vania-janet/multiturn-rag-retrieval-data huggingface dataset:
FAQs for network load balancers 

This section contains answers to some frequently asked questions about the IBM Cloud® Network Load Balancer for VPC (NLB).



 Can I use a different DNS name for my load balancer? 

The auto-assigned DNS name for the load balancer is not customizable. However, you can add a CNAME (Canonical Name) record that points your preferred DNS name to the auto-assigned load balancer DNS name. For example, if your load balancer in us-south has the ID dd754295-e9e0-4c9d-bf6c-58fbc59e5727, and the auto-assigned load balancer DNS name is dd754295-us-south.lb.appdomain.cloud, then your preferred DNS name is www.myapp.com. You can add a CNAME record (through the DNS provider that you use to manage myapp.com) pointing www.myapp.com to the load balancer DNS name dd754295-us-south.lb.appdomain.cloud.





 How are DNS names for my load balancer registered? 

DNS hostnames for your load balancers are automatically assigned by the load balancer service under the common DNS zone lb.appdomain.cloud. For maximum portability, these DNS names are registered publicly, even for private load balancers. The hostname has a portion of the randomly generated load balancer ID and does not expose any identifying information. Private load balancer names can be resolved publicly, but the addresses they resolve to are not routable from the internet, and can only be reached from inside your own private network environment.





 Does the NLB support layer 7 switching? 

No. The network load balancer does not support layer 7 switching.





 What's the maximum number of front-end listeners I can define with my load balancer? 

You can define a maximum of ten front-end listeners for an NLB.





 What's the maximum number of virtual server instances I can attach to my back-end pool? 

You can attach a maximum of 50 virtual server instances to your back-end pool for a network load balancer.
[Comparing the PKCS #11 API with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-introduce-cloud-hsmuko-compare-grep11-pkcs11). With the support of the PKCS 11 API, you don't need to change your existing applications that use the PKCS 11 standard. Hyper Protect Crypto Services also provides the isolated keystores to store cryptographic keys generated by the PKCS 11 functions. These keys are protected by the master key and the applications never see the key files locally.

Before you can use the PKCS #11 API, first install the PKCS #11 library. In this way, the PKCS #11 application can interact with the PKCS #11 library, which then calls cryptographic functions that are implemented by Hyper Protect Crypto Services through gRPC. The following diagram shows the key components that are implemented by the Hyper Protect Crypto Services PKCS #11 library and the interactions among different components.

Zoom

![Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-components.svg)

Figure 1. Performing cryptographic operations with the PKCS #11 API

The following sections explain each PKCS #11 component in detail.



 Application 

An application runs within a single address space. All threads of control are running in the application. An application becomes a Cryptoki application by calling the Cryptoki function C_Initialize from one of the threads. After this call is made, the application can call other Cryptoki functions. When the application finishes using Cryptoki, it calls the Cryptoki function C_Finalize and ceases to be a Cryptoki application.





 User 

The PKCS #11 standard defines two types of users for login: a security officer (SO) and a normal user.
Coming from the public internet in, the load balancing products are first, the Hardware Firewall products are next, and the NetScaler products are last (along with the customers servers).





 Does a server's uplink port speed need to match the Hardware Firewall? 

The Hardware Firewall does need to match the public uplink speed of the server. However, because it only protects the public side of the network, the public uplink speed is what must match the firewall selection. Customers can create a case to request a downgrade of only the public interfaces if desired.





 Does IBM Cloud charge for firewall bandwidth? 

The Hardware Firewall and FortiGate Security Appliance (FSA) 1G are not metered for bandwidth. FSA 10G is charged for firewall bandwidth after 20 TB are used. Additionally, these products can reduce total bandwidth utilization by limiting the traffic that servers must respond to.





 How do I upgrade the uplink of my Hardware Firewall? 

The Hardware Firewall is locked to the public uplink port speed of a server. You can upgrade in place by cancelling the firewall, upgrading the port speed for the server, and ordering a new firewall. Alternatively, you can deploy a new server with the desired uplinks and associated firewall.





 Is High Availability possible with the Hardware Firewall? 

No. The Hardware Firewall platform is enterprise-grade and highly durable, but true High Availability (redundant devices) is not an option for the Hardware Firewall. For HA, a Hardware Firewall (High Availability) or FortiGate Security Appliance (High Availability) is required. The Network Gateway product also has an HA option with firewall capabilities.





 I am running a hypervisor on an IBM Cloud server. Will the Hardware Firewall protect the Virtual Machines running on my hypervisor? 

No. Portable IPs are used for the VMs in a hypervisor environment and portable IPs are not protected by the hardware firewall. A FortiGate Security Appliance is recommended.





 What are the grayed out ports in my Windows Firewall? 

IBM Cloud offers many different services that you can utilize with your server including Evault, SNMP and Nagios monitoring.
IBM Cloud HSM Roles 

The following sections outline the roles that access the IBM Cloud® HSM and the cryptographic engine within or connected to the host.



 Mandatory roles 

The following roles are mandatory if you want to access the IBM Cloud® HSM.



* HSM Security Officer (SO) is responsible for initialization of the HSM, setting and changing of HSM policies and creating and deleting application partitions
* Partition Security Officer (PO) is responsible for initializing the Crypto Officer role on the partition, resetting passwords, setting and changing partition-level policies
* Crypto Officer (CO) is responsible for initializing the Crypto User role, and for creating and modifying cryptographic objects in the HSM partition







 Optional Roles 

The following roles are optional if you want to access the IBM Cloud® HSM.



* Auditor (Au) is responsible for managing HSM audit logging, independent from other roles on the HSM
* Crypto User (CU) is responsible for using cryptographic objects (encrypt, decrypt, sign, verify, and more) in the HSM partition







 Enhanced Cryptoki Model 

The separation of roles on the SafeNet Luna Network HSM follows an enhanced Cryptoki model for the following roles:



 HSM Security Officer (SO) 

The HSM SO has control of the HSM within the SafeNet Luna Network HSM appliance. To access HSM SO functions, you must first log in as appliance admin.

In addition to all the other appliance functions, a user who is authenticated with the HSM SO credential can do the following actions:



* Create and delete partitions
* Back up and restore the HSM
* Change HSM policies







 Partition Security Officer (PO) 

The Partition Security Officer has control of one or more partitions (virtual HSMs) within the SafeNet Luna Network HSM. To access Partition SO functions, you must log in by using the LunaCM utility on a registered client computer. The Partition SO, when logged in to the partition, can do the following actions:



* Modify partition policies
* Back up and restore partition contents
* Initialize the Crypto Officer role







 Crypto Officer (CO)
An example of how to retrieve checksum values for AES, DES2, and DES3 keys along with the verification of the key checksums can be found [here](https://github.com/IBM-Cloud/hpcs-pkcs11/blob/master/samples/pkcs11-checksum.c).





 PKCS 11 function list 

The PKCS #11 standard defines an API called Cryptoki. The following table lists the PKCS #11 Cryptoki API functions and descriptions.

Not all PKCS #11 functions are implemented by Hyper Protect Crypto Services. Functions that are implemented are marked with Yes in the table.



Table 1. Describes the implemented PKCS #11 functions by service backend

 Category PKCS #11 function Implemented? (Yes or No) Description 

 [General Purpose](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959740) C_Initialize Yes Initializes Cryptoki. 
 [General Purpose](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959740) C_Finalize Yes Clean up miscellaneous Cryptoki-associated resources. 
 [General Purpose](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959740) C_GetInfo Yes Obtains general information about Cryptoki. 
 [General Purpose](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959740) C_GetFunctionList Yes Obtains entry points of Cryptoki library functions.
With the support of the PKCS 11 API, you don't need to change your existing applications that use the PKCS 11 standard. Hyper Protect Crypto Services also provides the isolated keystores to store cryptographic keys generated by the PKCS 11 functions. These keys are protected by the master key and the applications never see the key files locally.

Before you can use the PKCS #11 API, first install the PKCS #11 library. In this way, the PKCS #11 application can interact with the PKCS #11 library, which then calls cryptographic functions that are implemented by Hyper Protect Crypto Services through gRPC. The following diagram shows the key components that are implemented by the Hyper Protect Crypto Services PKCS #11 library and the interactions among different components.

Zoom

![Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-components.svg)

Figure 1. Performing cryptographic operations with the PKCS #11 API

The following sections explain each PKCS #11 component in detail.



 Application 

An application runs within a single address space. All threads of control are running in the application. An application becomes a Cryptoki application by calling the Cryptoki function C_Initialize from one of the threads. After this call is made, the application can call other Cryptoki functions. When the application finishes using Cryptoki, it calls the Cryptoki function C_Finalize and ceases to be a Cryptoki application.

If you are running a Java PKCS #11 application using the SunPKCS11 provider on the IBM Z (s390x) platform, make sure that you use the latest IBM Semeru JVM and specify the -Xjit:noResumableTrapHandler Java option when starting your application.
To control inbound traffic, you might want to grant access to other users such as assigning Reader role to invoke actions. 
 API key An API Key for the service ID that can be used to generate IAM tokens. You can use the tokens to authenticate the namespace with other IBM Cloud services. The API key is provided to actions as the environment variable __OW_IAM_NAMESPACE_API_KEY. 



You can view a list of your service IDs by running the following command.

ibmcloud iam service-ids

You can view the API keys that are associated with a service ID by running the following command.

ibmcloud iam service-api-keys <ServiceID-12345678-1234-abcd-1234-123456789abc>

Do not delete service IDs or API keys.





 Are there any limitations for namespaces? 

The [mobile SDK](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-pkg_mobile_sdk) is not supported for IAM-managed namespaces.

The names of all entities, including actions, triggers, rules, packages, and namespaces, are a sequence of characters that follow the following format:



* The first character must be an alphanumeric character, or an underscore.
* The subsequent characters can be alphanumeric, spaces, or any of the following values: _, @, ., -.
* The last character can't be a space.







 What do I do if I have a Cloud Foundry-based namespace? 

Your Cloud Foundry-based namespaces still work. However, to take advantage of new features, you must create an IAM-enabled namespace.





 How do I see a list of my Cloud Functions namespaces? 

You can see a list of your Cloud Functions namespaces by running the [namespace list](https://cloud.ibm.com/docs/openwhisk?topic=cloud-functions-cli-plugin-functions-clicli_namespace_list) command.
For example, #.







 External table 

The supported file format for the content of an external table is a .csv file with header.

The following example shows a create external table statement, and the .csv file that specifies the content of this external table.

create external table Company2Location
(name Text, location Text)
allow_empty false;

The first line of the .csv file contains the header. The remaining lines contain the data.

name,location
IBM,USA
Infosys,India
LG,Korea
Vodafone,UK





 External view 

The content of external views can be specified in the following ways:



* When you run an extractor, you can specify external view content for a data collection only when you are using the JSON input format.









 Built-in functions 

AQL has a collection of built-in functions for use in extraction rules.



* Aggregate functions Aggregate functions are used to implement operations (such as counting, mathematical operations, and other operations) across a set of input values. These functions return only one result.
* Predicate functions Predicate functions test a certain predicate over its input arguments and return a corresponding Boolean value.
* Scalar functions Scalar functions perform an operation over the values of a field across a set of input tuples and return a non-Boolean value, such as a Span, Text, or Integer. These functions can be used within the select list of a select statement or an extract statement. They can also be used as inputs to predicate functions.







 Aggregate functions 

Aggregate functions are used to implement operations (such as counting, mathematical operations, and other operations) across a set of input values. These functions return only one result.

These functions can be used within the select list of a select statement but not within an extract statement.

The following example is the general form of an aggregate function call:

Aggregate_Function_Name(argument)

The argument can be:



* An expression that consists of a column of a view in the from clause, or a combination of scalar functions that involve columns of the views in the from clause.

In most cases, except as noted, null values for argument are ignored.
While a single data center connection is possible, best practice is to select two different port locations to provide redundancy. * Megaport has a number of cloud service providers including IBM Cloud. * Virtual Cross Connects (VXCs) provide connections between any of the locations and services on the Megaport network. Ordering a VXC (by using the Megaport portal or API) allows you to connect into the Power virtual server environment and, optionally, the classic/VPC infrastructure environments or other clouds.

Megaport connectivity services are available in DAL12, DAL13, FRA05, LON06, MON01, SYD05, OSA21, WDC04, and WDC06 data centers.

Complete the following steps to implement this scenario:



1. Define the IP address schema of your Power Systems Virtual Server subnets in your Power Systems Virtual Server environment. Your Power Systems Virtual Server instances are hosted on these subnets. Ensure that you do not overlap these subnets with your IBM Cloud classic private subnets or the IP addressing schema that is used for the services network. For instructions, see [Configuring and adding a private network subnet](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-configuring-subnet).
2. Procure the [Megaport](https://www.megaport.com/) VXC connections to connect your on-premises (remote) networks to the Megaport network.



* Open an IBM Support case against Power Systems Virtual Server to receive a service ID or a virtual cross-connect (VxC) identifier from IBM.
* Engage with Megaport to procure the connection (VxC) to Power Systems Virtual Server Port @ Megaport. Although a single data center connection between the on-premises network and Megaport network is possible, best practice is to select two different port locations to provide redundancy.



3. Open an IBM Support case against the Power Systems Virtual Server team to configure the Megaport network to the Power Systems Virtual Server router by using VXCs. Remember to include the following pieces of information in your case:

Customer name and contact:
Customer account ID
[Figure 2 - vSRX and vCenter Server integration](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/vcsvsrx-vsrx-with-vcs-architecture.svg)

Figure 2. vSRX and vCenter Server integration

The tight integration of the vSRX HA Chassis Cluster into a vCenter Server instance extends the basic vCenter Server architecture in a few key areas.



 vCenter Server cluster design 

When a vCenter Server instance is deployed to a customer account it is typically a single hyper-converged cluster in which compute, management, and edge functions are delivered by a single three ESXi host (NFS shared storage) or four node (vSAN shared storage) cluster configuration.

The addition of the vSRX offering on ESXi impacts the basic vCenter Server design by moving the edge gateway out of the hyper-converged cluster onto a dedicated two ESXi host cluster. The gateway cluster is managed by the existing vCenter Server that is deployed with the initial vCenter Server instance.



 Host sizing 

The current vSRX offering has limited hardware options for deployment. Since these options are not variable, it is recommended that you review the options available in the [IBM Cloud infrastructure customer portal](https://control.softlayer.com/network/gatewayappliances).







 Network design 

The vCenter Server offering is designed to manage east-west network traffic at the SDN layer by using NSX Tier-1 and virtual tunnel endpoints (VTEP) on each ESXi host and north-south traffic through NSX Tier-0. The vSRX is not a replacement for the NSX-T Tier0/1 edge clusters but can either assist or potentially replace the Tier-0 firewall services in managing the north-south traffic flows.

The required network design changes are modest and include all customer VM traffic no matter the destination, platform management traffic, direct-link traffic, where applicable, and internet bound traffic. Traffic that is explicitly excluded includes VTEP traffic, storage traffic, and vMotion traffic.
You will create a Code Engine project, select the project and deploy Code Engine entities - applications and jobs - to the project. You will learn how to bind IBM Cloud services to your Code Engine entities. You will also understand the auto-scaling capability of Code Engine where instances are scaled up or down (to zero) based on incoming workload.

Code Engine Kubernetes service

+2

Object Storage,Natural Language Understanding



* 2 hours
* 2023-05-05



[Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server)Tutorial: Using Secure Build Server with a digital wallet

In this tutorial, you use the IBM Cloud® Hyper Protect Virtual Servers Secure Build Server to build a digital wallet application, then you use Hyper Protect Virtual Servers to deploy the resulting application in the public cloud.

Hyper Protect Virtual Servers



* 1 hour
* 2022-02-14



[Tutorial: Setting up the secure network](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_network)Tutorial: Setting up the secure network

This tutorial describes how you can set up the secure network which provides an end to end encrypted network communication for IBM Cloud® Hyper Protect Virtual Servers services. This tutorial is intended for IBM Cloud Hyper Protect Virtual Servers customers. Contact your IBM representative for access to the GitHub repository.

Hyper Protect Virtual Servers



* 1 hour
* 2022-07-20



[Setting up a Red Hat OpenShift for HPC cluster](https://cloud.ibm.com/docs/hpc-openshift?topic=hpc-openshift-setting-up-red-hat-openshift-hpc-cluster)Setting up a Red Hat OpenShift for HPC cluster

While IBM values the use of inclusive language, terms that are outside of IBM's direct influence are sometimes required for the sake of maintaining user understanding. As other industry leaders join IBM in embracing the use of inclusive language, IBM will continue to update the documentation to reflect those changes.
Limitations & Exclusions 

Maximo Application Suite SaaS is implemented using a defined set of technologies and operates within a security profile designed to ensure our client's data is secure and the applications operate efficiently and effectively. As a result of the decisions made regarding technologies and to meet the high security standards, there are differences between what is available using the Managed Services and what a client could do if they hosted and operated the Suite themselves.

The following items are not included or allowed in the Maximo Application Suite SaaS offering:



 Databases 

The following are database limitations of the MAS-SaaS offering:



* Only IBM DB2 Warehouse is supported. Oracle and SQLServer are not supported. Conversion services are available.
* If converting from Oracle to DB2, Oracle compatibility mode is not supported.
* Customers are not allowed direct access to MAS-SaaS database(s). If direct database access is needed, customer should look into the [MAS-Dedicated](https://cloud.ibm.com/docs/mas-ms) offering.
* DB2 Text Search is not supported.
* Running SQL statements (update/insert/delete) directly on the database is not allowed and IBM SRE team will not be able to execute those statements for you. DBC scripts are not allowed. Customers should carry out these changes using the Maximo UI via [Automation Scripts](https://ibm-maximo-dev.github.io/maximo-autoscript-documentation/introduction/whatisautoscript) or the [Maximo Integration Framework](https://www.ibm.com/docs/en/maximo-ora-con/8.1.0?topic=architecture-maximo-integration-framework-overview).







 Java Extensions 

Java extensions are not supported. Maximo Manage [Automation Scripting](https://ibm-maximo-dev.github.io/maximo-autoscript-documentation/introduction/whatisautoscript) capability should instead be used. Existing Maximo customers who have Java extensions will need to migrate / convert these functions into automation scripts within the application.





 3rd Party Applications 

Maximo Application Suite SaaS will not host or support 3rd party applications.