vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Exempts matching requests from evaluation, based on a user-defined list that contains one or more of the following features: Browser Integrity Check, Domain Lockdown, Hotlink Protection, Rate Limiting, Security Level, User Agent Block, WAF Managed Rules. Matching requests are still subject to evaluation within Firewall Rules, based on order of execution. 2 
 Allow <br><br> * Firewall rules<br> * IP firewall<br><br><br> Allows matching requests to access the site, on condition that no other CIS firewall features block the request, such as IP firewall or access rules. 3 
 Challenge (Captcha) <br><br> * Firewall rules<br> * IP firewall<br> * User agent rules<br><br><br> Requires a user to pass a Google reCaptcha Challenge before proceeding. If successful, CIS accepts the matched request; otherwise, it is blocked. 4 
 JS Challenge <br><br> * Firewall rules<br> * IP firewall<br> * User agent rules<br><br><br> JS Challenge Requires a user to pass a CIS JavaScript Challenge before proceeding. If successful, CIS accepts the matched request; otherwise, it is blocked. 
 Block <br><br> * Firewall rules<br> * IP firewall<br> * User agent rules<br><br><br> Blocks a matching request from accessing the site. 6
set firewall name OUTSIDE2INSIDE rule 30 destination port 500
set firewall name OUTSIDE2INSIDE rule 40 action accept
set firewall name OUTSIDE2INSIDE rule 40 ipsec match-ipsec
set firewall name OUTSIDE2INSIDE rule 50 action accept
set firewall name OUTSIDE2INSIDE rule 50 protocol gre
set firewall name OUTSIDE2INSIDE rule 60 action accept
set firewall name OUTSIDE2INSIDE rule 60 protocol tcp
set firewall name OUTSIDE2INSIDE rule 60 destination port 1723
set firewall name OUTSIDE2INSIDE rule 70 action accept
set firewall name OUTSIDE2INSIDE rule 70 protocol tcp
set firewall name OUTSIDE2INSIDE rule 70 destination port 80
set firewall name OUTSIDE2INSIDE rule 80 action accept
set firewall name OUTSIDE2INSIDE rule 80 protocol tcp
set firewall name OUTSIDE2INSIDE rule 80 destination port 443
set firewall name OUTSIDE2INSIDE rule 90 action accept
set firewall name OUTSIDE2INSIDE rule 90 state established enable
set firewall name SLSERVICE2INSIDE
set firewall name SLSERVICE2INSIDE default-action drop
set firewall name SLSERVICE2INSIDE rule 10 action accept
set firewall name SLSERVICE2INSIDE rule 10 protocol all
set firewall name SLSERVICE2INSIDE rule 10 source group network-group SLSERVICES
set firewall name INSIDE2SLSERVICE
set firewall name INSIDE2SLSERVICE default-action drop
set firewall name INSIDE2SLSERVICE rule 10 action accept
set firewall name INSIDE2SLSERVICE rule 10 protocol all
set firewall name INSIDE2SLSERVICE rule 10 destination group network-group SLSERVICES
set firewall name VMACCESS2MGMT
set firewall name VMACCESS2MGMT default-action drop
set firewall name VMACCESS2MGMT rule 10 action drop
set firewall name VMACCESS2MGMT rule 10 protocol all
set firewall name VMACCESS2MGMT rule 10 source group network-group 1103VMACCESS
set firewall name STORAGE2MGMT
You can configure your firewall allow access to the public and private IP addresses of only the services that you want to use





 External communication to apps that run on worker nodes with a gateway appliance 

To provide private access to an app in your cluster, you can create a private network load balancer (NLB) or Ingress application load balancer (ALB) to expose your app to the private network only. If you need to provide limited public access to an app in your cluster, you can create a public NLB or ALB to expose your app. Because all traffic goes through your gateway appliance firewall, you can control public and private traffic to the network services that expose your apps by opening up the service's ports and IP addresses in your firewall to permit inbound traffic to these services.

Ready to get started with a cluster for this scenario? After you plan your [high availability](https://cloud.ibm.com/docs/containers?topic=containers-ha_clusters) and [worker node](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodes) setups, see [Creating clusters](https://cloud.ibm.com/docs/containers?topic=containers-clusters).







 Scenario: Extend your on-premises data center to a classic cluster 

In this scenario, you want to run workloads in a classic cluster. However, you want these workloads to be accessible only to services, databases, or other resources in your on-premises data center, such as IBM Cloud Private. Your cluster workloads might need to access a few other IBM Cloud services that support communication over the private network, such as IBM Cloud Object Storage.

Zoom

![Architecture image for a cluster that connects to an on-premises data center on the private network.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_clusters_planning_extend.png)

Figure 1. Network setup for a cluster that connects to an on-premises data center on the private network
Also, if there are rules with Security Groups with dynamic memberships based on Security Tags or with static memberships.
* If "Applied To" is set to a universal security group or a universal logical switch in any rule, and all the rules are IP-based.









 Distributed firewall migration guidance 

When you migrate the workload VMs to the NSX-T environment in waves, it is imperative that the distributed firewall does not break communications between the workload VMs during the migration. Therefore, the configuration migration for the distributed firewall has two stages:



1. The first stage migrates the firewall rules and the groups to NSX-T.
2. The second stage creates specific VIFs for each VM that is migrated. And also includes the creation of IP Set-based rules for every VM that is migrated to ensure that there are no security gaps when you move to NSX-T.



It is important to note that:



* Tags cannot be applied before you move the VM over to the NSX-T.
* A VM moved without tags can create a gap in security.
* Temporary IP Sets are used to allow for a gradual migration while micro-segmentation is enforced for flows between the two NSX environments.
* If workload VMs must be migrated by using vMotion, then the vMotion must be initiated through the API. So that, the VMs are connected to the pre-created logical ports.
* When workload VMs are migrated, there is a post-migration step to remove temporary IP Set group and tag the VMs that migrate.







 Load balancer migration guidance 

The approach is to configure load balancing in NSX-T in parallel to the existing NSX-V configuration. This action allows testing and then, when verified, cut-over to NSX-T load balancing. To migrate the load-balancing service from NSX-V to NSX-T, consider the following steps:



* Deploy a new NSX-T Edge cluster that contains two Edge node VMs with active or standby configurations.
* Deploy a T1 router into the Edge cluster with centralized service ports (CSP).
How do I protect the VRA itself with a zone-based firewall? 

The VRA does not have a local zone. You can use the Control Plane Policing (CPP) functionality instead as it is applied as a local firewall on loopback.

This is a stateless firewall and you must explicitly allow the returning traffic of outbound sessions that originate on the VRA itself.





 How do I restrict SSH and block connections that come from the internet? 

It is considered a best practice to not allow SSH connections from the internet, and to use another means of accessing the private address, such as SSL VPN.

By default, the VRA accepts SSH on all interfaces. To listen only for SSH connections on the private interface, you must set the following configuration:

set service ssh listen-address '10.1.2.3'

Keep in mind that you must replace the IP address with the address that belongs to the VRA.
The following example CLI command creates a context-based restriction rule for all of the virtual server instances in the current account and restricts access to private endpoints:

ibmcloud cbr rule-create --context-attributes 'endpointType=private' --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for VSIs" --service-name is --resource-attributes "instanceId="

The following example CLI command creates a context-based restriction rule for all the virtual server instances in the resource group and restricts access to private endpoints:

ibmcloud cbr rule-create --context-attributes 'endpointType=private' --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for VSIs" --service-name is --resource-attributes "instanceId=" --resource-group-id 1171749e3a8545069d04e6fca1ded18f





 Creating rules in the UI 



1. Go to Manage > Context-based restrictions in the IBM Cloud® console.
2. Select Rules and click Create.
3. Select VPC Infrastructure Services and click Next.
4. Scope the rule to All resources or Specific resources. For more information, see [Protecting VPC Infrasturcture Services resources](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr). Click Continue.
5. Define the allowed endpoint types.



* Keep the toggle set to No to allow all endpoint types.
* Set the toggle to Yes to allow only specific endpoint types, then choose from the list.



6. Select a network zone or zones that you have already created, or create a new network zone by clicking Create.

Contexts define the location from which your resources can be accessed, effectively linking your network zone to your rule.
7. Click Add to add your configuration to the summary. Click Next.
8.
[CHANGE LOG](https://cloud.ibm.com/docs/hardware-firewall-shared?topic=hardware-firewall-shared-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:



* Allow and route the following service networks to the BCR on your gateway appliance or firewall for all Bare Metal and Virtual Server provisions and reloads: 10.0.64.0/19, 10.200.80.0/20, 161.26.13.0/24, 161.26.96.0/22, 166.9.12.0/23, 166.9.48.0/24, 166.9.50.0/24, 166.9.228.0/24, 166.9.250.192/27, 10.3.160.0/20, 10.201.0.0/20, 161.26.92.0/22, 161.26.132.0/22, 166.9.20.0/23, 166.9.231.0/24.
* For RHEL servers, ensure the entire 161.26.0.0/16 is allowed and routed properly to the BCR. Add any additional datacenter service networks that are mentioned in the RHEL section near the bottom of the page.
* Allow traffic between the service networks and your server in both directions.
* By default, all classic servers and classic gateway and firewall devices are configured with a static route for the 10.0.0.0/8, 161.26.0.0/16 and 166.8.0.0/14 networks to the Back-end Customer Router (BCR). If you configure overlapping routes with those subnets, validate that you have also configured PBR or a similar service. Otherwise, consider using different IP space that doesn't overlap with our service networks for your VPNs or tunnels.
To do this, we'll create a new network zone and apply it to the new rule.



1. Click on Create +.



![Scope the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_5.png)



2. Give the network zone a helpful name and description.
3. Add some IP ranges to the Allowed IP addresses text box.
4. Click Next.



![Scope the rule](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/images/cbr_6.png)





 Step 5: Finish the rule and verify that it works 

Finally, all you need to do is click Create and your new rule will be active.

An easy way to check that it works is to [send a simple CLI command] from outside of the allowed network zone, such as a bucket listing (ic cos buckets). It will fail with a 403 error code.





 Next steps 

Learn more about [context-based restrictions and how they relate to legacy bucket firewalls](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewall).
In the previous lesson, you blocked all traffic and allowed only a few IPs. That scenario works well for testing purposes when you want to limit access to only a few controlled source IP addresses. However, the PR firm has apps that need to be widely available to the public. You need to make sure that all traffic is permitted except for the unusual traffic you are seeing from a few IP addresses. A denylist is useful in a scenario like this one because it can help you prevent an attack from a small set of IP addresses.

In this lesson, block traffic from your own system's source IP address. At the end of Lesson 4, all traffic to the public node ports is blocked, and all traffic to the public NLB is allowed. Only traffic from your specific system IP to the NLB is blocked.

Zoom

![The web server app is exposed by public NLB to the internet. Only traffic from your system IP is blocked.](https://cloud.ibm.com/docs-content/v1/content/4d497aff9e27b92fbbc2ee4e343a9ec4549cb1d7/containers/images/cs_tutorial_policies_L4.png)

Figure 4. The webserver app is exposed by public NLB to the internet.



1. Clean up the allowlist policies you created in the previous lesson.



* Linux:

calicoctl delete GlobalNetworkPolicy deny-lb-port-80

calicoctl delete GlobalNetworkPolicy allowlist
* Windows and OS X:

calicoctl delete GlobalNetworkPolicy deny-lb-port-80 --config=filepath/calicoctl.cfg

calicoctl delete GlobalNetworkPolicy allowlist --config=filepath/calicoctl.cfg



Now, all incoming TCP and UDP traffic from any source IP to the NLB IP address and port is permitted again.
2.
* Alternatively, to allow the inbound traffic for router health checks, you can create a single inbound rule and outbound rule to allow all incoming and outgoing traffic on port 80.
6. In the Outbound rules section, create the following rules by clicking Create.

ACL rules are applied to traffic in a specific order. If you must create custom rules to allow other traffic to or from your worker nodes on this subnet, be sure to set the custom rules' Priority before the final rule that denies all traffic. If you add a rule after the deny rule, your rule is ignored, because the packet matches the deny rule and is blocked and removed before it can reach your rule. Note that these steps outline the minimum ACL rules that are required for basic cluster functionality. You might need to create additional ACL rules based on your use case.



Table 6. Required outbound rules

 Rule purpose Allow/Deny Protocol Source IP or CIDR Source Port Destination IP or CIDR Destination Port Priority 

 Allow worker nodes to be created in your cluster. Allow ALL Any <br><br> * <br><br><br> 161.26.0.0/16 <br><br> * <br><br><br> Set to top 
 Allow worker nodes to communicate with other IBM Cloud services that support private cloud service endpoints, and in clusters that run Red Hat OpenShift version 4.5 or earlier, with the cluster master through the private cloud service endpoint. Allow ALL Any <br><br> * <br><br><br> 166.8.0.0/14 <br><br> * <br><br><br> After 1 
 Multizone clusters: Allow worker nodes in one subnet to communicate with the worker nodes in all other subnets within the cluster. Create one rule for each subnet that you want to connect to. Allow ALL Any <br><br> * <br><br><br> Other subnet's CIDR <br><br> * <br><br><br> After 2 
 Allow incoming traffic requests to apps that run on your worker nodes. Allow TCP Any 30000 - 32767 Any Any After 3
Get user-agent blocking rules GET /v1/{crn}/zones/{domain_id}/firewall/ua_rules internet-svcs.security.read internet-svcs.ua-rules.read 
 Create a user-agent blocking rule POST /v1/{crn}/zones/{domain_id}/firewall/ua_rules internet-svcs.security.manage internet-svcs.ua-rules.create 
 Update a user-agent blocking rule PUT /v1/{crn}/zones/{domain_id}/firewall/ua_rules/{rule_id} internet-svcs.security.update internet-svcs.ua-rules.update 
 Delete a user-agent blocking rule DELETE /v1/{crn}/zones/{domain_id}/firewall/ua_rules/{rule_id} internet-svcs.security.manage internet-svcs.ua-rules.delete 
 Get domain lockdown rules GET /v1/{crn}/zones/{domain_id}/firewall/lockdowns internet-svcs.security.read internet-svcs.domain-lockdown-rules.read 
 Create a domain lockdown rule POST /v1/{crn}/zones/{domain_id}/firewall/lockdowns internet-svcs.security.manage internet-svcs.domain-lockdown-rules.create 
 Update a domain lockdown rule PUT /v1/{crn}/zones/{domain_id}/firewall/lockdowns/{rule_id} internet-svcs.security.update internet-svcs.domain-lockdown-rules.update 
 Delete a domain lockdown rule DELETE /v1/{crn}/zones/{domain_id}/firewall/lockdowns/{rule_id} internet-svcs.security.manage internet-svcs.domain-lockdown-rules.delete 







 Firewall Rules 



Table 8. Firewall Rules

 Action Method IAM ACTION AT ACTION
Firewall rules are enforced at the vNIC level of each VM to provide consistent access control even when the VM gets vMotioned. For more information, see [Distributed firewall](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-95600C1C-FE9A-4652-821B-5BCFE2FD8AFB.html). 
 Configure NAT rules NSX Edge provides Network Address Translation (NAT) services to assign a different source or destination IP address to a VM or a group of VMs. The NAT service configuration is separated into Source NAT (SNAT) and Destination NAT (DNAT) rules. For more information, see [Managing NAT rules](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-5896D8CF-20E0-4691-A9EB-83AFD9D36AFD.html). 
 Configure NSX load balancer The NSX Edge load balancer enables high-availability service and distributes the network traffic load among multiple VMs. It distributes incoming service requests evenly among multiple VMs in such a way that the load distribution is transparent to users. Load balancing helps in achieving optimal resource usage, maximizing throughput, minimizing response time, and avoiding overload. NSX Edge provides load balancing up to Layer 7. You map an external, or public, IP address to a set of internal VMs for load balancing. The load balancer accepts TCP, UDP, HTTP, or HTTPS requests on the external IP address and decides which internal server to use. Port 80 is the default port for HTTP and port 443 is the default port for HTTPs. Two types of load-balancing services are available in NSX: one-armed mode (proxy mode) or Inline mode (transparent mode).
set firewall name VMACCESS2MGMT
set firewall name VMACCESS2MGMT default-action drop
set firewall name VMACCESS2MGMT rule 10 action drop
set firewall name VMACCESS2MGMT rule 10 protocol all
set firewall name VMACCESS2MGMT rule 10 source group network-group 1103VMACCESS
set firewall name STORAGE2MGMT
set firewall name STORAGE2MGMT default-action drop
set firewall name STORAGE2MGMT rule 10 action accept
set firewall name STORAGE2MGMT rule 10 protocol all
set firewall name STORAGE2MGMT rule 10 source group network-group 1102PRIMARY
set firewall name STORAGE2MGMT rule 20 action accept
set firewall name STORAGE2MGMT rule 20 protocol all
set firewall name STORAGE2MGMT rule 20 source group network-group 1102STORAGEA
set firewall name STORAGE2MGMT rule 30 action accept
set firewall name STORAGE2MGMT rule 30 protocol all
set firewall name STORAGE2MGMT rule 30 source group network-group 1102STORAGEB
set firewall name MGMT2STORAGE
set firewall name MGMT2STORAGE default-action drop
set firewall name MGMT2STORAGE rule 10 action accept
set firewall name MGMT2STORAGE rule 10 protocol all
set firewall name MGMT2STORAGE rule 10 source group network-group 1101PRIMARY
set firewall name MGMT2STORAGE rule 10 source group network-group 1101MGMT
commit
save
Show more





 Configuring zone bindings 

Bind particular zones to interfaces on the Brocade vRouter (Vyatta).

Use the following commands in configure mode:

set zone-policy zone OUTSIDE description “Internet Zone”
set zone-policy zone OUTSIDE default-action drop
set zone-policy zone OUTSIDE interface bond1
set zone-policy zone SLSERVICE description “SoftLayer Services”
set zone-policy zone SLSERVICE default-action drop
set zone-policy zone SLSERVICE interface bond0
set security firewall name from-vpc rule 20 source address 10.240.0.0/24
 set security firewall name from-vpc rule 20 action accept
 set interfaces bonding dp0bond0 vif 862 firewall out to-vpc
 set interfaces bonding dp0bond0 vif 862 firewall in from-vpc

You might need to add other rules according to your network requirement to allow other traffic.
* If you are using a zone firewall with IPsec, see [Setting up an IPsec tunnel that works with zone firewalls](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-setting-up-an-ipsec-tunnel-that-works-with-zone-firewalls).
Managing FortiGate firewall rules (policies) 

The FortiGate Security Appliance 1 Gbps (FSA) uses the concept of a "policy". This includes the ability to accept or deny traffic, apply security profiles, shape traffic, log traffic, and schedule a timeframe for a policy to apply. To assemble a policy, you must first create the objects that take part in it.



1. From your browser, open the [IBM Cloud UI Console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/security/firewalls/multivlan/provision) and log in to your account.
2. Follow the How to [Manage the FortiGate Security Appliance](https://cloud.ibm.com/docs/fortigate-1g?topic=fortigate-1g-managing-the-fortigate-security-appliance-1gbps) instructions to find the credentials.
3. After logging in to the appliance, navigate to the Policy and Objects menu and select the protocol that you want to manage (such as IPv4 or IPv6). Policies are implemented against traffic based on the Sequence Number on the far left. Users can drag a policy higher in the list to have it implemented earlier or vice versa.
4. To add a policy, click Create New and refer to these field definitions:

Incoming Interface: Either the public-facing interface (outside interface) for ingress rules or compute-facing interface (inside interface) for egress rules.

Source Address: The source IP for the traffic. The IP must be added to the "Addresses" list on the "Objects menu." An "All" option is available.

Source User: Applies the policy to a user or group created in the "User and Device" panel.

Source Device Type: Applies the policy to a device created in the "User and Device" panel.

Destination Address: The target IP of the traffic. The IP must be added to the "Addresses" list on the "Objects menu."