vania-janet/multiturn-rag-retrieval-data huggingface dataset:
A Watson Assistant phone integration in one region is unaware of a phone integration in a different region. You need to ensure that your assistants are identically configured in both regions. You also need to rely on the upstream SIP trunking provider to detect and manage failing over between regions.



 Monitoring 

SIP trunking providers can be configured to actively health-check the Watson Assistant session border controllers (SBCs) by sending periodic SIP OPTIONS messages to each zone within a region. A failure to receive a response from one of the zones being health-checked can be used to either provide notification of a failure to trigger a manual failover, or it can be used to automate removal of the failed zone from the route list.





 Failover 

The SIP trunking provider plays an important role in detecting and managing a failover, especially if an automatic failover is expected between regions. In most cases, SIP trunking providers should be configured to treat each zone within a region as active/active and two regions where an assistant is configured as active/passive. SIP trunking providers should always be configured to load balance and fail over between zones within a single region. The remainder of this section focuses on handling a failover between regions.





 Full service outage 

Phone integration failures have two types. The first type is a full outage where the session border controllers in all 3 regional zones become unreachable. This is the easier of the two types to detect and handle because the SIP trunking provider is immediately notified via SIP timeouts that the call fails and can be configured to either automatically fail over or the call routing can be manually reconfigured at the SIP trunking provider to direct traffic away from the failed region towards the passive backup region. If a failover is automated and a regional backup is enabled, it is always best to try a different zone first and only redirect traffic to the passive backup region if a preconfigured number of failures occur within a short period of time. This prevents an unnecessary failover between regions if only a short outage occurs.

Note that Watson Assistant provides a round-robin fully qualified domain name (FQDN) that includes the IPs for each zone in the region. Many SIP trunking providers automatically retry each IP in the FQDN when failures occur.
For details on configuring TLS for channels please see the following [topic](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_configure_chl_ssl).

The Advanced Message Security (AMS) feature, which provides a higher level of protection for sensitive data is available for use at the application or queue manager. It is strongly recommended that sensitive data should be encrypted by the application using AMS, to ensure that it is fully protected as it flows between the application and the queue manager and through the system. For details on configuring AMS for client applications see the following [topic](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_app_ams).

The queue manager source IP address is dynamic and will change if a queue manager is restarted or fails over to another host. The source IP address is shared by multiple queue managers and therefore should not be used as the only mechanism for authenticating an incoming connection on a receiver channel.





 Securing data in transit 

The predefined administration and application channels in your MQ on Cloud queue manager are configured by default with TLS security. Enabling TLS causes the administration or application connections to encrypt the conversation thus protecting sensitive data and credentials. The following documents will explain how to enable TLS should a channel not have it, along with securing remote administration and application connections.



 Enabling TLS security for MQ channels in MQ on Cloud 

As mentioned previously, a queue manager created at MQ version 9.2.2r1 (or above) will have TLS enabled on its predefined channels by default. However, queue managers deployed at a lower version than 9.2.2r1, which have been upgraded to version 9.2.2r1 or above will not have TLS enabled by default. The below document explains the process of how you can enable TLS on a channel which does not have it set, along with how to create a trusted keystore file.
This process is possible only by accessing the KEK, which in this case is your root key that is stored in Key Protect.

Key Protect keys are secured by FIPS 140-2 Level 3 certified cloud-based

hardware security modules (HSMs).





 Enabling customer-managed keys with Watson 

Some Watson services have additional details about how to work with Key Protect. For more information, see the [docs](https://cloud.ibm.com/docs?tab=all-docs&category=ai) for the service.

Integrating Key Protect with Watson Premium services involves these steps in the IBM Cloud console.



1. Create an instance of Key Protect.
2. Add a root key to the Key Protect instance.
3. Grant Key Protect access to all instances of your Watson service.
4. Encrypt the Watson service data





 Step 1. Create the Key Protect instance 

Create an instance of Key Protect to hold your root keys.



1. Go to the [Key Protect](https://cloud.ibm.com/catalog/key-protect) page in the IBM Cloud catalog Security and Identity category.
2. Select a region. Make sure to create the instance in the same location as the Watson services you want to encrypt.
3. Name the service and click Create.







 Step 2. Add a key 

You use Key Protect to generate a key or import your own key.



 Create a root key 

When you use Key Protect to create a key, the service generates cryptographic key material that is rooted in cloud-based HSMs.

After you create an instance of the service, add a root key.



1. If you're not already on the details page, click the name of the Key Protect instance in your [resource list](https://cloud.ibm.com/resources?groups=resource-instance).
2. Add a Key Protectroot key:



1. Click Manage from the left navigation pane of the service details and click Add key.
2.
Sydney public.0001.voip.au-syd.assistant.watson.cloud.ibm.com <br>public.0002.voip.au-syd.assistant.watson.cloud.ibm.com <br>public.0003.voip.au-syd.assistant.watson.cloud.ibm.com 168.1.47.2 <br>135.90.86.50 <br>168.1.106.130 
 Tokyo public.0001.voip.jp-tok.assistant.watson.cloud.ibm.com <br>public.0002.voip.jp-tok.assistant.watson.cloud.ibm.com <br>public.0003.voip.jp-tok.assistant.watson.cloud.ibm.com 165.192.69.82 <br>128.168.105.178 <br>161.202.149.162 
 Washington, DC public.0001.voip.us-east.assistant.watson.cloud.ibm.com <br>public.0002.voip.us-east.assistant.watson.cloud.ibm.com <br>public.0003.voip.us-east.assistant.watson.cloud.ibm.com 52.116.100.158 <br>169.61.70.162 <br>169.59.136.194 







 Migrating from Voice Agent with Watson 

If you created an IBM® Voice Agent with Watson service instance in IBM Cloud to enable customers to connect to an assistant over the phone, consider using the phone integration instead. You can use the same SIP account and phone number that you configured for use with Voice Agent with Watson in the phone integration.

The phone integration provides a more seamless integration with your assistant. However, the integration currently does not support the following functions:



* Outbound calling
* Configuring backup locations
* Event forwarding to save call detail reports in the IBM Cloudant for IBM Cloud database service
* Reviewing the usage summary page. Use IBM Log Analysis instead. For more information, see [Viewing logs](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-phone-troubleshootingphone-troubleshooting-logs).
7. Return to the SMS with IntelePeer integration setup page. Click Next to go to Step 1 of your SMS with IntelePeer integration setup.
8. Enter your Account Secret information. Click Next to go to Step 2 of your SMS with IntelePeer integration setup.
9. Enter your Auth token information. Click Next to go to Step 3 of your SMS with IntelePeer integration setup.
10. Optional: Enter the phone number that your Intelepeer account uses for SMS integration. The webhook URI is used to transfer messages, but if you add your phone number in this optional field, you can easily refer to it later. Click Next to go to Step 4 of your SMS with IntelePeer integration setup.
11. Copy the value from the Webhook URI field.

You will add this URI to the webhook configuration in IntelePeer. If you want to support more than one phone number, you must add the URI to the webhook for each phone number separately.
12. Go to your [IntelePeer Customer Portal](https://customer.intelepeer.com/) site, under the My Applications section, select SMS API Management.
13. Go to the phone number(s) you want to enable for SMS. Toggle the Enabled/Disabled radial button beside the number and set it to Enabled. It may take a few minutes for the phone number to become activated for SMS.
14. Once the phone number has been enabled for SMS, you will see a webhook icon beside the number.

Paste the value that you copied from the Webhook URI field into it.
15. Click Save.
16. If you want to support multiple phone numbers, repeat the previous step for each phone number that you want to use.









 SMS Advanced configuration options 

The Advanced options tab is available after you set up the SMS integration. Click the Advanced options tab to make any of the following customizations to the messaging behavior:
For on-premise to cloud communication is uses a simple sender/receiver channel pair and for cloud to on-premise communication it uses a requester/server channel pair to establish the connection from the on-premises queue manager to the cloud queue manager.

Because the cloud queue manager cannot initiate the connection in this configuration, it is the on-premises queue manager which reaches out to the cloud queue manager to establish the connection. This method establishes a pair of channels and enables bi-directional flow of messages over the pair of channels.

The [guidance on direct connection](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_connect_onprem_direct) will help you implement this solution.

![alt text](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_connect_onprem1.png)





 Connection via the IBM Cloud Secure Gateway 

The IBM Cloud Secure Gateway is a service built into IBM Cloud which facilitates connectivity between cloud and on-premises services.

The gateway is particularly useful in configurations where the on-premises queue manager is in a part of the network which has no direct outbound connectivity. The secure gateway client is installed in a customer network location which does have outbound IP traffic access. The gateway client carries traffic securely from the on-premises queue manager via the gateway server to the cloud queue manager, and vice-versa.

Once the Secure Gateway connection has been established MQ channels can be initiated from either the cloud or the on-premise side, enabling a wider set of MQ channel types..

Similar to direct connection, this solution supports end-to-end TLS sessions between the on-premises queue manager and cloud-based queue manager.

The [guidance on secure gateway connection](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_connect_onprem_gateway) will help you implement this solution.

!
If you using the upstart capability so that the Secure Gateway client runs automatically at system startup, you have to check its configuration first (/etc/ibm/sgenvironment.conf). Once you have configured the upstart service you can use the following command to start it:

sudo initctl start securegateway_client

To restart the service:

sudo initctl restart securegateway_client

To stop the service, run the following command:

sudo initctl stop securegateway_client





 SystemD 

If you are using the systemD capability so that the Secure Gateway client runs automatically at system startup, you have to check its configuration first (/etc/ibm/sgenvironment.conf). Once you have configured the upstart service you can use the following command to start it:

systemctl start securegateway_client

To restart the service:

systemctl restart securegateway_client

For status on the service:

systemctl status securegateway_client

To stop the service, run the following command:

systemctl stop securegateway_client





 System V 

System V is not setup during installation like the other auto-start facilities. Scripts are available in the installation directory /opt/ibm/securegateway/client/upstart, they are:

secgw.sh
securegateway_clientd

Note: This section will affect users of SuSE/SLES 11.

Optional: If you are running SuSE version 11 that uses System V auto-start, scripts are provided that can be used to configure this process. Follow the below procedure:

cd /opt/ibm/securegateway/client/upstart/systemV
cp secgw.sh /usr/local/bin
chmod +x /usr/local/bin/secgw.sh
cp securegateway_clientd /usr/local/bin
chmod +x /usr/local/bin/securegateway_clientd
cd /etc/init.d
ln -s /usr/local/bin/securegateway_clientd
Optionally, you can enable MD5 authentication to secure the BGP session by allowing routing of messages only from routers using a shared authentication key.

You must configure the same BGP MD5 authentication key on both your Edge router and the IBM cross-connect router (XCR). The shared authentication key on the IBM device must be stored in your HPCS or Key Protect instance and shared with the Direct Link service.

To enable MD5 authentication after submitting your order, follow these steps:



1. [Set up BGP Message Digest 5 (MD5) authentication keys](https://cloud.ibm.com/docs/dl?topic=dl-dl-md5).
2. Log in to the IBM Cloud [Direct Link console](https://cloud.ibm.com/interconnectivity/direct-link), then click the Direct Link name in the table to show its details.
3. In the Actions section, click Review to review the direct link configuration. The Review configuration panel displays.
4. Review your settings and click Accept. The Finalize creation panel displays.
5. Click the MD5 authentication switch to enable it, then complete the following:



* For the keystore, select Hyper Protect Crypto Services or Key Protect.
* Choose an authentication keystore instance and authentication key.



6. Click Create.
The SIP trunk provider sets up a SIP trunk for your voice traffic, and manages access from allowed IP addresses. Most of the major SIP trunk providers have existing relationships with IBM. Therefore, the network configuration that is required to support the SIP trunk connection typically can be handled for you with minimal effort.



1. Create a [IBM Cloud case](https://cloud.ibm.com/unifiedsupport/cases/form).
2. Click Customer success as the case type.
3. For Subject, enter SIP trunk provider setup for Watson Assistant.
4. Include the following information in the description:



* Company Name
* Your IBM Cloud account ID
* Your Watson Assistant service name
* Network diagram with IP address or SIP trunk provider information









 Bring your own SIP trunk 

If you choose to use a SIP trunk carrier that IBM does not have an established relationship with, you can do so.

The following table lists the fully qualified domain names that are used for SIP connections.



SIP network information

 Location Domain name 

 Dallas public.0001.voip.us-south.assistant.watson.cloud.ibm.com 
 Dallas public.0002.voip.us-south.assistant.watson.cloud.ibm.com 
 Dallas public.0003.voip.us-south.assistant.watson.cloud.ibm.com 
 Frankfurt public.0001.voip.eu-de.assistant.watson.cloud.ibm.com 
 Frankfurt public.0002.voip.eu-de.assistant.watson.cloud.ibm.com 
 Frankfurt public.0003.voip.eu-de.assistant.watson.cloud.ibm.com 
 London public.0001.voip.eu-gb.assistant.watson.cloud.ibm.com 
 London public.0002.voip.eu-gb.assistant.watson.cloud.ibm.com 
 London public.0003.voip.eu-gb.assistant.watson.cloud.ibm.com 
 Seoul public.0001.voip.kr-seo.assistant.watson.cloud.ibm.com 
 Sydney public.0001.voip.au-syd.assistant.watson.cloud.ibm.com
<br><br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Isolate management VPC and allow SSH network connections from public network<br> * All other connections from or to management VPC are forbidden except for IBM services and VPC<br><br><br> ACL and security group rules in management VPC Open following ports by default: 22 (for limited number of IPs) <br>All ports to other VPCs are open More ports might be opened in preset or added manually after deployment 
 <br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC Allow connectivity for IBM Cloud services, Workload VPC and Management VPC More ports might be opened in preset or added manually after deployment 
 Enable floating IP on jump box host Floating IPs on jump box host in management VPC Use floating IP on jump box host for administration access 







 Key and password management architecture decisions 



Table 3. Key and passwords management architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Use public SSH key to access virtual server instances by using SSH<br><br><br> Public SSH key provided by customer Ask customer to specify the key. Accept the input as secure parameter.
The key must be base64-encoded. 
 key_type A boolean value that determines whether the key material can leave the service. <br> <br>When you set the extractable attribute to true, the service designates the key as a standard key that you can store in your apps or services. 



To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service. For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://www.nist.gov/publications/guide-protecting-confidentiality-personally-identifiable-information-pii).

A successful POST api/v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Key Protect API.



 Optional: Verify standard key importation 

You can verify that a standard key has been imported by issuing a list keys request:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys" -H "accept: application/vnd.ibm.collection+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Where the <instance_ID> is the name of your instance, and your <IAM_token> is your IAM token.







 Base64-encoding your key material 

When importing an existing standard key, it is required to include the encrypted key material that you want to store and manage in the service.



 Using OpenSSL to encrypt existing key material 

To encode your key material, first you should download and install [OpenSSL](https://github.com/openssl/opensslfor-production-use).

Once OpenSSL has been downloaded and installed, there are two recommended commands for encoding the key material. Both methods are equivalent, in that they convert a string , whether <key_material_string> or , as you can see below, into a base64 string.
The following inter-connectivity options are available:



* VPC zone to zone,
* VPC to VPC,
* VPC to Classic Infrastructure,
* VPC to IBM Power Systems Infrastructure,
* VPC to on-premises data centers by using a VPC VPN Gateway



When a connection to the public internet is not acceptable because of security measures, you can deploy an IPsec Gateway into your VPC to connect to your server. For more information, see [Connectivity to your SAP system landscape - VPC VPN Gateway](https://cloud.ibm.com/docs/sap?topic=sap-determine-accessdetermine-access-vpc-vpn-gateway). Or, you can have an even closer integration into your backbone infrastructure by an IBM Cloud Direct Link. For more information, see [Connectivity to your SAP system landscape - IBM Cloud Direct Link](https://cloud.ibm.com/docs/sap?topic=sap-determine-accessdetermine-access-vpc-direct-link).

Server resources that are in IBM Cloud Classic Infrastructure can be connected through Transit Gateways. These virtual devices are used to connect your private VLAN subnets in the Classic Infrastructure to your VPC subnets.

For more information, see [About Networking for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc) and [Setting up access to classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure).

Extra requirements exist in Classic Infrastructure networking to enable the Transit Gateway, be sure to review documentation before you change your Classic Infrastructure or VPC Infrastructure networking topology and configuration.

It is advised that your networking department contact [IBM Cloud Support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatargetting-support) after determining the layout of your landscape and the connectivity that is required on the SAP application layer.





 Networking protection
Enable encryption For more information about using the KMIP for VMware service to enable encryption, see [KMIP for VMware overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerationskmip_standalone_considerations). For more information about enabling VM encryption, see [Virtual machine encryption](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-E6C5CE29-CD1D-4555-859C-A0492E7CB45D.html). For more information about using data at rest encryption to protect data in your vSAN cluster, see [Using encryption on a vSAN cluster](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.virtualsan.doc/GUID-F3B2714F-3406-48E7-AC2D-3677355C94D3.html). 
 Add vSAN storage For more information about adding more vSphere ESXi hosts to your existing vSAN cluster, see [Adding ESXi servers to vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservers). The addition of more hosts increases CPU, RAM, and storage to your cluster. For more information about vSAN technology, see [Expanding a vSAN cluster](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.virtualsan.doc/GUID-666D9839-2726-4936-8C0F-94476ECE0606.html).