vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "Private Outbound" -Source 10.208.242.128/26 -Service any -Action accept
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "Public Outbound" -Source 169.48.73.40/29 -Service any -Action accept
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "OpenShift Network" -Source 192.168.133.0/24 -Service any -Action accept
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "Transit Network" -Source 192.168.100.0/24 -Service any -Action accept
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "Private inbound to OpenShift" -Source 10.0.0.0/8 -Destination 10.208.242.131 -Service tcp/80,tcp/443 -Action accept
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -Name "SSH inbound to Bastion" -Source 10.0.0.0/8 -Destination 10.208.242.133 -Service tcp/22 -Action accept

 Configure ESG NAT rules
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeNat | Set-NsxEdgeNat -enabled -confirm:$false
Get-NsxEdge OpenShift-ESG | Get-NsxEdgeNat | New-NsxEdgeNatRule -Vnic 1 -OriginalAddress 192.168.133.0/24 -TranslatedAddress 169.48.73.43 -Action snat -Protocol any -OriginalPort any -TranslatedPort any -Enabled -Description "OpenShift Network Public Outbound"
Port Range - These two fields indicate the range of ports (between 1 and 65535) that the rule will apply to.

Protocol - This field selects the protocol the rule will apply to (TCP/GRE/ICMP/UDP/PPTP/AH/ESP).

Notes: Freeform field to enter any note about this rule.
6. Click on the Overflow menu icon at the end of the row of the firewall rule to edit or delete the rule. Click the Add rule button at the right top corner of the table to add an additional rule. The rules are automatically validated as you enter them.
7. Click the Save or Add buttons to save the rule and apply to the firewall. The rule addition or update should take effect within two minutes.



The Delete action will be disabled if there is only one rule on the firewall.





 Common ports 



Common ports

 Protocol Port 

 FTP 21 
 SSH 22 
 Telnet 23 
 SMTP 25 
 DNS 53 
 HTTP 80 
 POP3 110 
 IMAP 143 
 HTTPS 443 
 MSSQL 1433 
 MySQL 3306 
 Remote Desktop 3389 
 PostgreSQL 5432 
 VNC Web 5800 
 VNC Client 5900 
 Urchin 9999 or 10000
e3caad9c-68b7-4a4a-8188-d239fbc724df allow-all-inbound-rule-740b07cb-4e69-4ef2-b667-42ed27d8b29e allow ipv4 all 0.0.0.0/0 0.0.0.0/0 2019-09-18T15:09:45-05:00

outbound
ID Name Action IPv* Protocol Source Destination Created
7043ac95-cc4e-42e9-a490-22177237f083 allow-all-outbound-rule-740b07cb-4e69-4ef2-b667-42ed27d8b29e allow ipv4 all 0.0.0.0/0 0.0.0.0/0 2019-09-18T15:09:45-05:00
3. Export the ACL ID as an environment variable.

export ACL_ID=<acl_id>
4. Delete the default rules that allow all inbound and outbound traffic. After, your ACL still exists, but does not contain any networking rules.

ibmcloud is network-acl-rule-delete $acl_id <default_inbound_rule_ID> -f

ibmcloud is network-acl-rule-delete $acl_id <default_outbound_rule_ID> -f
5. Multizone clusters: Add rules to your ACL to allow worker nodes in one subnet to communicate with the worker nodes in all other subnets within the cluster. The subnet for which you create the ACL rule is defined as 0.0.0.0/0 and you use the CIDRs of the other subnets as your destination CIDR. Make sure to create one inbound and one outbound rule for each of the subnets that you want to connect to.
* Version upgrades







 Firewalls 

Implementing an Ubuntu firewall (UFW, Iptables, and so on) without required rules can cause the vSRX HA cluster to be disabled. The vSRX solution depends on heartbeat communication between the primary and secondary nodes. If the firewall rules do not allow communication between the nodes, then cluster communication will be lost.

The vSRX architecture influences the firewall rules discussed below. Details on the two architectures can be found in [vSRX default configuration](https://cloud.ibm.com/docs/vsrx?topic=vsrx-understanding-the-vsrx-default-configurationinterface-configurations).

For vSRX version 18.4 HA deployments running with the legacy architecture, the following rules are required to allow cluster communication for UFW:



* To allow protocol 47 (used for heartbeat communication) in /etc/ufw/before.rules:

-A ufw-before-input -p 47 -j ACCEPT
* To allow private network communication:

ufw allow in from 10.0.0.0/8 to 10.0.0.0/8
* To enable UFW:

ufw enable



For vSRX versions running with the newer architecture, the firewall rules must allow for multicast communication.

In some cases, troubleshooting operations might require disabling the firewall for access to public repositories. In these cases, you should work with IBM Support to understand how to proceed.

Most Gateway actions require SSH access to the private 10.0.0.0/8 subnet for the host OS and the vSRX. Blocking this access with a firewall can cause the following actions to fail:



* OS reloads
* Cluster rebuilding
* Version upgrades



As a result, if SSH access is disabled for the 10.0.0.0/8 subnet, you must re-enable it prior to executing any of these actions.
You can also choose to allocate a reserved IP address to bind to the gateway, or specify a VPC subnet to allocate a reserved IP address for binding to the gateway.
4. In the Security groups section, select the checkboxes of the security groups that you want to attach from the security group table. You can then manage these security groups and tighten their security rules for inbound traffic towards your endpoint gateways.

When you create an endpoint gateway without specifying a security group, the VPC default security group is attached to the endpoint gateway. For more information, see [Configuring ACLs and security groups for use with endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways).

Endpoint gateways created prior to support for security groups being introduced do not have a security group attached and allow all inbound traffic. If you attach a security group to a VPE that does not have a security group, you cannot revert back to having no security groups. You can revert to the previous "allow all inbound traffic" behavior by attaching a security group with rules for allowing all inbound traffic. However, such a rule is inherently less secure than having a more restrictive security group in place, and is not recommended.
5. In the Cloud service section, select the IBM Cloud service that you want to access using this endpoint gateway. The region is pre-selected to optimize performance.
6. In the Reserved IP section, select a reserved IP address. You can choose:



* Select one for me - Enter a name for the IP address, or one is chosen for you. Select a subnet from the list and enable the Auto-delete toggle if you want this reserved IP to be deleted automatically if the endpoint gateway is deleted.
* Select from existing IPs - Choose from a list of existing IP addresses.
* Select one later - Select an IP address after creating the endpoint gateway.



7. The order Summary shows pricing estimates for your review. Review and click Create endpoint gateway.







 Creating an endpoint gateway from the CLI
Context-based restrictions protect only the actions associated with the [Direct Link API](https://cloud.ibm.com/apidocs/direct_link). Actions associated with the following platform APIs are not protected by context-based restrictions. Reference the API docs for the specific action IDs.



* [Resource Instance APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-instances)
* [Resource Keys APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-keys)
* [Resource Bindings APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-bindings)
* [Resource Aliases APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-aliases)
* [IAM Policy APIs](https://cloud.ibm.com/apidocs/iam-policy-managementlist-policies)
* [Global Search APIs](https://cloud.ibm.com/apidocs/search)
* Global Tagging [Attach](https://cloud.ibm.com/apidocs/taggingattach-tag) and [Detach](https://cloud.ibm.com/apidocs/taggingdetach-tag) APIs
* [Context-based Restriction Rule APIs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule)







 Creating rules 

Context-based restrictions for the Direct Link service can be scoped to a Direct Link service resource type. The Direct Link Service has two applicable resource types: connect and dedicated.

Additionally, rules can be scoped to a specific instance of the service, or a resource group by using resource attributes.



 Creating rules by using the CLI 



1.
0738-e2b30627-1a1d-447b-859f-ac9431986b6f allow-all-inbound-rule-2d86bc3f-58e4-436a-8c1a-9b0a710556d6 allow ipv4 all 0.0.0.0/0 0.0.0.0/0 2 months ago

outbound
ID Name Action IPv* Protocol Source Destination Created
0738-173a3492-0544-472e-91c0-7828cbcb62d4 allow-all-outbound-rule-2d86bc3f-58e4-436a-8c1a-9b0a710556d6 allow ipv4 all 0.0.0.0/0 0.0.0.0/0 2 months ago

Save the IDs of both ACL rules as variables so you can use the values in later commands. For example, you can save the IDs in variables inrule and outrule:

inrule="0738-e2b30627-1a1d-447b-859f-ac9431986b6f"
outrule="0738-173a3492-0544-472e-91c0-7828cbcb62d4"





 Step 3. Add new ACL rules as described 

In this example, first add inbound rules and then add outbound rules.

Insert new inbound rules before the default inbound rule.

ibmcloud is network-acl-rule-add my_web_acl_rule200 $webacl deny inbound all 0.0.0.0/0 0.0.0.0/0 --before-rule-id $in-rule

At each step, save the ID of the ACL rule in a variable so the ID can be used in later commands. For example, you can use the variable acl200:

acl200="0738-90930627-1a1d-447b-859f-ac9431986b6f"
* Create destination NAT rules that map destination subnets to translated subnets for IP packets with a source address from the cybertools segment. For example, Src=172.16.67.2->Dst=172.16.68.2 => Src=172.16.67.2->Dst=172.16.253.2.



The required traffic flow is shown in the following diagram where:



* Green designates allowed traffic flow.
* Red designates denied traffic flow.



Zoom

![Immutable backup environment sandbox example](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/veeam-cr-sa-sb-ib-detail.svg)

Figure 2. Immutable backup environment sandbox example

The Destination Network Address Translation (DNAT) rules have been configured as:



Table 2. NSX-T DNAT rules

 Source Destination Translated 

 172.16.67.0/24 172.16.68.0/24 172.16.253.0/24 
 172.16.67.0/24 172.16.69.0/24 172.16.254.0/24 



The distributed firewall groups configuration is defined as:



Table 3. NSX-T distributed firewall groups

 Name Category Members Criteria 

 Cyber-Tools-Segments Segments cyber-tools None 
 Cyber-Isolated-Segments None None Segment Tag Equals Isolated-Segments Scope: Cyber 



The distributed firewall policy configuration in a policy named Cyber-Isolated is defined as:



Table 4. NSX-T distributed firewall policy

 Rule Name Sources Destinations Services Action 

 Allow access to Isolated Cyber-Tools-Segments Cyber-Isolated-Segments All Allow 
 Allow access between isolated Cyber-Isolated-Segments Cyber-Isolated-Segments All Allow 
 Deny access to Isolated Any Cyber-Isolated-Segments All Deny 
 Deny access from Isolated Any Cyber-Isolated-Segments All Deny 





 Related links
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH description "Allow ping and SSH from the internet to the public subnet"
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match source-address any
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match destination-address VSI_PUB_NET
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match application junos-ssh
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match application junos-ping
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH then permit
Show more
$domainnb = "<NB_Domain>"
$user = $domainnb + "sqlsvc"
New-Item -Path "C:" -Name "TempShare" -ItemType "directory"
$ACL=Get-ACL -Path "C:TempShare"
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($user,"FullControl","Allow")
$ACL.SetAccessRule($AccessRule)
$ACL | Set-Acl -Path "C:TempShare"
New-SmbShare -Name "TempShare" -Path "C:TempShare" -FullAccess $user







 Create the endpoints 



1. RDP to the first SQL server using a user from the SQL Admins group account and open a PowerShell session.
2. To participate in Always On availability groups, a server instance requires its own endpoint, which use TCP port 5022 to send and receive traffic between the server instances hosting availability replicas.
3. The following PowerShell commands are used to configure these endpoints, Hadr_endpoint on the default SQL instances (DEFAULT) on the SQL servers; <hostname1> and <hostname2> and enables encryption between the endpoints:

$sqldb01 = "<hostname1>"
$sqldb02 = "<hostname2>"
$domainnb = "<NB_Domain>"
$user = $domainnb + "sqlsvc"
$pathsqldb01 = "SQLSERVER:SQL" + $sqldb01 + "DEFAULT"
$pathsqldb01 = "SQLSERVER:SQL" + $sqldb02 + "DEFAULT"
$endpoint1 = New-SqlHadrEndpoint Hadr_endpoint -Port 5022 -Path $pathsqldb01 -Encryption Required -EncryptionAlgorithm Aes -Owner $user
Set-SqlHadrEndpoint -InputObject $endpoint1 -State "Started"
Update a domain lockdown rule PUT /v1/{crn}/zones/{domain_id}/firewall/lockdowns/{rule_id} internet-svcs.security.update internet-svcs.domain-lockdown-rules.update 
 Delete a domain lockdown rule DELETE /v1/{crn}/zones/{domain_id}/firewall/lockdowns/{rule_id} internet-svcs.security.manage internet-svcs.domain-lockdown-rules.delete 







 Firewall Rules 



Table 8. Firewall Rules

 Action Method IAM ACTION AT ACTION 

 Get firewall rules GET /v1/{crn}/zones/{domain_id}/firewall/rules internet-svcs.security.read internet-svcs.firewall-rules.read 
 Create a firewall rule POST /v1/{crn}/zones/{domain_id}/firewall/rules internet-svcs.security.manage internet-svcs.firewall-rules.create 
 Update a firewall rule PATCH /v1/{crn}/zones/{domain_id}/firewall/rules/{rule_id} internet-svcs.security.update internet-svcs.firewall-rules.update 
 Delete a firewall rule DELETE /v1/{crn}/zones/{domain_id}/firewall/rules/{rule_id} internet-svcs.security.manage internet-svcs.firewall-rules.delete 
 Get filters GET /v1/{crn}/zones/{domain_id}/filters internet-svcs.security.read internet-svcs.filters.read 
 Create a filter POST /v1/{crn}/zones/{domain_id}/filters internet-svcs.security.manage internet-svcs.filters.create 
 Update a filter PATCH /v1/{crn}/zones/{domain_id}/filters/{filter_id} internet-svcs.security.update internet-svcs.filters.update
not (http.request.method eq "POST" and http.request.uri.path eq "/login")



 Deviations from Wireshark display filters 

Firewall rules expressions are inspired by Wireshark display filters. However, the implementation deviates in the following ways:



* For CIDR IP equality tests, Wireshark allows ranges in the format ip.src == 1.2.3.0/24, while CIS only supports equality tests using a single IP address. To compare a CIDR, use the in operator; for example, ip.src in {1.2.3.0/24}.
* In Wireshark, ssl is a protocol field containing hundreds of other fields of various types that are available for comparison in multiple ways. However in Firewall Rules, ssl is a single boolean field used to determine if the connection from the client to CIS is encrypted.
* The slice operator is not supported.
* Not all functions are supported. Currently, len(), and count() are not supported.
Or, to isolate a single administrator's scope of influence, the responsibility might be assigned to an administrator who has access only to the edge gateway and no access to manage SDN security.

The workload region is managed by one or more administrators that are only responsible for the management of the application VMs deployed upon the workload clusters. One approach where multiple administrators are useful is the case where a user wants to isolate administrative tasks on a per business unit basis or other compliance requirements.

Three distinct regions: the management region, the edge services region, and the workload region, design the zero trust security model into the IBM Cloud for VMware Regulated Workloads. Taking advantage of this design through audited and enforced separation of duties at every possible opportunity, assists users to comply with industry standards or government regulations, making the IBM Cloud for VMware Regulated Workloads that are uniquely suited to host applications for clients in highly regulated industries.



 Related links 



* [IBM Cloud compliance programs](https://www.ibm.com/cloud/compliance)
* CLI
* API







 Protecting DNS Services resources with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to IBM Cloud DNS Services resources can be controlled with context-based restrictions and identity and access management (IAM) policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the DNS Services service to create, update, or delete rules. And a user must have either the Editor or Administrator role on the Context-based restrictions service to create, update, or delete network zones. A user with the Viewer role on the Context-based restrictions service can only add network zones to a rule.

Any IBM Cloud Activity Tracker or audit log events generated come from the context-based restrictions service, not DNS Services. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started protecting your DNS Services resources with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).



 Creating network zones 

A network zone represents an allowlist of IP addresses where an access request is created. It defines a set of one or more network locations that are specified by the following attributes:



* IP addresses, which include individual addresses, ranges, or subnets
* VPCs





 Creating network zones by using the API
* Creates a management VM that runs Linux and Ansible. The management VM changes the security policy on the vSRX appliances at the required times.
* Uses a cron job on the automation server to schedule the running of an Ansible playbook that changes the inbound firewall rule from "Deny" to "Allow". After the backup window, the customer changes the inbound firewall rule from "Allow" to "Deny".



To enable cyberbackup of the production environment, the customer:



* Follows the prerequisite tasks on the bare metal server to prepare the server ready for its role as a Linux hardened repository.
* Uses the Veeam backup server enabled the Linux hardened repository.
* Removes the isolated recovery environment vCenter from the Veeam backup server configuration.
* Adds the production vCenter to the Veeam backup server configuration.
* Creates and deploys the Veeam VMware proxy servers to the production environment.
* Creates cyber-backup jobs for the required production VMs.



To enable cyber-related tasks on the cyberbackups, such as scanning backup files for malware and recovering VMs from backups on isolated networks, the customer:



* Creates a segment for their cybertoolsets, which include the malware scanners.
* Creates a new T1 named Isolated-NW-T1 and links it to the workload T0. The Isolated-NW-T1 is configured to advertise all NAT IPs only. This action stops the advertisement of connected segments and advertises only the NAT IP addresses of the segments.
* Creates the following two distributed firewall groups:



* Name: Cyber-Tools-Segments, Category: Segments, Members: cybertools
* Name: Cyber-Isolated-Segments, Criteria: Segment Tag Equals Isolated-Segments, Scope: Cyber



* Creates a distributed firewall policy that is named Cyber-Isolated, which contains the following rules to satisfy their isolation requirements:





Table 2. NSX-T distributed firewall rules

 Rule Name Sources Destinations Services Action 

 Allow access to Isolated Cyber-Tools-Segments Cyber-Isolated-Segments All Allow 
 Allow access between Isolated Cyber-Isolated-Segments Cyber-Isolated-Segments All Allow 
 Deny access to Isolated Any Cyber-Isolated-Segments All Deny
Create an access control policy to permit traffic across the VPN. To do so, follow these steps:



1. Click Policies from the menu bar.
2. Click the + button to add an access rule. Select your local network object for Source, and your remote network object as Destination. You can create network objects for the Source and the Destination.
3. Select Allow for Action, and then click OK.



Zoom

![Create access control policy](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-access-rule2.png)

Create access control policy
7. Repeat step 6 to create another access control policy for the returning traffic. This time, the remote network object is the Source, and the local network object is the Destination.
8. Configure TCP MSS clamping to avoid unnecessary fragmentation. Go to Device > Advanced Configuration > FlexConfig > FlexConfig Objects > + button and create a FlexConfig Object with the sysopt connection tcpmss 1360 command.

Zoom

![FlexConfig Policy](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-flexconfig-policy.png)

FlexConfig Policy
9. Go to Device > Advanced Configuration > FlexConfig > FlexConfig Policy and add the FlexConfig object that you created. Click SAVE.

Zoom

!
Valid values: "country-access-rules", "waf", "firewall-rules", "ratelimit", "securitylevel", "ip-access-rules", "browser-integrity-check", "ua-rules", "lockdowns", "iprange-access-rules", "asn-access-rules", "Managed-firewall" (Enterprise plan only). Note: The 'SERVICES' is only used for advanced waf alert. If the alert policy you wanted to update is created without services specified, create a new one with sevices specified instead of updating.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-update-firewall-events-alert" "> --><-- <section "id="section-update-firewall-events-alert-examples" "> --> Examples Update a firewall-events-alert policy a2633e68-1a64-2512-a321-b64a17c7db7a. ibmcloud cis alert-policy firewall-events-alert-update a2633e68-1a64-2512-a321-b64a17c7db7a --name test1 --emails test1@cn.ibm.com --webhooks b2633e68-9a64-4519-b361-a64a67c8db8e --enabled true --domains d2633e61-1b61-2512-1321-b61a17c3db7e -i "cis-demo"