vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Secure access to services by using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview) and [Securing your connection when you use the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-service-connection).



 IBM Cloud Command Line Interface 

The [CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started) offers a powerful set of commands to work with your resources. Most of the services that are part of the reference architectures have [specific plug-ins](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins) that you can use to extend the base CLI experience.

The following table provides links for the CLI extensions for each service in the reference architectures that has one.



Table 2. CLI information for services in reference architectures

 Category VPC reference architecture Satellite reference architecture Optional for both 

 Core <br><br> * [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environment)[1]<br><br><br> <br><br> * [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-cli)<br><br><br>
[Local TLS Mutual Authentication Details](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/editLocalTLSma.png?raw=true)







 Downloading the Security Files 

From the destination info panel of my destination, there is a link to download a .zip file containing all the certificates and keys associated with my destination:

![Mutual Authentication Info Panel](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/infoPanelMA.png?raw=true)

After downloading the .zip and extracting the files, I now have the following:



 File Name Purpose 

 secureGatewayCert.pem Primary certificate of the Secure Gateway server 
 DigiCertCA2.pem Intermediate certificate of the Secure Gateway server 
 DigiCertTrustedRoot.pem Root certificate of the Secure Gateway server 
 Nn5TJ34LyVQ_i2NOT_cert.pem Auto-generated certificate to be used by my application when connecting to the cloud host and port 
 Nn5TJ34LyVQ_i2NOT_key.pem Auto-generated key to be used by my application when connecting to the cloud host and port 
 Nn5TJ34LyVQ_i2NOT_destCert.pem Auto-generated certificate for the SG Client to use when connecting to the destination 
 Nn5TJ34LyVQ_i2NOT_destKey.pem Auto-generated key for the SG Client to use when connecting to the destination 
 Nn5TJ34LyVQ_clientCert.pem Auto-generated certificate from your gateway for the SG Client to use in the event it does not have a _destCert or _destKey file 
 localServerCert.pem The certificate of my local resource to be used in the CA of the Secure Gateway Client 







 Creating the Application
Ensure that software is developed, deployed, configured, and managed in a way that is consistent with the control requirements.<br><br><br> 
 [Implement a system of account, identity, and access management to enable a zero trust environment](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-zero-trust) <br><br> * For accounts and resources in IBM Cloud, use IBM Cloud IAM for account, identity, and access management for IBM Cloud. See [Accounts, identity management, and access control](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup) for more details.<br> * For accounts and resources managed outside of IBM Cloud (such as source code control systems, databases, federated identity providers, user directories, and so on), use solutions for account, identity, and access management that are appropriate for those resources.<br> * For all workload operators, develop and use tools and processes of your choosing that allow operators to request access to be granted, to have access revoked, and so on.<br> * For workload consumers accessing your workloads (both web apps and APIs), use App ID (either federated or not) or bring your own solution.<br><br><br> <br><br> * For operators of the IaaS / Data Center, use your own solutions for account, identity, and access management.<br> * Develop and use tools and processes of your choosing for operators to request access, to be granted access, to have access revoked, and so on.<br><br><br>
Connecting application provider to the management VPC 

The management VPC should be accessed only by you, the application provider. It's important that the connection be secure to avoid bad actors gaining access and conducting malicious operations. There are two options to enable this connectivity from your on-premises enterprise network: [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-dl-about) and [VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn). Alternatively, if you want to support connectivity without going through your enterprise network, you can deploy your own full tunnel client-to-site VPN solution. After a connection is established, operators can [complete actions through a bastion host](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion) in the management VPC.

Operators who are connecting to the on-premises enterprise network from offsite (such as their home) should connect to the enterprise network only by using a full tunnel client-to-site VPN solution. After connected to the enterprise network through a full tunnel, they can access the management VPC to perform their duties.



 Direct Link 

Direct Link is the most secure way to enable connectivity from the application provider's on-premises environment to the management VPC. The speed and reliability of Direct Link extends your organization’s data center network and offers more consistent, higher-throughput connectivity, keeping traffic within the IBM Cloud network. When using Direct Link, a private [Application Load Balancer for VPC (ALB)](https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancers) is used to distribute traffic among multiple server instances within the same region of your VPC.

The following diagram shows the Direct Link connection pattern.

Zoom

!
AT&T NetBond Essentials using Equinix Fabric ordering considerations 

Follow these steps to create a Direct Link connection for your AT&T NetBond Essentials service provider.



1. Obtain an IP subnet and local ASN (Public ATT ASN) for the BGP from the AT&T NetBond Essentials service on the Total Access Orchestration (TAO) platform.

This block is /29 broken down into two /30 subnets. You require the /30 subnet for ordering in the IBM Cloud® console.
2. Using your IBM Cloud account, order an IBM Cloud Direct Link Connect gateway through the [IBM Cloud console](https://cloud.ibm.com/login). For instructions, see [Ordering IBM Cloud Direct Link Connect](https://cloud.ibm.com/docs/dl?topic=dl-how-to-order-ibm-cloud-dl-connect).

During the ordering process (Step 7), Make sure to specify the AT&T-supplied IP addresses instead of your actual client Edge IP addresses.

To add your own IP address, follow these steps:



* Choose Manual-select IP.
* For Range, select Public.
* For Your CIDR, enter the specific IP address from the AT&T-supplied subnet (for example, 10.254.0.26/30).
* For IBM CIDR, enter the specific IP address from remaining addresses in the AT&T-supplied subnet (for example, 10.254.0.25/30).
* for the BGP ASN, enter the supplied local ASN (AT&T Public ASN) supplied by AT&T.

Zoom

![Direct Link Connect ordering](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/public-range.png)

Manual-select IP Public Range



Write down and retain the connection name and the service key that was generated from the order.
3.
You can also add security zones by attaching more VXLANs to new logical interfaces on the DLR.
* Two VMware NSX Edge Services Gateways (ESGs):



* A secure management services ESG for outbound HTTPS management traffic, which is deployed by IBM as part of the management networking typology. This ESG is used by the IBM management VMs to communicate with specific external IBM management components that are related to automation. For more information, see [Configuring your network to use the customer-managed ESG](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_esg_config).



This ESG is not accessible to you and you cannot use it. If you modify it, you might not be able to manage the vCenter Server with Hybridity Bundle instance from the IBM Cloud for VMware Solutions console. In addition, when you use a firewall or disable the ESG communications to the external IBM management components cause IBM Cloud for VMware Solutions to become unusable.



* A secure customer-managed ESG for outbound and inbound HTTPS workload traffic, which is deployed by IBM as a template that can be modified by you to provide VPN access or public access. For more information, see [Does the customer-managed NSX Edge pose a security risk?](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutionsfaq-customer-nsx)





For more information about networking components that are ordered when you deploy the HCX service, see [HCX overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx_considerationshcx_considerations).





 Virtual Server Instances 

Your existing instance contains the following virtual server instances (VSIs):



* A VSI for IBM CloudDriver.
* A single Microsoft® Windows® Server VSI for Microsoft Active Directory™ (AD) or two high availability Microsoft Windows VMs on the management cluster that was chosen at initial deployment.







 vSAN storage
The fewer the network nodes (for example, firewalls or routers) to traverse, the better.





 Prerequisites 

If you intend to connect by using the SSL protocol, download and install GSKit V8. See [GSKit V8 - Install, Uninstall and Upgrade instructions](http://www.ibm.com/support/docview.wss?uid=swg21631462). Click the operating system tab that applies to your client machine’s operating system. If you are installing the GSKit on a Windows computer, ensure that you specify the GSKit installation directory path (<installation_directory>gsk8bin) for the PATH environment variable.

Before attempting to connect to your Db2 Warehouse on Cloud database, verify that you have the [prerequisites](https://cloud.ibm.com/docs/Db2whc/connecting?topic=Db2whc-connect_ovprereqs).

If you intend to connect by using the SSL protocol, download the DigiCertGlobalRootCA.crt SSL certificate from the web console to a directory on the client machine. To download the certificate, click Connection > Connection Information and then click the Connection with SSL tab.





 Procedure 



1. Choose one of the following approaches to make your connection:



* To create a connection with SSL, complete the following steps:

a. Issue the following command:

cd /<ssl_directory_name>/ssl

where /<ssl_directory_name>/ssl is the path to the directory into which you downloaded the DigiCertGlobalRootCA.crt SSL certificate.

b. Create a client key database and a stash file by using the GSKCapiCmd tool. For example, the following command creates a client key database that is called dashclient.kdb and a stash file that is called dashclient.sth:

gsk8capicmd_64 -keydb -create -db "dashclient.kdb" -pw "passw0rdpw0" -stash

where passw0rdpw0 is a password.
Initializing service instances with smart cards and the Management Utilities 

Before you can use your Hyper Protect Crypto Services instance, you need to first initialize your service instance by loading the master key. Initialize your service instance by using smart cards and the Hyper Protect Crypto Services Management Utilities with the steps that are provided.

For an introduction to the approaches of service instance initialization and the related fundamental concepts, see [Initializing service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-service) and [Introducing service instance initialization approaches](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode).

The Hyper Protect Crypto Services [Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeunderstand-management-utilities) use smart cards to hold

signature keysand master key parts. You need to complete the tasks in [Setting up smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilities) before you can complete the steps in this task.

You can also watch the following video to learn how to initialize Hyper Protect Crypto Services instances with smart cards and the Management Utilities:



 Before you begin 



1. Make sure that you [set up the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilities).
2. Complete [the prerequisite steps](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-prerequisite) before you initialize your service instance.
3. Plug the two [smart card readers](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-prepare-management-utilitiesorder-smart-card-and-reader) into the USB ports of your workstation.
4.
You can choose if you want to expose your apps to the public, or if you want your apps and services be reachable on the private network only. When you keep your apps and services private, you can leverage the built-in security features to assure secured communication between worker nodes and pods. To expose services and apps to the public internet, you can leverage the [NLB and Ingress ALB support](https://cloud.ibm.com/docs/containers?topic=containers-cs_network_planningpublic_access) to securely make your services publicly available. Ensure that only necessary services are exposed, and revisit the list of exposed apps regularly to ensure that they are still valid. 
 Keep worker nodes private When you create a cluster, every cluster is automatically connected to a private VLAN. The private VLAN determines the private IP address that is assigned to a worker node. You can choose to keep your worker nodes private by connecting them to a private VLAN only. Keep in mind that to communicate with the Kubernetes master from your local machine and for IBM Cloud Kubernetes Service to connect to IBM Cloud services that don't support a private cloud service endpoint, you must configure public connectivity to [specific URLs and IP addresses](https://cloud.ibm.com/docs/containers?topic=containers-firewallfirewall_outbound). If the IBM Cloud services that you want to connect to have a private cloud service endpoint and your account is enabled for VRF, network traffic to and from these services is automatically routed over the private network and no public network connection is required. To set up public connectivity for cluster that is connected to a private VLAN only, you can configure a firewall, such as a [Virtual Router Appliance](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-about-the-vra), in front of your worker nodes and enable network traffic to these URLs and IP addresses. 
 Limit public internet connectivity with edge nodes If you don't create a cluster with a gateway enabled, every worker node is configured to accept app pods and associated load balancer or ingress pods.
When you order Direct Link Connect via the IBM Cloud console, you need to populate the Layer-3 provider's ASN for the BGP session, not your customer ASN.



* Layer-3 IP VPN or AVPN networks enable "any-to-any" connectivity.
* Layer-3 networks require the network service provider to maintain a BGP session between the enterprise and IBM Cloud.
* Certain network service providers might restrict certain functionalities across their network when using Layer-3 connections, such as ASN prepend, GRE tunneling, and so forth. Be sure to check with your provider about possible restrictions.







 Provider interconnection table 

The following table summarizes the type of connections that each IBM Cloud partner provides.



Table 1: Provider interconnections

 Partners Interconnection type 

 AT&T NetBond for Cloud Layer 3 
 AT&T Cloud Gateway (formerly known as RedFringe) Layer 3 
 Bell Canada Layer 3 
 British Telecom Layer 3 
 Chief Telecomm Layer 2 
 China Unicom Layer 3 
 Colt Layer 2 
 Console Connect Layer 2 
 Digital Realty Service Exchange Layer 2 
 Epsilon Layer 2 
 Equinix Fabric Layer 2 
 EU Networks Layer 2 
 IBM BlueFringe Layer 3 
 Intercloud Layer 3 
 IXReach Layer 2 
 Megaport Layer 2 
 Neutrona Layer 2 
 nextGen GNPP Layer 3 
 NTT Layer 3 
 Orange Business Services Layer 3 
 PacketFabric Layer 2 
 Softbank Layer 3 
 SES Networks Layer 2 
 Tata IZO™ Private Connect Layer 3 
 Arelion Layer 3 
 Telstra Layer 3 
 Tokai Layer 2 
 Verizon SCI Layer 3 
 Vodafone Layer 3 
 Zayo Cloud Link Layer 2
Creating import tokens 

You can enable the secure import of root key material to the cloud by first creating an import token for your Key Protect instance.

Import tokens are used to encrypt and securely bring root key material into Key Protect based on the policies that you specify. To learn more about importing your keys securely to the cloud, see [Bringing your encryption keys to the cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keys).



 Creating an import token with the API 

Create an import token that's associated with your Key Protect instance by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/import_token



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Set a policy for your import token by calling the [Key Protect API](https://cloud.ibm.com/apidocs/key-protect).

$ curl -X POST "https://<region>.kms.cloud.ibm.com/api/v2/import_token" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/json" -d '{
"expiration": <expiration_time>,
"maxAllowedRetrievals": <use_count>
}'

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to create an import token.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required.
Satellite Link <br><br> * Establish a secure connection between IBM Cloud and Satellite locations by using the Satellite link connector.<br> * Provide the ability to control access to endpoints through IBM Cloud IAM.<br> * Provide the ability to monitor network traffic between your location and endpoints outside of your location.<br><br><br> <br><br> * Set up and audit [link endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) across locations.<br><br><br> 
 Satellite Storage <br><br> * Provide security updates and patches for IBM-provided storage templates.<br><br><br> <br><br> * Apply provided security and version updates for IBM-provided storage templates to keep your installed storage drivers compliant and supported.<br> * Implement mechanisms to back up your data to meet data retention requirements.<br> * Maintain responsibility for your data and how your apps consume the data.<br> * Ensure that your data is stored highly available by using snapshots, data replication, data synchronization, or other high availability mechanisms.<br><br><br> 
 Satellite-enabled services <br><br> * Review each service's documentation for additional responsibilities that IBM maintains.<br><br><br> <br><br> * Review each service's documentation for additional responsibilities that you fulfill when you use these services.<br><br><br> 
 Satellite Connector <br><br> * Update the managed master components.<br> * Provide the ability to control access to connectors through IBM IAM.<br><br><br> You are responsible for keeping your container platform infrastructure secure and compliant. 
 Satellite Connector Agent Image <br><br> * Test and publish updates to the Satellite Connector Agent Image in the IBM Container Registry.<br> * Monitor and update the software inside the container image for CVE.<br><br><br> You are responsible for updating the Satellite Connector Agent Image to new versions published to the IBM Container Registry. 







 Disaster recovery
Connectivity to your SAP system landscape 

IBM Cloud has many connectivity options, including low latency worldwide connections between your private internal network and IBM Cloud's private network backbone.

You can securely connect to your infrastructure in multiple ways by using various protocols and ports, based on the infrastructure chosen and the different network types:



* [Classic Infrastructure](https://cloud.ibm.com/docs/sap?topic=sap-classic-env-introduction) network (formerly Softlayer network)



* Intel Bare Metal
* Classic Intel Virtual Servers
* VMware solutions



* [VPC Infrastructure](https://cloud.ibm.com/docs/sap?topic=sap-vpc-env-introduction) network



* Intel Virtual Servers (Generation 1), formerly known as VPC on Classicno longer available, not SAP certified
* Intel Virtual Servers (Generation 2)



* [IBM Power](https://cloud.ibm.com/docs/sap?topic=sap-power-env-introduction) Virtual Server network, connection through IBM Cloud®



* IBM Power Virtual Servers, connection through IBM Cloud®. This is a complementary offering from IBM Power Systems







 Interconnectivity between IBM Cloud network 



* Transit Gateway, handling interconnectivity across the IBM Cloud private backbone between the networks with defined and controlled communication between resources worldwide across the IBM Cloud network or across multiple IBM Cloud accounts (useful for Managed Service Providers of SAP). Transit Gateways are used to support hybrid workloads, frequent data transfers, and private workloads by providing dynamic scalability, high availability, and private, in-transit data between hosts on IBM Cloud.



* Local routing, connect VPCs in same region
* Global routing, connect VPCs across regions
* Classic Infrastructure routing, connect to VLANs on Classic Infrastructure network
* Cross-account connection (also known as account-to-account routing), connect VPCs across multiple IBM Cloud accounts. See [Adding a cross-account connection (VPC only)](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-edit-gatewayadding-cross-account-connections)









 Connectivity options within the IBM Cloud Classic Infrastructure network