vania-janet/multiturn-rag-retrieval-data huggingface dataset:
--name ROUTE_NAME
: The name to be given to the route.

Do not include any personal identifying information (PII) in any resource names.

--file RULES_DEFINITION_JSON_FILE
: A JSON file containing the definition of the rules for route. The file needs to be formatted as follows:

[
{
"locations": "LOCATION1","LOCATION2"],
"target_ids": "TARGET_ID1","TARGET_ID2"]
}
]

--rules RULES
: A JSON formatted rule definition enclosed in single quotes. For example:

--rules '[{"locations":"global"],"target_ids":"11111111-1111-1111-1111-111111111111"]},{"locations":"us-south","us-east"],"target_ids":"22222222-2222-2222-2222-222222222222","33333333-3333-3333-3333-333333333333"]}]'

--locations LOCATIONS
: List of locations associated with the route. Specify global to include global events. To include all locations specify . If you have multiple rules, along with a rule with a * location, then the other rules will route events to the specified targets with any events not matching any other rule routing the remaining events to the target specified by the rule with the * location.

--target-ids TARGET_ID
: A comma-separated list of target IDs.

--output FORMAT
: If JSON is specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

help | --help | -h
: List options available for the command.





 Example
[Flow2](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/vpc-to-vpc.png)





 Flow3: VPC to VMware (Overlay Network for VMs) 

![Flow3](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/vpc-to-vmware.png)





 Flow4: VPC to Internet 

![Flow4](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/vpc-to-internet.png)





 Flow5: VPC to Cloud Service Private Endpoints 

![Flow5](https://cloud.ibm.com/docs-content/v1/content/d50364af907081c3c38f99c11f35dd9cab4b2510/vpc-journey/images/network-flows/vpc-to-cse.png)





 Next Steps 

The next step on the deployment journey is:



* [Configure IAM Roles](https://cloud.ibm.com/docs/vpc-journey?topic=vpc-journey-vpc-prep-account)
* Enable full-tunnel mode on VPN servers. Full-tunnel mode is more secure and preferred, especially if connecting from an untrusted network. In full-tunnel mode, all traffic from a VPN client is routed to the VPN server.
* Configure the transport protocol and VPN ports. In some cases, you might not want to leave well-known ports, such as TCP/443, open. Edit this option to use a non-default transport protocol and VPN ports.
* Configure IBM Log Analysis and Activity Tracker to receive and analyze VPN server logs. For more information, see [Using IBM Log Analysis to view VPN server logs](https://cloud.ibm.com/docs/vpc?topic=vpc-client-vpn-log-analysis-c2s) and [Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events&interface=uievents-vpn-server).
* Route 5 - 10.10.128.0/18



Only Route 1 - 10.10.0.0/16 and Route 3 - 10.10.0.0/19 would be learned by the direct link and advertised to attached virtual connections.



* Route 1 - 10.10.0.0/16 does not match with any import filter.



* The route matches filter 2 by address and mask length, but the ge option changes the prefix match specification, excluding route 1's mask of /16.
* The default import filter determines how this route is handled, which is permit.



* Route 2 - 10.10.0.0/18 only matches with import filter 2.



* The ge and le options of filter 2 alter the prefix match specifications to include route 2 with a mask of /18.
* Filter 2's action is deny, so route 2 will not be learned.



* Route 3 - 10.10.0.0/19 matches with import filter 1 and 2.



* The route matches filter 1 by address and mask length. Filter 1 has no ge or le values, so only the exact mask length would match.
* The ge and le options of filter 2 alter the prefix match specifications to include route 2 with a mask of /19.
* Filter 1 is before filter 2 in the list giving higher precedence. That filter action is set to permit, so the route goes through and is learned.



* Route 4 - 120.120.154.0/24 matches filter 3 exactly.



* Filter 3's action is set to deny, so route 4 will not be learned.



* Route 5 matches rule 2 (deny 10.10.0.0/16 ge 18 le 30), therefore route 5 is denied. Moving the prefix into the subnet of 18 expands the address of 10.10.128.0/18.







 Exporting routes 

For this example, direct link routes learned from any virtual connection would pass through the export_route_filters to determine whether the direct link advertises them to the customer's on-premises network.

Let's first understand the route filters.

Route filter 1
Action: permit
Address 10.10.0.0
Mask length: 18
Minimum matching length (ge): 18
Because RMM is deployed in IBM Cloud VPC, it requires a transit gateway for the RMM to communicate with the source and the target server over the private interface. The source and target server also need to be able to communicate with one another.

If the source and target server do not have direct communication, then consider using pass-through with the RMM server. The RMM server acts as a proxy, and migration flows through the RMM server. For more information, search for pass-through in the [RMM user guide](https://www.rackwareinc.com/rackware-rmm-users-guide-for-ibm-cloud). The pass-through migration time increases.

To create an IBM Cloud Transit Gateway and establish connection between classic and VPC, review the following information:



* [Planning for IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tips)
* [Ordering IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ordering-transit-gateway)



For transit gateway and classic, you need to follow two steps:



1. Enable VLAN spanning to allow communication between subnets and data centers in classic. For more information, see [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanning).
2. To allow communication between VPC and classic, both transit gateway and enabling VRF in classic are necessary. For more information, see [Planning for IBM Cloud Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-helpful-tipsgeneral-considerations).



Zoom

![Topology](https://cloud.ibm.com/docs-content/v1/content/8aa0853d34cf2349f1d2db8e5c61e6422a580169/cloud-infrastructure/images/p-p_classic_private_ip_routing2.png)

Figure 1.
Core <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about)[1]<br><br><br> <br><br> * [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-data-securitysat-data-encryption)<br><br><br> 
 Containers <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption)<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encrypt)<br><br><br> <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption)[2]<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_encrypt)<br><br><br> 
 Networking <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-about)<br> * Direct Link [3]<br> * Transit Gateway<br><br><br> 
 Storage <br><br> * [Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption)<br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption)<br><br><br> <br><br> * [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-encryption)<br><br><br>
Open the [VPCs](https://cloud.ibm.com/vpc-ext/network/vpcs) in the IBM Cloud.
2. Select the transit VPC and notice the Address prefixes displayed.
3. Find the additional address prefixes for the enterprise CIDR blocks and note the associated zones.



Also notice that the Address prefix for that transit VPC itself:



* 10.1.0.0/16 Dallas 1.
* 10.2.0.0/16 Dallas 2.
* 10.3.0.0/16 Dallas 3.



The transit VPC will only use a subset of each zone:



* 10.1.0.0/24 Dallas 1.
* 10.2.0.0/24 Dallas 2.
* 10.3.0.0/24 Dallas 3.



The address prefixes for the transit itself is expanded to include all of the spokes to allow the routes to flow to the enterprise.

With these additional address prefixes:



* Spoke VPCs learn that traffic spoke -> (192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24) should pass through the Transit Gateway tgw-link.
* Enterprise will learn that traffic enterprise -> (10.1.0.0/16, 10.2.0.0/16 10.3.0.0/16) should pass through the IBM Cloud® Direct Link









 Step 7: Removing the firewall for Transit destination traffic 

The IBM Cloud VPC uses the industry standard state-based routing for secure TCP connection tracking. It requires that the TCP connections use the same path on the way in as the way out. One exception is Direct Server Return used by routers like [Network Load Balancers](https://cloud.ibm.com/docs/vpc?topic=vpc-network-load-balancers). It allows incoming connections from the enterprise to pass through the firewall to the transit test instance and then return directly to the originator.

Zoom

!
"id": "710y-b8aa945c-7eac-4c15-bad6-a56db9d1e9bd",
"name": "enlace-traverse-oat-console",
"resource_type": "VirtualNetworkInterface"
},
"vpc": {
"crn": "crn:[...]",
"href": "$vpc_api_endpoint/v1/vpcs/82fa21ae-a645-4dd5-9136-d48a723bf00e",
"id": "82fa21ae-a645-4dd5-9136-d48a723bf00e",
"name": "my-vpc-2",
"resource_type": "vpc"
}
}





 Creating a file share and mount target by specifying a subnet and security group 

New

To create the mount target network interface, make a POST /shares request and specify a subnet and security group.

In this example, the mount_targets property specifies a subnet ID and security group ID. When the transit_encryption property is set to user_managed, it enables encryption in transit by using an instance identity certificate. The default value is none, which disables encryption in transit.

curl -X POST "$vpc_api_endpoint/v1/shares?version=2023-06-11&generation=2&maturity=beta" 
-H "Authorization: $iam_token" 
-d '{
"size": 20,
"name": "myshare-3",
"profile": {
"name": "dp2"
},
"zone": {
"name": "us-south-1"
},
"mount_targets": [
"virtual_network_interface": {
"subnet": {
"encoding/json"
"fmt"
"github.com/softlayer/softlayer-go/datatypes"
"github.com/softlayer/softlayer-go/filter"
"github.com/softlayer/softlayer-go/services"
"github.com/softlayer/softlayer-go/session"
"time"
)

// Session created using values set in the environment, or from the local configuration file (i.e. /.softlayer).
var sess = session.New()

// Set the limit number of events that the API retrieves in each SoftLayer_Event_Log::getAllObjects method call.
var pagination = 50

// Set the max number of events to retrieve in each log example function.
var maxNumberOfEvents =200

func main() {

sess.Debug = true

//shows the all user type events
getEventUserTypes()
userType:="EMPLOYEE"
//shows the events with names is a userType value
getLogsByUserType(userType)

//shows the all user type events
getEventNames()
eventName:="Authentication"
//shows the events which names contain the eventName value
getLogsByName(eventName)

//shows the events created from a specific number of days ago
daysAgo:=30
getRecentLogs(daysAgo)

//shows the system logs
getSystemLogs()

//shows the login logs
getLoginLogs()
}

/
Shows the Event Logs by user type.
Request URL:
GET https://api.softlayer.com/rest/v3.1/SoftLayer_Event_Log/getAllObjects.json?
objectFilter={"userType":{"operation":"userType"}}&
objectMask=mask[userType,eventName,eventCreateDate]&
The default is none, which disables encryption in transit. The default access control mode is security_group, which is shown in the response.

curl -X POST "$vpc_api_endpoint/v1/shares?version=2023-05-11&generation=2&maturity=beta" 
-H "Authorization: $iam_token" 
-d '{
"size": 10,
"name": "myshare-1",
"profile": {
"name": "dp2"
},
"zone": {
"name": "us-south-1"
},
"mount_targets": [
"virtual_network_interface": {
"subnet": {
"id": "4e95744c-7e64-48c9-b5d2-3b6481b1dfde"
},
},
"transit_encryption": {
"user_managed"
}
]
}'

A successful response looks like the following example.

{
"access_control_mode": "security_group",
"created_at": "2023-05-11T12:15:12Z",
"href": "$vpc_api_endpoint/v1/shares/90c4bb62-1724-47bd-8c45-f7d37d7c3508/mount_targets/7e5bdb52-676d-43b2-991f-2053cf6855eb",
"id": "7e5bdb52-676d-43b2-991f-2053cf6855eb",
"lifecycle_state": "pending",
"mount_path": "",
"name": "myshare-1",
"primary_ip": {
"address": ""
},
"resource_type": "share_target",
"subnet": {
Workload migration by using vMotion or third-party tools and NSX-T L2 bridge 

VMware NSX-V to VMware NSX-T™ migration in IBM Cloud® is done by following the principles of the VMware® Lift-and-Shift Migration model, which consists of migrating the network configurations and workloads. Migrating workloads during this process can be done in many ways. For example, you can use Advanced Cross vCenter vMotion between the environments, or you can use other optional or existing third-party tools like Veeam® or Zerto.



 Using NSX-T L2 bridge in migration 

Regardless of the tool you choose to migrate the workloads, you typically need to extend L2 between the existing NSX-V instance and the new NSX-T instance. The following diagram presents an overview how to extend the networks with NSX-T L2 bridging capability.

Zoom

![Migration by using vMotion or third-party tools and NSX-T L2 bridge](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/v2t-diagrams-l2-nsx-t.svg)

Figure 1. Migration by using vMotion or third-party tools and NSX-T L2 bridge



1. Your existing NSX-V based instance was deployed previously and it hosts the current workloads and NSX-V network configurations. Before you start the migration, you must have a thorough understanding of the environment, the workloads that are deployed on it, and the NSX-V and underlay network configurations.
2. You can deploy the new vCenter Server® with NSX-T instance with new VLANs and a new POD, or you can use existing VLANs.
3. Capture the existing network configuration and create a new network topology manually, by using scripting or Terraform, migration coordinator, or third-party tools.
4.
* [Latency requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-service-architecturearchitecture-latency)



* [Workload isolation in IBM Cloud Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-service-architectureworkload-isolation)



* [Workload isolation in the IBM Cloud multizone metro that manages your location](https://cloud.ibm.com/docs/satellite?topic=satellite-service-architectureworkload-isolation-cloud)
* [Workload isolation in your Satellite location](https://cloud.ibm.com/docs/satellite?topic=satellite-service-architectureworkload-isolation-location)





[Security and compliance](https://cloud.ibm.com/docs/satellite?topic=satellite-compliancecompliance)



* [Data security](https://cloud.ibm.com/docs/satellite?topic=satellite-compliancesecure-data)



* [What data is stored when I use Satellite? How can I use my own keys to encrypt my data?](https://cloud.ibm.com/docs/satellite?topic=satellite-compliancesecure-data-store-encrypt)
* [How do I make my data secure over Satellite Link?](https://cloud.ibm.com/docs/satellite?topic=satellite-compliancesecure-data-link)
* [What measures can I take to secure user access to data in my location?](https://cloud.ibm.com/docs/satellite?topic=satellite-compliancesecure-data-access)



* [IBM operational access](https://cloud.ibm.com/docs/satellite?topic=satellite-complianceoperational-access)



* [What automated access does IBM have to my location?](https://cloud.ibm.com/docs/satellite?topic=satellite-complianceoperational-access-automated)
* [What access do IBM SREs have to my location control plane, including the masters of Satellite-enabled IBM Cloud service clusters?]
[Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/order-vsrx/vcs-server-list.png)
2. Go to the Infrastructure tab and select the cluster.

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/order-vsrx/vcs-infra-page.png)
3. Scroll down and under network interface expand private VLAN. You will see a field named primary route which will have a value like bcr01a.wdc07 in the example below. This designates that the VCS cluster is in Washington DC 07, POD 1. Take note of this information as it will be needed for the vSRX order.

![Architecture](https://cloud.ibm.com/docs-content/v1/content/7f09c1b3f21dd05ddc2c4638a3dc66976ad73e53/vmware-classic-journey/images/solution-vmware-onboarding-hidden/order-vsrx/network-interface.png)
4. From the hamburger menu choose Classic Infrastructure > Gateway Appliances (or go to https://cloud.ibm.com/gen1/infrastructure/provision/gateway). !
VLAN 1 Private Transit Private transit VLAN, ESXi management, and vMotion 
 VLAN 2 Public Transit Public transit VLAN 







 Naming conventions 

The following naming conventions are used for deployment. For readability, only the specific naming is used. For example, instancename-dcname-clustername-tz-edge-private is referred to as tz-edge-private.



Table 7. NSX-T design naming convention

 Description Naming Standard 

 Management VMs instancename-nsxt-ctrlmgr0 <br>instancename-nsxt-ctrlmgr1 <br>instancename-nsxt-ctrlmgr2 
 Uplink profiles instancename-esxi-private-profile <br>instancename-esxi-public-profile <br>instancename-edge-private-profile <br>instancename-edge-public-profile <br>instancename-edge-tep-profile <br>instancename-mgmt-edge-private-profile <br>instancename-mgmt-edge-public-profile <br>instancename-mgmt-edge-tep-profile 
 NIOC profiles instancename-clustername-nioc-private-profile <br>instancename-clustername-nioc-public-profile 
 Gateway cluster profiles instancename-dcname-clustername-service-edge-cluster-profile <br>instancename-dcname-clustername-service-edge-cluster-profile 
 Transport zones instancename-tz-esxi-private <br>instancename-tz-esxi-public <br>instancename-tz-vm-overlay <br>instancename-tz-edge-private <br>instancename-tz-edge-public
* Technically Identifiable Personal Information (such as device IDs, usage-based identifiers, static IP address, and so on. - when linked to an individual)
* Healthcare Information (data related to physical or mental health of an individual, or which otherwise reveals information about his or her health status)







 Usage Data 

When engaging in the Permitted Uses of the Service, Developer may collect certain information automatically, including, but not limited to the following (collectively "Usage Data"):



* The types of devices being used for testing or development
* IP addresses
* Operating systems
* The types of Internet browsers used
* Unique device identifiers and other diagnostic data









 Use Of Data 

Developer uses the collected data for various purposes:



* To perform development and testing of applications
* To provide analysis or valuable information to improve development and testing
* To monitor usage in development and testing
* To detect, prevent, and address technical issues







 Transfer Of Data 

Information, including Personal Data, may be transferred to — and maintained on — computers located outside of Developer’s state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Developer’s jurisdiction.

Developer will take all steps reasonably necessary to ensure that Personal Data is treated securely and in accordance with this Privacy Policy and applicable law. Developer will also ensure no transfer of Personal Data will take place to an organization or a country, unless there are adequate authorizations and controls in place including obtaining consent where necessary and ensuring the security of Personal Data.





 Disclosure Of Data 



 Legal Requirements 

Developer may disclose Personal Data in the good faith belief that such action is necessary:



* To comply with a legal obligation
* To protect and defend the rights or property of Developer
* To prevent or investigate possible wrongdoing in connection with development and testing activities
* To protect the safety of Personal Data
* To protect against legal liability









 Security Of Data 

Developer will strive to use appropriate means to protect all Personal Data used in performing the Permitted Uses of the Service.





 Service Providers 

Developer may employ third-party companies and individuals ("Service Providers") to facilitate Permitted Uses of the Service, including to perform development and testing, or to analyze development and testing activities.
* Check whether Hyper Protect DBaaS for PostgreSQL is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
* Check whether data disks are encrypted with customer-managed keys







 NIST supplemental guidance 

This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. System-related information requiring protection includes, for example, configurations or rule sets for firewalls, gateways, intrusion detection/prevention systems, filtering routers, and authenticator content. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing Write-Once-Read-Many (WORM) technologies. Organizations may also employ other security controls including, for example, secure off-line storage in lieu of online storage when adequate protection of information at rest cannot otherwise be achieved and/or continuous monitoring to identify malicious code at rest.
* To prevent or investigate possible wrongdoing in connection with development and testing activities
* To protect the safety of Personal Data
* To protect against legal liability









 Security Of Data 

Developer will strive to use appropriate means to protect all Personal Data used in performing the Permitted Uses of the Service.





 Service Providers 

Developer may employ third-party companies and individuals ("Service Providers") to facilitate Permitted Uses of the Service, including to perform development and testing, or to analyze development and testing activities.

These Service Providers have access to Personal Data only to perform these tasks on Developer’s behalf and are obligated not to disclose or use it for any other purpose.





 Children's Privacy 

The Permitted Use of the Service does not address anyone under the age of 18 ("Children").

Developer does not knowingly collect Personal Data from anyone under the age of 18. If Developer becomes aware of the collection or processing of Personal Data from Children without verification of parental consent, Developer will take steps to remove that information from the default settings of App ID.





 Changes To This Privacy Policy 

This Privacy Policy may be updated from time to time and any changes will be reflected by posting the new Privacy Policy on this page. Before the change becomes effective and updated, notification is made via prominent notice on our Service.

This Privacy Policy should be reviewed periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.





 Contact Us 

For any questions about this Privacy Policy, please contact the Developer.