vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing access with context-based restrictions 

After you set up your Event Notifications service instance, you can manage access by using [context-based restrictions (CBR)](https://cloud.ibm.com/context-based-restrictions/overview).



 Managing CBR settings 

With [context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis), you can define and enforce user and service access restrictions to Event Notifications resources based on specified criteria. These resources include Internet Protocol (IP) addresses that are linked to your Event Notifications instance.

To restrict access, you must be the account owner or have an access policy with the administrator role on all account management services.





 Overview 

To restrict access, you must create [zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uinetwork-zones-create) and [rules](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules).

First, create a zone with the appropriate details for network or resource definitions. Then, attach that zone to the specified resource to restrict access. You can create zones and rules by using a ReSTful [API](https://cloud.ibm.com/apidocs/context-based-restrictionsintroduction) or with [context-based restrictions](https://cloud.ibm.com/context-based-restrictions/overview). After you create or update a zone or a rule, it might take a few minutes for the change to take effect.

CBR rules do not apply to provisioning or deprovision processes.





 Understanding network zones 

By creating network zones, you can define an allowlist of network locations where access requests originate, to determine when a rule can be applied. The list of network locations can be specified by using IP addresses, such as individual addresses, ranges or subnets, and Virtual Private Cloud (VPC) IDs.

After you create a network zone, you can add it to a rule.



 Creating network zones by using the CBR API
HTTP/S Route Control using the ACL 

Starting with v1.6.0, HTTP/S destinations can also enforce specific routes on the ACL entries. These are added the same way as the typical ACL entries, but with the path appended to the end of the rule. For example, the following will allow only requests following the /my/api path to pass through:

acl allow localhost:80/my/api

With this rule in place, requests to <cloud host>:<cloud port>/my/api* will be allowed through.

Routes are only supported on acl allow commands.





 Access Control List Precedence 

After providing an acl allow : command, if further acl allow commands are entered, the ALL:ALL allow rule (from acl allow :) will be removed from the list on the assumption that you no longer want to allow unbounded access. After providing an acl deny : command, if another acl deny command is entered, the ALL:ALL deny rule (from acl deny :) will be removed from the list on the assumption that you no longer want to restrict all access. If you list your current ACL rules via the show acl command in the CLI, there will be an indicator to display whether unlisted rules are being allowed or denied.





 Importing an ACL File 

You can supply a filename to the acl file command that contains the supported ACL commands that will be read by the client upon startup. This file should have commands of the following format:

acl allow [<hostname>]:[<port>]
acl deny [<hostname>]:[<port>]
no acl [<hostname>]:[<port>]
no acl

Note:no acl without any other parameters RESETS the ACL table and sets the access to DENY ALL.

You can find a sample ACL file [here](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-acl-files).
Typically, to meet this requirement, the Firewall Port Groups are combined with Firewall Rules. You can also use individual Firewall Rules per host, although is often becomes unmanageable.

The below table includes some of the key Ports to use with SAP Systems that use SAP NetWeaver and SAP HANA, which need correction, depending on the SAP Technical Application’s instance number; the instance numbers 00, 01, 02 are the defaults across the various SAP Technical Applications and will be in different patterns (these patterns are shown with code blocks highlighting):



Table 1. Common Ports used with SAP Technical Applications

 SAP Technical Application Component Port 

 SAP Router 
 SAP Router 3200 
 SAP Router 3299 
 SAP NetWeaver 
 SAP NetWeaver AS Primary App Server (PAS Dialog) Instance 01 3201 
 SAP NetWeaver AS PAS Gateway Instance 01 3301 
 SAP NetWeaver AS Central Services Messenger Server (ASCS MS) Instance 01 3602 
 SAP NetWeaver AS PAS Gateway (with SNC Enabled) Instance 01 4801 
 SAP NetWeaver AS ICM HTTP (Port 80 prefix) 8001 
 SAP NetWeaver AS ICM HTTPS (Secure, Port 443 prefix) 44301 
 SAP NetWeaver sapctrl HTTP (Dual Host install) 50113 
 SAP NetWeaver sapctrl HTTPS (Dual Host install) 50114 
 SAP HANA 
 SAP HANA sapctrl HTTP (One Host install) 50013 
 SAP HANA sapctrl HTTPS (One Host install) 50014 
 SAP HANA Internal Web Dispatcher 30006 
 SAP HANA MDC System Tenant SYSDB Index Server 30013 
 SAP HANA MDC Tenant 1 Index Server 30015 
 SAP HANA ICM HTTP Internal Web Dispatcher 8000 
 SAP HANA ICM HTTPS (Secure) Internal Web Dispatcher 4300 
 SAP Web Dispatcher 
 SAP Web Dispatcher ICM HTTP (Port 80 prefix) Instance Number 90 8090 
 SAP Web Dispatcher ICM HTTPS (Secure, Port 443 prefix) Instance Number 90 44390 
 SAP HANA XSA 
 SAP HANA XSA Instance 00 Client HTTPS for the connection to the xscontroller-managed Web Dispatcher (platform router) for purposes of user authentication. 30032
For more information about NAT in NSX-T, see [VMware Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-7AD2C384-4303-4D6C-A44A-DEF45AA18A92.html).





 Firewall 

You can configure East-West and North-South firewall policies in your NSX-T platform.

Gateway firewall represents rules that are applied to the perimeter firewall for North-South traffic connected to IBM Cloud VPC. Gateway firewall can be applied to both Tier-0 and Tier-1 Logical Routers.

Distributed firewall monitors all the East-West traffic on your VMs. Grouping of objects simplifies rule management. Groups include different objects that are added both statically and dynamically, and can be used as the source and destination of a firewall rule. They can be configured to contain a combination of virtual machines, IP sets, MAC sets, segment ports, segments, AD user groups, and other groups. Dynamic inclusion of groups can be based on tag, machine name, OS name, or computer name.

For more information about Firewalls in NSX-T, see [VMware Documentation](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-F206A4B8-0F33-482D-8727-E71FE253BBCD.html).





 Related links 



* [IBM Cloud VPC getting started](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)
* [IBM Cloud VPC Bare Metal Servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [IBM Cloud VPC RYO VMware reference architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vpc-ryo-arch-overview)
* [Context-based Restriction Rule APIs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule)







 Creating rules 

Context-based restrictions for the transit service can be scoped to a Transit Service resource type. Since the Transit Service has only one applicable resource type, it is set to gateway.

Additionally, rules can be scoped to a specific instance of the service or a resource group by using resource attributes.



 Creating rules from the CLI 



1. To create rules from the CLI, [install the CBR CLI plug-in](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugininstall-cbr-plugin).
2. Use the [ibmcloud cbr rule-create command](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugincbr-cli-rule-create-command) to create CBR rules. For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugincbr-zones-cli).



The examples in this section are enforcement rules. You can make them report-only by adding --enforcement-mode report.

The following example CLI commands create a context-based restriction rule for Transit Service instances in the current account:



* Create a disabled rule against all gateway instances in your transit service:

ibmcloud cbr rule-create --description transit-rule1 --service-name transit --resource-type gateway --zone-id=<zone_id> --enforcement-mode disabled
* Create a disabled rule against all gateway instances in ResourceGroup x in your transit service:

ibmcloud cbr rule-create --description transit-rule2 --service-name transit --resource-type gateway --resource-attributes "resourceGroupId=<rg_x_id>" --zone-id=<zone_id> --enforcement-mode disabled
[CHANGE LOG](https://cloud.ibm.com/docs/vsrx?topic=vsrx-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:



* Allow and route the following service networks to the BCR on your gateway appliance or firewall for all Bare Metal and Virtual Server provisions and reloads: 10.0.64.0/19, 10.200.80.0/20, 161.26.13.0/24, 161.26.96.0/22, 166.9.12.0/23, 166.9.48.0/24, 166.9.50.0/24, 166.9.228.0/24, 166.9.250.192/27, 10.3.160.0/20, 10.201.0.0/20, 161.26.92.0/22, 161.26.132.0/22, 166.9.20.0/23, 166.9.231.0/24.
* For RHEL servers, ensure the entire 161.26.0.0/16 is allowed and routed properly to the BCR. Add any additional datacenter service networks that are mentioned in the RHEL section near the bottom of the page.
* Allow traffic between the service networks and your server in both directions.
* By default, all classic servers and classic gateway and firewall devices are configured with a static route for the 10.0.0.0/8, 161.26.0.0/16 and 166.8.0.0/14 networks to the Back-end Customer Router (BCR). If you configure overlapping routes with those subnets, validate that you have also configured PBR or a similar service. Otherwise, consider using different IP space that doesn't overlap with our service networks for your VPNs or tunnels.
Keep in mind that even though they can't see you, a public cloud shares networks with other customers. True, best-case VRA throughput is determined by available network capacity at a point in time, plus the distance the data must travel.

These variables aside, VRA is capable of forwarding 80 Gbps of unmodified traffic across multiple interfaces, using the rough formula that every 10 Gbps of throughput requires one full processor core (not including hyperthread). Given that current servers max out at 40 Gbps (2 x 10 Gbps public + 2 x 10 Gb private), a server with 8 or more cores should have sufficient compute headroom to handle multiple common VRA features at near best-case network performance
* What do I do if I lose my VRA password?

If you can access the system, set a new password by running the following command:

set system login user [account] authentication plaintext-password [password]

If you cannot access the system, you can reboot the device and use the password recovery option on the GRUB menu for resetting the root user password.
* What do I do if I am locked out of the firewall?

The reboot at [time] construct can be useful when testing potentially dangerous firewall rules.

If the rule works, then use the command reboot cancel to cancel the reboot. If the rule locks out your access, simply wait for the scheduled reboot to occur.

If you cannot access the system, then you might reboot to recover access. Upon rebooting, the system reads the configuration file, which is unchanged by previous entries that were discarded.

If there is access using IPMI, follow these steps to recover access:



1. Disable the offending rule by running:

set security firewall name [firewall name] rule [rule number] disable
commit
2. Unhook the entire named rule set from the necessary interface by running:

delete interfaces dataplane [interface] firewall [type] [firewall name]
commit



Incorrect use of these commands can wipe out your interface configuration.
* Why would I want to run two Vyatta devices in a High Availability (HA) pair?

Most cloud customers want HA services.
[CHANGE LOG](https://cloud.ibm.com/docs/security-groups?topic=cloud-infrastructure-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:



* Allow and route the following service networks to the BCR on your gateway appliance or firewall for all Bare Metal and Virtual Server provisions and reloads: 10.0.64.0/19, 10.200.80.0/20, 161.26.13.0/24, 161.26.96.0/22, 166.9.12.0/23, 166.9.48.0/24, 166.9.50.0/24, 166.9.228.0/24, 166.9.250.192/27, 10.3.160.0/20, 10.201.0.0/20, 161.26.92.0/22, 161.26.132.0/22, 166.9.20.0/23, 166.9.231.0/24.
* For RHEL servers, ensure the entire 161.26.0.0/16 is allowed and routed properly to the BCR. Add any additional datacenter service networks that are mentioned in the RHEL section near the bottom of the page.
* Allow traffic between the service networks and your server in both directions.
* By default, all classic servers and classic gateway and firewall devices are configured with a static route for the 10.0.0.0/8, 161.26.0.0/16 and 166.8.0.0/14 networks to the Back-end Customer Router (BCR). If you configure overlapping routes with those subnets, validate that you have also configured PBR or a similar service. Otherwise, consider using different IP space that doesn't overlap with our service networks for your VPNs or tunnels.
For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/containers?topic=containers-cbr-tutorial).

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating network zones from the console 



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create). Add the Kubernetes service to your network zones to allow IBM Cloud Kubernetes Service to access services and resources in your account.









 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/containers?topic=containers-cbr&interface=clicbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Since no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT-ID"
},
{
"name": "serviceName",
: Specify output format, only JSON is supported.





 Examples 

Update firewall rules.

ibmcloud cis firewall-update bc014906ccce4e7ea2e28be7df70d0d2 -t access-rules --json '{"mode": "challenge", "notes": "This rule is added because of event X that occurred on date xyz"}' -i "cis-demo"
ibmcloud cis firewall-update 4af47b1518be478aa2c8f024af1c0bad -t ua-rules -d 31984fea73a15b45779fa0df4ef62f9b --json '{"mode": "block", "configuration": {"target": "ua", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/603.2.4 (KHTML, like Gecko) Version/10.1.1 Safari/603.2.4"}}' -i -i "cis-demo"
ibmcloud cis firewall-update e6106d7ec58e47ebb2fa053dedcd7dcb -t lockdowns -d 31984fea73a15b45779fa0df4ef62f9b --json '{"urls": ["api.mysite.com/some/endpoint"], "configurations": [{"target": "ip", "value": "127.0.0.1"}, {"target": "ip_range", "value": "2.2.2.0/24"}]}' -i "cis-demo"







 ibmcloud cis firewalls 

List firewall rules.

ibmcloud cis firewalls (-t, --type Type) [-d, --domain DNS_DOMAIN_ID] [--page PAGE] [--per-page PER_PAGE ] [-i, --instance INSTANCE] [--output FORMAT]



 Command options
[Security groups across instances and zones](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/security-groups-across-zones.svg)

Figure 1: Security groups across instances and zones





 Defining security group rules 

Every security group consists of a set of rules. The security group examines all of its rules before allowing any traffic to enter or leave the instance. The rules that are used to control the inbound traffic are independent of the rules that are used to control the outbound traffic.

When you create a new security group, initially all inbound traffic is restricted and outbound traffic is allowed. Therefore, you must add rules to the group to permit incoming traffic and to apply restrictions on the outbound traffic.

Because a resource can have multiple security groups associated with it, all the rules from each security group associated with the resource are combined to form a single set of rules. This set of rules is used to determine whether the traffic should be denied or allowed into and out from the resource. For every security rule that you add to the security group, you must specify the values for the following fields:



* Direction - The direction of traffic to enforce, either inbound or outbound.
* Protocol - Indicates the prototype that this rule applies for. Values are tcp, udp, icmp, or all.



* If its value is all, it means that this rule applies to all protocols. Then, it's invalid to specify the port range (PortMin, PortMax).
* If protocol is either tcp or udp, then the rule can also contain the port range (PortMin, PortMax). You must set either both ports, or neither. When neither is set, then traffic is allowed on all ports. For a single port, you must set both ports to the same value.
* When protocol is icmp, you can optionally specify the type property. If specified, then ICMP traffic is allowed for only the specified ICMP type.
10.10.0.0/16 Delegate Dallas DC 1 
 10.11.0.0/16 Delegate Dallas DC 1 
 0.0.0.0/0 Deliver 10.10.1.5 Dallas DC 1 





 Objective: Edge proxy firewall 

Secure flows to the public internet from behind a client-defined gateway, proxy, or firewall appliance, while also allowing resources on the other subnets to flow through the VPC-managed public gateway.

Using VPC custom routes with per subnet egress routing, you can create a table to override the system-implicit routing within the VPC network. In this example, the default table created by the system, where all subnets are assigned at creation, is unchanged. A table to direct traffic from subnet 10.10.1.0/24 through an edge proxy (NFV Proxy) is created as well.

Because the destination for the proxied flows are the public internet and, typically, follow the default route (0.0.0.0/0), you must first exempt flows toward internally-reachable private networks using the Delegate function of custom routes. Resources in subnet 10.10.3.0/24 continue to use the public gateway that is attached to that subnet.

While the instances that use the proxy share a common subnet with the proxy in this example, you are not required to do so. Custom routes also enable you to specify a next-hop IP of an instance connected to a different subnet. This allows you to scale horizontally without concern for the subnet sizings of Edge services. For example, a proxy routing table can be attached to subnet 10.10.3.0/24 and directs all public flows to the NFV proxy.





 Functions used in an Edge proxy firewall 

This use case uses the following functions of Edge proxy firewalls:



* Disabling the IP spoofing check on 10.10.0.5 and 10.10.1.5 interfaces to enable source address preservation. This action requires elevated IAM permissions on the instance.
* A public gateway for outbound flows with resources that are not directed through the NFV proxy.
When the VPC NAT is disabled, the packet is passed unmodified to or from the network interface, allowing for instance the NSX-T logical routers to perform any needed NAT or routing operations. This capability can also be used with public IP addresses assigned to NSX-T overlay services and later with subnets on NSX-T segments.

An Access Control List (ACL) can allow or deny inbound and outbound traffic for a subnet. It is stateless, which means that inbound and outbound rules must be specified separately and explicitly. Each ACL consists of rules based on a source IP, source port, destination IP, destination port, and protocol. Every VPC has a default ACL that allows all inbound and outbound traffic. You can edit the default ACL rules, or create a custom ACL and attach it to your subnets. A subnet can have only one ACL attached to it at any time, but one ACL can be attached to multiple subnets.

A security group operates as a virtual firewall that controls the traffic for one or more virtual server instances. It is a collection of rules that specify whether to allow or deny traffic for an associated instance. You can associate an instance with one or more security groups and edit the security group rules.

Interconnectivity between VPCs can be established by using IBM Cloud Transit Gateway. When a VPC is attached to a Transit Gateway as a connection, the VPC prefixes (not the subnets) are advertised to the Transit Gateway instance. The connectivity to on-premises networks can be established through IBM Cloud Direct Link, where you can bring your WAN or MPLS connection to one of IBM Cloud PoPs and connect to your resources.

For more information, see [About networking](https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking-for-vpc).



 Related links 



* [Getting started with IBM Cloud VPC (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)