vania-janet/multiturn-rag-retrieval-data huggingface dataset:
cloudbaseinit.plugins.common.sethostname.SetHostNamePlugin,
cloudbaseinit.plugins.windows.createuser.CreateUserPlugin,
cloudbaseinit.plugins.windows.extendvolumes.ExtendVolumesPlugin,
cloudbaseinit.plugins.common.setuserpassword.SetUserPasswordPlugin,
cloudbaseinit.plugins.common.localscripts.LocalScriptsPlugin
7. Modify the Unattend.xml file in C:Program FilesCloudbase SolutionsCloudbase-InitconfUnattend.xml to set PersistAllDeviceInstalls to false.
8. Run Sysprep by using the following command:

C:WindowsSystem32SysprepSysprep.exe /oobe /generalize /shutdown "/unattend:C:Program FilesCloudbase SolutionsCloudbase-InitconfUnattend.xml"

If you are customizing a virtual server to migrate from the Classic infrastructure, return to [Migrating a virtual server from the classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-migrate-vsi-to-vpcmigrate-customize-image-vpc) and continue completing migration steps.







 Uploading the custom image 

Upload your image to IBM Cloud Object Storage. On the Objects page of your IBM Cloud® Object Storage bucket, click Upload. You can use the Aspera high-speed transfer plug-in to upload images that are larger than 200 MB. For more information about uploading to IBM Cloud Object Storage, see [Upload data](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-upload).





 Next steps
[Genesys create trunk](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/phone-genesys-create-trunk.png)
5. Under Outbound, scroll to the SIP Servers or Proxies section. Specify the following information:



* In the Hostname or IP Address field, type the SIP URI (not including sips:) from your Watson Assistant phone integration settings.
* In the Port field, type 5061.



Click the + button.

Currently, SIPS and digest authentication are supported.

![Genesys create trunk](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/phone-genesys-create-trunk.png)
6. Under SIP Access Control, add the IP addresses for the data center where your assistant is located:



 Data center IP addresses 

 US-South 67.228.108.82 <br>169.63.5.162 <br>150.239.30.146 
 US-East 52.116.100.158 <br>169.61.70.162 <br>169.59.136.194 
 EU-DE 161.156.178.162 <br>169.50.56.146 <br>149.81.86.82 
 EU-GB 158.176.120.162 <br>141.125.102.34 <br>158.175.99.34 
 AU-SYD 168.1.47.2 <br>135.90.86.50 <br>168.1.106.130 
 JP-TOK 165.192.69.82 <br>128.168.105.178 <br>161.202.149.162 



7. Under Identity, specify the following information:



* Toggle the Address Omit + Prefix switch to Disabled.

!
EU-GB 158.176.120.162 <br>141.125.102.34 <br>158.175.99.34 
 AU-SYD 168.1.47.2 <br>135.90.86.50 <br>168.1.106.130 
 JP-TOK 165.192.69.82 <br>128.168.105.178 <br>161.202.149.162 



7. Under Identity, specify the following information:



* Toggle the Address Omit + Prefix switch to Disabled.

![Disable address omit + prefix](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/phone-genesys-address-omit-disabled.png)



8. Under Media, remove Opus from the Preferred Codec List. Click Select a Codec and then select g729 to add it to the list. Leave PCMU as the first item in the list.

![Genesys select codec](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/phone-genesys-select-codec.png)
9. Under Protocol



* In the Header/Invite section, toggle the Conversation Headers switch to Enabled
* Enable Take Back and Transfer.



10. Click Save External Trunk.
11. Under Sites, select the existing site you want to use this trunk with. To create a new site, specify a name and location and click Create.
12. Click Number plans. Create a new number plan and specify the following information:



* In the Number Plan Name field, type a descriptive name (for example, Watson).
* For Match type, select E. 164 Number List.
* In the Numbers field, type a number in the Start and End fields.
* Reviewing the usage summary page. Use IBM Log Analysis instead.



To migrate from Voice Agent with Watson to the Watson Assistant SMS integration, complete the following step:



1. Do one of the following things:



* If your Voice Agent with Watson service instance uses an SMS service provider other than Twilio or IntelePeer, you cannot continue to use it. You must create an SMS account with Twilio or IntelePeer first. Complete the [Before you begin - Twilio](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-smsdeploy-sms-service-setup-twilio) or [Before you begin - IntelePeer](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-smsdeploy-sms-service-setup-intelepeer) steps to create the account. Next, set up the integration.
* If your Voice Agent with Watson service instance uses Twilio or IntelePeer as its SMS provider, you can go directly to [Set up the integration - Twilio](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-smsdeploy-sms-setup-twilio) or [Set up the integration - IntelePeer](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-smsdeploy-sms-setup-intelepeer).
3. An admin username and apikey downloaded in a platformApiKey.json file
4. An application username and apikey downloaded in an apiKey.json file



* You can consult Appendix 1 at the end of this tutorial for how to get these files if you don't have them.



5. A JMS application



* This tutorial requires a JMS application to successfully complete it. We recommend you follow the tutorial detailed in Appendix 2 in order to ensure you have a suitable JMS application for this tutorial.



6. IBM's JDK



* You will need a Java JDK to complete this tutorial. It is recommended that you use the IBM JDK. This JDK contains support for modern encryption types and higher levels of security, which are needed for this tutorial. You will make use of java, javac and ikeycmd tools. If you do not have these commands, follow the steps in Appendix 3 at the end of this tutorial to download and install the IBM JDK. If you are running this tutorial on Mac OSX, there are instructions later for using keytool instead of ikeycmd.



7. IBM MQ Client



* To complete this tutorial you will need the IBM MQ command line tool runmqsc installed and exported to your PATH. If you do not have this command, you can get it by installing the IBM MQ Client. Appendix 4 at the end of this tutorial details how to do this.









 Securing Applications with Standard (One Way) TLS 

Standard TLS authentication ensures that a client can only talk to trusted queue managers, while also encrypting the messages travelling between the queue manager to the client.

In this section of the document, you will first demonstrate an existing, un-secure connection between a client and a queue manager, and then transform it into a TLS enabled, secure connection.

After enabling TLS on the queue manager's channel, the JMS application will need to be configured to trust the queue manager before it can communicate with it. First you will export the public part of the queue manager's security certificate. This part of the certificate is known as a public key.
[Performing cryptographic operations with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-apiset-up-grep11-api)



* [Retrieving your IBM Cloud credentials](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-apiretrieve-grep11-credentials)
* [Generating a GREP11 API request](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-apiform-grep11-api-request)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-apiset-up-grep11-api-next-steps)



[Enabling the second layer of authentication for EP11 connections - Standard Plan only](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11enable-authentication-ep11)



* [Security and availability best practices for enabling mutual TLS authentication](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11enable-authentication-ep11-security-best-practices)
* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11enable-authentication-ep11-prerequisites)
* [Step 1: Configure the administrator signature key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-authentication-ep11enable-authentication-ep11-step1-signature)
[Genesys select codec](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/phone-genesys-select-codec.png)
9. Under Protocol, enable Take Back and Transfer.
10. Click Save External Trunk.
11. Under Sites, select the existing site you want to use this trunk with. To create a new site, specify a name and location and click Create.
12. Click Number plans. Create a new number plan and specify the following information:



* In the Number Plan Name field, type a descriptive name (for example, Watson).
* For Match type, select E. 164 Number List.
* In the Numbers field, type a number in the Start and End fields. This does not need to be a real number; you can make up any number to use as an identifier to assign to Watson. Specify the same number in both fields.

To create a PSTN number you can give to your clients, you must create a Direct Inward Dialing (DID) or Bring Your Own Carrier (BYOC) number. For more information about how to do this, see the Genesys documentation.
* 

1. In the Classification field, type a classification name (for example, Watson).





Click Save Number Plans.

![Genesys number plan](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/phone-genesys-number-plan.png)
13. Click Outbound Routes. You can either edit the default outbound route or create a new one. Specify the following information:



* In the External Trunks field, click Select External Trunks. Select the trunk you created for Watson Assistant.
* In the Classifications field, add the applicable classifications.
cr.expiration = time.Now().Add((time.Duration(iamToken.ExpiresIn - 60))* time.Second)

return nil
}

// Generating a GREP11 API function call

// The following IBM Cloud items need to be changed prior to running the sample program
const address = "<grep11_server_address>:<port>"

var callOpts = []grpc.DialOption{
grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{})),
grpc.WithPerRPCCredentials(&util.IAMPerRPCCredentials{
APIKey: "<ibm_cloud_apikey>",
Endpoint: "https://iam.cloud.ibm.com",
}),
}

conn, err := grpc.Dial(address, callOpts...)
if err != nil {
panic(fmt.Errorf("Could not connect to server: %s", err))
}
defer conn.Close()

cryptoClient := pb.NewCryptoClient(conn)

rngTemplate := &pb.GenerateRandomRequest{
Len: (uint64)(ep11.AES_BLOCK_SIZE),
}

// Generate 16 bytes of random data for the initialization vector
rng, err := cryptoClient.GenerateRandom(context.Background(), rngTemplate)
if err != nil {
panic(fmt.Errorf("GenerateRandom Error: %s", err))
}
iv := rng.Rnd[:ep11.AES_BLOCK_SIZE]
fmt.Println("Generated IV")
Show more

In the example, update the following variables:



* Replace <grep11_server_address> and <port> with the value of your GREP11 API endpoint.
The Media Relay will reattempt to send the request."
}
],
"realtime_transport_network_summary": {
"inbound_stream": {
"average_jitter": 4,
"canonical_name": "b74f3689-1ae8-4a0a-bde3-adf5b488553e",
"maximum_jitter": 18,
"packets_lost": 0,
"packets_transmitted": 952,
"tool_name": ""
},
"outbound_stream": {
"average_jitter": 0,
"canonical_name": "voice.gateway",
"maximum_jitter": 0,
"packets_lost": 0,
"packets_transmitted": 838,
"tool_name": "IBM Voice Gateway/1.0.7.0"
}
},
"call": {
"start_timestamp": "2021-10-12T20:54:02.591Z",
"stop_timestamp": "2021-10-12T20:54:20.375Z",
"milliseconds_elapsed": 17784,
"outbound": false,
"end_reason": "assistant_hangup",
"security": {
"media_encrypted": false,
"signaling_encrypted": false,
"sip_authenticated": false
}
},
"session_initiation_protocol": {
"invite_arrival_time": "2021-10-12T20:54:00.565Z",
"setup_milliseconds": 2026,
"headers": {
"call_id": "17465345_115257202@10.90.150.99",
"from_uri": "sip:+18885550456@pstn.twilio.com",
Connecting to on-premises queue manager using IBM Cloud Secure Gateway 

In order to connect an IBM MQ on Cloud queue manager to an on-premises queue manager via the IBM Secure Gateway there are several steps to follow:



1.  Create an MQ cloud queue manager (or use an existing one).
2.  Create an on-premises MQ queue manager (or use an existing one).
3.  Create a cloud based IBM Secure Gateway, install its client on-premises and configure the Secure Gateway to link the two Queue Managers.
4.  Create channels to pass messages between the two Queue Managers.
5.  Set up TLS security by giving the local queue manager the certificates to permit a trust relationship between the two queue managers.



[Download full instructions here](http://ibm.biz/BdqDUx) in PDF format.

![alt text](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_connect_onprem2.png)
For more information about the Secure Gateway service, and how to set it up, see [About Secure Gateway](https://cloud.ibm.com/docs/SecureGateway?topic=securegateway-getting-started-with-sg).



 Using the secure gateway with your APIs 

When you have configured the gateway, you can use it with your APIs.

To use your secure gateway with APIs, complete the following steps.



1. Create your API and Product. When you create the API, be sure to select the Add a Product option to create a new Product at the same time.

IMPORTANT: Do not publish the Product yet.

The API is displayed in the Design View.
2. Click Assemble.
3. Click the Invoke policy to open the Invoke palette.

RESTRICTION: Logic switches (for example, Switch, Operation Switch, and If) cannot be used with APIs that use a secure gateway.
4. IMPORTANT: Do not select the Access URL through Secure Gateway check box.

This check box is for a deprecated feature that is not supported for production and is subject to removal at any time. Instead, you will provide an address for the Secure Gateway URL directly in the next step.
5. In the URL field, update the target-url with the Cloud host name and port number, as in: Cloud-host:Port, where the cloud host will be the Secure Gateway server specified in the secure gateway service, and the port will be assigned once you create the destination. For example:



cap-sg-prd-5.securegateway.appdomain.cloud:18579



6. Click **Save![Save icon](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/icon_save.png).
7. Click All APIs > Products and select the Product that you created earlier.
8. Click Publish to stage the Product to a selected Catalog.
9.
curl -X POST --header "Authorization: Bearer {token}" "{url}/v1/register_callback?callback_url=http://{user_callback_path}/results&user_secret=ThisIsMySecret"
2. The service attempts to validate, or allowlist, the callback URL if it is not already registered by sending a GET request to the callback URL. The service passes a random alphanumeric challenge string via the challenge_string query parameter of the request. The request includes an Accept header that specifies text/plain as the required response type.

If the call to the register_callback method included a user secret, the GET request from the service also includes an X-Callback-Signature header that specifies the HMAC-SHA1 signature of the challenge string. The service calculates the signature by using the user secret as the key.

GET http://{user_callback_path}/results?challenge_string=n9ArPGMQ36Hiu7QC
header: X-Callback-Signature {HMAC-SHA1_signature}
3. You respond to the GET request from the service with status code 200. Include the challenge string that was sent by the service in the response. Include the string in plain text in the body of the response, and set the Content-Type response header to text/plain.

If the initial POST request included a user secret, you can calculate an HMAC-SHA1 signature of the challenge string by using the secret as the key. If the GET request was sent by the service, the signature matches the value specified by the X-Callback-Signature header.

response code: 200 OK
body: n9ArPGMQ36Hiu7QC
4. The service checks whether the challenge string is returned in the body of the response to its GET request. If it is, the service allowlists the callback URL and responds to your original POST request with status code 201. The body of the response includes a JSON object with a status field that has the value created and a url field that has the value of your callback URL.

response code: 201 Created
body: {
Click Browse to select the common_cacert file and click Next.
6. Under the Certificate Store page, select Place all certificates in the following store and click browse to select the Trusted Root Certificate Authorities, and then click Next.
7. On the Completing the Certificate Import Wizard page, click Finish.
8. After you transfer the CA cert to the truststore successfully, you need to create a secure session in PCOMM. Under the Host Definition tab of the Link Parameters configuration, enter the IP address or the hostname of your z/OS virtual server instance with port 992.
9. Under the Security Setup tab of the Link Parameters configuration, check the Enable Security box.



The default user ID is IBMUSER and the password is the one you configured in the previous step. Then, you can interact with the z/OS in the TSO native mode, by using the Interactive System Productivity Facility (ISPF), or by using z/OS UNIX shell and utilities. For more information, see [Interacting with z/OS: TSO, ISPF, and z/OS UNIX interfaces](https://www.ibm.com/docs/en/zos-basic-skills?topic=concepts-interacting-zos-tso-ispf-zos-unix-interfaces).

The unsecured port 23 for 3270 connection is closed. You must use the secured port 992.

The VSI server certificate only contains the private IP address information of the z/OS virtual server instance.

Optionally, you can use the IP address of the floating IP as part of the accepthostname argument. For example:

c3270 -cafile <my local dir>/common_cacert -port 992 -accepthostname <floating ip> <vsi ip address>







 Using IBM Host On-Demand 

If you want to import the CA certificate by using IBM Host On-Demand, run the following commands:



1. Download the certificate file from the z/OS system.

scp ibmuser@<vsi ip address>:/u/ibmuser/common_cacert ./Downloads/common_cacert
2. Import the downloaded certificate.
Access Control (AC) [AC-20 Use of External Information Systems](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-20) 
 Security Assessment and Authorization (CA) [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) 







 Next steps 



* [Connectivity to public internet](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-to-internet)
* [Administering a queue manager using IBM MQ Web Console](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_mqweb)
* [Administering a queue manager using IBM MQ Explorer](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_mqcliexp)
* [Administering a queue manager using runmqsc from an IBM MQ client](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_mqcliexp)









 Securing remote administration 

After configuring TLS security on the required channels, you will need to properly establish a connection. This can be done in two ways:



* [MQ explorer](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_remote_ssl_exp_admin)
* [runmqsc](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_remote_ssl_runmqsc_admin)







 Application connections in C MQI&JMS programs 

To securely connect to an MQ on Cloud queue manager using "C MQI" and "JMS" applications, please refer to the following document:



* [Connections in C MQI&JMS programs](https://cloud.ibm.com/docs/mqcloud?topic=mqcloud-mqoc_connect_app_ssl)







 Enabling TLS between a client and a queue manager 

If TLS security has not been enabled on a queue manager, the following document explains how to correctly configure a queue manager. This walkthrough covers an "anonymous" one-way TLS connection as well as a "mutual" two-way connection.
Defect fix: French Canadian voice now handles numeric times properly
: Defect fix: The French Canadian voices now pronounce times like 19:41 correctly. Previously, the voices were omitting elements of the time in the synthesized audio.

Defect fix: Japanese voice no longer inserts unexpected audio
: Defect fix: The Japanese voice no longer inserts unexpected audio in speech synthesis results. Previously, additional audio was inserted in certain cases.

Defect fix: Update Korean phonetic symbols in documentation
: Defect fix: In the documentation for Korean SPR symbols, two-character symbols for consonants are now enclosed in single quotes, making them a single symbol. Previously, they were shown as two separate symbols, without enclosing quotes. For more information, see [Consonants (Korean)](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-koSymbols-newkoConsonants-new).

Documentation updates for IBM SPR symbols
: The overview documentation for IBM SPR symbols has been updated to clarify the use of multi-character symbols. For more information, see [Speech sound symbols](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-symbolsintro-SPRs-symbols)).

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python (CVE-2020-10735)](https://www.ibm.com/support/pages/node/6988073)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to phishing attacks in Python (CVE-2021-28861)](https://www.ibm.com/support/pages/node/6988075)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Pypa Setuptools (CVE-2022-40897)](https://www.ibm.com/support/pages/node/6988077)
* IPSec Encryption / Encryption Algorithm: AES-256
* Authentication Algorithm: SHA1
* DH-Group (if using PF-Secrecy): Group 5
* Security Association Lifetime (seconds): 3600 seconds





After receipt of your request, IBM Cloud technicians will open the appropriate firewall ports and allowlist the provided IP address. Communication and resolution to the request will be made through the IBM Cloud Support case ticket.

Zoom

![Public network access to IBM Cloud through a VPN](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/connecting/images/public_connection_vpn.png)

Figure 3. Public network access to IBM Cloud through a VPN