vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Deploying and configuring the IBM Hardware Security Module (HSM) with Citrix Netscaler VPX 

This step-by-step guides you through integrating the HSM with Citrix Netscaler VPX. The two services can then communicate and generate the cryptographic material required to create a certificate.



 About the deployment 

This deployment was built and tested with the following component specifications:



Component specifications

 NetScaler VPX Version & Build HSM Software Version HSM Firmware version HSM Client Version 

 NS12.1: Build 48.13.nc 6.2.2-5 6.10.9 6.2.2 



If you have an older version of VPX or, if when ordering the device through the IBM Cloud® platform you only see versions 11.1 and earlier as selection options, the device can be upgraded so that the set-up described in this guide can be completed.





 Logical topology 

The following diagram shows the network traffic flow for the SSL offload use case. This provides a visual and logical perspective of the trust link and the configuration between VPX and the HSM appliance.

If you are not familiar with SSL offload, review this [Citrix article](https://docs.citrix.com/en-us/netscaler/12-1/ssl.html).





 What you'll accomplish 

In this step-by-step guide you will learn how to deploy and configure an HSM with a Citrix Netscaler VPX:



 Task Description 

 [Order a Hardware Security Module (HSM)](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-order-the-ibm-hardware-security-module-hsm-) First, you'll order an HSM. 
 [Order a Citrix Netscaler VPX](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-order-a-citrix-netscaler-vpx) If you haven't already, you'll order a Citrix Netscaler VPX.
(https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/security-compliance/images/config-rules-property.svg)

Figure 1. The ways in which properties can relate to each other.







 Creating a rule 

You can use the Security and Compliance Center UI to define the configuration rules that you want monitor for your IBM Cloud resources. For more information about which services you can configure rules for, see [What can I evaluate?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scannable-componentsevaluate-services).

You can either use the rule builder or edit the JSON directly.



1. In the IBM Cloud console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/a6478671e8f845a84102d9cf49bf28ee7f4f3227/icons/icon_hamburger.svg)> Security and Compliance > Controls > Rules, and click Create.
2. Give your rule a meaningful name and description.
3. Optional: Add one or more labels that you can use to organize and search for similar rules and click Next.
4. Target your resource.



1. From the Target service drop-down, select a service. For example, Cloud Object Storage.
2. From the Resource type drop-down, select the type of resource that you want to create a rule for. For example, Bucket.
3. Optional: Add additional target attributes to further qualify the resources that you want to target.

For example, to target all of your Cloud Object Storage buckets in the US South location, you would make the following selections: Attribute: Location, Value: string_equals, and enter us_south for Value.
4. Click Add to rule.



5. Configure your properties.
SSL VPN FAQs 

These FAQs provide answers to common questions about SSL VPNs.



 What is IBM Cloud VPN? 

IBM Cloud® VPN access is designed to allow users to remotely manage all servers securely over the IBM Cloud private network. A VPN connection from your location to the private network allows for out-of-band management and server rescue through an encrypted VPN tunnel. VPN tunnels can be created to any IBM Cloud data center or PoP providing geographic redundancy.

With VPN access, you can:



* Establish a VPN connection to the private network by using SSL or IPsec
* Access your server through its private 10.x.x.x IP address by using SSH or RDP
* Connect to your server’s IPMI IP address for server management or rescue needs.



Our SSL VPN gateway is a security product from Array Networks. The gateway itself runs radius to update users and passwords from our customer portal.





 What if I cannot connect to the SSL or IPsec VPN endpoint of my choice? 

Geographic redundancy exists to allow access into your private network from anywhere in the world that you choose to connect from. If one location doesn't connect, you can use a different data center during the interruption. If multiple locations are failing to connect, visit our Troubleshooting section.





 Does the SSL VPN also perform IPsec or other VPN protocols? 

Currently, the SSL VPN gateway uses a browser-based SSL VPN plug-in or a proprietary client for creating connections. We continue to bring more VPN connectivity options to the private network. The SSL VPN was selected for ease of use and compatibility.





 Can I mount the NAS/FTP server from my remote location over the SSL VPN gateway? 

No. You have access to your private VLAN and servers only from the SSL VPN gateway. If you want to download data from your NAS/FTP volume, you must move the data to your server then out through the VPN to the remote location.

For security reasons, only servers that are located inside the data center are allowed access to the servers, which provide services (DNS, Update, NAS, Lockbox).
* [VPC worker nodes](https://cloud.ibm.com/docs/containers?topic=containers-encryptionworker-encryption-vpc)





[Configuring pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-psppsp)



* [FAQs](https://cloud.ibm.com/docs/containers?topic=containers-psppsp-faqs)



* [Why do I set pod security policies?](https://cloud.ibm.com/docs/containers?topic=containers-pspwhy-set-psps)
* [Are any policies set by default? What can I add?](https://cloud.ibm.com/docs/containers?topic=containers-psppsp-defaults)
* [How does policy authorization work?](https://cloud.ibm.com/docs/containers?topic=containers-psppsp-auth)
* [Why can I still create privileged pods when I am not part of the privileged-psp-user cluster role binding?](https://cloud.ibm.com/docs/containers?topic=containers-psppsp-role-binding)



* [Customizing pod security policies](https://cloud.ibm.com/docs/containers?topic=containers-pspcustomize_psp)



* [Modifying the RBAC resources](https://cloud.ibm.com/docs/containers?topic=containers-pspmodify_rbac)
* [Deleting RBAC resources](https://cloud.ibm.com/docs/containers?topic=containers-pspdelete_rbac)
* [Creating your own pod security policy](https://cloud.ibm.com/docs/containers?topic=containers-pspcreating_security_policy)



* [Understanding default resources for IBM cluster management](https://cloud.ibm.com/docs/containers?topic=containers-pspibm_psp)
7. Optional: To view interfaces that are attached to the security group, click the Attached resources tab and review the Attached interfaces section.
8. When you finish creating rules, click the Security groups breadcrumb at the top of the page to return to your list of Security groups for VPC.







 Updating the default security group from the CLI 

Complete the following steps to update the default security group by using the CLI:



1. Log in to IBM Cloud® Virtual Private Cloud.

If you have a federated account:

ibmcloud login -sso

Otherwise, use this command:

ibmcloud login
2. Get the default security group ID and details for the VPC.

Run the following command to list all VPCs:

ibmcloud is vpcs

The default security group name is shown under the column Default Security Group. Note the name of it so that you can find the ID when you list the security groups (next).

Now list all the security groups:

ibmcloud is security-groups

Save the security group ID (for the default security group) in a variable so that you can use it later. For example, use the variable name sg:

sg=0738-2d364f0a-a870-42c3-a554-000001162469

To get details about the security group, run the following command:

ibmcloud is security-group GROUP

For example, run the following command to get details about the security group with the security group ID you saved as a variable:

ibmcloud is security-group $sg

Alternatively, you can insert the actual ID value in place of the variable $sg.
3. Update the default security group to add rules that allow SSH and PING.

Disabling SSH connections prohibits the license registration for RedHat Enterprise Linux. This can result in provisioning failures.

To add rules in your default security group, run the following command:

ibmcloud is security-group-rule-add GROUP DIRECTION PROTOCOL [--port-min PORT_MIN] [--port-max PORT_MAX]
* [Security group settings for Azure](https://cloud.ibm.com/docs/satellite?topic=satellite-azureazure-reqs-firewall)
* [Microsoft Azure credentials](https://cloud.ibm.com/docs/satellite?topic=satellite-azureinfra-creds-azure)
* [I created a Satellite location, what's next?](https://cloud.ibm.com/docs/satellite?topic=satellite-azureazure-whats-next)



[IBM Cloud for tests](https://cloud.ibm.com/docs/satellite?topic=satellite-ibmibm)



* [Manually adding IBM Cloud RHEL hosts to Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-ibmibm-host-attach)
* [Manually adding IBM Cloud RHCOS hosts to Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-ibmibm-host-attach-rhcos)
* [I created a Satellite location, what's next?](https://cloud.ibm.com/docs/satellite?topic=satellite-ibmibm-whats-next)



[Setting up the Satellite location control plane](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-control-planesetup-control-plane)



* [Setting up the control plane from the console](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-control-planecontrol-plane-ui)
* [Setting up the control plane from the CLI](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-control-planecontrol-plane-cli)
* [I created a Satellite location, what's next?](https://cloud.ibm.com/docs/satellite?topic=satellite-setup-control-planelocation-control-plane-next)
[Policy-based root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy) Every 1 - 12 months Choose a rotation interval between 1 - 12 months for your key based on your on-going security needs. After you set a rotation policy for a key, the clock starts immediately based on the initial creation date for the key. For example, if you set a monthly rotation policy for a key that you created on 2019/02/01, Hyper Protect Crypto Services automatically rotates the key on 2019/03/01. 
 [On-demand root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys) Up to one rotation per hour If you're rotating a key on demand, Hyper Protect Crypto Services allows one rotation per hour for each root key. 







 What's next 



* To learn how to use Hyper Protect Crypto Services to set an automatic rotation policy for an individual key, see [Setting a rotation policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy).
* To find out more about manually rotating root keys, see [Rotating keys on demand](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys).
7. In the Source type section, select Security group.
8. Click Create to apply these changes.









 Related links 

These links provide additional information about IBM Cloud Security Groups for VPC:



* [Security Groups CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referencesecurity-groups-cli-ref)
* [Security Groups API reference](https://cloud.ibm.com/apidocs/vpclist-security-groups)
* [Security Groups required permissions](https://cloud.ibm.com/docs/vpc?topic=vpc-resource-authorizations-required-for-api-and-cli-callssg-authorizations-required-for-api-and-cli-calls)
* [Security Groups for VPC infrastructure resources for Terraform](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_security_group) (VPC infrastructure > Resources)
* [Security Groups Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-eventsevents-network-security-group)
* [Security Groups quotas](https://cloud.ibm.com/docs/vpc?topic=vpc-quotassecurity-group-quotas)
Release notes for IBM Cloud Security Groups 

Find out about new and updated features in IBM Cloud Security Groups.



  6 April 2018 

Predfined security groups
:   You can now add existing or predefined IBM Cloud Security Groups to instances during the ordering process. You can use security groups to enact a set of IP filter rules that define how to handle incoming and outgoing traffic to both the public and private interfaces of a virtual server instance.
:   For more information, refer to [Adding a predefined security group during ordering](https://cloud.ibm.com/docs/security-groups?topic=security-groups-adding-a-pre-defined-security-group-during-ordering).
Access groups are assigned policies that grant roles and permissions to the members of that group.

[Inviting users to your account ](https://cloud.ibm.com/docs/account?topic=account-iamuserinv)

Use IAM to invite users, cancel invitations, or resend a pending invitation.

[Managing resource groups ](https://cloud.ibm.com/docs/account?topic=account-rgs)

A resource group is a way for you to organize your account resources in customizable groupings.

[Managing access to resources ](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources)

You can manage access through the UI, CLI, API, or Terraform.

[Centrally managing multiple accounts with an enterprise ](https://cloud.ibm.com/docs/account?topic=account-create-enterprise)

Enterprises simplify managing billing, invoicing, and payments for the accounts.

 Security and compliance 

Learn how IBM Cloud security components work together and mitigate risk.

[IBM Cloud Security and Compliance Center ](https://cloud.ibm.com/security-compliance)

Get centralized views of your compliance, governance, and security postures.

[Defining your security strategy ](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-posture-management)

Learn how IBM Cloud security components work together to help you mitigate risk.

[Setting up compliance monitoring ](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started)

Embed security checks into your workflows to validate your configurations.

[Understanding IBM Cloud compliance ](https://cloud.ibm.com/docs/overview?topic=overview-compliance)

A platform and services that are built on best-in-industry security standards.

[Controlling what users access ](https://cloud.ibm.com/docs/account?topic=account-cloudaccess)

Access management enables you to control which users see, create, use, and manage resources in your account.
After provisioning is complete, you cannot change the resoure group.



* Tags - Add user tags. User tags are visible account-wide. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).



User tags are visible account-wide. Avoid including sensitive data in the tag name.



* Optional:Access management tags - Add access management tags to help organize access control relationships. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Optional:Virtual private cloud - Select your VPC.



7. Under Rules, click Create to configure inbound and outbound rules that define what type of traffic is allowed to and from the instance. For each rule, specify the following information:



* Select the protocols and ports to which the rule applies.
* Specify a CIDR block or IP address for the permitted traffic. Alternatively, you can specify a security group in the same VPC to allow traffic to or from all instances that are attached to the selected security group.



Tips:



* All rules are evaluated, regardless of the order in which they're added.
* Rules are stateful, which means that return traffic in response to allowed traffic is automatically permitted. For example, you created a rule that allows inbound TCP traffic on port 80. That rule also allows replying outbound TCP traffic on port 80 back to the originating host, without the need for another rule.
* For Windows images, make sure that the security group that is associated with the instance allows inbound and outbound Remote Desktop Protocol traffic (TCP port 3389).



8. Optional: Attach interfaces, bare metal interfaces, load balancers, virtual private endpoint gateways, and VPN servers in the remaining sections if these targets are available to attach.







 Setting up the security groups for your resource from the CLI 

In this example, you create a virtual server instance with a security group that is enabled by using the command-line interface (CLI). Figure 1 shows what this scenario looks like.

Zoom
Console [Navigating the console](https://cloud.ibm.com/docs/overview?topic=overview-ui) 
 Global search and tagging [Searching for resources](https://cloud.ibm.com/docs/account?topic=account-searching-for-resources) and [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag) 
 IAM [What is IBM Cloud Identity and Access Management?](https://cloud.ibm.com/docs/account?topic=account-iamoverview) 
 IBM Cloud CLI [Understanding high availability and disaster recovery for the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-ha-dr) 
 IBM Cloud projects [Understanding high availability and disaster recovery for projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-ha-dr) 
 Security and Compliance Center [Understanding high availability](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ha) and [disaster recovery](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-bc-dr) for Security and Compliance Center 



Some platform services are regionally available, which means that automated global failover isn’t supported. If a region is unavailable, the service also becomes unavailable in that region. Be sure to review the “Understanding high availability and disaster recovery” topics to learn about where those services are run.





 High availability for resources 

High availability and disaster recovery aren't universal across all resources, so the type of high availability and disaster recovery that's available depends on the resource that you're using. All IBM Cloud resources are hosted in data center locations around the world. The locations that you deploy your app to can spread workloads across data centers, and you can ensure that a failover design is in place to keep your app up and running.
To see the steps, see [Adding compliance controls by using the console](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-onboard-custom&interface=uicustom-tf-add-controls-ui).





 Applying Security and Compliance Center scans by using the console 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center scans determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).



1. Select the profile that you used for the evaluation.
2. Select the Security and Compliance Center scan.
3. Click Apply scan.
4. Click Next.



If your version does not pass all of the goals for a particular control, you can create a custom Security and Compliance profile. For more information, see [What is a profile?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-profiles)





 Applying Security and Compliance Center scans by using the CLI 

Add the scans that you previously ran in the Security and Compliance Center. Security and Compliance Center determine adherence to regulatory controls. For more information, see [Scheduling a scan](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-schedule-scan).

To add the Security and Compliance Center scan, run the [ibmcloud catalog offering version scc](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginversion-scc) command:

ibmcloud catalog offering version scc --vl <VERSION_LOCATOR> --profile <PROFILE_ID> --scan <SCAN_ID>







 Reviewing requirements by using the console 

Make sure that you completed all of the required steps so that you can share the deployable architecture with others in your enterprise.





 Reviewing requirements by using the CLI 

You can make sure that you completed all of the required steps.
You can set up goals that check whether volumes are encrypted by using customer-managed keys. By using the Security and Compliance Center to validate the Block Storage for VPC configurations in your account against a profile, you can identify potential issues as they arise.

For more information about monitoring security and compliance for VPC, see [Monitoring security and compliance posture with VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-manage-security-compliancemonitor-vpc). For more information about creating security and compliance goals, see [Defining rules](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-rules-define&interface=ui) in the Security and Compliance documentation.





 Cancelling your Block Storage for VPC 

If you no longer need a volume, you can cancel it at any time. IBM [wipes all data](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storageblock-storage-data-eradication) before the storage is reused. If you have extra compliance requirements such as NIST 800-88 Guidelines for Media Sanitization, you must perform data sanitation procedures before you delete your volumes. For more information, see [Sanitize your data before you delete a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storageblock-storage-sanitization).





 Next steps 

Create your Block Storage for VPC volumes.



* For more information about creating a volume during instance provisioning, see [Create and attach a Block Storage for VPC volume when you create an instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storagecreate-from-vsi).
* For more information about creating a Block Storage for VPC encrypted by your own encryption keys, see [Creating Block Storage for VPC volumes with customer-managed encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption).