vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can either [choose the allowed network when you provision the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision) or [update the network access policy after you set up the instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-network-access-policies).

Before you [update the network access policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-network-access-policies), you need to initialize the service instance first. See [Initializing service instances with the IBM Cloud TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) or [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities) for instructions.

Added: ReencryptSingle function in GREP11 API
: The GREP11 API now supports the ReencryptSingle function, which enables you to decrypt data with the original key and then encrypt the raw data with a different key in a single call within the cloud HSM. This single call is a viable option where a large amount of data needs to be reencrypted with different keys, and bypasses the need to perform a combination of DecryptSingle and EncryptSingle functions for each data item that needs to be reencrypted. For more information, see [GREP11 API reference - ReencryptSingle function](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-refgrep11-ReencryptSingle).

Added: Support for accessing service instances through the Virtual Private Endpoint
Integrations 

Integrations in Event Notifications represent list of other IBM Cloud services that are connected to your Event Notifications instance. You can encrypt the data that you store in IBM Cloud databases by using encryption keys that you can control. For more information, see [Integrating with a Key management service](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-integrationsen-int-key-management). You can also collect failed events and take appropriate action. For more information, see [Collect failed events](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations).



 Integrating with a Key management service 

You can use either one of the following options:



* Bring Your Own Key (BYOK) through IBM Key Protect, and use one of your own keys to encrypt your databases and backups.
* Hyper Protect Crypto Services (HPCS) - IBM Cloud® Hyper Protect Crypto Services, a dedicated key management service, and Hardware Security Module (HSM) that provides you with the Keep Your Own Key capability for cloud data encryption with exclusive control of your encryption keys.



BYOK and KYOK capabilities are supported only for Event Notifications Standard plan.

For more information, see [Managing encryption](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-managing-encryption).

If you are using Event Notifications CLI or API to integrate with a key management service (KMS), ensure that you have enabled authorization to grant access between services before integrating with a KMS service. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-integrationsen-using-auth-access-between-services).

You can create and bring keys that are created by using Key Protect or Hyper Protect Crypto Services.
[Add IKE v2 Policy](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-ike-v2-policy.png)

Add IKE v2 Policy
* Configure the IPSec Proposal settings, which define the combination of security protocols and algorithms that secure traffic in an IPsec tunnel.

Zoom

![Add IKE v2 IPSec Proposal](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-ike-v2-ipsec-proposal.png)

Add IKE v2 IPSec Proposal
* Specify the Pre-shared Key that is defined on both the local and remote device. The key can be 1-127 alphanumeric characters. Then, click NEXT.

Zoom

![Pre-Shared Key](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-pre-shared-key.png)

Pre-shared Key



5. Review the summary and click FINISH.
6. To create the secondary IPsec tunnel, follow these steps:



1. Click the + button from the Device Summary page.
2. Repeat steps 3 through 5 with the following exceptions:



* For the Remote IP Address, use the greater IBM Gateway members public IP for the secondary IPsec tunnel.
* Use the same IKE VERSION 2 configuration and IPSec Proposals as the primary tunnel.





7. Create an access control policy to permit traffic across the VPN. To do so, follow these steps:



1. Click Policies from the menu bar.
Source – Click on the pencil icon next to source and toggle the slider next to Any source to green (enabled). Click on Keep when complete.
4. Destination – Click on the pencil icon next to destination and select IP Set ipset-dnat-to-jump (or Static Group if that would have been used). Click on Keep when complete.



7. Review the inputs and click on Save when complete.



The new firewall rule will be created. This may take a few seconds to complete. Repeat the process for the other firewall rules, or more if needed in your solution.





 Step 6: Connect to the virtual machine using the web console 

Prior to logging in to the virtual machine for the first time you will need to get the provisioned password.

To get the password:



1. Click on Details on the virtual machine.
2. Click on Guest OS Customizations.
3. Click on Edit.
4. The password auto generated during virtual machine provisioning will be listed under Specify Password. Copy this password to a safe space to be used upon initial login. Click on Discard when this password has been saved.



To connect to the virtual machine using the web console:



1. Click on Launch Web Console to open a local console to the virtual machine.
2. Using the web console, log in to the virtual machine using root as the user ID and the password you captured from the previous step.
3. You should then be able to ping Internet resources such as www.ibm.com, showing that the networking is complete and working.







 Step 7: Connect to the virtual machines though the Internet and validate connectivity 

The final step is to connect to the virtual machine through the Internet to validate the deployment and its network connectivity.

To connect to the virtual machine through the Internet:



1. You should be able to ping the public IP address public-ip-0 from your laptop or workstation, showing that the networking is complete and working.
2. You should be able to use RDP to connect to your Jump Server using the public IP address public-ip-0 and the username and password collected in the previous step.
Proceed with the connection only if the host key fingerprint matches the specified value for the server that is provided in the following code snippets.

au-syd.git.cloud.ibm.com:
ECDSA:
SHA256:oUpjbxJ+UVIlBvcdcKuprZ0JEtCWkTu1yFTdfFHoEF8
MD5:ca:34:27:f1:49:fd:b4:9d:e8:ce:d2:7b:99:a1:dd:98
ED25519:
SHA256:uUqxTjqUQuBjmQGynGb8pXX6FQ2Ag0VLAh4TtuSZMAQ
MD5:87:ad:c9:26:bd:7f:bc:a8:1c:dc:07:ca:aa:d3:8c:9e
RSA:
SHA256:y+QM+SbgQ7SqzQXqwmJTPD0jni+qsDdqZg/sOgOFWbY
MD5:70:71:95:b5:2a:b4:04:ad:12:b4:77:c6:cf:fe:35:c8

ca-tor.git.cloud.ibm.com:
ECDSA:
SHA256:xqeLs5qKCCNd/SmSTgFktFJW8nTqnF5BmwJSZggguJI
MD5:fb:41:1a:b4:8c:4d:95:c3:67:d9:eb:4a:b1:94:c2:cb
ED25519:
SHA256:mT5EGA/63iaHQZrFkXevP+T/qaFN39JChMGUJtla4nE
MD5:6f:f2:4e:0e:90:0b:2b:e7:fc:f8:d2:1a:16:35:16:fc
RSA:
<br><br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Isolate management VPC and allow only a limited number of network connections<br> * All other connections from or to management VPC are forbidden<br><br><br> ACL and security group rules in management VPC More ports might be opened in preset or added manually after deployment 
 <br><br> * Isolate workload VPC and allow only a limited number of network connections<br> * All other connections from or to workload VPC are forbidden<br><br><br> ACL and security group rules in workload VPC More ports might be opened in preset or added manually after deployment 
 Load VPN configuration to simplify VPN setup VPNs VPN configuration is the responsibility of the customer
When the edge application is working, it is important to prevent users from using the global load balancer directly. This is especially important to prevent a DDoS attack against the global load balancer. To prevent users from accessing the global load balancer directly, create a policy within BIG-IP that allows traffic to pass that specifies the FQDN of the Range application only.





 Step 5: Enable license modules on the BIG-IP 



1. Under System > License, click the Module Allocation tab.
2. If Application Security (ASM) is not enabled, enable it with the Nominal selection.
3. After BIG-IP restarts, log back into the BIG-IP console.







 Step 6: Import client certificate and key to BIG-IP 



 Import client key 



1. In the BIG-IP console, go to System > Certificate Management > Traffic Certificate Management.
2. Click Import.
3. Select Key from the Import Type.
4. Type in a name for your key under the option Key Name.
5. Either upload your key or paste your key under the option Key Source.
6. Select the proper security type.
7. Click Import.







 Import client certificate 



1. In the BIG-IP console, go to System > Certificate Management > Traffic Certificate Management.
2. Click Import.
3. Select Certificate from the Import Type.
4. In the Certificate Name field, enter a name for your certificate.
5. Either upload your certificate or paste your certificate under the option Certificate Source.
6. Click Import.



BIG-IP feature enhancement for HPCS integration is being worked on.







 Step 7: Import server-side intermediate certificates to BIG-IP 

For each server certificate that you have, complete the following actions:



1. In the console, go to System > Certificate Management > Traffic Certificate Management.
2. Click Import.
3. Select Certificate from the Import Type.
4. In the Certificate Name field, enter a name for your certificate.
5.
If a failover is automated and a regional backup is enabled, it is always best to try a different zone first and only redirect traffic to the passive backup region if a preconfigured number of failures occur within a short period of time. This prevents an unnecessary failover between regions if only a short outage occurs.

Note that Watson Assistant provides a round-robin fully qualified domain name (FQDN) that includes the IPs for each zone in the region. Many SIP trunking providers automatically retry each IP in the FQDN when failures occur. To support disaster recovery, the service provider may need to configure two separate SIP trunks, one for each region, and only when all the zones in a single region fail should the call be switched to the backup region. It's important to set the SIP INVITE failure timeouts at the SIP trunking provider low enough to avoid long call setup latencies when a failover is occurring.





 Partial service outage 

The second type of failure is a partial service outage within the region. This is much harder to detect and manage because of the large number of variations in service failures that can occur within a region. In some cases, these may be small issues that affect the performance characteristics of the call but not cause the call to fail.

For issues like this that ultimately cause a call to fail, there are two ways Watson Assistant can handle the call. The first is to accept the call and then transfer it to a configured default SIP URI. This can be configured in the Watson Assistant phone integration settings and is also used if there is a mid-call failure. The default transfer target SIP URI is defined in the SIP target when a call fails field located on the Advanced tab of the phone integration configuration panel.

The phone integration can also be configured to respond to a SIP INVITE with a SIP 500 (service unavailable) message if an outage is detected during call setup instead of transferring a call to a live agent. A SIP 500 can then be used to redirect the call to another zone, or if many SIP 500s are received, to another region. Using a SIP 500 INVITE error is a better way to signal a failure to an upstream SIP trunking provider because it gives the provider a way to reroute the call.
On the Download and install Secure Gateway client page, download the appropriate version of IBM® Secure Gateway for IBM Cloud®.
3. After you complete the download, click Download Secure Gateway and Continue.
4. When prompted, enter the Gateway ID and Token that are displayed.

For more information, see [Installing the client](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-install).
5. On the machine where the Secure Gateway Client is running, open the Secure Gateway dashboard at http://localhost:9003.
6. Click add ACL on the dashboard, and add the URL of the data source that you want to access to the Allow access list.

For example, hostname: mycompany.sharepoint.com or mycompanywebsite.com and port: 80.
7. Return to Discovery, and click Continue.



* If the connection is successful, a Connection successful message is displayed.
* If the connection is unsuccessful, open the IBM® Secure Gateway for IBM Cloud® dashboard, and verify that the endpoints on the Allow access list are correct.









 Data source connection and data isolation 

When you connect to external data sources, you reduce the data isolation of your service instance because data in transit between the source and the service cannot be isolated. All other data isolation (at-rest, administration, query) remains in full. All in-flight communication among services and data sources is encrypted with TLS v1.2. The private keys for the TLS certificates are encrypted at rest with AES-256-GCM encryption. The service certificates expire every three years and the certificate revocation lists are updated monthly. All credentials are sent over an encrypted connection that uses TLS v1.2 and are encrypted at rest with AES-256 encryption. Connections to data sources use the secure protocols that are supported by the data sources.





 Viewing collections that are connected to a gateway 

You can view a list of collections that are connected to a particular gateway. Complete the following steps to view collections that share a particular gateway:



1.
// example: “ibm-lh-client/localstorage/volumes/infra/tls/truststore.jks";
String ts_password = System.getenv("TRUSTSTORE_PASSWORD");
// example: "changeit";
Connection connection = null;
Statement statement = null;
ResultSet resultSet = null;
try
{
/ load the Presto JDBC Driver class /
String driverClass = "com.facebook.presto.jdbc.PrestoDriver";
Class.forName(driverClass);
/ Set the connection properties/
Properties properties = new Properties();
properties.setProperty("user", username);
properties.setProperty("password", password);
properties.setProperty("SSL", "true");
/
* identify where the java truststore is located.
* skip if the default JDK truststore already has the Presto Server's certificate
* or if the Presto server has signed certificates
/
properties.setProperty("SSLTrustStorePath", ts_location);
properties.setProperty("SSLTrustStorePassword", ts_password);
/ Connect /
connection = DriverManager.getConnection(presto_url, properties);
/ Issue a Query /
String query = "SELECT * FROM tpch.tiny.customer LIMIT 10";
statement = connection.createStatement();
resultSet = statement.executeQuery(query);
/ iterate through the results /
while (resultSet.next())
{
String phone = resultSet.getString("phone");
String name = resultSet.getString("name");
System.out.println("phone = " + phone + ", name = " + name);
}
}
catch (Exception e)
{
e.printStackTrace();
}
finally
{
* Resolve Secure Gateway Client UI vulnerability
* Resolve resource auth vulnerability
* Enhance the handling when both side close the connection in the same time
* Resolve collapsed resource when the on-prem destination connection close too fast







 Breaking changes 

You might get certificate error when the Secure Gateway Client is sending connection to the endpoint since this release, to fix the vulnerabilities, we start to check whether the certificate of the endpoint is authorized with the list of supplied CAs.

To fix the error, you can upload the CAs to the [resource authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destcloud-or-on-prem-auth) such that the Secure Gateway Client can trust it, or you can upgrade the Secure Gateway Client to v1.8.4 or later, then disable the Reject unauthorized in the [resource authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destcloud-or-on-prem-auth).







 v1.8.2 Fixpack 1 

Published date: 2019-04-30



 Fixes 



* Upgrade Node.js to 8.15.1
* Resolve undefined environment info in Deutsch
* Resolve the incorrect concurrent connection limit for reverse connections
* Resolve collapsed connections when both side end the connection in the same time









 v1.8.2 

Published date: 2019-03-12



 Features and Fixes 



* Upgrade Node.js to 8.15.0
* Node modules vulnerabilities fix







 Breaking changes 

The system requirement is changed since this release. For more information, see [System Requirements](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-client-requirementssystem-requirements)







 v1.8.1 

Published date: 2019-01-13



 Features and Fixes 



* Resolve regular connections hanging issue when closing
: To ensure the exclusive control on the execution of cryptographic operations, you can use the Hyper Protect Crypto Services certificate manager CLI to enable the second layer of authentication for EP11 (GREP11 or PKCS #11 API) connections. By enabling this function, you enable an extra layer of access control on top of the Identity and Access Management (IAM) token to the EP11 applications. A mutual TLS connection is established to ensure that only EP11 applications with a valid client certificate can perform EP11 operations. For more information, see [Enabling the second layer of authentication for EP11 connections](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11)

Added: Hyper Protect Crypto Services expands into the Tokyo region
: You can now create Hyper Protect Crypto Services instances in the Tokyo (jp-tok) region where the infrastructure is based on IBM Cloud Virtual Private Cloud (VPC). For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).

Added: Using Terraform to initialize the Hyper Protect Crypto Services instance
: With the integration with Terraform, now you can initialize your service instance by using Terraform, and then automate actions by using Terraform. For more information, see [Setting up Terraform for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-terraform-setup-for-hpcs) and the [Terraform documentation - Hyper Protect Crypto Services](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/hpcs).

Added: Using a signing service to manage signature keys for instance initialization
: If you are using Terraform or key part files to initialize a service instance, you can now choose to use a third-party signing service to create, store, and manage the administrator signature keys that are used by Terraform or the Trusted Key Entry (TKE) CLI plug-in.
You can get the SIP URI for your phone integration from the phone integration configuration page.
6. If you plan to support call transfers, enable Call Transfer (SIP REFER) in your SIP trunk. If you expect to transfer calls to the public switched telephone network (PSTN), also enable PSTN Transfer on your trunk.
7. Select Numbers from the navigation bar for your SIP trunk, and then do one of the following things:



* Click Add a number and then Buy a Number.
* If you already have a number, you can click Add a number and then Add an Existing Number.





If you use a Lite or Trial Twilio account for testing purposes, then be sure to verify the transfer target. For more information, see the [Twilio documentation](https://support.twilio.com/hc/en-us/articles/223136107-How-does-Twilio-s-Free-Trial-work-).

You cannot enable SIP authentication if you choose Twilio as your SIP trunk provider. Twilio doesn't support SIPS for originating calls.





 Using other third-party providers 

You can ask for help setting up an account with another SIP trunk provider by opening a support request.

IBM has established relationships with the following SIP trunk providers:



* [Five9](https://www.five9.com/products/capabilities/contact-center-software)
* [Genesys](https://www.genesys.com/en-sg/definitions/what-is-a-trunk)
* [Vonage](https://www.vonage.com/communications-apis/sip-trunking/)
* [Voximplant](https://voximplant.com/)



The SIP trunk provider sets up a SIP trunk for your voice traffic, and manages access from allowed IP addresses. Most of the major SIP trunk providers have existing relationships with IBM. Therefore, the network configuration that is required to support the SIP trunk connection typically can be handled for you with minimal effort.



1.
If you have a toolchain and are adding this tool integration to it, from the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous Delivery card, click View toolchain. Then, click Overview.

a. Click Add tool.

b. In the Tool Integrations section, click Key Protect.
3. Specify a name for this instance of the Key Protect tool integration to use in your toolchain. The name that you specify is used in the UI tools that select Key Protect secrets. It is also used as part of the reference that resolves the secret values when the toolchain runs. This instance name is also displayed on the Key Protect tool integration tile within the toolchain workspace.
4. Review the default values for Region and Resource-Group and update, if required.
5. Select the instance of the Key Protect service that you want to use.
6. Click Create Integration.
7. On the Toolchain's Overview page, on the Third-Party tools card, click Key Protect.





 Applying secrets 

After your Key Protect tool integration is configured, you can use it to apply secrets anywhere that they are needed by the toolchain. The following example applies a secret that is stored in Key Protect to an IBM Cloud API key that is required by the [Pipeline tool integration](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline). You can follow the same steps to apply secrets to any of the Continuous Delivery tool integrations that require secret values.

You must save third-party secrets, such as a Slack webhook or an Artifactory API token, in Key Protect before you create a new toolchain.