vania-janet/multiturn-rag-retrieval-data huggingface dataset:
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/fortigate-1g?topic=cloud-infrastructure-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
As root, edit the sshd_config file in /etc/ssh/sshd_config

nano /etc/ssh/sshd_config
3. Add a line in the Authentication section of the file that says PermitRootLogin yes. This line might exist and be commented out with a "#". In this example, remove the "#".

LoginGraceTime 2m

PermitRootLogin yes

StrictModes yes

MaxAuthTries 6

MaxSessions 10



Save the updated /etc/ssh/sshd_config file.

Restart sshd service on an Ubuntu or Debian Linux by using the following command: sudo systemctl restart ssh.service

RHEL and CentOS Linux users, run the following command: sudo systemctl restart sshd.service





 Port not configured for SSH 

Check the port number that is configured for SSH in the /etc/ssh/sshd_config file. By default, SSH is configured with port 22. However, for security reasons, your administrator might change the port.





 Firewall is blocking SSH traffic 

SSH port traffic might be blocked by your firewall. For more information, see [Allowing SSH and pinging to a public subnet](https://cloud.ibm.com/docs/vsrx?topic=vsrx-allowing-ssh-and-pinging-to-a-public-subnet).





 Security group is blocking SSH traffic 

If you use a security group to protect your virtual servers, you need to allow SSH traffic. For more information, see [Creating security groups and rules](https://cloud.ibm.com/docs/security-groups?topic=security-groups-creating-security-groups).







 Why can't I access KVM through a browser? 

If you are unable to connect to the KVM console, review the following troubleshooting tips for help.
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
$uplinkLif = New-NsxLogicalRouterInterfaceSpec -Name ToESG -Type uplink -ConnectedTo (Get-NsxLogicalSwitch OpenShift-Transit) -PrimaryAddress 192.168.100.2 -SubnetPrefixLength 24
$internalLif = New-NsxLogicalRouterInterfaceSpec -Name ToLS -Type internal -ConnectedTo (Get-NsxLogicalSwitch OpenShift-LS) -PrimaryAddress 192.168.133.1 -SubnetPrefixLength 24
$haLif = New-NsxLogicalRouterInterfaceSpec -Name ToHA -Type internal -ConnectedTo (Get-NsxLogicalSwitch OpenShift-HA)
New-NsxLogicalRouter -Name OpenShift-DLR -ManagementPortGroup (Get-NsxLogicalSwitch OpenShift-HA) -Interface $uplinkLif,$internalLif,$haLif -Cluster (Get-Cluster cluster1) -EnableHA -Datastore (Get-Datastore vsanDatastore)

 Configure the default gateway on the DLR to be the ESG
$uplinkVnic = Get-NsxLogicalRouter OpenShift-DLR | Get-NsxLogicalRouterInterface "ToESG"
$uplinkVnicId = $uplinkVnic.index
Get-NsxLogicalRouter OpenShift-DLR | Get-NsxLogicalRouterRouting | Set-NsxLogicalRouterRouting -DefaultGatewayVnic $uplinkVnicId -DefaultGatewayAddress 192.168.100.1 -Confirm:$false

 Configure the default firewall rule on the DLR to "allow"
$dlr = Get-NsxLogicalRouter OpenShift-DLR
$dlr.features.firewall.defaultpolicy.action = "Accept"
$dlr | Set-NsxLogicalRouter -Confirm:$false

 Configure DHCP relay on DLR
$dlrID = (Get-NsxLogicalRouter -Name "OpenShift-DLR").Id
* Veeam backup server access to isolated recovery vCenter and hosts is done through connected networks.
* Veeam backup server access to the Linux hardened repository is done through the connected network.
* The "Allow proxy access to Linux hardened repository" rule can be toggled between "Allow" and "Deny" to facilitate the air gap.
* If NFS is used, then this action bypasses the vSRX as the storage VLAN is not associated with the IBM Cloud gateway devices that host the vSRX appliances.
* If the "Allow access between vCenter Server subnets" rule needs to be locked down further, for more information, see [Ports that are used by VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-vmwareuses).
* If encryption is used, then vCenter needs access to the KMIP service. This service is accessed through the IBM Cloud endpoint service network 166.8.0.0/14.
* If automated Day 2 operations are required on the vCenter Server instance, for more information, see [Ports that are used for deployment and Day 2 operations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmwaresol_ports-deploy-day2ops).



To enable the air gap, the customer:



* Creates a new T1 named Cyber-Tools-T1 and links it to the workload T0. The Cyber-T1 is configured to advertise connected segments. This action enables the routing of traffic to and from VMs on connected segments.
* Creates a segment for their management VM.
* Creates a management VM that runs Linux and Ansible. The management VM changes the security policy on the vSRX appliances at the required times.
* Uses a cron job on the automation server to schedule the running of an Ansible playbook that changes the inbound firewall rule from "Deny" to "Allow". After the backup window, the customer changes the inbound firewall rule from "Allow" to "Deny".
The default is every 1 minute.
 scrape_timeout is set to the global default (10s).

 Alertmanager configuration
alerting:
alertmanagers:
- static_configs:
- targets:
 - alertmanager:9093

 Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
 - "first_rules.yml"
 - "second_rules.yml"

 A scrape configuration containing exactly one endpoint to scrape:
 Here it's Prometheus itself.
scrape_configs:
 The job name is added as a label job=<job_name> to any timeseries scraped from this config.
- job_name: ipmi

metrics_path: '/metrics'
scheme: http

static_configs:
- targets: ['localhost:9290']
labels:
instance: baremetal01
region: us-south
Show more
6. Run the Prometheus exporter:

./prometheus &







 Configure network settings 

If you want to collect metrics from remote servers, complete the following steps:



1. Enable the firewall to allow access to the ipmi_exporter.
2. [Optional] Update the VPC rules

If you use private endpoints, add an inbound rule to the security group for port 9290 with source type = Security Group and choose the security group for the bare metal server.







 Update the monitoring agent that is running in the bare metal server 

Complete the following steps:



1. In the bare metal server, from the shh session, change to the directory /opt/draios/etc/. Run the following command:

cd /opt/draios/etc/
2. Update the /opt/draios/etc/dragent.yaml.

Append the following section to the dragent.yaml file:

prometheus:
enabled: true
interval: 30
log_errors: true
max_metrics: 3000
IBM Cloud IP ranges 

A frequently asked question is, "What IP ranges do I allow through the firewall?" The following tables contain the full range of IPs to use with these IBM firewalls and appliances.



* IBM Cloud Juniper vSRX Standard
* IBM Virtual Router Appliance
* Fortigate Security Appliance 10 Gbps
* IBM Security Groups
* Hardware Firewall



To identify potential conflicts between IP ranges in your on-premises environment(s) and IP ranges used in IBM Cloud, you can search in the [IP Ranges Calculator tool](https://ibm.biz/cidr-calculator). The tool allows you to also download the IP ranges below in JSON format. Disclaimer: This is a community tool that is updated based on support availability.



 Front-end (public) network 

Ports to allow:



* All TCP/UDP ports
* ICMP – ping (for support troubleshooting and monitoring)





Table 1: Front-end (public) network

 Data center City IP range 

 ams03 Amsterdam 159.8.198.0/23 
 che01 Chennai 169.38.118.0/23 
 dal05 Dallas 173.192.118.0/23 
 dal08 Dallas 192.255.18.0/24 
 dal09 Dallas 198.23.118.0/23 
 dal10 Dallas 169.46.118.0/23 
 dal12 Dallas 169.47.118.0/23 
 dal13 Dallas 169.48.118.0/24 
 fra02 Frankfurt 159.122.118.0/23 
 fra04 Frankfurt 161.156.118.0/24 
 fra05 Frankfurt 149.81.118.0/23 
 lon02 London 5.10.118.0/23 
 lon04 London 158.175.127.0/24 
 lon05 London 141.125.118.0/23 
 lon06 London 158.176.118.0/23 
 mil01 Milan 159.122.138.0/23 
 mon01 Montreal 169.54.118.0/23
wdc04 BCR02 10.0.192.128/26 <br>10.170.0.0/16 
 wdc04 BCR03 10.183.0.0/16 <br>10.216.0.0/16 
 wdc04 BCR04 10.65.0.0/16 <br>10.201.11.0/24 <br>10.211.0.0/16 
 wdc04 BCR05 10.213.0.0/16 
 wdc06 BCR01 10.3.4.0/24 <br>10.188.0.0/15 <br>10.200.171.0/24 
 wdc07 BCR01 10.3.5.0/24 <br>10.39.0.0/16 <br>10.190.0.0/15 <br>10.200.187.0/24 









 Service network (on back-end/private network) 

[CHANGE LOG](https://cloud.ibm.com/docs/vsrx?topic=vsrx-ibm-cloud-ip-rangescloud-infrastructure-jul2522)

To provision and reload classic Virtual Servers and classic Bare Metal Servers, the following private service networks must be allowed through your gateway appliances and firewalls.

Be sure to configure rules and verify routes for the service networks listed in the table below for dal10, wdc04, and the location of your server.

Additionally, complete the following steps:
* Source: <sql_subnet>
* Value: Ports 49152-65535
* Security Group: SQL
* Rule: Outbound
* Protocol: UDP
* Destination Type: CIDR
* Destination: <sql_subnet>
* Value: Ports 49152-65535







 Replication traffic between domain controllers 

In this example we allow all ports between the active directory subnets. See [How to configure a firewall for Active Directory domains and trusts](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trustswindows-server-2008-and-later-versions) for all the ptotocols used between domain controllers to enable you to lock this down further if required.



* Security Group: AD
* Rule: Inbound
* Protocol: All
* Destination Type: CIDR
* Destination: <ad_subnet>
* Value: Ports all
* Security Group: AD
* Rule: Outbound
* Protocol: All
* Destination Type: CIDR
* Destination: <ad_subnet>
* Value: Ports all







 AD traffic between member servers and domain controllers 



* Security Group: Bastion
* Rule: Outbound
* Protocol: TCP
* Destination Type: CIDR
* Destination: <ad_subnet>
* Value: Ports 464, 88, 389, 636, 3268, 3269, 135, 49152-65535
* Security Group: SQL
* Rule: Outbound
* Protocol: TCP
* Destination Type: CIDR
* Destination: <ad_subnet>
* Value: Ports 464, 88, 389, 636, 3268, 3269, 135, 49152-65535
* Security Group: AD
* Rule: Inbound
* Protocol: TCP
* Source Type: CIDR
* Source: <bastion_subnet>, <sql_subnet>
The IP must be added to the "Addresses" list on the "Objects menu." An "All" option is available.

Source User: Applies the policy to a user or group created in the "User and Device" panel.

Source Device Type: Applies the policy to a device created in the "User and Device" panel.

Destination Address: The target IP of the traffic. The IP must be added to the "Addresses" list on the "Objects menu." An "All" option is available.

Schedule: Determines when the policy runs. An "Always" option is available. You can also create a schedule in the Objects menu under Schedules.

Service: Determines the service that the policy applies to. An "ALL" option is available as well as numerous standard services. Extra services can be added in the Services menu under Objects.

Action: Accepts or denies the traffic.

Firewall / Network Options: Enables or disables NAT and its associated options.

Security Profiles: Provides an On or Off toggle for each option, as well as allows association to the profile.

Traffic Shaping: Configures the maximum and guaranteed (minimum) bandwidth available to the traffic. A maximum connections limit can also be set on a per-IP shaper.

DSCP settings are not effective since user-generated QoS information is ignored by the IBM© Cloud platform.

Logging Options: Configures when "Allowed" traffic is recorded. This setting (and especially the "Capture Packets" option) uses device resources.

Comments: User-generated comments

Enable this policy: Enables or disables the policy





 Example of a simple "Allow All" rule for web traffic to a web server 

Incoming Interface:outside VLAN

Source Address:All

*Source User:Blank

Source Device Type:Blank

Outgoing Interface:inside VLAN

Destination Address:x.x.x.x (Web Server IP)

Schedule:always

Service:HTTP

Action:ACCEPT

NAT:OFF

Security Profiles:Use Standard

Traffic Shaping:Off

Log Allowed Traffic:On (Security Events)

Comments:Web Server Traffic x.x.x.x

Enable this policy:On
Before you install the HCX service, you must add a firewall rule to any existing firewalls.



1. From the VMware Solutions console, click Resources > vCenter Server from the left navigation pane.
2. In the vCenter Server table, click the instance to view the clusters in it.
3. Click the Infrastructure tab and select the cluster where you want to install the HCX service.
4. Go to the Network interface section on the cluster page.
5. Collapse the Public VLAN option and collapse the subnet with the description that corresponds to the portable subnet of the particular cluster.
6. Use the IP address from the Service T0 uplink2 Virtual IP address to route the traffic in the firewall rule. The firewall rule is required to allow all outbound HTTPS traffic so that the HCX Manager virtual appliance (HCX Manager) can register itself.
7. After the HCX Manager installation is completed, you can remove the firewall rule.



In addition, you must configure firewall rules to allow HCX to function properly. For more information, see [VMware HCX port access requirements](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx-archi-port-reqhcx-archi-port-req).







 Considerations when you delete HCX 

Review the following considerations before you delete the HCX service:



* Before you delete the service, you must remove any personal VMs from storage that is deployed with this service. HCX only orders personal VMs if it’s not vSAN.
* Ensure that the service mesh and extended networks between the on-premises source site and the IBM Cloud target sites are deleted. To remove the service mesh and extended networks, use the HCX user interface in the on-premises VMware vSphere Web Client.
* Ensure that the site pairings between the on-premises source site and the IBM Cloud target sites are removed. To remove the site pairings, use the HCX user interface in the on-premises VMware vSphere Web Client.
For more information, see [Configuring your firewall](https://docs.openshift.com/container-platform/4.8/installing/install_config/configuring-firewall.html).

Allow control plane worker nodes to communicate with the control plane master.
: 

* Destination IP addresses: 169.63.123.154, 169.63.110.114, 169.62.13.2, 169.60.123.162, 169.59.152.58, 52.117.93.26
* Destination hostnames: c107.us-east.satellite.cloud.ibm.com, c107-1.us-east.satellite.cloud.ibm.com, c107-2.us-east.satellite.cloud.ibm.com, c107-3.us-east.satellite.cloud.ibm.com, c107-e.us-east.satellite.cloud.ibm.com, c117.us-east.satellite.cloud.ibm.com, c117-1.us-east.satellite.cloud.ibm.com, c117-2.us-east.satellite.cloud.ibm.com, c117-3.us-east.satellite.cloud.ibm.com, c117-e.us-east.satellite.cloud.ibm.com
* Protocol and ports: TCP 30000 - 32767 and UDP 30000 - 32767



Allow control plane worker nodes to back up control plane etcd data to IBM Cloud Object Storage.
: 

* Destination IP addresses: N/A
* Destination hostnames: s3.us-east.cloud-object-storage.appdomain.cloud and .s3.us-east.cloud-object-storage.appdomain.cloud
* Protocol and ports: HTTPS 443



Allow continuous delivery of updates to platform components.
: 

* Destination IP addresses: N/A
* Destination hostnames: s3.us.cloud-object-storage.appdomain.cloud and .s3.us.cloud-object-storage.appdomain.cloud
* Protocol and ports: HTTPS 443
-H "x-amz-copy-source: /(bucket-name)/(object-key)"







 Check CORS information 

curl -X "OPTIONS" "https://(endpoint)/(bucket-name)/(object-key)"
-H "Access-Control-Request-Method: PUT"
-H "Origin: http://(url)"







 Download an object 

curl "https://(endpoint)/(bucket-name)/(object-key)"
-H "Authorization: bearer (token)"







 Check object's ACL 

curl "https://(endpoint)/(bucket-name)/(object-key)?acl"
-H "Authorization: bearer (token)"







 Enable a firewall 

Note the use of the config API endpoint isn't the same as the endpoint for your bucket itself. Use of this command enables a firewall for the specified bucket. No other IBM Cloud® services can access the bucket when the firewall is active.

curl -X PATCH https://config.cloud-object-storage.cloud.ibm.com/v1/b/{my-bucket} 
-H 'authorization: bearer $IAM_TOKEN' 
-d '{"firewall": {"allowed_ip": ["10.142.175.0/22", "10.198.243.79"]}}'







 Enable activity tracking 

Note the use of the config API endpoint isn't the same as the endpoint for your bucket itself. Use of this command enables activity tracking for the specified bucket.

curl -X PATCH https://config.cloud-object-storage.cloud.ibm.com/v1/b/{my-bucket} 
-H 'authorization: bearer <IAM_token>' 
-d '{"activity_tracking": { 
"activity_tracker_crn": at_crn, 
"read_data_events": True, 
"write_data_events": True}'







 Allow anonymous access to an object
Configuration files (Terraform template) describe to Terraform the components needed to run a single application or your entire datacenter.

In a previous step you created a virtual data center(VDC). This tutorial includes a Terraform template available in a [public Github repository](https://github.com/IBM-Cloud/vmware-solutions-shared) which will be used to configure and deploy resources in that VDC.

The main.tf file contains most of the critical sections for this template.



 Create a routed network 

An organization VDC network with a routed connection provides controlled access to machines and networks outside of the organization VDC. The following section creates a routed network and connects it to the existing edge gateway. The template also specifies a static IP pool and DNS servers for the network.

Zoom

![Routed Network](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution58-vmware-solutions-getting-started/routed-network.svg)

Routed Network

resource "vcd_network_routed" "tutorial_network" {

name = "Tutorial-Network"
edge_gateway = module.ibm_vmware_solutions_shared_instance.edge_gateway_name
gateway = "192.168.100.1"

interface_type = "distributed"

static_ip_pool {
start_address = "192.168.100.5"
end_address = "192.168.100.254"
}

dns1 = "9.9.9.9"
dns2 = "1.1.1.1"
}
Show more





 Create a firewall and SNAT rule to access the Internet 

You can create rules to allow or deny traffic, this section creates a firewall and SNAT rule to allow traffic from the VDC network to reach the Internet with no additional restrictions.

Zoom

!
On the Veeam backup server, open a PowerShell window with "Run as administrator" option.
3. Run the following command New-NetFirewallRule -DisplayName "WinRM (HTTPS-In)" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5986 to create the required firewall rule.







 Creating a service account for ansible automation 



1. From the jump server, use the RDP client to access the Veeam backup server.
2. On the Veeam backup server, open a PowerShell window with "Run as administrator" option.
3. Use the following commands and enter a password at the prompt:

$n = "sa-ansible"
$d = "Service Account for ansible control node"
$pw = Read-Host -AsSecureString
New-LocalUser -AccountNeverExpires -Description $d -Name $n -Password $pw -PasswordNeverExpires -Confirm:$false
Add-LocalGroupMember -Group "Administrators" -Member $n
4. Verify with Get-LocalUser and Get-LocalGroupMember -Group "Administrators".



For more information, see [Setting up a Windows host](https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html).





 Related links 



* [Cyber recovery with Veeam architecture overview](https://cloud.ibm.com/docs/vmwaresolutions/?topic=vmwaresolutions-veeam-cr-sa-overview)
* Department C - VLAN 50 (interface dp0bond1.50)



A zone can be created for each department and the interfaces for that department can be added to the zone. The following example illustrates this:

set security zone-policy zone DEPARTMENTA interface dp0bond1.10
set security zone-policy zone DEPARTMENTA interface dp0bond1.20
set security zone-policy zone DEPARTMENTB interface dp0bond1.30
set security zone-policy zone DEPARTMENTB interface dp0bond1.40
set security zone-policy zone DEPARTMENTC interface dp0bond1.50

The commit command populates each zone as an interface and the default drop rules discard any traffic trying to enter the zone from the outside. In the example, VLAN 10 and 20 can pass traffic since they are in the same zone (DEPARTMENTA) but VLAN 10 and VLAN 30 cannot pass traffic because VLAN 30 is in a different zone (DEPARTMENTB).

The interfaces within each zone can pass traffic freely and rules can be defined for interaction between the zones. A rule set is configured from the point of view of leaving one zone to another zone.

The following command shows an example of how to configure a rule:

set security zone-policy zone DEPARTMENTC to DEPARTMENTB firewall ALLOW_PING

This command associates the transition from DEPARTMENTC to DEPARTMENTB with the rule set named ALLOW_PING. Traffic entering the DEPARTMENTB zone from the DEPARTMENTC zone would be checked against this rule set.

It is important to understand that this assignment from zone DEPARTMENTC going into zone DEPARTMENTB does not make any statement about the inverse. If there are no rules allowing traffic from zone DEPARTMENTB into zone DEPARTMENTC, then traffic (ICMP replies) will not get back to the hosts in DEPARTMENTC.

ALLOW_PING would be applied as an out firewall on the interfaces of DEPARTMENTB zone (dp0bond1.30 and dp0bond1.40). As this is installed by the zone policy, only traffic originating from the source zone's interfaces (dp0bond1.50) would be checked against the ruleset.





 Session and packet logging 

The VRA supports two types of logging:



1.