vania-janet/multiturn-rag-retrieval-data huggingface dataset:
set nat source rule 10 source address .../ (Portable Private Subnet VLAN1101/Management VMs)
set nat source rule 10 translation address ... (Brocade vRouter (Vyatta) bond1 IP)
set nat source rule 10 outbound-interface bond1
set nat source rule 20
set nat source rule 20 source address .../ (Portable Private Subnet VLAN1103/Virtual Machines)
set nat source rule 20 translation address ... (Brocade vRouter (Vyatta) bond1 IP)
set nat source rule 20 outbound-interface bond1
commit
save





 Configuring firewall groups 

Next, configure the firewall groups that are associated with certain IP ranges.

Use the following commands in configure mode:

set firewall group network-group SLSERVICES
set firewall group network-group SLSERVICES network 10.1.128.0/19
set firewall group network-group SLSERVICES network 10.0.86.0/24
set firewall group network-group SLSERVICES network 10.1.176.0/24
set firewall group network-group SLSERVICES network 10.1.64.0/19
set firewall group network-group SLSERVICES network 10.1.96.0/19
set firewall group network-group SLSERVICES network 10.1.192.0/20
set firewall group network-group SLSERVICES network 10.1.160.0/20
set firewall group network-group SLSERVICES network 10.2.32.0/20
set firewall group network-group SLSERVICES network 10.2.64.0/20
set firewall group network-group SLSERVICES network 10.0.64.0/19
set firewall group network-group SLSERVICES network 10.2.128.0/20
set firewall group network-group SLSERVICES network 10.2.200.0/24
set firewall group network-group SLSERVICES network 10.1.0.0/24
Procedure to find the firewall and SNAT rules defined (NSX-T only) 



1. Log in to the NSX-T Manager, and click Networking in the menu.
2. Click NAT from the left navigation pane.
3. Select the T0 consolidated gateway from the Gateway list.

The EntrustCC SNAT rules are displayed in the NAT rules table.







 Known issue about Network Time (Entrust CloudControl 5.x only) 

On the Entrust CloudControl 5.x web console, if you go to General > Health, the Network Time (NTP) value in the Services section might be shown as disabled. Although the value shows disabled on the console, NTP is working as expected.





 Enabling internet access for the Entrust CloudControl VMs (Entrust CloudControl 5.x only) 

IBM Cloud for VMware Solutions provides automatic renewal support for Entrust licenses with the Call Home feature enabled. For VMware vCenter Server® instances that are not private-only, Entrust CloudControl is deployed with firewall and SNAT (Source Network Address Translation) rules that are defined on the management services ESG mgmt-nsx-edge.

These rules enable internet access for the Entrust VMs. If internet access is not enabled, the license that is applied to your Entrust CloudControl installation will expire after a year.

For private-only vCenter Server environments, the VMware NSX® Edge Services Gateway (ESG)mgmt-nsx-edge is not added. Therefore, the firewall and SNAT rules are not defined. As a result, internet connectivity cannot be enabled for private-only instances and Entrust licenses expire annually.



 Procedure to find the firewall and SNAT rules defined (Entrust CloudControl 5.x and NSX-V only) 



1. Log in to the VMware® vSphere Web Client (FLEX) and find the ESG mgmt-nsx-edge.
2. Click Home > Networking & Security > NSX Edges.
3. Double-click the ESG mgmt-nsx-edge and click the Manage tab.
4.
Page rules 50 page rules per domain <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> <br><br> * 100 page rules per domain<br> * Additional settings for fine-grained control<br><br><br> 
 IP firewall <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * Block is not available to Country filter<br> * 100 Domain lockdown rules<br> * 250 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> <br><br> * [All IP firewall rule actions](https://cloud.ibm.com/docs/cis?topic=cis-actions)<br> * 1000 Domain lockdown rules<br> * 1000 User agent rules<br><br><br> 
 Caching Basic caching options Browser cache minimum TTL 30 seconds Browser cache minimum TTL 30 seconds Browser cache minimum TTL 30 seconds Advanced caching options
Keep in mind that even though they can't see you, a public cloud shares networks with other customers. True, best-case VRA throughput is determined by available network capacity at a point in time, plus the distance the data must travel.

These variables aside, VRA is capable of forwarding 80 Gbps of unmodified traffic across multiple interfaces, using the rough formula that every 10 Gbps of throughput requires one full processor core (not including hyperthread). Given that current servers max out at 40 Gbps (2 x 10 Gbps public + 2 x 10 Gb private), a server with 8 or more cores should have sufficient compute headroom to handle multiple common VRA features at near best-case network performance





 What do I do if I lose my VRA password? 

If you can access the system, set a new password by running the following command:

set system login user [account] authentication plaintext-password [password]

If you cannot access the system, you can reboot the device and use the password recovery option on the GRUB menu for resetting the root user password.





 What do I do if I am locked out of the firewall? 

The reboot at [time] construct can be useful when testing potentially dangerous firewall rules.

If the rule works, then use the command reboot cancel to cancel the reboot. If the rule locks out your access, simply wait for the scheduled reboot to occur.

If you cannot access the system, then you might reboot to recover access. Upon rebooting, the system reads the configuration file, which is unchanged by previous entries that were discarded.

If there is access using IPMI, follow these steps to recover access:



1. Disable the offending rule by running:

set security firewall name [firewall name] rule [rule number] disable
commit
2. Unhook the entire named rule set from the necessary interface by running:

delete interfaces dataplane [interface] firewall [type] [firewall name]
commit



Incorrect use of these commands can wipe out your interface configuration.





 Why would I want to run two Vyatta devices in a High Availability (HA) pair? 

Most cloud customers want HA services.
Bypassing the firewall 

You can bypass your FortiGate Security Appliance 1 Gbps (FSA) by following the instructions here.

Follow these steps:



1.  From your browser, open the [IBM Cloud UI Console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/security/firewalls/multivlan/provision) and log in to your account.
2.  Click the navigation menu in the [IBM Cloud Catalog ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com). Then, select Classic Infrastructure > Network > IP Management > VLANs and click the firewall device that you want to bypass.
3.  In the Device Details page, you can use the Actions drop down menu to choose Set Route Bypass or in the Status: section, you can click the Route Around button. Bypassing the rules takes approximately two minutes to take effect. The Status changes to "Bypassing All Rules".

Another option is to route around the firewall. You can use the Actions drop down menu to choose Set Route Bypass or in the Status: section, you can click the Route Around button. Click Yes to confirm your action. Bypassing the route takes approximately two minutes to take effect. While in bypass mode, the status is Routing AROUND firewall.





  Unbypass the firewall 

To route the public network traffic back to the firewall, follow the previous instructions to locate the Configuration tab of the device. Click the Actions menu and choose Set Route Bypass, or in the Status section, click the Route Through button. Click Yes to confirm your action. The status changes back to Routing THROUGH firewall within two minutes.
[CHANGE LOG](https://cloud.ibm.com/docs/gateway-appliance?topic=gateway-appliance-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:



* Allow and route the following service networks to the BCR on your gateway appliance or firewall for all Bare Metal and Virtual Server provisions and reloads: 10.0.64.0/19, 10.200.80.0/20, 161.26.13.0/24, 161.26.96.0/22, 166.9.12.0/23, 166.9.48.0/24, 166.9.50.0/24, 166.9.228.0/24, 166.9.250.192/27, 10.3.160.0/20, 10.201.0.0/20, 161.26.92.0/22, 161.26.132.0/22, 166.9.20.0/23, 166.9.231.0/24.
* For RHEL servers, ensure the entire 161.26.0.0/16 is allowed and routed properly to the BCR. Add any additional datacenter service networks that are mentioned in the RHEL section near the bottom of the page.
* Allow traffic between the service networks and your server in both directions.
* By default, all classic servers and classic gateway and firewall devices are configured with a static route for the 10.0.0.0/8, 161.26.0.0/16 and 166.8.0.0/14 networks to the Back-end Customer Router (BCR). If you configure overlapping routes with those subnets, validate that you have also configured PBR or a similar service. Otherwise, consider using different IP space that doesn't overlap with our service networks for your VPNs or tunnels.
* CLI







 Protecting resources with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to Direct Link resources can be controlled with context-based restrictions and identity and access management policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the Direct Link service to create, update, or delete rules. And a user must have either the Editor or Administrator role on the Context-based restrictions service to create, update, or delete network zones.

Any IBM Cloud Activity Tracker or audit log events generated will come from the context-based restrictions service, and not Direct Link. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started protecting your Direct Link with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).



 Limitations 

Context-based restrictions protect only the actions associated with the [Direct Link API](https://cloud.ibm.com/apidocs/direct_link). Actions associated with the following platform APIs are not protected by context-based restrictions. Reference the API docs for the specific action IDs.



* [Resource Instance APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-instances)
* The cloud resource is specified by resource attributes similar to IAM access policies.
* A context is a combination of network zones and endpoint types.



The contexts that you configure define the boundary for the associated resources.

The necessary resource attributes in context-based restrictions rules are accountId and serviceName. Rules must be scoped to an account and a specific service.

Context-based restriction rules are applied by the following logic:



* Access is granted by a rule only when at least one of the rule's contexts allows access.
* If multiple rules are applicable to a particular resource, access is granted only when all applicable rules allow access.
* If no rules are applicable to a particular resource, access is determined exclusively by IAM policies.



Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure.

The interface that you use to access a resource, such as the console, CLI, or API, doesn't affect how a rule applies to that resource. The rule applies the same way across all interfaces and is based on the client IP address.



 Rule enforcement 

You can decide how you want to enforce a rule upon creation and update the rule enforcement at any time.

Enabled
: Enforce the rule. Depending on the service that you select, monitoring denied access attempts through Activity Tracker might be available. Review each service's documentation to learn about how they integrate with context-based restrictions.

Disabled
: No restrictions apply to your account resources. Select this option if you're not ready to enable the rule.

Report-only
: Depending on the service that you select, you can monitor how a rule affects access without enforcing it. With report-only mode, all attempts to access resources in the account are logged in Activity Tracker. If available, monitoring is recommended for 30 days before you enforce a rule.

Report-only mode is not available for all services, so review each service's documentation to learn about how they integrate with context-based restrictions.

You can monitor the impact of your enabled and report-only rules.
To allow inbound traffic from an external network, you must configure a DNAT (Destination Network Address Translation) rule and a firewall policy.

Before you create the firewall and NAT rules, capture the information that is necessary for subsequent steps.



1. From the tenant portal, click Data Centers.
2. On the main page, under Virtual Data Center, click the virtual data center for that edge gateway.
3. In the left pane under Networking, click Edges.
4. Under Configuration, select Gateway Interfaces. Copy the values in the table for the tenant external and the Service networks. With the tenant external addresses, we can route to the external network, and with the service network addresses, we can route to the IBM private network.
5. Return to the IBM Cloud for VMware Solutions console. From the Resources > VMware Shared page, copy the public IP addresses that were assigned to your virtual data center.





 Create the Organization virtual data center network firewall rule to allow access to the external network 

From the virtual data center for that edge gateway, create the network firewall rule. For more information, see [Add an NSX data center for vSphere Edge Gateway firewall rule](https://docs.vmware.com/en/VMware-Cloud-Director/10.1/VMware-Cloud-Director-Tenant-Portal-Guide/GUID-97ADAF42-598B-44B2-80EF-8B215B743C78.html).

Review the following notes for creating the Organization virtual data center network firewall rule to allow access to the external network.



* For Source, you can use an IP address, a range of addresses, or an object.
* In the Browse objects of Type menu, select Org Vdc Networks. Select the Organization virtual data center network that you created as the Source cell. Click the right arrow to move the Organization virtual data center network into the Filter column.
* Keep all remaining default selections.
* For Action, select Accept.
* To define a source IP address or range, click the IP in the Source cell and set the IP address, or range to allow everything on that subnet.
Restricting access by network context 

[Context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis&interface=ui) provide a way for administrators to limit access to resources. What if certain data must be accessed from trusted networks only? A properly configured policy restricts all access to data unless the request originates from an approved [network zone](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis&interface=uinetwork-zones-whatis) and endpoint type (public, private, or direct).

This feature is not currently supported in Object Storage for Satellite. [Learn more.](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-about-cos-satellite)



 Using context-based restrictions 

A [context-based restriction](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis&interface=ui) is comprised of a rule and one or more contexts (network zones and/or endpoint type). These restrictions do not replace IAM policies, but simply check that a request is coming from an allowed context, such as a range of IP addresses, VPCs, or service references.

A user must have the Administrator role on a service to create, update, or delete rules. A user must have either the Editor or Administrator role to create, update, or delete network zones.

You can learn more about how context-based restrictions work in the [detailed documentation](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=ui), or you can follow a [quick tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-cos-tutorial-cbr).

Any Activity Tracker or audit log events generated will come from the context-based restrictions service, and not Object Storage.

If no rules are applicable to a particular resource, access is determined by IAM policies and the presence of a legacy bucket firewall.
--allow Allows all connections to the client. Is overridden by the ACL file, if provided 
 --service After an initial connection, the parent will restart within 60s if all child clients are terminated 



Note:--service, --allow, and --noUI flags should be the last parameters in the command line arguments.

The most basic use case is to start with a single client connection with the default settings:

<gateway_id> -t <security_token>

These options can be extended to support the automatic connection of multiple clients, as well. In order to pass these to multiple client connections, they must be passed in using a specific format. The gateway IDs can be passed in the same way as with the single client connection (with each gateway ID separated by a space); however, the order of these IDs determine the order the rest of the arguments must follow. When passing in any of the other arguments, they must be separated by -- in order to be picked up correctly. If nothing is passed in for a particular flag, it is assumed to not apply to any of the clients.

If there aren't enough arguments supplied to fulfill all of the gateway IDs, then they will be applied in order until there are no more arguments. For example, if two gateway IDs are passed in and a single security token is passed in, then the token will be applied to the first gateway ID and not the second one.

If gateway IDs are provided that require different arguments, then the keyword none should be designated in the place of any particular argument that a gateway is not enforcing/supplying. For example, if three gateway IDs are passed in and the user would like to specify a loglevel for the first and third, the argument would look like --loglevel DEBUG--none--TRACE. In this case, none would then default to INFO.





 Startup Argument Examples 

Single client connection, custom loglevel, no UI:

node lib/secgwclient.js <gateway_id> -t <security_token> -l <loglevel> --noUI

Multiple client connections, default options:
For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/containers?topic=containers-cbr-tutorial).

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip







 Creating network zones from the console 



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create). Add the Kubernetes service to your network zones to allow IBM Cloud Kubernetes Service to access services and resources in your account.









 Creating rules 

Define rules to protect access to resources in your account. The contexts that you define in your rules determine how the resources in your network zones (allowlists) can interact with the resources defined in the rule.

Review the [limitations](https://cloud.ibm.com/docs/containers?topic=containers-cbrcbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Since no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT-ID"
},
{
"name": "serviceName",
SC-7 (5) - Deny by Default / Allow by Exception 



 Control requirements 

SC-7 (5) - 0
: The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Accessing the public internet](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-internet)
* [Connecting application provider to the management VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management)
* [Connectivity to IBM Cloud services with private endpoints](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-ibm-services)
* [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workload)
* [Creating and connecting the management and workload VPCs](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-create-vpcs)
* [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)
* [Working with Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-containers-openshift)







 IBM Cloud for Financial Services profile