
* Click Create.
* Select a subnet to attach to this ACL. Click Attach to attach additional subnets.



If the subnet has an existing ACL connection, the ACL is replaced by the ACL being created.
7. View your Total estimated cost in the Summary menu in the lower right of the page.







 Creating a network ACL from the CLI 

Before you begin, make sure to [set up your CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).

To create a network ACL from the CLI, run the following command:

ibmcloud is network-acl-create ACL_NAME VPC [--rules (RULES_JSON|@RULES_JSON_FILE) | --source-acl-id SOURCE_ACL_ID] [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] [--output JSON] [-q, --quiet]

Where:



* ACL_NAME is the name of the network ACL.
* VPC is the ID of the VPC.
* --rules are the rules for the ACL in JSON or JSON file.
* --source-acl-id is the ID of the network ACL to copy rules from.
* --resource-group-id is the ID of the resource group.
You can learn more about how context-based restrictions work in the [detailed documentation](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=ui), or you can follow a [quick tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-cos-tutorial-cbr).

Any Activity Tracker or audit log events generated will come from the context-based restrictions service, and not Object Storage.

If no rules are applicable to a particular resource, access is determined by IAM policies and the presence of a legacy bucket firewall.

An account is limited in the [number of rules and network zones that can be supported](https://cloud.ibm.com/docs/account?topic=account-known-issuescontext-based-restrictions-limits).





 Bucket firewalls versus context-based restrictions 

Prior to the availability of context-based restrictions, Object Storage itself would enforce access restrictions based on IP addresses. While this method is still supported, it is recommended to [use the newer context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=ui) instead of the legacy bucket firewall.

Bucket firewalls and context-based restrictions operate independently of one another, which means it's possible to have a request permitted by one and denied by the other.



* Bucket creation requests must be permitted by any context-based restrictions.
* For all other bucket or object requests, both the context-based restrictions and the bucket firewall must allow the request.



An IP address that is allowed by context-based restrictions can still be denied by the bucket firewall.



 About legacy bucket firewalls 

There are some rules around setting a firewall:



* A user that sets or views a firewall must have the Manager role on the bucket.
* A user with the Manager role on the bucket can view and edit the list of allowed IP addresses from any IP address to prevent accidental lockouts.
* The Object Storage Console can still access the bucket, provided the user's IP address is authorized.
* All rules are evaluated, regardless of the order in which they're added.
* Rules are stateful, which means that return traffic in response to allowed traffic is automatically permitted. For example, if you create a rule that allows inbound TCP traffic on port 80, that rule also allows replying outbound TCP traffic on port 80 back to the originating host, without the need for another rule.



7. Optional: Edit the interfaces if you're planning to apply this security group to your other instances. Attaching security groups is performed in the load balancer section.
8. Click Create security group after you finish creating rules.





 Security group example 

For example, configure the following inbound rules, which allow all traffic on port 80 for an HTTP listener (TCP port 80).



Table 6. Example configuration information for inbound rules

 Protocol Source type Source Value 

 TCP Any 0.0.0.0/0 Port 80 



Then, configure outbound rules that allow TCP traffic to your back-end target:



Table 7. Example configuration information for outbound rules

 Protocol Destination type Destination Value 

 TCP Any 10.11.12.13/32 (Back-end target IP address) 80 (Back-end target port) 
 TCP Any 10.11.12.14/32 (Back-end target IP address) 80 (Back-end target health check port) 









 Procedure: Attaching security groups during ALB creation 

To attach security groups when [creating your application load balancer](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancer), follow these steps:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2. Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click VPC Infrastructure > Load balancers in the Network section.
3. Click Create.
4.
Also, it's possible to set up a BGP password for authentication purposes, we just need to let the engineers know.



FortiGate Security Appliance (FSA) 1 Gbps



* What is a firewall?

A firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the server is reached.
* Why should I use a firewall?

The primary advantage of having a firewall is that your server handles “good” traffic exclusively. That means your resource is solely being used for its intended purpose as opposed to handling unwanted traffic, too.
* What firewall products does IBM© offer?

You can find a detailed comparison of all firewall products that are offered in the IBM Cloud by reviewing [this topic](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-exploring-firewalls).
* Is the FortiGate Security Appliance 1 Gbps compatible with IBM's load balancer products?

Yes. The FSA 1 Gbps is compatible with the cloud load-balancing service, local load balancer, as well as the Citrix Netscaler VPX and MPX.
* Does public traffic pass through my load balancer or firewall first?

Coming from the public internet in, the load-balancing products are first. The Hardware Firewall products are next, and the NetScaler products are last (along with your servers).
* Does IBM charge for firewall bandwidth?

The FortiGate Security Appliance 1 Gbps is not metered for bandwidth. Additionally, the FSA can reduce total bandwidth utilization by limiting the traffic that servers must respond to.
* What are the grayed out ports in my Windows Firewall?

IBM Cloud offers many different services that you can use with your server including, Evault, SNMP and Nagios monitoring. These services require that IBM's internal systems communicate with your server to some degree. The disabled ports you see in the Exceptions list are ports open on the internal network port only. They are still blocked on the public (internet) network connection. Since the internal network is a secured network, having these ports open is considered secure.
Why is my rule for all endpoint types from VPC not working as expected? 

If you create a context-based restrictions rule for VPC that allows all endpoint types, the network zone for your rule must be configured correctly.

  What’s happening 

When you create a context-based restrictions rule for VPC that allows all endpoint types, access from the VPC to the public endpoint is denied while the private endpoint returns the expected results. You might need to reconfigure your network zone.

  Why it’s happening 

The public gateway's associated IP addresses are not included in the zone definition along with the VPC.

  How to fix it 

To include the public gateway's associated IP addresses in the zone definition, complete the following steps. To update a network zone, you must be the account owner or be assigned the administrator or editor role on the Context-based restrictions account management service.



1.  Go to Manage > Context-based restrictions in the IBM Cloud console, and click Network zones.
2.  Select the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) for the network zone that you want to update, and select Edit.
3.  Update the list of allowed IP addresses to include the public gateway's associated IP addresses. For more information, see [Retrieve a public gateway](https://cloud.ibm.com/apidocs/vpc/latest?code=nodeget-public-gateway).
4.  Click Next to review your new configuration.
5.  Click Update to apply the changes.
2. [DNS hostnames](https://datatracker.ietf.org/doc/html/rfc1123).



By using these form-factors, you can create a network policy as either an allow or a block policy.





 Block and allow policies 



 Block policy 

Specifies a type of policy that prevents you from the following:



* Connecting to the Netezza Performance Server database by using any device or service.
* Connecting from the Netezza Performance Server database to any device or service that has either the specified hostname or an IP address in the range that is specified by CIDR.







 Allow policy 

Specifies a policy that allows you to do the following:



* Connecting to the Netezza Performance Server database by using any device or service.
* Connecting from the Netezza Performance Server database to any device or service that has either the specified hostname or an IP address in the range that is specified by CIDR.



You can use the combination of allow and block (deny) policies to restrict connections to and from the Netezza Performance Server database to the provided set of IP addresses and hostnames.







 Defining network policies 



 Defining network policies with Classless Inter-Domain Routing (CIDR) 

With Netezza Performance Server, you can specify a range of IP addresses by using Classless Inter-Domain Routing (CIDR) in network policies.

A CIDR notation is a compact representation of an IP address and its associated network mask.

<ip_address>/<prefix_length>

For example, 76.168.0.0/24 represents IP addresses in the range of 76.168.0.0 and 76.168.0.62

0.0.0.0/0 is a special case of a CIDR notation, which is allowed. Use it with caution because of the following reasons:



* When you use 0.0.0.0/0 as a block policy, all traffic to and from your Netezza Performance Server database is restricted.
* When you use 0.0.0.0/0as an allow policy, all traffic to and from your Netezza Performance Server database is allowed.



You can use CIDR ranges to represent public and private IP addresses.
Using page rules 

A page rule specifies settings and values that you can apply to a specific URL pattern that references your domain. Page rules help you manage security, performance, and reliability based on each individual URL in your site. The following table describes the page rules that are available to customers, the behaviors they produce, and any special considerations you should keep in mind before you use them.



 Security 



Table 1. Security rules

 Setting Behavior Considerations 

 Browser Integrity Check Looks for common HTTP headers that are abused by spammers, and denies access to your page. It also blocks visitors that do not have a user agent, or add a non-standard user agent (also commonly used by abuse bots, crawlers, or APIs). 
 Disable Security Disables the following features: Email Obfuscation, Server Side Excludes and WAF (Web Application Firewall). If a rule is set to disable security, and another rule is set to enable the WAF, the WAF rule takes precedence regardless of the order in which they appear. 
 Email Obfuscation Toggles email obfuscation feature on or off. When the email obfuscation feature is turned on, email addresses on your web page are obfuscated (hidden) from bots, but visible to humans. There are no visible changes to your website for visitors. 
 IP Geolocation Header Includes the country code of the visitor location with all requests to your website. The information can be found in the CF-IPCountry HTTP header. 
 Security Level Controls how high a client threat score must be so that a client encounters a challenge page. Use this setting to present visitors with a Defense Mode challenge when they visit your site. 
 Server Side Excludes Toggles server-side excludes on or off. Server-side excludes gives you the ability to hide sensitive content from suspicious visitors, but keep it visible to normal visitors. SSE only works with HTML. 
 TLS Controls which TLS mode is used. 
 WAF Toggles WAF rules on or off. Individual WAF rules cannot be turned on or off using page rules. 
 Automatic HTTPS Rewrites Toggles automatic HTTPS rewrites on or off.
To create a context-based restriction rule for a service, you must be assigned an IAM policy with the Administrator role the service you are creating a rule against. For example, if you want to create a rule to protect a Key Protect instance, you must be assigned the Administrator role on the Key Protect service and the Viewer role or higher on the Context-based restrictions service.

The Viewer role on the Context-based restrictions service allows you to add network zones to your rule.



Table 6. Roles and example actions for the context-based restrictions service

 Roles Actions role_ID value 

 Viewer View network zones crn:v1:bluemix:public:iam::::role:Viewer 
 Editor View network zones<br><br>Create network zones<br><br>Update network zones<br><br>Remove network zones crn:v1:bluemix:public:iam::::role:Editor 
 Administrator View network zones<br><br>Create network zones<br><br>Update network zones<br><br>Remove network zones crn:v1:bluemix:public:iam::::role:Administrator 



You can give users access to view, create, update, and remove context-based restrictions and network zones.





 Enterprise 

You can use the Enterprise service to assign users access to manage an enterprise by creating accounts within the enterprise, assigning accounts to account groups, naming account groups, and more. This type of policy works only if it is assigned within the enterprise account.



Table 7. Roles and example actions for the Enterprise service

 Roles Actions role_ID value 

 Viewer View the enterprise, account groups, and accounts crn:v1:bluemix:public:iam::::role:Viewer 
 Operator Not applicable 
 Editor View and update the enterprise name and domain, create accounts and account groups, view usage reports, and import accounts. crn:v1:bluemix:public:iam::::role:Editor 
 Administrator View and update the enterprise name and domain, create accounts and account groups, move accounts between account groups, import existing accounts, and view usage reports crn:v1:bluemix:public:iam::::role:Administrator
Configure the default firewall rule on the DLR to "allow"
$dlr = Get-NsxLogicalRouter OpenShift-DLR
$dlr.features.firewall.defaultpolicy.action = "Accept"
$dlr | Set-NsxLogicalRouter -Confirm:$false

 Configure DHCP relay on DLR
$dlrID = (Get-NsxLogicalRouter -Name "OpenShift-DLR").Id
$internalLifVnicId = (Get-NsxLogicalRouter OpenShift-DLR | Get-NsxLogicalRouterInterface "ToLS").index
$uri = "/api/4.0/edges/$($dlrID)/dhcp/config/relay"
$xmlPayload = "
<relay>
<relayServer>
<ipAddress>192.168.100.1</ipAddress>
</relayServer>
<relayAgents>
<relayAgent>
<vnicIndex>$($internalLifVnicId)</vnicIndex>
<giAddress>192.168.133.1</giAddress>
</relayAgent>
</relayAgents>
</relay>"

$null = invoke-nsxwebrequest -method "put" -uri $uri -body $xmlPayload -connection $nsxConnection

 Disconnect
Disconnect-NsxServer
Show more





 Related links 



* [Red Hat OpenShift Bastion node setup](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-bastion-intro)
* [Red Hat OpenShift 4.7 user provider infrastructure installation](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-openshift-runbook-runbook-install-intro)
* Keep the toggle set to No to allow all endpoint types.
* Set the toggle to Yes to allow only specific endpoint types, then choose from the list.



6. Select a network zone or zones that you have already created, or create a new network zone by clicking Create.

Contexts define the location from which your resources can be accessed, effectively linking your network zone to your rule.
7. Click Add to add your configuration to the summary. Click Next.
8. Name your rule and select how you want to enforce it. Then click Create.









 Monitoring context-based restrictions in VPC Infrastructure Services 

The context-based restriction service generates audit logs every time a context-based policy is enforced. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).





 Troubleshooting failures due to context-based restrictions 



 User getting 403 Unauthorized 

When a request is denied because of improper access permissions or the request originates outside of the network zone that is defined in context-based restrictions rule, the error response has a format that is similar to the following examples.



 403 unauthorized error when using the CLI 

Error code: not_authorized and
Error message: the provided token is not authorized
Trace ID: b266a31c-b359-4ecb-8b81-a27c1b2cdb7b





 403 unauthorized error when using IBM Cloud console 

reference_id b266a31c-b359-4ecb-8b81-a27c1b2cdb7b
code not_authorized
message the provided token is not authorized





 403 unauthorized error when using the API 

"code":"not_authorized",
"message":"the provided token is not authorized to list floating-ips in this account"
"trace":"b266a31c-b359-4ecb-8b81-a27c1b2cdb7b"







 Locating context-based restriction events in Activity Tracker
Create an RBAC policy 

The RBAC Policy Builder allows you to define Rules, which is, the permissions for user groups. One or more groups can be given READ, READ_WRITE, or MASK permissions. The group-to-permission mapping constitutes a single Rule, which in turn is added to the policy. Once a policy is established, you can apply it to the selected columns in a table, thereby determining who has access to what data.

To create an RBAC policy, complete the following steps:



1. In the Data Protection Policies section, expand RBAC and select Policies. On the RBAC Policy builder panel, click Create RBAC Policy. You also have the option for creating another user group before creating a policy.
2. In the Policy Builder panel, enter a Policy Name of 30 characters or less, and a unique Description of 100 characters or less.
3. From the Default Permissions drop-down, select one of the following:

a. READ assigns read-only permission as the default. The user sees clear data.

b. READ_WRITE assigns read and write permissions as the default. The user sees clear data and writes via Shield.

c. MASK assigns a data masking format as the default. You can see the masked data, according to the Mask mode specification that is selected.

d. All Mask Modes are available for selection. The Default Permission is applied to any user or client connection who does not belong to a user group in the given RBAC policy.
4. Add a Rule to the Policy. Each Rule consists of two pieces:

User Groups and Permission. The individual Rule maps a Permission to one or more User Groups. A policy can have an unlimited number of rules, or no rules. An RBAC Policy with no rules, containing only the Default Permission, can be used to apply simple data masking for all Users which connect to the Shield.

a. Enter a Rule Name of 30 characters or less.

b. Select relevant User Groups from the drop-down list. All User Groups are available, but only one Rule will be considered per User. See step 5.

c.