vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Update universal SSL setting PATCH /v1/{crn}/zones/{domain_id}/ssl/universal/settings internet-svcs.security.update internet-svcs.universal-ssl-setting.update 
 Get edge certificates ordered from CIS GET /v1/{crn}/zones/{domain_id}/ssl/certificate_packs internet-svcs.security.read internet-svcs.certificate-packs.read 
 Order an edge certificate POST /v1/{crn}/zones/{domain_id}/ssl/certificate_packs internet-svcs.security.manage internet-svcs.certificate-packs.create 
 Delete an edge certificate DELETE /v1/{crn}/zones/{domain_id}/ssl/certificate_packs/{cert_id} internet-svcs.security.manage internet-svcs.certificate-packs.delete 
 Get uploaded certificates GET /v1/{crn}/zones/{domain_id}/custom_certificates internet-svcs.security.read internet-svcs.custom-certificates.read 
 Upload a certificate to CIS edge POST /v1/{crn}/zones/{domain_id}/custom_certificates internet-svcs.security.manage internet-svcs.custom-certificates.create 
 Update the certificate uploaded to CIS edge PATCH /v1/{crn}/zones/{domain_id}/custom_certificates/{cert_id} internet-svcs.security.update internet-svcs.custom-certificates.update 
 Delete a certificate uploaded to CIS edge DELETE /v1/{crn}/zones/{domain_id}/custom_certificates/{cert_id} internet-svcs.security.manage internet-svcs.custom-certificates.delete 
 Get origin certificate issued by CIS GET /v1/{crn}/zones/{domain_id}/origin_certificates internet-svcs.security.read internet-svcs.origin-certificates.read 
 Create an origin certificate issued by CIS POST /v1/{crn}/zones/{domain_id}/origin_certificates internet-svcs.security.manage internet-svcs.origin-certificates.create
ibmcloud cis glbs 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"
<-- </section "id="section-list-glb-examples" "> --><-- </section "id="section-list-glb" "> --><-- <section "id="section-list-glb-pools" "> --> ibmcloud cis glb-pools List all GLB pools for a given service instance. ibmcloud cis glb-pools -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-list-glb-pools-options" "> --> Command options -i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-list-glb-pools-options" "> --><-- <section "id="section-list-glb-pools-examples" "> --> Examples List all GLB pools for instance cis-demo. ibmcloud cis glb-pools -i "cis-demo"
<-- </section "id="section-list-glb-pools-examples" "> --><-- </section "id="section-list-glb-pools" "> --><-- <section "id="section-create-glb-pool" "> --> ibmcloud cis glb-pool-create Create a GLB pool for a given service instance. ibmcloud cis glb-pool-create (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
[Setting up a web application firewall with F5 BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialvpc-architecture-connectivity-waf-tutorial)



* [Network path](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialnetwork-path)
* [Before you begin](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialwaf-setup-prereqs)
* [Provision CIS](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialprovision-cis)
* [Configure CIS TLS Mode](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialconfigure-cis-TLS)
* [Configure CIS Global Load Balancer](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialconfigure-cis-global-loadl-balancer)
* [Configure CIS Range Application](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialconfigure-cis-range-application)
* [Enable license modules on the BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorialf5-waf-license)
: The ID of access certificate. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Show details of access certificate a5836c2a7ea72d2e225890caea70ae32.

ibmcloud cis access-certificate 31984fea73a15b45779fa0df4ef62f9b a5836c2a7ea72d2e225890caea70ae32 -i cis-demo







 ibmcloud cis access-certificate-update 

Update an access certificate (Enterprise plan only).

ibmcloud cis access-certificate-update DNS_DOMAIN_ID ACCESS_CERTIFICATE_ID --name NAME --associated-hostnames ASSOCIATED_HOSTNAMES [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

ACCESS_CERTIFICATE_ID
: The ID of access certificate. Required.

--name value
: The name of the Certificate. Required.

--associated-hostnames value
: The hostnames that are prompted for this certificate. Required. The associated hostnames are reset if not specified by associated-hostnames.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Update access certificate a5836c2a7ea72d2e225890caea70ae32.

ibmcloud cis access-certificate-update 31984fea73a15b45779fa0df4ef62f9b a5836c2a7ea72d2e225890caea70ae32 --name example --associated-hostnames example.com -i cis-demo
If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-a-firewall-rule-options" "> --><-- <section "id="section-show-a-firewall-rule-examples" "> --> Examples Get the details of firewall-rule 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis firewall-rule 31984fea73a15b45779fa0df4ef62f9b 372e67954025e0ba6aaa6d586b9e0b60 -i "cis-demo"
<-- </section "id="section-show-a-firewall-rule-examples" "> --><-- </section "id="section-show-a-firewall-rule" "> --><-- <section "id="section-create-a-firewall-rule" "> --> ibmcloud cis firewall-rule-create Create a firewall-rule for a given DNS domain. ibmcloud cis firewall-rule-create DNS_DOMAIN_ID --expression EXPRESSION --action ACTION --priority PRIORITY] --paused on|off] --products PRODUCTS]--description DESCRIPTION] -i, --instance INSTANCE] --output FORMAT]
ibmcloud cis firewall-rule-create DNS_DOMAIN_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis firewall-rule-create DNS_DOMAIN_ID (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) -i, --instance INSTANCE] --output FORMAT] ! !!!!!! ! ! ! ! !
<-- </section "id="section-update-glb-pool-examples" "> --><-- </section "id="section-update-glb-pool" "> --><-- <section "id="section-list-glb-monitors" "> --> ibmcloud cis glb-monitors List GLB monitors for a given service instance. ibmcloud cis glb-monitors -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-list-glb-monitors-options" "> --> Command options -i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-list-glb-monitors-options" "> --><-- <section "id="section-list-glb-monitors-examples" "> --> Examples List all GLB monitors for instance cis-demo. ibmcloud cis glb-monitors -i "cis-demo"
<-- </section "id="section-list-glb-monitors-examples" "> --><-- </section "id="section-list-glb-monitors" "> --><-- <section "id="section-create-glb-monitor" "> --> ibmcloud cis glb-monitor-create Create a GLB monitor for a given service instance. ibmcloud cis glb-monitor-create (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis glb-monitor-create (-s, --json-str JSON_STR | -j, --json-file JSON_FILE) -i, --instance INSTANCE] --output FORMAT] ! !!!!!!!!!!
[IBM Cloud Load Balancer supporting either or both public and private.](https://cloud.ibm.com/docs-content/v1/content/df269b100c3499f1efcbb7d030dce8dec25c539b/ha-infrastructure/images/HA-load-balancer.svg)

Figure 5. IBM Cloud Load Balancer supporting either or both public and private (internal) deployment.





 IBM Cloud Internet Services 

IBM Cloud Internet Services (CIS) is a suite of services that includes DNS, Global Load Balancing (GLB), Web Application Firewall (WAF), DDoS mitigation, and Content Delivery Network (CDN). For more information, see [IBM Cloud Internet Services](https://www.ibm.com/cloud/cloud-internet-services).

Similar to IBM Cloud Load Balancer, CIS supports load balancing for HTTP/HTTPS alike. CIS also goes further to solve a different set of problems such as local load balancing and distributed applications that are deployed in different regions or geographies.

Some of the other key load-balancing features of CIS are:



* Public (internet-facing) load balancer
* Local and global load balancing
* Pool base distribution
* TCP, HTTP, and HTTPS health checks



The following diagram illustrates a common three-tier web app use case that uses both IBM Cloud Load Balancer offerings. CIS directs traffic based on user origin while also providing backup if there is a failure at the primary location, where US-East is backing up EU-GB and vice versa. While an IBM Cloud Load Balancer can sit in between CIS and the web server, in this case, it is deployed as an internal load balancer between the web and the app tier.

Zoom

![Three tier web app with CIS and Load Balancer.](https://cloud.ibm.com/docs-content/v1/content/df269b100c3499f1efcbb7d030dce8dec25c539b/ha-infrastructure/images/HA-tier-web-app.svg)

Figure 6.
<-- </section "id="section-create-glb-pool-examples" "> --><-- </section "id="section-create-glb-pool" "> --><-- <section "id="section-show-glb-pool" "> --> ibmcloud cis glb-pool Show the details of a given GLB pool. ibmcloud cis glb-pool GLB_POOL_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-show-glb-pool-options" "> --> Command options GLB_POOL_ID: The ID of global load balancer pool. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-glb-pool-options" "> --><-- <section "id="section-show-glb-pool-examples" "> --> Examples Show the details of GLB pool 17b5962d775c646f3f9725cbc7a53df4. ibmcloud cis glb-pool 17b5962d775c646f3f9725cbc7a53df4 -i "cis-demo"
<-- </section "id="section-show-glb-pool-examples" "> --><-- </section "id="section-show-glb-pool" "> --><-- <section "id="section-delete-glb-pool" "> --> ibmcloud cis glb-pool-delete Delete a given GLB pool. ibmcloud cis glb-pool-delete GLB_POOL_ID -i, --instance INSTANCE] ! ! ! ! ! !
* [Global load balancer concepts](https://cloud.ibm.com/docs/cis?topic=cis-global-load-balancer-glb-concepts)
* [Web Application Firewall concepts](https://cloud.ibm.com/docs/cis?topic=cis-waf-q-and-a)
* [Routing concepts](https://cloud.ibm.com/docs/cis?topic=cis-cis-routing)
* [Caching concepts](https://cloud.ibm.com/docs/cis?topic=cis-caching-concepts)
* [HTTP concepts](https://cloud.ibm.com/docs/cis?topic=cis-http-concepts)
* [Compression and optimization concepts](https://cloud.ibm.com/docs/cis?topic=cis-compression-concepts)
* [Domain lifecycle concepts](https://cloud.ibm.com/docs/cis?topic=cis-domain-lifecycle-concepts)



* [Release notes for CIS](https://cloud.ibm.com/docs/cis?topic=cis-release-notes)



* Tutorials



* Solution tutorials



* [Resilient and secure multi-region Kubernetes clusters with IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-multi-region-k8s-cis)
* [Configuring a highly available application](https://cloud.ibm.com/docs/cis?topic=cis-deploy-multiple-regions)



* [What are computer networking solutions](https://www.ibm.com/cloud/learn/networking-a-complete-guidetoc-computer-n-9C7jokVu)



* How to



* [Managing your CIS deployment](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-cis-deployment)
* [Managing origin certificates](https://cloud.ibm.com/docs/cis?topic=cis-cis-origin-certificates)
There are many valid cases where you might want to allow consumers to access your service through the public internet. The base architecture can be adapted to securely enable this type of access as shown in the following diagram which introduces a new edge VPC. The request from the consumer gets routed through a global load balancer outside of the edge VPC, through a web application firewall (WAF) in the edge VPC, and then to the public application load balancer within the workload VPC. This is shown in the following diagram.

Zoom

![Detailed VPC reference architecture with edge VPC for the IBM Cloud for Financial Services](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/f5-bigip/vpc-single-region-edge.svg)

Figure 5. Detailed VPC reference architecture with edge VPC



 Global load balancer 

One option for global load balancing outside of the edge VPC is IBM Cloud® Internet Services (CIS), powered with Cloudflare. CIS provides a fast, highly performant, reliable, and secure internet service for customers running their business on IBM Cloud.

CIS is not Financial Services Validated. Because of this, TLS connections must not be terminated in CIS and should be configured only for pass-through connections. CIS global load balancers must be configured with the proxy configuration setting value of off. CIS Range applications should be used to provide DDoS protection in front of global load balancers.

For more information, see the following resources:



* [Getting started with CIS](https://cloud.ibm.com/docs/cis?topic=cis-getting-started)
* [Configuring a global load balancer](https://cloud.ibm.com/docs/cis?topic=cis-global-load-balancer-glb-concepts)
* [Protecting TCP traffic (Range)](https://cloud.ibm.com/docs/cis?topic=cis-configure-glb)
application/xml+rss
application/vnd.api+json
application/x-protobuf
application/json
multipart/bag
multipart/mixed
application/xhtml+xml
font/ttf
font/otf
font/x-woff
image/svg+xml
application/vnd.ms-fontobject
application/ttf
application/x-ttf
application/otf
application/x-otf
application/truetype
application/opentype
application/x-opentype
application/font-woff
application/eot
application/font
application/font-sfnt
application/wasm
application/javascript-binast
application/manifest+json
application/ld+json
Show more

If you do not want a particular response from your origin to be encoded, you can disable this by setting cache-control: no-transform at your origin web server.



 Enable Brotli compression 



1. Log in to your CIS account.
2. Choose the appropriate domain.
3. Click the Performance tab.
4. Click the Advanced tab.
5. Toggle the Brotli switch to On.









 HTML, JavaScript, and CSS compression features 

CIS uses Minify web content to remove all unnecessary characters from HTML, JavaScript and CSS files, without changing their functionality.

CSS and JavaScript minification operates on cached CSS and JS files only. After CIS returns a cache HIT for the file, it it is returned to browsers in minified form. This allows CIS to deliver a more complete minification result. If you need to enable or disable minification for CSS and JavaScript, purge your CIS cache to see the effect of any minification change.





 Image size optimization compression 

Image size optimization compresses resources cached in the CIS edge network by stripping metadata and applying lossy or lossless compression. Image size optimization accelerates image downloads by reducing image size. Image size optimization cannot optimize off-site resources.
<-- </section "id="section-update-ratelimit-examples" "> --><-- </section "id="section-update-ratelimit" "> --><-- <section "id="section-list-ratelimit-rules" "> --> ibmcloud cis ratelimit-rules List rate limiting rules of a given DNS domain. ibmcloud cis ratelimit-rules DNS_DOMAIN_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-list-ratelimit-rules-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-list-ratelimit-rules-options" "> --><-- <section "id="section-llist-ratelimit-rules-examples" "> --> Examples List rate limiting rules in domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis ratelimit-rules 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"
<-- </section "id="section-llist-ratelimit-rules-examples" "> --><-- </section "id="section-list-ratelimit-rules" "> --><-- <section "id="section-show-ratelimit-rule" "> --> ibmcloud cis ratelimit-rule Get details of a rate limiting rule by ID. ibmcloud cis ratelimit-rule DNS_DOMAIN_ID RATELIMIT_RULE_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! !
Product guide 

 Cloud Internet Services (CIS) 

--------------------



* Get started



* [Getting started with IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-getting-started)
* [About IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-about-ibm-cloud-internet-services-cis)
* Using best practices



* [Best practices for CIS setup](https://cloud.ibm.com/docs/cis?topic=cis-best-practices-for-cis-setup)
* [Managing CIS for optimal security](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cis-for-optimal-security)
* [Managing your CIS deployment for optimal reliability](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cloud-internet-services-deployment-for-optimal-reliability)
* [Managing your CIS deployment for best performance](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-cis-deployment-for-best-performance)



* Concepts



* [DNS concepts](https://cloud.ibm.com/docs/cis?topic=cis-dns-concepts)
* [Dealing with Distributed Denial of Service attacks](https://cloud.ibm.com/docs/cis?topic=cis-distributed-denial-of-service-ddos-attack-concepts)
* [Global load balancer concepts](https://cloud.ibm.com/docs/cis?topic=cis-global-load-balancer-glb-concepts)
* [Web Application Firewall concepts](https://cloud.ibm.com/docs/cis?topic=cis-waf-q-and-a)
* [Routing concepts](https://cloud.ibm.com/docs/cis?topic=cis-cis-routing)
If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-list-waf-overrides-options" "> --><-- <section "id="section-list-waf-override-examples" "> --> Examples List WAF overide rules under instance cis-demo. ibmcloud cis waf-overrides 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"
<-- </section "id="section-list-waf-override-examples" "> --><-- </section "id="section-list-waf-overrides" "> --><-- <section "id="section-get-waf-override" "> --> ibmcloud cis cis waf-override Get a URL based Web Application Firewall (WAF) rule. ibmcloud cis waf-override DNS_DOMAIN_ID OVERRIDE_WAF_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-get-waf-overrides-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.OVERRIDE_WAF_ID: The ID of override WAF rule. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-get-waf-overrides-options" "> --><-- <section "id="section-get-waf-override-examples" "> --> Examples Get a WAF overide rule under instance cis-demo.
* [Getting started with CIS](https://cloud.ibm.com/docs/cis?topic=cis-getting-started)
* [Configuring a global load balancer](https://cloud.ibm.com/docs/cis?topic=cis-global-load-balancer-glb-concepts)
* [Protecting TCP traffic (Range)](https://cloud.ibm.com/docs/cis?topic=cis-configure-glb)







 Edge VPC with web application firewall 

The edge VPC is used to enhance boundary protection for both the management VPC and the workload VPC. For public internet access to the workload VPC, a WAF in the edge VPC is use to protect web applications by filtering and monitoring internet web traffic. A WAF can prevent attacks exploiting a web application's known vulnerabilities.

IBM does not currently offer a Financial Services Validated solution for WAF. So, you need to install and manage your own WAF within your edge VPC. One option for WAF is to use F5 BIG-IP. See the tutorial [Setup WAF with F5 BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-waf-tutorial) for more details.

For [management VPC connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-management), your operators can connect to the environment from your on-premises network (with Direct Link or VPN for VPC) or through a full-tunnel client-to-site VPN. In practice, all three zones in the edge VPC would be the same, but for illustrative purposes, each zone in the edge VPC box depicts one of the three scenarios for operator connectivity:



* Zone 1 - Connectivity with Direct Link, so neither a full-tunnel client-to-site VPN nor VPN for VPC is needed.
<-- </section "id="section-delete-range-app-examples" "> --><-- </section "id="section-delete-range-app" "> --><-- <section "id="section-show-range-app" "> --> ibmcloud cis range-app Get the application configuration of a specific application (Enterprise plan only). ibmcloud cis range-app DNS_DOMAIN_ID APP_ID --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-show-range-app-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.APP_ID: The ID of range application. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-range-app-options" "> --><-- <section "id="section-show-range-app-examples" "> --> Examples Show details of range application ea95132c15732412d22c1476fa83f27a. ibmcloud cis range-app 31984fea73a15b45779fa0df4ef62f9b ea95132c15732412d22c1476fa83f27a -i "cis-demo"
<-- </section "id="section-show-range-app-examples" "> --><-- </section "id="section-show-range-app" "> --><-- <section "id="section-list-range-app" "> --> ibmcloud cis range-apps Retrieve a list of currently existing range applications for a given DNS domain (Enterprise plan only). ibmcloud cis range-apps DNS_DOMAIN_ID --instance INSTANCE] --output FORMAT] !