vania-janet/multiturn-rag-retrieval-data huggingface dataset:
IBM is not responsible for any tool a client selects to make this connection with and it will be the client responsibility to troubleshoot issues connecting their chosen tool to the database. Non-SSL connections are not allowed.



Please note, if a client has been granted write access to a database, and there are issues with data, the SRE team will only restore the database back to the last version. SRE personnel will not troubleshoot queries or data issues in these databases.

A support case must be submitted listing the names and emails of the users needing access. One ticket is required for each database.

It is the client's responsibility to ensure once access is no longer required for a user, a support case is submitted to have the IBM SRE team remove that user's access.





 Summary of MAS-Dedicated Database Access Rules & Guidelines 



Table 1. MAS-Dedicated Database Access Rules & Guidelines

 Database Task Non-PROD PROD 

 Direct Read Access Yes Not Allowed (only allowed if secondary DB ordered) 
 Direct Write Access Yes Not Allowed 
 Create/Update Access for Triggers Not Allowed Not Allowed 
 Create/Update Access for Procedures Not Allowed Not Allowed 
 Run Explain Plan Not Allowed Not Allowed 
 Create/Update Tables/Columns Maximo DB Configuration App (UI) Maximo DB Configuration App (UI) 
 Create/Update Access for Indexes Maximo DB Configuration App (UI) Maximo DB Configuration App (UI) 
 Create/Update Access for Sequences Maximo DB Configuration App (UI) Maximo DB Configuration App (UI) 
 Run SQL Scripts Not Allowed Yes 
 Run DBC Scripts Not Allowed Not Allowed 







 Running SQL Scripts in Production 

For production environments, the IBM SRE team highly discourages requests to run sql scripts with insert/update/delete statement(s). These are considered high risk and can break overall data integrity. SRE will only execute statements that have been tested by the client on their non-production environments. Every effort should be made to use [automation scripts](https://www.ibm.com/docs/en/maximo-manage/continuous-delivery?topic=scripts-automation) or standard tools through the Maximo front end rather than altering data directly.
IBM Blockchain Platform provides different offerings that allow you to deploy your network in the environment of your choice. You need to decide if you want to deploy the IBM Blockchain Platform 2.5.4 or if you want to use the IBM Blockchain Platform for IBM Cloud.



Table 1. Which offering is right for your business?

 IBM Blockchain Platform for anywhere (2.5.4) IBM Blockchain Platform for IBM Cloud 

 Where do you want to deploy the platform? Multiple Kubernetes distributions on a private, public, or hybrid multicloud <br> <br>See [Supported Platforms](https://www.ibm.com/docs/en/blockchain-platform/2.5.4?topic=started-about-blockchain-platform-254console-ocp-about-prerequisites)) A Kubernetes cluster on IBM Cloud <br> <br>See [Supported configuration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-overviewibp-console-overview-supported-cfg) 
 What are my deployment options? <br><br> * Full platform<br> * [Only IBM Blockchain images](https://cloud.ibm.com/docs/blockchain/index.htmlget-started-ibp-images)<br><br><br> <br><br> * Full platform<br><br><br> 
 How is it billed? Contact us for [pricing](https://www.ibm.com/docs/en/blockchain-platform/2.5.4?topic=253-pricing) [$0.29 USD per allocated CPU hour](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricing) 
 Can I connect with peers in other clouds? Yes Yes 
 Can my data center be<br><br>on-prem<br><br>and behind a firewall? Yes No 
 Can I use a console UI to deploy and manage my blockchain components? Yes Yes
IBM Blockchain Platform provides different offerings that allow you to deploy your network in the environment of your choice. You need to decide if you want to deploy the IBM Blockchain Platform 2.5.4 or if you want to use the IBM Blockchain Platform for IBM Cloud.



Table 1. Which offering is right for your business?

 IBM Blockchain Platform for anywhere (2.5.4) IBM Blockchain Platform for IBM Cloud 

 Where do you want to deploy the platform? Multiple Kubernetes distributions on a private, public, or hybrid multicloud <br> <br>See [Supported Platforms](https://www.ibm.com/docs/en/blockchain-platform/2.5.4?topic=started-about-blockchain-platform-254console-ocp-about-prerequisites)) A Kubernetes cluster on IBM Cloud <br> <br>See [Supported configuration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-overviewibp-console-overview-supported-cfg) 
 What are my deployment options? <br><br> * Full platform<br> * [Only IBM Blockchain images](https://cloud.ibm.com/docs/blockchainget-started-ibp-images)<br><br><br> <br><br> * Full platform<br><br><br> 
 How is it billed? Contact us for [pricing](https://www.ibm.com/docs/en/blockchain-platform/2.5.4?topic=253-pricing) [$0.29 USD per allocated CPU hour](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricing) 
 Can I connect with peers in other clouds? Yes Yes 
 Can my data center be<br><br>on-prem<br><br>and behind a firewall? Yes No 
 Can I use a console UI to deploy and manage my blockchain components? Yes Yes
Actions 

Answers to common questions about the IBM Cloud Schematics Actions are classified into following section.



 Are Classic VSIs supported for use with Actions? 

Classic VSI environments have not been tested with Actions. Only IBM Cloud VPC VSIs have been tested and are supported with Actions.





 What network configuration is suggested for use with Actions? 

It is your responsibility as a user to ensure that suitable network policies and a bastion host configuration is in place for the cloud environment to allow Schematics to connect via SSH to your environment. See [Schematics firewall, allowed IPs](https://cloud.ibm.com/docs/schematics?topic=schematics-allowed-ipaddresses) for details of the IP addresses Schematics uses and must be allowed access. When using a bastion host, SSH forwarding is used to connect to the target VSIs. To validate access the command ssh -J bastion-ip vsi-ip.

Example as-is IBM Cloud® VPC configurations with bastion hosts are available in the [Cloud-Schematics repo](https://github.com/orgs/Cloud-Schematics/repositories?q=bastion&type=all&language=&sort=). Follow the tutorial [Discover best-practice VPC configuration for application deployment](https://developer.ibm.com/articles/secure-vpc-access-with-a-bastion-host-and-terraform/) for guidance on creating a suitable network configuration.





 Why does my action job display a DEPRECATION WARNING message? 

In the action settings page you, need to set the input variable as ansible_python_interpreter = auto as shown in the screen capture to avoid DEPRECATION WARNING message.

Zoom

![Configuring input variable to silence warning message](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/advanced_inputvariable.png)

Configuring input variable to silence warning message
About Hardware Firewall 

A Hardware Firewall is a network device that is connected upstream from a server. The firewall blocks unwanted traffic from a server before the traffic ever reaches the server. The main advantage to having a Hardware Firewall is that a server only has to handle 'good' traffic and no resources are wasted dealing with the 'bad' traffic.

The Hardware Firewall leverages a multi-tenant enterprise platform to protect an individual server. It can be purchased with the server or added on later. It delivers virtualized network security through its Virtual Domain (VDOM) technology, providing virtualized security domains that are separately provisioned and managed.

Because there are multiple customers associated with the hardware, if the firewall fails or is overwhelmed by an attack, every customer that shares a Hardware Firewall instance may be impacted.

Up to 79 firewall rules can be configured for the primary and statically routed IP addresses assigned to the server. Reports for Firewalls are available based on the activity of a single IP for a selected date range. Customers can manage the firewall through two ways: the IBM Cloud console (the firewall tab under the protected server details page) and SLDN APIs.

Since monthly server bandwidth is recorded at the server switch port, traffic blocked by the Hardware Firewall is not counted against your monthly allotments, eliminating the need to pay for unwanted traffic.



  Overview and features 

Intended Use: Single Server Primary Public IP Protection

User Interface: Integrated into IBM Cloud console and APIs

Features: Stateful Packet Inspection, Ingress Firewall Rules, IPv4, IPv6, Basic Logging

Server Network Interface Speeds: 100Mbps, 200Mbps, 1000Mbps, and 2000Mbps

It is required that the throughput of Hardware Firewall instance match the uplink speed of the server the firewall is being added to.
Technical FAQs for IBM Cloud Virtual Router Appliance 

These frequently asked questions address the configuration of the IBM Cloud® Virtual Router Appliance (VRA), and issues that involve migrating to the VRA from Vyatta 5400.



 How do I allow internet-bound traffic from hosts that are on a private VLAN? 

This traffic must obtain a public source IP; thus, a Source NAT must masquerade the private IP with the public one of the VRA.

set service nat source rule 1000 description 'SNAT traffic from private VLANs to Internet'
set service nat source rule 1000 outbound-interface 'dp0bond1'
set service nat source rule 1000 source address '10.0.0.0/8'
set service nat source rule 1000 translation address masquerade

This configuration performs only SNAT from traffic originating from servers in the private 10.0.0.0/8 network.

This ensures it does not interfere with packets that already have an internet-routeable source address.





 How can I filter internet-bound traffic and only allow specific protocols and destinations? 

This is a common question when Source NAT and a firewall must be combined.

Keep in mind the order of operations in the VRA you design your rulesets.

In short, firewall rules are applied after SNAT.

To block all outgoing traffic in a firewall, but allow specific SNAT flows, you must move the filtering logic onto your SNAT. For example, to only allow HTTPS internet-bound traffic for a host, the SNAT rule would be:

set service nat source rule 10 description 'SNAT https traffic from server 10.1.2.3 to Internet'
set service nat source rule 10 destination port 443
set service nat source rule 10 outbound-interface 'dp0bond1'
set service nat source rule 10 protocol 'tcp'
set service nat source rule 10 source address '10.1.2.3'
set service nat source rule 10 translation address '150.1.2.3'

150.1.2.3 would be a public address for the VRA.

It is recommended to use the VRRP public address of the VRA so that you can differentiate between host and VRA public traffic.
Managing the FortiGate Security Appliance 1 Gbps 

When the FortiGate Security Appliance 1 Gbps (FSA) is first added to the VLAN, all traffic is allowed. You need to add rules to the firewall in order to control the traffic.



1.  From your browser, open the [IBM Cloud UI Console ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/security/firewalls/multivlan/provision) and log in to your account.
2.  Click the navigation menu in the [IBM Cloud Catalog ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com) and select Classic Infrastructure > Network > IP Management > VLANs.

To view only Public VLANs, click the Filter drop down and enter fcr in the Primary Router field.
3.  Scroll to the VLAN you want to manage and click the link of the firewall name in the GATEWAY/FIREWALL column to go to the Device Details page.
4.  In the Device Details page, you can view the associated subnets, the current "Status" of the firewall routing, and the management information.

The management information includes a Management IP, a username, and a Password. This Management IP is publicly accessible by default. For automation purposes or advanced use cases, administration is also available using SSH with the same IP and credentials.
5.  To access the GUI, click the Management IP link and enter the username and password provided.
6.  From the Management UI, you can manage the FortiGate Security Appliance as a VDOM Administrator. Some functions not available with the Management UI, such as managing SSL Certificates, initiating a manual HA failover, rebooting, upgrading, or performing a default configuration restore. In these cases, a support case needs to be opened.
If the ping from the VRA command line fails, validate that a ping reply is seen in response to a ping request on the tunnel interface.

monitor interface tunnel tun0 traffic

No response indicates an issue with the firewall rules or routing at the data center. If a reply is seen in the monitor output, but the ping command times out, check the configuration of the local VRA firewall rules.
6. If the ping from the VSI fails, this indicates an issue with the VRA firewall rules, routing in the VRA or VSI configuration. Complete the prior step to ensure that a request is sent to and response is seen from the data center. Monitoring the traffic on the local VLAN and inspecting the firewall logs will assist in isolating the issue to routing or the firewall.

monitor interfaces bonding dp0bond0.<VLAN ID>
show log firewall name APP-TO-TUNNEL
show log firewall name TUNNEL-TO-APP



This completes setup of the VPN from the secure private network enclosure. Additional tutorials in this series illustrate how the enclosure can access services on the public internet.





 Step 7: Remove resources 

Steps to take to remove the resources created in this tutorial.

The VRA is on a monthly paid plan. Cancellation does not result in a refund. It is suggested to only cancel if this VRA will not be required again in the next month. If a dual VRA High-Availability cluster is required, this single VRA can be upgraded on the [Gateway Details](https://cloud.ibm.com/classic/network/gatewayappliances) page.



1. Cancel any virtual servers or bare-metal servers
2. Cancel the VRA
3. [Cancel any additional VLANs](https://cloud.ibm.com/docs/vlans?topic=vlans-cancel-vlan)







 Related content
[CHANGE LOG](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:



* Allow and route the following service networks to the BCR on your gateway appliance or firewall for all Bare Metal and Virtual Server provisions and reloads: 10.0.64.0/19, 10.200.80.0/20, 161.26.13.0/24, 161.26.96.0/22, 166.9.12.0/23, 166.9.48.0/24, 166.9.50.0/24, 166.9.228.0/24, 166.9.250.192/27, 10.3.160.0/20, 10.201.0.0/20, 161.26.92.0/22, 161.26.132.0/22, 166.9.20.0/23, 166.9.231.0/24.
* For RHEL servers, ensure the entire 161.26.0.0/16 is allowed and routed properly to the BCR. Add any additional datacenter service networks that are mentioned in the RHEL section near the bottom of the page.
* Allow traffic between the service networks and your server in both directions.
* By default, all classic servers and classic gateway and firewall devices are configured with a static route for the 10.0.0.0/8, 161.26.0.0/16 and 166.8.0.0/14 networks to the Back-end Customer Router (BCR). If you configure overlapping routes with those subnets, validate that you have also configured PBR or a similar service.
Application load balancer IP addresses are not guaranteed to be fixed. During system maintenance or horizontal scaling, you see changes in the available IPs associated with the FQDN of your load balancer.

Use FQDN, rather than cached IP addresses.
* Does the load balancer support layer 7 switching?

Yes, the load balancer supports layer 7 switching.
* Why does HTTPS listener creation or update tell me that my certificate is invalid?

Check for these possibilities:



* The provided certificate CRN might not be valid.
* The certificate instance in the Secrets Manager might not have an associated private key.



* What is the role of application load balancer front-end listeners?

Load balancer front-end listeners are the listening ports for the application. They act as proxies for back-end pools.
* Why are there only 2 IPs instead of 3?

The Application Load Balancer for VPC (ALB) operates in ACTIVE-ACTIVE mode, a configuration that makes it highly available. Horizontal scaling might further add extra appliances when your load increases. The recommendation is that you choose subnets in different zones to make your load balancers support MZR. This way, if a zone is negatively impacted, a new load balancer is provisioned in a different zone.
* If a pool is attached to an instance group, what is the maximum number of back-end members that I can have in a pool?

The maximum number of back-end members that are allowed in a pool is 50. So if an instance group is attached to a pool, the number of instances in the group can't scale up beyond this limit.
* Why is my listener not receiving traffic?

Make sure that the security group rules that are attached to your load balancer allow incoming ingress and outgoing egress traffic on your listener's port. Security groups attached to your load balancer can be found on your load balancer's overview page. Locate the Attached security groups tab from the load balancer overview, then select the security groups that you want to view and modify their rules.
* Does IBM complete quarterly ASV scans of data-plane LBaaS appliances?
conf
set protocols static route <DC1 APP zone subnet/CIDR> next-hop <DC1 VRA Private IP>
commit
3. Review the VRA routing table from the VRA command line. At this time the VSIs cannot communicate as no APP zone firewall rules exist to allow traffic between the two APP Zone subnets. Firewall rules are required for traffic initiated at either side.

show ip route



The new route to allow the APP zone to communicate via the IBM private network will be now seen.





 Step 4: VRA firewall configuration 

The existing APP zone firewall rules are only configured to allow traffic to and from this subnet to IBM Cloud services on the IBM Cloud private network and for public Internet access via NAT. Other subnets associated with VSIs on this VRA, or in other data centers are blocked. The next step is to update the ibmprivate resource group associated with the APP-TO-INSIDE firewall rule to allow explicit access to the subnet in the other data center.



1. On the data center 1 VRA edit command mode, add the <DC2 APP zone subnet>/CIDR to the ibmprivate resource group

set resources group address-group ibmprivate address <DC2 APP zone subnet/CIDR>
commit
2. On the data center 2 VRA edit command mode, add the <DC1 APP zone subnet>/CIDR to the ibmprivate resource group

set resources group address-group ibmprivate address <DC1 APP zone subnet/CIDR>
commit
3. Verify that the VSIs in both data centers can now communicate

ping <Remote Subnet Gateway IP>
ssh root@<VSI Private IP>
ping <Remote Subnet Gateway IP>

If the VSIs cannot communicate follow the instructions in the [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosuresecure-network-enclosure) tutorial for monitoring traffic on the interfaces and reviewing the firewall logs.







 Step 5: Remove resources 

Steps to take to remove the resources created in this tutorial.
Network security 

Infrastructure provides virtual LAN (VLAN) isolation between different tenants, which are enforced at Virtual I/O Server (VIOS) and physical switches and routers.



  Default firewall ports 

The Power® Systems Virtual Server network security architecture relies on a set of fixed firewall ports open on the Juniper vSRX firewalls:

There are plans to add the ability to dynamically configure the firewall rules in the future.



*  22 (SSH)
*  443 (HTTPS)
*  992 (IBM i5250 emulation SSL)
*  ICMP traffic



The following firewall ports are also open, typically used for IBM i logical partitions (LPARs):



*  2005
*  2007
*  2010
*  2012
*  9470
*  9475
*  9476



The port 6443 is also open for miscellaneous purposes. This port will not be open for the WDC04 and DAL13 data centers.

If you need extra ports to be opened, you can consider customer-specific firewall option that is currently available by using an IBM Cloud firewall, such as Vyatta, Juniper vSRX, or FortiGate, and by connecting to Power Systems™ Virtual Server by using [Direct Link Connect](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-ordering-direct-link-connect). To understand the Power Systems™ Virtual Server connection methods, see [Network architecture diagrams](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-network-architecture-diagramsnetworking-environment).
The management interface is attached to the management VLAN and port group for the corresponding cluster, and a management IP address is assigned by IBM Cloud automation for this interface. Do not reassign or reconfigure this management interface.

When deployed to a management cluster that has public interfaces, a firewall and source NAT rules are created on the services NSX Edge™ to allow the FortiGate devices to connect to the public network by using http and https only. It allows license management and it is not recommended to change these rules as it might lead to your license to be deactivated.

When deployed to a gateway cluster, or to a management cluster that has only private interfaces, you must instead provide the details for a proxy server that the FortiGate appliances can use to connect to the public network for licensing. The appliances might attempt to access any of the following hostnames:



* update.fortiguard.net
* service.fortiguard.net
* support.fortinet.com
* guard.fortinet.com







 HA interface 

When deployed to a management cluster, the FortiGate appliances’ HA interfaces are connected to a dedicated logical switch.

When deployed to a gateway cluster, the FortiGate appliances’ HA interfaces are connected to the storage VLAN used by the gateway cluster.





 Firewall interfaces 

When deployed to a management cluster, the remaining firewall interfaces for the FortiGate appliances are attached to the management network yet with no IP addresses assigned. You must assign these interfaces to the networks you want to protect.

When deployed ot a gateway cluster, the FortiGate VM appliances are connected to the IBM Cloud transit network and configured to peer with the IBM Cloud customer routers. Define appropriate firewall rules before you configure your VLANs to be protected by the gateway cluster.







 VMware DRS and reservations 

Because it provides time–sensitive networking services, FortiGate VM must be configured to ensure that it has adequate resources. The IBM Cloud automation configures a reservation to ensure that the virtual appliances receive their full allotment of CPU and memory. To assure high availability, the IBM Cloud automation also creates a DRS anti–affinity rule to restrict the two FortiGate VM virtual appliances from running on the same host.





 License requirements