vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Create a [cloud endpoint](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-createlink-cloud) to connect your Satellite location client app to a resource that runs in IBM Cloud, or a [location endpoint](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-createlink-location) to connect a resource that runs in IBM Cloud to your Satellite location app.
2. For a location endpoint, [set up a source list](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-createlink-sources) to limit and control access from IBM Cloud to the app in your Satellite location.
3. [Audit events for endpoint actions](https://cloud.ibm.com/docs/satellite?topic=satellite-link-cloud-monitorlink-audit).



Now, you have a managed Satellite location that runs in your on-premises environment and a secure communication channel to resources in IBM Cloud.
Monitoring parameters and components 



 Using the WAN Optimizer for monitoring 

The Silver Peak WAN optimization appliance that is deployed as part of HCX™ does not get its management interface configured. The web user interface (UI) is a valuable tool to use when you base line traffic throughput and throttling network migration bandwidth use.

Only the HCX CGW Gateway WAN tunnel traffic flows through the WAN Optimizer appliance. Therefore, it cannot monitor stretched L2 traffic.



 Configuring the UI 

Outside of configuring an IP address for the web UI, do not make configuration changes to the WAN Optimizer appliance unless directed by the IBM® or VMware® support staff.

To configure the WAN Opt web UI:



1. Find the WAN Opt virtual machine (VM) appliance within the vCenter client.
2. Open up a console to the VM that uses the vCenter client.
3. Within the console, click F4 to configure the management interface.
4. Select to configure a static IP.
5. Use an IP address on the management IBM Cloud® assigned portable IP range and default gateway.
6. Click Apply on the next screen to save.
7. Click edit settings for the WAN Opt VM within the vCenter console.
8. Select Connected at Power On and Connected for Network Adapter 1.
9. Click OK to save.
10. Find the CGW-<xxx>-WANOPT in vCenter.
11. Edit settings on the VM.
12. Select the checkbox to connect Network adapter 1.
13. Click OK.
14. Go to https://<configured_WAN_OPT_IP>.
15. Log in with the admin default user and the admin password.



You can now use the WAN Opt web UI to monitor throughput rates, compression ratios, and to set bandwidth restrictions.





 Migration bandwidth throttling 

Before you migrate VMs, do an assessment of the network link that is used.
Securing your API with two-legged OAuth 

Duration: 10 mins
Skill level: Beginner



 Objective 

This tutorial will guide you through securing your API using a two-legged OAuth 2.0 flow in API Connect V5. In this application flow, the OAuth client initiates a request with the authorization server, and received an access token. The OAuth client can then use the token to access protected resources through your API.





 Prerequisites 

Before you begin, you must have completed the following tutorial.



* [Securing an API with Client-ID and Client-Secret Keys with IBM Cloud](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_secure_id_secret_bm) or
* [Securing an API with Client-ID and Client-Secret Keys with the Toolkit](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_secure_id_secret_tk)



Note: This tutorial shows the steps and screenshots for accomplishing the task within the IBM Cloud UI. You can also complete the same procedure by using the command line. You can view that procedure in the [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SSMNED_5.0.0/com.ibm.apic.toolkit.doc/tutorial_apionprem_security_OAuth_v506.html).





 Procedure 



1. Create an OAuth Provider API and select your OAuth scheme.
a. Open Drafts, select APIs, and click Add > OAuth 2.0 Provider API.
![oauth_provider_1.png](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/oauth_provider_1.png) b.
Adding a Client 

The Secure Gateway Client is the piece of the puzzle that makes the magic happen. The client establishes the initial connection between the on-premises network and a gateway on the Secure Gateway servers and allows for communication to pass through to the defined destinations.

![New Gateway](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/newGateway.png?raw=true)

From within your new gateway and on the Clients tab, click the Connect Client button to open the Connect Client panel.

![Connect Client](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/connectClient.png?raw=true)

After selecting your preferred client, [click here to see how to install it](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-client-install).

Once you have installed your client, you can configure it to [start automatically](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-auto-start-conf) or to [run interactively](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-client-interacting).

![Connected Client](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/connectedClient.png?raw=true)

If you would like to configure the Access Control List for your client now, [click here for more details](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-acl).
The following table lists the actions that are related to configuring settings and generate an event:



Table 16. Actions that generate settings events

 Action Description 

 internet-svcs.cache-level-setting.update Change caching level. 
 internet-svcs.browser-cache-ttl-setting.update Change browser cache TTL. 
 internet-svcs.development-mode-setting.update Enable or disable development mode. 
 internet-svcs.security-level-setting.update Change security level. 
 internet-svcs.ssl-setting.update Change SSL setting. 
 internet-svcs.tls-1-2-only-setting.update Enable or disable TLS 1.2 support. 
 internet-svcs.waf-setting.update Enable or disable web application firewall. 
 internet-svcs.cname-flattening-setting.update Change CNAME flattening setting. 
 internet-svcs.always-online-setting.update Enable or disable serve stale content for the domain. 
 internet-svcs.sort-query-string-for-cache-setting.update Enable or disable sorting query arguments when querying content in cache. 
 internet-svcs.tls-1-3-setting.update Change TLS 1.3 setting. 
 internet-svcs.automatic-https-rewrites-setting.update Enable or disable automatic HTTPS rewrites. 
 internet-svcs.opportunistic-encryption-setting.update Enable or disable opportunistic encryption. 
 internet-svcs.browser-check-setting.update Enable or disable browser integrity check. 
 internet-svcs.challenge-ttl-setting.update Update challenge TTL. 
 internet-svcs.always-use-https-setting.update Enable or disable Always Use HTTPS. 
 internet-svcs.true-client-ip-header-setting.update Enable or disable True client IP header. 
 internet-svcs.image-size-optimization-setting.update Enable or disable image size optimization. 
 internet-svcs.script-load-optimization-setting.update Enable or disable script load optimization.
2016-11-03T12:32:44.83-0200 [App/0]      ERR [ERROR   ] CWPKI0022E: SSL HANDSHAKE FAILURE:  A signer with SubjectDN CN=.gateway.prd.na.ca.ibmserviceengage.com, O=International Business Machines Corp., L=Armonk, ST=New York, C=US was sent from the target host.  The signer might need to be added to local trust store /home/vcap/app/wlp/usr/servers/defaultServer/resources/security/key.jks, located in SSL configuration alias defaultSSLConfig.  The extended error message from the SSL handshake exception is: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
2016-11-03T12:32:44.83-0200 [App/0]      ERR java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
2016-11-03T12:32:44.83-0200 [App/0]      ERR java.security.cert.CertPathValidatorException: Certificate chaining error

 Why it’s happening 

The errors can be generated when a secure service is bound to a Liberty app and the Liberty app was deployed as a server directory or packaged server that contains a server.xml file that configures the Liberty ssl-1.0 feature. Binding the secure service to the Liberty app causes the runtime to connect to the service over a secure connection. That secure connection is established by using the default SSL settings. Because the default SSL settings are specified in the Liberty server.xml file, the configured trust store might not trust the certificate that is used by the secure service.

 How to fix it 

Modify configuration to use the JVM's trust store with one of the options that follow.
Without the automation user, the server has no remote SSH access as the root user is unable to connect through SSH, and the veeamuser has no SSH access. Access to the server is possible through the remote console through the IPMI connection.

If you choose this optional task, then you need to change the Ansible inventory file hosts to ansible_user=ansible.

The following code snippet does these actions:



* Adds a user named ansible.
* Copies the ansible user's public key to the authorized_hosts file.
* Allows the ansible user to run a sudo command without a password.



tasks:
- name: Add the user 'ansible' with a bash shell
ansible.builtin.user:
name: ansible
shell: /bin/bash
create_home: yes
state: present
groups: wheel
append: yes

- name: Add ansible public key
authorized_key:
user: ansible
key: "{{ lookup('file', '/home/ansible/.ssh/id_rsa.pub') }}"

- name: "Allow ansible user to sudo without a password"
lineinfile:
dest: "/etc/sudoers"
state: "present"
insertafter: "^includedir /etc/sudoers.d"
line: "ansible ALL=(ALL) NOPASSWD: ALL"
Show more





 Securing the SSH access 

The following code snippet secures the SSH access:

- name: Allow public key authentication
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^PubkeyAuthentication yes"
line: "PubkeyAuthentication yes"
state: present

- name: Disallow password authentication
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^PasswordAuthentication"
line: "PasswordAuthentication no"
state: present
Satellite Location <br><br> * Provide an interface to initiate change management activities, such as to delete locations.<br><br><br> <br><br> * Update the hosts that are assigned to the location control plane, and ensure the control plane has [enough compute resources to run](https://cloud.ibm.com/docs/satellite?topic=satellite-location-sizingcontrol-plane-attach-capacity).<br> * Before you [delete any locations](https://cloud.ibm.com/docs/satellite?topic=satellite-host-removelocation-remove-console), remove all associated hosts and clusters. Save any backup information that you want to keep about the location before you delete the location.<br><br><br> 
 Satellite Host <br><br> * Provide an interface to initiate change management activities.<br> * Monitor the health of hosts and report back status with actions that you must complete, such as reloading a host operating system.<br> * Disable the ability to SSH into hosts after you attach the hosts to a location, to enhance security.<br> * Make major, minor, and fix pack version updates of the container platform available for you to apply.<br> * Make minor, and fix pack version updates of the operating system software available for you to apply.<br><br><br> <br><br> * [Review the status of your hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-monitorhost-health) and take any actions required to resolve host infrastructure issues, such as operating system reloads or updates.<br> * Before you update or [delete](https://cloud.ibm.com/docs/satellite?topic=satellite-host-remove) any hosts, make sure that you have [enough additional hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-location-sizing) in the cluster or location control plane to continue running any components that you must run. Save any backup information that you want to keep about the hosts before you update or delete.<br> * To reuse a host after removal from a cluster, you must remove the host from the location.
Additionally, another interface is configured on the Public VLAN (Public Portable) for connections that are made over the public internet. Public access is not required if a direct connection exists (private connection in place). The last connection that is associated with the HCX-IX Interconnect Appliance is a logical switch that is created and configured upon site pairing.





 HCX WAN Optimizer 

The second component that is deployed is the WAN Optimization appliance. While the WAN Optimization appliance is optional, it uses WAN conditioning to reduce effects of latency. It also incorporates Forward Error Correction to negate packet loss scenarios, and deduplication of redundant traffic patterns.

Altogether, these reduce bandwidth use and ensure the best use of available network capacity to expedite data transfer to and from the IBM Cloud. The HCX WAN Optimizer is disk intensive and requires sufficient amount of IOPS to function properly. As a result, the HCX WAN Optimizer is on vSAN storage (if present), or on the Endurance storage with 2,000 IOPS.

The following table shows the sizing specification for the WAN Optimization appliance.



Table 6. HCX WAN Optimizer appliance sizing

 Component Configuration 

 CPU 8 vCPU 
 RAM 14 GB 
 Disk 100 GB VMDK resident on shared storage / 5000 IOPS 



Unlike the HCX-IX Interconnect Appliance, the WAN Optimization appliance is only attached to a logical switch to enable communication between itself and the HCX-IX Interconnect Appliance. This appliance is required if WAN optimization is in use within the source environment.





 HCX Network Extension Virtual Appliance 

The third component is known as the HCX Network Extension Virtual Appliance (HCX-NE) and is part of the Network Extension Services. The HCX-NE is the VM that allows the extension of on-premises data center networks to the IBM Cloud. The HCX-NE stretches on-premises VLANs or VXLANs. Each HCX-NE can stretch up to 4096 VLANs.
ap-north crn:v1:bluemix:public:container-registry:jp-tok:::endpoint:jp.icr.io 
 ap-south crn:v1:bluemix:public:container-registry:au-syd:::endpoint:au.icr.io 
 br-sao crn:v1:bluemix:public:container-registry:br-sao:::endpoint:br.icr.io 
 ca-tor crn:v1:bluemix:public:container-registry:ca-tor:::endpoint:ca.icr.io 
 eu-central crn:v1:bluemix:public:container-registry:eu-de:::endpoint:de.icr.io 
 jp-osa crn:v1:bluemix:public:container-registry:jp-osa:::endpoint:jp2.icr.io 
 uk-south crn:v1:bluemix:public:container-registry:eu-gb:::endpoint:uk.icr.io 
 us-south crn:v1:bluemix:public:container-registry:us-south:::endpoint:us.icr.io 
 Global us-east crn:v1:bluemix:public:container-registry:us-east:::endpoint:icr.io 



For VPE gateways that were created before 11 November 2022, if you want to connect to IBM Cloud Container Registry in another region, you must use hostnames, such as private.uk.icr.io. For more information about private Container Registry networks, see [Securing your connection to Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_private).

For VPE gateways that are created after 11 November 2022, you can pull images from any other Container Registry region by using the public hostnames, such as uk.icr.io.



 Configuring an endpoint gateway 

To configure a VPE gateway, complete the following steps:



1.
You can interact with your z/OS virtual server instance with the following approaches.



 Using TN3270 terminal emulator 

You can use the TN3270 terminal emulator to log on to the Time Sharing Option/Extensions (TSO/E). The default port for the secured TN3270 is 992 and you need to provide a self-signed certificate-authority (CA) certificate as a parameter to have a secured connection to the 3270 emulation program. You can find your self-signed CA certificate in a file that is called common_cacert in the home directory of the IBMUSER user ID in z/OS UNIX System Services.



* For macOS, Linux, and Windows system where the Secure Copy Protocol (SCP) client is installed, you need to transfer the common_cacert file before you connect to the secured telnet port and run the following commands:

scp ibmuser@<vsi ip address>:/u/ibmuser/common_cacert <my local dir>/common_cacert
c3270 -cafile <my local dir>/common_cacert -port 992 <vsi ip address>

If the file is not in the correct format, you need to convert it to ASCII format.
* For Windows, you need to import the self-signed CA cert into Windows first and then create the IBM Personal Communications (PCOMM) to read the CA cert from the truststore in Windows. Complete the following steps:



1. Transfer the common_cacert file from the z/OS system to your workstation.
2. Open Internet Options in your workstation.
3. Under Content, select Certificates.
4. Select Import to open the Certificate Import Wizard page and click Next.
5. Click Browse to select the common_cacert file and click Next.
6. Under the Certificate Store page, select Place all certificates in the following store and click browse to select the Trusted Root Certificate Authorities, and then click Next.
7. On the Completing the Certificate Import Wizard page, click Finish.
8. After you transfer the CA cert to the truststore successfully, you need to create a secure session in PCOMM.
Applications <br><br> * Provide default queue manager configuration to allow applications to connect securely<br> * Provide sample applications such as [MQ JMS client](https://developer.ibm.com/messaging/learn-mq/mq-tutorials/develop-mq-jms/)<br> * Generate an API key that is used to access queue managers<br> * Provide application connection configuration in JSON CCDT format<br><br><br> <br><br> * Maintain responsibility for your apps, data, and their complete lifecycle<br> * Configure applications for [high availability](https://cloud.ibm.com/docs/services/mqcloud?topic=mqoc_ha)<br> * Manage open connections to ensure the maximum queue manager limit is not exceeded<br><br><br> 
 Data <br><br> * Provide encrypted persistent storage for persistent messages<br> * Separation of storage from queue manager runtime allowing queue managers to recover within an availablity zone with no data loss<br><br><br> <br><br> * Maintain responsibility for your data and how your apps consume the data<br> * Control queue sizes to prevent storage limits being exceeded<br> * Encrypt message payload in transit and at rest using Advanced Message Security (AMS)<br><br><br>
VhXWfwcMoe76l8bgote0pDJi7Xf+5rvVqSLFCNQ6HZ3JWkuZsoIIvLIgsIbcOj2T
U1Gg0jW2nPIS/QHC4BrPHUZLtzD+EFKt8GdmkKJHCcoQ3T+1+UrtGHh3lhtVUZda
Fxj++vmk25rJEC6eS1zh9ADrt7PWGBzYvJDflUrHYbkqggASrzYqYpAtyvjkwGCC
/YInZ8eZG9gN81EWkZrP8jRObirL77rzi+sceeiV2PKJBiFUeyf6BQQlwcGGRZIq
Uf3YZ4D9AcWW7UgQiCpkjosrGY1k7evgMZoMoViDRNZGFxZisPEV12qdqpEK0dIc
DkrXQTicJCrpBeWgX5Dj+Xhc7CDhk0W4I837iHZPl5AOG4iQB3rhS3ZRomfQUuXS
j/lLHltrcRnxqOBhmvCVBFucGUwb7kS6Aj+Sm8a50o+Gt9cS/wp6FewDGceYirlZ
FV2IizLUqDxFYIJLYRrV/zmKPymN9A7e5Ex5GbDxpqMg
=c6rC
-----END PGP MESSAGE-----
Show more
3. Follow the steps in these [instructions](https://github.com/ibm-hyper-protect/secure-build-cli/blob/master/SBS-HPVScloud.md) to provision a Hyper Protect Virtual Server that uses the SBS and to perform your first build.
Configure IP routing between private networks
4. Configure firewall rules for remote site access







 Before you begin 

This tutorial is based on the tutorial, [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure). That tutorial and its prerequisites should be reviewed before commencing.





 Step 1: Configure secure private network sites 

The tutorial [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure) is utilised twice to implement private networks in two different data centers. There is no restriction on which two data centers can be utilised, apart from noting the impact of latency on any traffic or workloads that will communicate between the sites.

The [Isolate workloads with a secure private network](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-secure-network-enclosure) tutorial can be followed without change for each selected data center, recording the following information for later steps.



Network details to write down for next steps

 Item Datacenter1 Datacenter2 

 Data center 
 VRA public IP address 
 VRA private IP address 
 VRA private subnet & CIDR 
 Private VLAN ID 
 VSI private IP address 
 APP zone subnet & CIDR <DC1 APP zone subnet/CIDR> <DC2 APP zone subnet/CIDR> 





1. Proceed to the Gateway Details page for each VRA via the [Gateway Appliances](https://cloud.ibm.com/classic/network/gatewayappliances) page.
2. Locate the Gateway VLANs section and click on the Gateway [VLAN](https://cloud.ibm.com/classic/network/vlans) on the Private network to view the VLAN details.
Auditing events for Satellite 

As a security officer, auditor, or manager, you can use IBM Cloud® Activity Tracker to track how users and applications interact with IBM Cloud Satellite.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-startedgetting-started).



 Events for Satellite clusters 

See the [Red Hat OpenShift on IBM Cloud documentation](https://cloud.ibm.com/docs/openshift?topic=openshift-at_events).





 Events for the Satellite Link component 



Satellite Link actions that generate events.

 Action Description 

 satellite.link.create A Satellite location and Satellite Link connector are created. 
 satellite.link.delete A Satellite location and Satellite Link connector are removed. 
 satellite.link.get Details for a Satellite location are retrieved. 
 satellite.link-endpoint-certs.delete A TLS certificate for a Satellite endpoint is removed. 
 satellite.link-endpoint-certs.get A list of TLS certificates that are used for a Satellite endpoint is retrieved. 
 satellite.link-endpoint-certs.upload A TLS certificate is uploaded for a Satellite endpoint. 
 satellite.link-endpoints.create A Satellite endpoint is created. 
 satellite.link-endpoints.delete A Satellite endpoint is removed. 
 satellite.link-endpoints.export The configuration for a Satellite endpoint is exported to a file. 
 satellite.link-endpoints.get Details for a Satellite endpoint are retrieved. 
 satellite.link-endpoints.import The configuration for a Satellite endpoint is imported from a file. 
 satellite.link-endpoints.list A list of Satellite endpoints is retrieved.