vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Standard <br><br> * Core security: firewall, ALG, screens, user firewall<br> * IPsec VPN (site-to-site VPN)<br> * NAT<br> * CoS<br> * Routing services: BGP, OSPF, DHCP, J-Flow, IPv4<br> * Foundation: Static routing, management (J-Web, CLI, and NETCONF), on-box logging, diagnostics<br><br><br> 
 Content Security Bundle (CSB) <br>Includes all Standard features, along with the additional features listed in the next column. <br><br> * AppSecure<br> <br> <br> <br> <br> * Application Tracking (AppTrack)<br> * Application Firewall (AppFW)<br> * Application Quality of Service (AppQoS)<br> * Advanced policy-based routing (APBR)<br> * Application Quality of Experience (AppQoE)<br> <br> <br> <br> <br> * User Firewall<br> * IPS<br> * UTM<br> * Anti Virus<br> * Anti Spam<br> * Web Filtering<br> * Content Filtering<br> * SSL Proxy<br> * SSL Forward Proxy<br> * SSL Reverse Proxy<br> * SSL Decrypting Mirror<br><br><br> 



You can specify your license type when ordering your vSRX, as well as change the license by using the [Gateway Appliance Details](https://cloud.ibm.com/docs/vsrx?topic=vsrx-vsrx-licensesvsrx-licenses) page.





 Ordering a vSRX 

You can order your IBM Cloud® Juniper vSRX by performing the following procedure:



1. From your browser, open the Gateway Appliances page in the [IBM Cloud catalog](https://cloud.ibm.com/gen1/infrastructure/provision/gateway) and log in to your account.
: The total number of log entries to be exported.

--from <TIME>
: The starting time to be used for log entries. No log entries early than this time will be returned. <TIME> is specified as a UNIX timestamp in seconds or milliseconds.

--to <TIME>
: The ending time to be used for log entries. No log entries after than this time will be returned. <TIME> is specified as a UNIX timestamp in seconds or milliseconds.

--output <TYPE>
: Type of output produced. If JSON is specified, output will be returned in JSON format. If not specified, output will be returned in tabular format.

--query <STRING> | -q <STRING>
: A value to be searched for within the log. All log entries containing the specified <STRING> will be returned.

--prefer <VALUE> | -p <VALUE>
: The log lines you want to export. Valid values are HEAD and TAIL. HEAD specifies the log lines will be exported from the earliest entry to the most current entry. TAIL specifies the log lines will be exported in reverse order from the most current entry to the earliest entry. If not specified, the default is TAIL.

--email <ADDRESS> | -e <ADDRESS>
: If specified, an email with a link to the export information will be sent to the specified email <ADDRESS>. The recipient can use that link to download the exported information.

--email-subject <SUBJECT> | --es <SUBJECT>
: Use with --email to specify a subject line to be included in the email that is sent.

--help | -h
: List options available for the command.





 Examples 

The following are examples using the ibmcloud logging export command.

Export all logs for the provided service key.

ibmcloud logging export --service-key <SERVICE_KEY>

Export log entries for the provided service key occurring during the specified time range. Time stamps need to be in UNIX format. For example: 1614228407550.
The spec.ingress.from.podSelector.matchLabels section lists the labels for the Srv1 front-end service so that ingress is permitted only from those pods.

Then, they create a similar Kubernetes network policy that allows traffic from the back end to the database:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: db-allow
spec:
podSelector:
matchLabels:
app: Srv1
tier: db
ingress:
- from:
- podSelector:
matchLabels:
app: Srv1
Tier: backend

The spec.podSelector.matchLabels section lists the labels for the Srv1 database service so that the policy applies only to those pods. The spec.ingress.from.podSelector.matchLabels section lists the labels for the Srv1 back-end service so that ingress is permitted only from those pods.

Traffic can now flow from the front end to the back end, and from the back end to the database. The database can respond to the back end, and the back end can respond to the front end, but no reverse traffic connections can be established.





 Isolate app services between namespaces 

The following scenario demonstrates how to manage traffic between app microservices across multiple namespaces.

Services that are owned by different sub teams need to communicate, but the services are deployed in different namespaces within the same cluster. The Accounts team deploys front end, back end, and database services for the app Srv1 in the accounts namespace. The Finance team deploys front end, back end, and database services for the app Srv2 in the finance namespace. Both teams label each service with the app: Srv1 or app: Srv2 label and the tier: frontend, tier: backend, or tier: db label. They also label the namespaces with the usage: accounts or usage: finance label.

Zoom

![Use a network policy to manage cross-namepspace traffic.]
However, in the latter case, if both of the gateways are connected to the same client, only one of the destinations will be able to listen on port 12000.



 Cloud Destination 

![Cloud Destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/reverseDestination.png?raw=true)





 On Premises Destination 

![On Premises destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/onPremDestination.png?raw=true)







 High Availability 

To achieve high availability, create multiple client connections to the same gateway ID. This can be accomplished by connecting multiple single-gateway clients to the same gateway ID and/or by issuing multiple connections on a single multi-gateway client to the same gateway ID. On-premises destination connections will be distributed between all connected clients in a round-robin fashion.
If you get stuck or need additional information, see the reverse proxy portion of the [Nginx documentation](https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/) or search [stackoverflow](https://stackoverflow.com) for examples.



1. Provision your VSI or bare metal servers with minimal RHEL or CentOS Linux build (recommended).
2. For each VSI, enable the following security group rules on the public interface: allow_http, allow_https, allow_outbound, allow_ssh
3. For each VSI, enable allow_all and allow_outbound rules on the private interface; select Save.
4. Using PuTTY in Windows or your desktop's terminal program, ssh into your new server as root.
5. Upgrade your operating system OS (yum update).
6. Install the EPEL repository (yum install epel-release).
7. Install NginX (yum install nginx).
8. Start NginX (nginx) and open your server's IP address in a browser.
9. The default location of nginx.conf is /etc/nginx. Create a safe copy.
10. Move the sample nginx.conf configuration file into /etc/nginx.
11. Purchase SSL certificates through the IBM Cloud console or run the command yum install easy-rsa and see your favorite online docs for tips on creating self-signed certificates.
12. Add your certificate information to the configuration file, nginx.conf.
13. Test the modified NginX configuration with the command nginx -t.
14. If your test passes, restart nginx with the command nginx -s quit; sleep 3; nginx.
15. Your client can now submit COS requests to the IPs or URLs of the NginX (proxy) server.



Notes:
[More options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) icon on the Number provided node, and then select Add child node.
27. Type yes into the If assistant recognizes field of this node.
28. Add the following message in the response text field:

Ok. The order $ordernumber is canceled. We hope we get the opportunity to bake a cake for you sometime soon.

![Shows the node that responds when the user confirms that they want to cancel the order.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-yes-child-node.png)
29. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/close.png) to close the edit view.
30. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) icon on the yes node, and then select Add node below.
31. Type true into the If assistant recognizes field of this node.

Do not add a response. Instead, you will redirect users to the branch that asks for the order number details that you created earlier.
32. In the And finally section, choose Jump to.

![Shows a true node that has no response, but has the jump to menu option selected.]
Request a private subnet 

In most deployments, the Citrix Netscaler VPX appliance is deployed in a reverse-proxy configuration. However, to configure the VPX with a forward-proxy configuration, Virtual IPs (VIPs) are needed, because the configuration will exist on a private network instead of a public one.

You must open a Support case with the IBM Cloud® Support team and request that a private network for your Citrix Netscaler VPX appliance be added to your account. You require at least two private addresses, so request a private subnet size of at least /29.
New validation choices for date, time, and numeric customer responses
: For Number, Date, Time, Currency, and Percentage customer responses, you can now customize the validation to check for a specific answer, such as a range of dates or a limited currency amount. For details, see [Customizing validation for a response](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-handle-errorscustomize-validation).

Confirmation to return to previous action
: If a customer changes to a different topic, assistants now ask a "yes or no" confirmation question to determine whether the customer wants to return to the previous action. Previously, the assistant returned to the previous action without asking. New assistants are set to use this confirmation by default. For details, see [Confirmation to return to previous topic](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-change-topicchange-topic-confirmation).

New "Never return" choice for when a customer changes topics
: In some cases, you might not want a customer to return to a previous action after the customer changes the topic. To set up this option, use the new Never return choice in Action settings. For details, see [Disabling returning to the original topic](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-change-topicchange-topic-never-return).

Allow changing topics in free text and regex responses
: By default, customers can't change topics when the assistant is asking for a free text response or when an utterance matches the pattern in a regex response. Now free text and regex customer response types have a setting to allow a customer to digress and change topics. For details, see [Enabling changing the topic for free text and regex customer responses](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-change-topicchange-topic-free-text-regex).

Adding and using multiple environments
: Each assistant has a draft and live environment. You can now add up to three environments to test your assistant before deployment.
[More options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) icon on the cancel_order node, and then select Add child node.
23. Add a label to the node to distinguish it from other child nodes. In the name field, add Number provided. Type @order_number into the If assistant recognizes field of this node.
24. Add the following message in the response text field:

Just to confirm, you want to cancel order $ordernumber?

![Shows the node that responds when the user does provide a valid order number.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-add-number-provided.png)
25. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/close.png) to close the edit view.

You must add child nodes that check for the user's response to your confirmation question.
26. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) icon on the Number provided node, and then select Add child node.
27. Type yes into the If assistant recognizes field of this node.
28. Add the following message in the response text field:

Ok. The order $ordernumber is canceled.
Uncommenting this line gives all users that are in the wheel group permission to run all commands.
8. Run the :wq command to save changes and exit the file.
9. Run the following command at the command line:

vi /etc/pam.d/su
10. Remove the hash (#) from the following line to uncomment the line:

auth required pam_wheel.so use_uid

Uncommenting this line requires users to be part of the wheel group to have permission to run all commands.
11. Run the :wq command to save changes and exit the file.
12. Run the following command to save all changes and restart SSH:

 etc/init.d/ssh restart





 Next steps 

After you restrict the root user from SSH access, the root user cannot log in to SSH. If a user currently can access the server through SSH under the root user, the connection will fail after the restart of SSH in the previous procedure. All future attempts to connect to SSH through the root user fail. To reverse these changes, repeat the steps and change PermitRootLogin no back to PermitRootLogin yes.
To reduce complexity, the enterprise needs to balance complexity with the separation of resources into different domains and subdomains, which has security benefits.





 Multiple forest models 

If the enterprise includes groups that require data isolation or service isolation from other groups in the enterprise, then the multiple forest model can be used to create a separate forest for these groups. Domains do not provide data isolation or service isolation. The forest service administrators have full access to all resources in the forest. This access cannot be prevented, so if you have resources that this group must not have access to, then these resources need to be placed in a different forest.

The multiple forest model is also seen where enterprises have merged, and the two enterprises have two different Active Directory Domain Services structures.

Review the following three forest models.



* Organizational forest model – In this model, user accounts and resources are contained in both forests but managed independently. This model can provide autonomy and isolation, if the forest is configured to prevent access to anyone outside the forest. If users in an organizational forest need to access resources in other forests, or the reverse, trust relationships can be established between one organizational forest and the other forests.
* Resource forest model – In this model, a separate forest is used to manage resources and these forests do not contain user accounts other than the service administrators. Forest trusts are established so that users from other forests can access the resources that are contained in the resource forest. This model provides service isolation.
* Restricted access forest model – In this model, a separate forest is created to contain user accounts and resource that must be isolated from the rest of the enterprise. Users from one forest cannot be granted access to the other forest as no trust exists between the forests. This model is often adopted by service providers who can provide infrastructure management services, for example. In this model, if users need access to resources in both forests, users have an account in one forest and a separate user account in the other forest. This model provides data isolation. The restricted access forest model is created when you provision a IBM Cloud for VMware Solutions vCenter Server instance.









 Related links 



* [Overview of VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-solution_overview)
[More options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon on the cancel_order node, and then select Add child node.
23. Add a label to the node to distinguish it from other child nodes. In the name field, add Number provided. Type @order_number into the If assistant recognizes field of this node.
24. Add the following message in the response text field:

Just to confirm, you want to cancel order $ordernumber?

![Shows the node that responds when the user does provide a valid order number.](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/gs-ass-add-number-provided.png)
25. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/close.png) to close the edit view.

You must add child nodes that check for the user's response to your confirmation question.
26. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon on the Number provided node, and then select Add child node.
27. Type yes into the If assistant recognizes field of this node.
28. Add the following message in the response text field:

OK. The order $ordernumber is canceled.
[Advanced Setup](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/advancedLanding.png?raw=true)





 On-premises vs Cloud Destinations 

The first question to answer when creating your destination is where the resource resides that you need to connect to.



 On-premises Destination 

The on-premises destination is for the use case where an application in the public space needs access to a restricted resource located on-premises. ![On Premises destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/onPremDestination.png?raw=true)





 Cloud Destination 

The cloud destination is for the use case where an application located in a restricted network needs access to a resource that is available in a public space. ![Reverse Destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/reverseDestination.png?raw=true)







 Defining your Destination 

For both types of destinations, the following information is required:



* Resource Hostname: This is the IP or hostname of the resource you need to connect to.
* Resource Port: This is the port that your resource is listening on.
* Protocol: This is the type of connection your application will be making. See the table below for the various [protocol options](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destprotocols-options).
[Advanced Setup](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/advancedLanding.png?raw=true)





 On-premises vs Cloud Destinations 

The first question to answer when creating your destination is where the resource resides that you need to connect to.



 On-premises Destination 

The on-premises destination is for the use case where an application in the public space needs access to a restricted resource located on-premises. ![On Premises destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/onPremDestination.png?raw=true)





 Cloud Destination 

The cloud destination is for the use case where an application located in a restricted network needs access to a resource that is available in a public space. ![Reverse Destination](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/reverseDestination.png?raw=true)







 Defining your Destination 

For both types of destinations, the following information is required:



* Resource Hostname: This is the IP or hostname of the resource you need to connect to.
* Resource Port: This is the port that your resource is listening on.
* Protocol: This is the type of connection your application will be making. See the table below for the various [protocol options](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destprotocols-options).
[Close](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/close.png) to close the edit view.

Now, add child nodes that either ask for the order number or get confirmation from the user that she wants to cancel an order with the detected order number.
8. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob.png) icon on the cancel_order node, and then select Add child node.

![Shows the menu on the #cancel_order node with the Add child node menu option selected.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-add-child-to-cancel.png)
9. Add a label to the node to distinguish it from other child nodes you will be adding. In the name field, add Ask for order number. Type true into the If assistant recognizes field of this node.
10. Add the following message in the response text field:

What is the order number?

![Shows the Ask for order number node details.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-ask-for-order-number.png)
11. Click !
[Close](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/close.png) to close the edit view.

Now, add child nodes that either ask for the order number or get confirmation from the user that she wants to cancel an order with the detected order number.
8. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon on the cancel_order node, and then select Add child node.

![Shows the menu on the #cancel_order node with the Add child node menu option selected.](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/gs-ass-add-child-to-cancel.png)
9. Add a label to the node to distinguish it from other child nodes you will be adding. In the name field, add Ask for order number. Type true into the If assistant recognizes field of this node.
10. Add the following message in the response text field:

What is the order number?

![Shows the Ask for order number node details.](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/gs-ass-ask-for-order-number.png)
11. Click !