vania-janet/multiturn-rag-retrieval-data huggingface dataset:
set security firewall name <name> rule <rule-no> action accept
set security firewall name <name> rule <rule-no> protocol esp







 Site-to-site IPsec with DNAT 



 Site-to-site IPsec with DNAT issues 

IPsec (prefix-based) does not work with DNAT.

server (10.71.68.245) -- vyatta 1 (11.0.0.1)
===S-S-IPsec=== (12.0.0.1)
vyatta 2 -- client (10.103.0.1)
Tun50 172.16.1.245

The prior code snippet is a small setup example for DNAT translation after an IPsec packet is decrypted in a Vyatta 5400. In this example, there are two Vyattas, vyatta1 (11.0.0.1) and vyatta2 (12.0.0.1). IPsec peering is established between 11.0.0.1 and 12.0.0.1. In this case, the client is targeting 172.16.1.245 sourced from 10.103.0.1 end-to-end. The expected behavior of this scenario is that the destination address 172.16.1.245 translates to 10.71.68.245 in the packet header.

Initially, the Vyatta 5400 device was performing DNAT on the inbound IPsec, terminating the interface and returning traffic gracefully into the IPsec tunnel using the connection tracking table.

On a IBM Cloud® Virtual Router Appliance, the configuration does not function the same. The session is created, however the return traffic bypasses the IPsec tunnel after the conntrack table reverses the DNAT change. The VRA then sends the packet on the wire without IPsec encryption. The upstream device is not expecting this traffic and most likely drops it. While end-to-end connectivity is broken, this is intended behavior.





 Site-to-site IPsec with DNAT workarounds 

To accommodate this networking scenario, IBM has created an RFE.
Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

The need for isolated and secure private network environments is central to the IaaS application deployment model on public cloud. Firewalls, VLANs, routing, and VPNs are all necessary components in the creation of isolated private environments. This isolation enables virtual machines and bare-metal servers to be securely deployed in complex multi-tier application topologies while proving protection from risks on the public internet.

This tutorial highlights how a [Virtual Router Appliance](https://cloud.ibm.com/docs/virtual-router-appliance?topic=virtual-router-appliance-faqs-for-ibm-virtual-router-appliancewhat) (VRA) can be configured on the IBM Cloud to create a secure private network (enclosure). The VRA provides in a single self-managed package, a firewall, VPN gateway, Network Address Translation (NAT) and enterprise-grade routing. In this tutorial, a VRA is used to show how an enclosed, isolated network environment can be created on the IBM Cloud. Within this enclosure application topologies can be created, using the familiar and well known technologies of IP routing, VLANs, IP subnets, firewall rules, virtual and bare-metal servers.

This tutorial is a starting point for classic networking on the IBM Cloud and should not be considered a production capability as is. Additional capabilities that might be considered are:



* [IBM Cloud® Direct Link](https://cloud.ibm.com/docs/direct-link?topic=direct-link-get-started-with-ibm-cloud-direct-linkget-started-with-ibm-cloud-direct-link)
* [Hardware firewall appliances](https://cloud.ibm.com/docs/fortigate-10g?topic=fortigate-10g-exploring-firewallsexploring-firewalls)
* [IPsec VPN](https://cloud.ibm.com/catalog/infrastructure/ipsec-vpn) for secure connectivity to your data center.
public-cr24a9f2caf6554648836337d240064935-alb2 true enabled public 169.46.52.222 dal10 ingress:1.1.2_2507_iks 2234945 -



* If a public ALB has no IP address (classic) or hostname (VPC), see [Ingress ALB does not deploy in a zone](https://cloud.ibm.com/docs/containers?topic=containers-cs_subnet_limit).



2. Verify that your ALB IP addresses are reachable by the ALB health check.



* Classic: If you use Calico pre-DNAT network policies or another custom firewall to block incoming traffic to your cluster, you must allow inbound access on port 80 or 443 from the Kubernetes control plane and Akamai's IPv4 IP addresses to the IP addresses of your ALBs so that the Kubernetes control plane can check the health of your ALBs. For example, if you use Calico policies, [create a Calico pre-DNAT policy](https://cloud.ibm.com/docs/containers?topic=containers-policy_tutoriallesson3) to allow inbound access to your ALB IP addresses from [Akamai's source IP addresses](https://github.com/IBM-Cloud/kube-samples/tree/master/akamai/gtm-liveness-test) on port 80 and the [control plane subnets for the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips).
* VPC: If you have a custom security group on the VPC LBaaS (LoadBalancer-as-a-Service) instances for the cluster ingress, ensure that the security group rules allow the necessary health-check traffic from the Kubernetes [control plane IP addresses](https://github.com/IBM-Cloud/kube-samples/tree/master/control-plane-ips) to port 443.



3.
Skipping nrt01: operating system is not supported for antivirus scan
Starting nrt01-CR-2021-11-19-12:50 recovery
Connecting to host host002.partner.ibmcloud.local
Restoring from Linux Hardened Repository - LHBR01
Checking if vPower NFS datastore is mounted on host
Locking backup files
Publishing backup files
Preparing change storage
Updating VM configuration
Checking free disk space available to Power NFS server
Registering VM
Creating VM snapshot
Powering on VM
Updating session history
nrt01-CR-2021-11-19-12:50 has been recovered successfully
Waiting for user to start migration
Show more

On the Linux hardened repository, the following ports were temporarily opened on the Linux firewall designated by the comment Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4.

ufw status
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW 10.38.207.142 Allow SSH from trusted servers
6162/tcp ALLOW 10.38.207.157 Allow Veeam Mgmt from Veeam BUR server
2500/tcp ALLOW Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
2501/tcp ALLOW Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4

6162/tcp ALLOW OUT Anywhere Veeam transport rule
2500/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
2501/tcp ALLOW OUT Anywhere Veeam rule 876f0752-7209-4e8b-8b34-fa0af7dbced4
Show more





 Stopping the instant recovery
If you go for the more complex implementation, a distributed SAP System, you will need to launch sapinst on sap-wdb, install the ASCS and the DB and then run sapinst on sap-wapp to install the PAS. Then, it is necessary that you open specific ports to allow inter-application communication between the application server and the database server. To accomplish this, you must use Windows Firewall tool.

1. Start Windows Firewall with Advanced Security - enter wf.msc in Windows search field
1. Click Inbound Rules then Action and New rule...
1. Click Rule Type Port and Next
1. Enter the ports that need to be opened (see below)
1. Click Action Allow the connection and Next
1. Click Profile Public to unselect this option and Next
1. Enter a name and optionally a description and click Finish (see below)

Example values are e.g. depending on the instance numbers that you have chosen:

 Ports Name

 3000-3999 SAP 
 5912-5917 Db2 
 40000-40099 IGS 
 50000-50099 sapstartsrv 

In a production environment you will get more granular on the port numbers. For more information about ports, see [!SAP ports](https://help.sap.com/viewer/ports){: external} and the respective documentation of your database vendor for details.
{: note}

If you run SAP GUI on your desktop, remember to add the ports that are required by your SAP application (example: ports 3200-3299, depending on your SAP NetWeaver instance number) to the security group.

 Finding more information {: find-information-wins}

Leaving now the tutorial and finding all information that you need to install your specific SAP components and versions, visit the [SAP Help Portal](https://help.sap.com/viewer/index){: external} as a starting point.

 Relevant SAP Notes

* [SAP Note 2384179 - SAP Systems on Windows Server 2016](https://launchpad.support.sap.com//notes/2384179){: external}.
Firewall appliance 

You have the following options for your firewall appliance:



*  Gateway cluster with Juniper® vSRX - Order a dedicated cluster for the network edge and firewall components and install Juniper vSRX on it.
*  Gateway cluster with FortiGate® Virtual Appliance - Order a dedicated cluster for the network edge and firewall components and install FortiGate Virtual Appliance on it.
*  Bring your own gateway appliance - Order a dedicated cluster for the network edge and firewall components.
*  FortiGate Security Appliance - Use an {{site.data.keyword.cloud} service, which is an enterprise-class hardware firewall for enhanced and granular control over your network.



The steps that you must follow differ depending on your selection.
<svc_password> is the password for the domain service account used for SQL Server service and <agt_password> is the password for the domain service account used for SQL Agent.

By default, SQL Server is installed with TCP protocol disabled and /TCPENABLED="1" enables TCP.

Verify that TCP/IP has been enabled on the server's interface and the loopback address (127.0.0.1):



1. On the SQL server, open the SQL Server Configuration Manager.
2. Expand the SQL Server Network Configuration node to view the Protocols for MSSQLSERVER.
3. At the details area, right-click on the TCP/IP protocol and choose Properties.
4. From the TCP/IP Properties window, choose the IP Addresses tab.
5. Look for the interfaces that has the Server's IPv4 IP address and the loopback address (127.0.0.1).
6. Verify that Enabled is set to Yes. If set to No, Select Yes.
7. Click OK, and OK again.
8. The service will need to be restarted for the changes to be made effective.
9. Select SQL Server Services, and restart the SQL Server service.







 Configure Windows firewall 

Use the following command to allow TCP 1433 through the Windows firewall New-NetFirewallRule -DisplayName 'SQL-Inbound' -Profile Domain -Direction Inbound -Action Allow -Protocol TCP -LocalPort 1433

Use the following command to allow TCP 5022 through the Windows firewall if you are going to configure availability groups New-NetFirewallRule -DisplayName 'SQL-AG-Inbound' -Profile Domain -Direction Inbound -Action Allow -Protocol TCP -LocalPort 5022





 Configure the NTP server 

To synchronize time automatically from the AD domain hierarchy, run the following commands:

w32tm /config /syncfromflags:domhier /update
net stop w32time
net start w32time
w32tm /query /status





 Install the Powershell SQL Server module
Making a network request 

You can use the BMSCore SDK to make network requests to any resource.



 Android 



1. Make sure you've [imported the Client SDK and initialized it](https://cloud.ibm.com/docs/cli/sdk?topic=cli-sdk_BMSClientinit-BMSClient-android) in your Android application.
2. Make a network request.

String customResourceURL = "<your resource URL>";
Request request = new Request(customResourceURL, "GET");

ResponseListener listener = new ResponseListener() {
@Override
public void onSuccess(Response response) {
Log.i("MyApp", "Response: " + response.getResponseText());
}

@Override
public void onFailure(Response response, Throwable t, JSONObject extendedInfo) {
Log.i("MyApp", "Request failed. Response: " + response.getResponseText() + ". Error: " + t.getLocalizedMessage());
}
};

request.send(getApplicationContext(), listener);
Show more



The Request class is a simple way to make an HTTP request and get the response after the request is completed. If you're downloading or uploading large files or large bodies of data, you can use the Requestdownload or upload methods. To monitor the progress of the download or upload, create a custom ProgressListener and pass it to the download or upload methods.

For complete usage examples, see the BMSCore GitHub [README](https://github.com/ibm-bluemix-mobile-services/bms-clientsdk-android-core).





 iOS 



1.
A secret in the Authorization + PKCE flow is not needed. You are not able to use regular web app credentials in your SPA flow.



1. Make the following post request to the [/management/v4//applications](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Applications/mgmt.registerApplication) endpoint.

curl -X POST https://us-south.appid.cloud.ibm.com/management/v4/<tenantID>/applications/ -H 'accept: application/json' -H 'Authorization: Bearer <IAMToken>' -H 'Content-Type: application/json' -d '{"name": "MySampleSPA", "type": "singlepageapp"}'

Example response:

{
"clientId": "<clientID>",
"tenantId": "<tenantID>",
"name": "MySampleSPA",
"oAuthServerUrl": "https://us-south.appid.cloud.ibm.com/oauth/v4/<tenantID>",
"type": "singlepageapp"
}







 Configuring the JavaScript SDK 

To install the SDK in your application, use the following steps as a guide.



1. By using the command prompt, change in to the directory that contains your application.
2. Install the App ID service by using NPM or by linking the CDN in your main HTML file.



* To use NPM, run the following command.

npm install ibmcloud-appid-js
* To add the CDN, add the following link to your main HTML file.

<script src="https://cdn.appid.cloud.ibm.com/appid-0.3.0.min.js"></script>



3. Add your client ID and discovery endpoint to your app to initialize the SDK.

const appID = new AppID();
VRVDR-51828 Major SIAD ACL: BCM SDK error when deleting ACL configuration 
 VRVDR-51639 Critical Response for "request hardware-diag version" takes much longer with 1912b 
 VRVDR-51619 Critical SIAD ACL: Ensure that rulesets which would exceed the TCAM are rejected 
 VRVDR-51616 Critical Storm Control triggered snmpd warning messages in journal 
 VRVDR-51543 Critical IPsec peers stuck in 'init' state after upgrade from 1801q to 1912d 
 VRVDR-51539 Critical Repeated FAL BCM "L3 Interface" for VSI 0 Syslog 
 VRVDR-51521 Critical NAT64 opd yang file missing required type field in 1908 and 1912 
 VRVDR-51518 Critical Dataplane performance fails for forward pkts when scatter mode driver is used 
 VRVDR-51483 Major Removing guest configuration fails with scripting error 
 VRVDR-51385 Critical Dataplane Crash in next_hop_list_find_path_using_ifp 
 VRVDR-51348 Major libsnmp-dev built from DANOS/net-snmp is not API compatible with libsnmp-dev from upstream 
 VRVDR-51345 Critical S9500-30XS: 100G Interface LED lit even when disabled 
 VRVDR-51311 Blocker DAS Switch with 1912b seeing low rate of drops vs 1903m 
 VRVDR-51295 Critical Changing speed on interface resets configured MTU to default 
 VRVDR-51247 Major S9500 - missing hw_rev.cfg file 
 VRVDR-51238 Major After broadcast storm, TACACS doesn't recover 
 VRVDR-51185 Blocker Link doesn't come up after swapping 1000BASE-T SFP for 1000BASE-X SFP 
 VRVDR-51183 Major 'FAL neighbor del' log is generated by dataplane for each ARP received for an unknown address 
 VRVDR-51179 Critical live-cd installs should not install all unique state 
 VRVDR-51148 Critical S9500 interface flaps when MTU is modified
-d '{"name": "ApplicationName"}'

Example response:

 {: screen}
{
  "clientId": "xxxxx-34a4-4c5e-b34d-d12cc811c86d",
  "tenantId": "xxxxx-9b1f-433e-9d46-0a5521f2b1c4",
  "secret": "ZDk5YWZkYmYt",
  "name": "app1",
  "oAuthServerUrl": "https://us-south.appid.cloud.ibm.com/oauth/v4/xxxxx-9b1f-433e-9d46-0a5521f2b1c4",
  "profilesUrl": "https://us-south.appid.cloud.ibm.com",
  "discoveryEndpoint": "https://us-south.appid.cloud.ibm.com/oauth/v4/xxxxxx-9b1f-433e-9d46-0a5521f2b1c4/.well-known/openid-configuration"
}

Show more







 Step 3: Initialize the SDK 

The easiest way to work with App ID is to take advantage of the Node.JS SDK.



1. By using the command line, change into the directory that contains your Node.js application.
2. Install the following NPM requirements.

npm install --save express express-session passport log4js pug
3. Install the App ID service.

npm install --save ibmcloud-appid
4. Add the following requirements to your server.js file.

const express = require('express'); 								// https://www.npmjs.com/package/express
const log4js = require('log4js'); // https://www.npmjs.com/package/log4js
We do not offer redundancy between switches or routers. Customers create redundancy with their BGP configurations on each Direct Link.
* How easy is it to upgrade the bandwidth of my Direct Link connection, for example 1 - 5 GB?

Typically, we install speeds of 1G and lower on 1G optics. For speeds of 2 - 10 GB, we install 10 GB optics. Thus, the upgrade 1 - 5 GB would require new optics to be assigned or inserted. It would be a service-affecting event. If you anticipate that type of growth, it's possible to request 10 GB optical fibers to be installed at the beginning of your Direct Link deployment, or to order 2 GB initially so that the 10 GB optics are in place.
* Is ECMP the way to go for redundant Direct Link connections? What alternatives exist?

ECMP isn’t for redundant connections, but for balancing the load over the two links. With ECMP, both connections must terminate to the same IBM Cloud cross-connect router (XCR), which makes it a single point of failure. (In other words, ECMP can be provisioned only as two sessions on the same IBM Cloud XCR.)

IBM Cloud does NOT recommend the use of ECMP. ECMP balancing with IBM cloud only extends to the XCRs. Past the XCRs, the ECMP-based traffic presents itself as the same IP address to IBM Cloud network, and the IBM Cloud network routing defaults to the shortest path found. This means that only one of the Direct Links in the ECMP configuration is usable at a given time.

ECMP is a feature of BGP. If you are looking for redundancy, get two Direct Link connections, one going into each XCR. If you want to use ECMP and have redundancy, you need two Direct Link connections on each XCR so that you can have 2 ECMP sessions running simultaneously.

Alternatively, some of our customers set up two links into different XCR in the same data center, for example WDC02, then failover as needed by using BGP configurations. This configuration is less redundant (less safe) than having Direct Link connections into two separate data centers, such as WDC02 and WDC05.
6. Check DI - Platform full
7. Click Confirm Selection then Next
8. Select Linux on x86_64 64bit
9. Click Confirm Selection then Next
10. Click Execute Plan
11. Fill HOSTNAME that you found above into entry field Fully Qualified Domain Name
12. Fill PORT that you found above into entry field Port
13. Click Next



Before you click Deploy you must enter your previously found URL [https://HOSTNAME](https://HOSTNAME):PORT/docs/index.html into a browser and login with your SLCB admin user credentials that you have provided during the ./slcb init installation process.



1. After successfull login, click Deploy then Next



Now, select the link in the tools column which will launch SAP Intelligence installer in a separate browser window. During installation of SAP Data Intelligence, you're prompted to provide the following parameters:



 Parameter Value 

 When the installer is called for the first time it will download SLCB images from SAP and therefore prompt you for your credentials 
 S-User Name: Sxxxxxxxx 
 S-User Password: xxxxxxxx 
 Then you will select Install and DI Platform Full and click Next two times 
 Kubernetes Namespace: sdi 
 Installation Type: advanced 
 Restore from Backup: no 
 Address of the Container Image Repository: de.icr.io/sdi_cr_os 
 Eventually you will need to enter your S-User credentials again 
 S-User Name: Sxxxxxxxx 
 S-User Password: xxxxxxxx 
 SAP DI System Tenant Administrator Password: xxxxxxxx (you have specified this password before) 
 SAP DI Initial Tenant Name: default 
 SAP DI Initial Tenant Administrator Username: default-adm 
 Specify a password for "default" user of "default" tenant: xxxxxxx 
 proxy no 
 backup confirm that SAP Note 2918288 is read 
 backup, restore and vora storage: s3 compatible 
 Access Key: xxxxxxxxxxxxxxxxxxxxxx (see above)
Enable offline mode 



  Benefits of offline mode 

Enabling offline mode lets you evaluate feature flags or properties when the application is running in an air-gapped environment.

This method allows the application to use App Configuration SDK and evaluate the feature flags and properties in a highly secure system such as FedRAMP compliant systems. It also helps to achieve GitOps operational procedures, which rely on Git as a source control system.





  Creating the configuration file to use in offline mode 

To enable offline mode, use a local file with the configuration details. You can create this file by using the App Configuration CLI.

Refer to the [CLI reference document](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-cli-plugin-app-configuration-cli) for steps to install and configure App Configuration CLI.

Retrieve the configuration in a file by using the command:

ibmcloud ac config --collection_id COLLECTION_ID --environment_id ENVIRONMENT_ID [--file FILE]





  Command options 

--environment_id ENVIRONMENT_ID
:   Environment ID

--collection_id COLLECTION_ID
:   Collection ID

--file FILE
:   Path to file where configuration is exported





  Enabling offline mode 

As part of App Configuration SDK initialization, you can let the SDK read the configuration from the file.

For a Node.js SDK you can use the local configuration file as in the following example:

const client = AppConfiguration.getInstance();
let region = AppConfiguration.REGION_US_SOUTH;
let guid = 'abc-def-xyz'; let apikey = 'j9qc-abc-z79';
client.init(region, guid, apikey)
let collectionId = '<collectionId>';
let environmentId = '<environmentId>';
let configurationFile = 'path/to/configuration/file.json';
let liveConfigUpdateEnabled = false;
client.setContext(collectionId, environmentId, configurationFile, liveConfigUpdateEnabled)

For more information, see the respective SDK documentation.
: The SDK for Node.js buildpack v3.24 provides IBM SDK for Node.js versions 4.8.5, 4.8.7 and Node.js community versions 6.14.3, 6.14.4, 8.11.3, 8.11.4, 10.9.0 and 10.10.0. The default is latest 6.x, so it is currently 6.14.4. The buildpack also fixes a minor bug in the Dynatrace hook.





 29 October 2018 

Updated Liberty buildpack v3.26-20181023-1545
: The default Liberty runtime version, 18.0.0.3, was updated to include a fix for the [CVE-2014-7810 security vulnerability](https://www.ibm.com/support/pages/node/737055).



* The monthly Liberty runtime version was updated to the 2018.10.0.0 release.
* The IBM JRE version was updated to 8 SR5 FP22.







 21 September 2018 

Updated Liberty buildpack v3.25-20180918-1034
: The buildpack now supports Java Platform, Enterprise Edition 8.0. To use Java EE 8, install the javaee-8.0 Liberty feature when you push your app. Learn more in [Install Liberty features](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-install-features).



* The default Liberty runtime version was updated to the 18.0.0.3 release.
* The monthly Liberty runtime version was updated to [2018.8.0.1](https://developer.ibm.com/wasdev/blog/2018/08/31/reactive-rest-client-liberty-beta/) release.
* The IBM JRE version was updated to 8 SR5 FP20.







 20 September 2018 

Updated ASP.NET Core buildpack v2.0-20180918-1356