vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the target key ring that you want to assign the key to. If unspecified, the header is automatically set to default and the key belongs to the default key ring in the specified Hyper Protect Crypto Services instance.<br><br>For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 
 key_name Required. A unique, human-readable name for easy identification of your key.<br><br>Important: To protect your privacy, do not store your personal data as metadata for your key. 
 alias_list Optional. One or more unique, human-readable aliases assigned to your key.<br><br>Important: To protect your privacy, do not store your personal data as metadata for your key.<br><br>Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_).
* Diffie-Hellman Group (for phase 1&2)
* Is Perfect Forward Secrecy (PFS) used?
* Key life time (for phase 1 & 2) - Note: Our system measures this value in seconds!



After you have this information available, you can configure the basic negotiation parameters of the VPN connection.





 Protected networks 

In the VPN connection properties, you must define the networks on the remote end of the tunnel and the local networks for the tunnel. In the “Protected Customer (Remote) Subnet”, enter the private IP address space in CIDR notation for the remote (Non-IBM) end of the IPsec tunnel.

For example, if your network on the remote end of the tunnel uses a single subnet 10.0.0.0 with a netmask of 255.255.255.0, you would enter IP address 10.0.0.0 / CIDR 24 for the “Protected Customer (Remote) Subnet” section.





 Network Address Translation (NAT) 

With the IPsec VPN, you also are allowed to define private IP addresses on the IBM Cloud network that will route traffic to remote subnets on the other end of the VPN connection. This allows you to have private internet traffic that is forwarded to one of your internal IP addresses of a system behind your VPN, without exposing the remote location to full internet access.





 Network Address Translation/assigned static NAT subnets 

To configure a remote VPN IP with a static NAT entry:



* Select the red arrow to display the subnet list in the Assigned Static NAT subnets section. Each IP in the subnet is displayed.
* Enter the IP on the remote end of the VPN connection under the Customer IP column and enter a name for the mapping under the Name column.
* Select the Add/Modify Context Address Translations and Apply Configurations to save and apply the configuration.



This action sets up a static one-to-one network translation for the return traffic, which is used by your hosts behind the IBM Cloud VPN concentrator to communicate with the hosts behind the remote VPN peer. For example, all traffic for IP 10.1.255.92 will be translated and forwarded to the customer's IP 192.168.10.15.
Premium VLANs cannot be cancelled if they are being used by other products. The following uses prevent cancellation:



* Servers directly homed on the VLAN (as opposed to trunked).
* Firewall products which serve the entire VLAN. This excludes non-dedicated hardware firewalls, for instance.



Additionally, some products and features do not prevent cancellation of a VLAN, but are affected by its removal. This includes being protected by a Virtual Router Appliance. The VLAN association is removed whether it is bypassed or not.
For the Terms of Service for SendGrid and Twilio, see [Twilio Terms of Service](https://www.twilio.com/legal/tos).





For more information about SendGrid, see the following links.



* [SendGrid documentation](https://sendgrid.com/docs/)
* [SendGrid Email API documentation](https://www.twilio.com/sendgrid/email-api)
* [SendGrid for developers](https://sendgrid.com/docs/for-developers/)





* Can I use outbound email on port 25?

As of 28 October 2015, IBM Cloud® no longer allows outbound connections through TCP port 25 (SMTP) on new accounts.
* Why is the standard email port 25 blocked?

By default, the standard SMTP TCP port 25 is blocked due to the large amount of abuse that is targeted at this port. IBM Cloud® offers a trusted third-party email relay service from SendGrid if you need to send outbound email from their domains or applications.
* What options do I have if I want to send email from my server or application?

If you need send email from your servers, you need to use a smart host outside of IBM Cloud®. A smart host is a host that relays SMTP traffic from an SMTP server, mail client, or any other service or programming language capable of handling SMTP. Servers typically send this type of traffic by using the mail submission TCP ports 465 or 587. You can communicate with 465, 587, or any custom port other than TCP port 25. If you want to use your own email server on a custom port, use the documentation specific to your email service to configure a custom email port.
* Why are my emails flagged as spam?

Your emails can be flagged as spam if you don't use authentication with RDNS, DMARC, BIMI, SPF, or DKIM. If your emails don't comply with internet privacy laws, then they might be blocked or flagged as spam. The following are some common privacy laws.
Describes the variables that are needed to add a root key with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the target key ring that you would like the newly create key to be a part of. If unspecified, the header is automatically set to 'default' and the key will sit in the default key ring in the specified Key Protect service instance. For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 
 key_name Required. A human-readable name for convenient identification of your key. Important: To protect your privacy, do not store your personal data as metadata for your key. 
 alias_list One or more unique, human-readable aliases assigned to your key. Important: To protect your privacy, do not store your personal data as metadata for your key. Each alias must be alphanumeric, case sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_).
Finally, if you are an administrator of a channel, you can add that organization to an existing channel so the organization can transact on the network using the Channels tab (this task might require the signature of other organizations). See the topic on [Join the consortium hosted by the ordering service](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-add-org) for detailed steps.





 Storage 

When the blockchain console deploys a node, storage is dynamically provisioned from the default storageclass for that node from persistent storage. You have the option of encrypting the persistent volume but there may be some performance implications with encryption to consider.

Customers are responsible for encrypting their own storage and the encryption must occur before any blockchain components are deployed to the cluster.

The default persistent storage type is File storage, also known as Endurance storage. For more information about encryption on all of the IBM Cloud storage options:



* [IBM Cloud File storage Provider managed encryption-at-rest](https://cloud.ibm.com/docs/FileStorage?topic=FileStorage-mng-dataprovisioning-storage-with-encryption)
* [Portworx encrypting volumes](https://docs.portworx.com/reference/cli/encrypted-volumes/)
* [IBM Cloud data encryption and key management](https://www.ibm.com/cloud/architecture/architectures/data-security-archt)







 Data privacy 

When you have data privacy requirements, [Private Data collections](https://hyperledger-fabric.readthedocs.io/en/release-2.2/private-data/private-data.htmlwhat-is-private-data) provide a way to further isolate specific data from the rest of the channel members. The combination of the use of channels and private data offer various solutions for achieving [Data Residency](https://cloud.ibm.com/docs/blockchain?topic=blockchain-console-icp-about-data-residency).





 GDPR
CopySource: sourceBucketName + '/' + sourceObjectName,
RetentionDirective: 'Copy'
}).promise()
.then((data) => {
console.log(Protected object copied from ${sourceBucketName}/${sourceObjectName} to ${destinationBucketName}/${newObjectName});
})
.catch((e) => {
console.log(ERROR: ${e.code} - ${e.message}n);
});
}
Show more





 Add or remove a legal hold to or from a protected object 

The object can support 100 legal holds:



* A legal hold identifier is a string of maximum length 64 characters and a minimum length of 1 character. Valid characters are letters, numbers, !, _, ., , (, ), - and \.
* If the addition of the given legal hold exceeds 100 total legal holds on the object, the new legal hold will not be added, a 400 error will be returned.
* If an identifier is too long it will not be added to the object and a 400 error is returned.
* If an identifier contains invalid characters, it will not be added to the object and a 400 error is returned.
* If an identifier is already in use on an object, the existing legal hold is not modified and the response indicates the identifier was already in use with a 409 error.
* If an object does not have retention period metadata, a 400 error is returned and adding or removing a legal hold is not allowed.



The user making adding or removing a legal hold must have Manager permissions for this bucket.

function addLegalHoldToObject(bucketName, objectName, legalHoldId) {
console.log(Adding legal hold ${legalHoldId} to object ${objectName} in bucket ${bucketName});
return cos.client.addLegalHold({
Bucket: bucketName,
Key: objectId,
RetentionLegalHoldId: legalHoldId
}).promise()
.then(() => {
You can create a virtual tunnel interface (VTI) by clicking the Create new Virtual Interface link in the Local VPN Access Interface menu. Be careful to choose the link-local address and make sure that it is not overlapping with other addresses on the device. In this example, we used 169.254.0.0/30 for our primary tunnel. There are two available IP addresses 169.254.0.1 and 169.254.0.1 in this subnet with a 30-bit netmask. The first IP address 169.254.0.1 was used as the VTI on the FTDv. The second IP address 169.254.0.2 was used as the IBM VPN gateway VTI address.

Zoom

![Create Virtual Tunnel Interface](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-create-vti.png)

Create Virtual Tunnel Interface
4. Click NEXT. On the Privacy Configuration page, define the privacy configuration for the VPN.



* Enable the IKE VERSION 2 toggle button and configure the Internet Key Exchange (IKE) Policy.

Zoom

![Add IKE v2 Policy](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/vpn-add-ike-v2-policy.png)

Add IKE v2 Policy
* Configure the IPSec Proposal settings, which define the combination of security protocols and algorithms that secure traffic in an IPsec tunnel.

Zoom

!
Zoom

![App ID application identity and authorization flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/app-to-app-flow.png)

Figure 1. Application identity and authorization flow



1. You register the application that needs to authenticate to access a protected resource with App ID.
2. Application A registers with App ID to obtain a client ID and secret.
3. Application A makes a request to the App ID authorization server /token endpoint by sending the credentials retrieved in the previous step.
4. App ID validates the request, authenticates the app, and returns a response to Application A that contains an access token.
5. Application A is now able to use the valid access token to send requests to protected resources such as Application B.



The client secret that is used to authenticate the client is highly sensitive and must be kept confidential. Because the application uses the client secret in-app, this workflow must be used with trusted applications only. Using a trusted application ensures that the client secret is not leaked or misused.







 Registering your app 



 With the GUI 



1. In the Application tab of the App ID dashboard, click Add Application.
2. Add your application name and click Save to return to a list of your registered apps. The name of your application cannot exceed 50 characters.
3. From the list of registered apps, select the application that you added in the previous step. The row expands to show your credentials.







 With the API 



1. Make a POST request to the [/management/v4/<tenantID>/applications endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Applications/mgmt.registerApplication).
: Geographical Access Control [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-geographical-access-control) (available through UI).

Vendor selection step removed from ordering
: Vendor Selection step is not needed anymore for [Ordering a CDN](https://cloud.ibm.com/docs/CDN?topic=CDN-order-a-cdn).





 July 2018 

Added Geographical access control to the API
: Geographical Access Control [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-geographical-access-control) (available through the API).





 June 2018 

Added HTTPS with DV SAN support
: HTTPS with DV SAN support [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-https-protocol-support).

GDPR compliance
: IBM Content Delivery Network adheres to the EU General Data Protection Regulation (GDPR) and compliance requirements. Our privacy practices are detailed in the [IBM Privacy Statement](https://www.ibm.com/privacy/us/en/).





 March 2018 

Large file optimization
: Large File Optimization [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-large-file-optimization).

Cache key optimization
: Cache Key Optimization [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-cache-key-optimization).

Video on demand optimization
: Video On Demand Optimization [feature description](https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn-video-on-demand).
[Checkmark icon](https://cloud.ibm.com/docs/images/checkmark-icon.svg) 
 South America Sao Paulo (br-sao) ![Checkmark icon](https://cloud.ibm.com/docs/images/checkmark-icon.svg) 



* What targets should I use based on my compliance needs?

There are two options available depending on your compliance needs:



* If you require Financial Services Validation.
* If you required PCI, SOC2, Privacy Shield and HIPAA compliance.





 Financial Services Validated status 

If you're the account owner, you can enable your IBM Cloud® account to be Financial Services Validated, which means your account stores and manages regulated financial services information. Services that are designated as IBM Cloud for Financial Services Validated leverage the industry’s highest levels of encryption certification, provide preventive and compensatory controls for financial services regulatory workloads, multi-architecture support and proactive, and automated security. For more information on how to enable your account, see [Enabling your account to use Finantial Services Validated products](https://cloud.ibm.com/docs/account?topic=account-enabling-fs-validated).

The IBM Cloud for Financial Services Validated designation is available for services that are operating in the Dallas (us-south), Washington DC (us-east), Frankfurt (eu-de), and London (eu-gb) multizone regions A region that is spread across data centers in multiple zones to increase fault tolerance..

Use Activity Tracker Event Routing to manage auditing events in your account whe requiring Financial Services Validated status.





 PCI, SOC2, Privacy Shield and HIPAA compliance 

Activity Tracker offers ready to run event search offerings that you can use to expedite your time to greater insights. You can choose to retain your events for 7, 14, or 30 days. In addition, a 30 day HIPAA compliant offering is also available. For more information about these offerings, see [Service plans](https://cloud.ibm.com/docs/atracker?topic=atracker-service_plan).
FAQs 



 Can I use outbound email on port 25? 

As of 28 October 2015, IBM Cloud® no longer allows outbound connections through TCP port 25 (SMTP) on new accounts.





 Why is the standard email port 25 blocked? 

By default, the standard SMTP TCP port 25 is blocked due to the large amount of abuse that is targeted at this port. IBM Cloud® offers a trusted third-party email relay service from SendGrid if you need to send outbound email from their domains or applications.





 What options do I have if I want to send email from my server or application? 

If you need send email from your servers, you need to use a smart host outside of IBM Cloud®. A smart host is a host that relays SMTP traffic from an SMTP server, mail client, or any other service or programming language capable of handling SMTP. Servers typically send this type of traffic by using the mail submission TCP ports 465 or 587. You can communicate with 465, 587, or any custom port other than TCP port 25. If you want to use your own email server on a custom port, use the documentation specific to your email service to configure a custom email port.





 Why are my emails flagged as spam? 

Your emails can be flagged as spam if you don't use authentication with RDNS, DMARC, BIMI, SPF, or DKIM. If your emails don't comply with internet privacy laws, then they might be blocked or flagged as spam. The following are some common privacy laws.



* Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM)
* Canada Anti-Spam Law (CASL)
* General Data Protection Regulation (GDPR)
* California Consumer Protection Act (CCPA)







 Why are my emails not being delivered? 



* Your email size might be higher than threshold restrictions. Failure notices often give more details about size restrictions.
* The recipient server might block your emails because of compliance and regulation reasons. For more information, see [Why are my emails flagged as spam?]
1.2.10 Ensure that the APIPriorityAndFairness feature gate is enabled. Manual 1 Pass 
 1.2.11 Ensure that the admission control plug-in AlwaysAdmit is not set. Automated 1 Pass 
 1.2.12 Ensure that the admission control plug-in AlwaysPullImages is not set. Manual 1 Pass 
 1.2.13 Ensure that the admission control plug-in SecurityContextDeny is not set. Manual 1 Pass 
 1.2.14 Ensure that the admission control plug-in ServiceAccount is set. Automated 1 Pass 
 1.2.15 Ensure that the admission control plug-in NamespaceLifecycle is set. Automated 1 Pass 
 1.2.16 Ensure that the admission control plug-in SecurityContextConstraint is set. Automated 1 Pass 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Automated 1 Pass 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Automated 1 Pass 
 1.2.19 Ensure that the --insecure-port option is set to 0. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.20 Ensure that the --secure-port option is not set to 0. Automated 1 Missing 
 1.2.21 Ensure that the healthz endpoint is protected by RBAC. Automated 1 Missing 
 1.2.22 Ensure that the --audit-log-path option is set. Automated 1 [Not checked](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_413_coco-benchmark-413-remdiations) 
 1.2.23 Ensure that the audit logs are forwarded off the cluster for retention.
: /etc/yum.repos.d/redhat.repo under baseurl



Contribute in GitHub

Open doc issue

Edit topic





On this page[What type of location do I need to use HTTP proxy?](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxyconsider-http-proxy)[What type of hosts can I use?](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxyconsider-http-proxy-host)[What else do I need to know about HTTP proxy?](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxyadditional-http-proxy)[Setting up TCP tunneling](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxysetup-tcp-http-proxy)[Requesting access to the allowlist](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxyaccess-http-proxy)[Configuring your HTTP proxy](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxyhttp-proxy-config)[Common mirror locations](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxycommon-mirror-locations)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences

Your privacy choices

Your privacy choices

!