vania-janet/multiturn-rag-retrieval-data huggingface dataset:
address SL19 10.3.64.0/20;
address SL16 10.2.144.0/20;
address SL17 10.2.48.0/20;
address SL14 10.1.208.0/20;
address SL15 10.2.80.0/20;
address SL12 10.2.112.0/20;
address SL13 10.2.160.0/20;
address SL10 10.2.32.0/20;
address SL11 10.2.64.0/20;
address SL_PRIV_MGMT 10.87.40.36/32;
address SL_PUB_MGMT 169.62.79.21/32;
address-set SERVICE {
address SL8;
address SL9;
address SL4;
address SL5;
address SL6;
address SL7;
address SL1;
address SL2;
address SL3;
address SL20;
address SL18;
address SL19;
address SL16;
address SL17;
address SL14;
address SL15;
address SL12;
address SL13;
address SL10;
address SL11;
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
queue-size 2000; Warning: 'queue-size' is deprecated
timeout 20;
}
land;
}
}
}
policies {
from-zone SL-PRIVATE to-zone SL-PRIVATE {
policy Allow_Management {
match {
source-address any;
destination-address [ SL_PRIV_MGMT SERVICE ];
application any;
}
then {
permit;
flexible-vlan-tagging;
native-vlan-id 764;
unit 0 {
vlan-id 764;
family inet {
address 161.202.136.77/29;
}
family inet6 {
address 2401:c900:1001:0210:0000:0000:0000:000a/64;
}
}
}
fxp0 {
unit 0;
}
lo0 {
unit 0 {
family inet {
filter {
input PROTECT-IN;
}
address 127.0.0.1/32;
}
}
}
}
firewall {
filter PROTECT-IN {
term PING {
from {
destination-address {
161.202.136.77/32;
10.129.33.87/32;
}
protocol icmp;
}
then accept;
}
term SSH {
from {
destination-address {
161.202.136.77/32;
10.129.33.87/32;
}
protocol tcp;
destination-port ssh;
}
then accept;
}
term WEB {
from {
destination-address {
161.202.136.77/32;
10.129.33.87/32;
}
protocol tcp;
port 8443;
}
then accept;
}
term DNS {
from {
protocol udp;
source-port 53;
}
then accept;
}
}
}
routing-options {
static {
route 166.9.0.0/16 next-hop 10.129.33.65;
route 0.0.0.0/0 next-hop 161.202.136.73;
route 161.26.0.0/16 next-hop 10.129.33.65;
[Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization vDC Distributed Firewall: Configure Rules ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/11f96f96f8f4b60cf6f3fa4d904856a2c4528bc2/icons/checkmark-icon.svg) 
 Organization vDC Distributed Firewall: View Rules !
If you want to use or connect from any other Azure service, add to the allow rule the CIDR range that is associated with those respective service endpoints.
To retrieve the CIDR range for various Azure services:



* Follow the instructions from [here](https://docs.microsoft.com/en-us/powershell/module/az.network/get-aznetworkservicetag?view=azps-7.5.0).
* Add the CIDR ranges as an allow rule as needed.



The Azure Blob Storage endpoints do not have a single IP address that is associated with them. Adding the endpoint hostname to the allow list can give inconsistent results.
curl --connect-timeout 10 <loadbalancer_IP>:80
4. In a text editor, create a low-order Pre-DNAT policy called allowlist.yaml to allow traffic from your system's IP to the NLB IP address and port. Using the values from your cheat sheet, replace <loadbalancer_IP> with the public IP address of the NLB and <client_address> with the public IP address of your system's source IP. If you can't remember your system IP, you can run curl ifconfig.co.

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
name: allowlist
spec:
applyOnForward: true
preDNAT: true
ingress:
- action: Allow
destination:
nets:
- <loadbalancer_IP>/32
ports:
- 80
protocol: TCP
source:
nets:
- <client_address>/32
selector: ibm.role=='worker_public'
order: 500
types:
- Ingress
Show more
5. Apply the policy.



* Linux:

calicoctl apply -f filepath/allowlist.yaml
* Windows and OS X:

calicoctl apply -f filepath/allowlist.yaml --config=filepath/calicoctl.cfg



Your system's IP address is now allowed.
6. Using the value from your cheat sheet, verify that you now can access the public NLB IP address.

curl --connect-timeout 10 <loadbalancer_IP>:80
7. If you have access to another system that has a different IP address, try to access the NLB from that system.

curl --connect-timeout 10 <loadbalancer_IP>:80

The connection times out because that system's IP address isn't allowed.



At this point, all traffic to the public node ports and NLB is blocked. Only traffic from your allowed system IP is allowed.
ibmcloud cbr rule-create my-rule-2 --service-name containers-kubernetes --service-instance CLUSTER-ID --zone-id NETWORK-ZONE-ID

The following example command creates a rule that allows all private network connections, but allows only resources in the allow-client-ip network zone to connect to the cluster over the public network. For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr rule-create --api-types crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --description "privateAccess=allowAll, publicAccess=oneIP" --service-name containers-kubernetes --service-instance CLUSTER-ID --context-attributes endpointType=private --context-attributes endpointType=public,networkZoneId=allow-client-ip





 Creating rules from the console 



1. [Review the available contexts](https://cloud.ibm.com/docs/openshift?topic=openshift-cbrcbr-overview) and determine the rules you want to create.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create).









 Limitations 



* After you create a rule, it might take up to 10 minutes for the rule to take effect.
* Red Hat OpenShift on IBM Cloud CBR rules that apply to all API types or the cluster API types must not reference network zones that contain IPv6 addresses. The APIs included in the cluster type don't support IPv6.
* If you add Red Hat OpenShift on IBM Cloud resources to private-only network zones, the APIs for getting and listing clusters are still accessible over the public network.
* Red Hat OpenShift on IBM Cloud CBR rules that apply to all API types or the cluster API types must not reference other services like IBM Cloud Object Storage or Key Protect
redundancy-group 1;
}
}
reth3 {
vlan-tagging;
redundant-ether-options {
redundancy-group 1;
}
}
}
firewall {
filter PROTECT-IN {
term PING {
from {
destination-address {
169.62.79.21/32;
10.87.40.36/32;
}
protocol icmp;
}
then accept;
}
term SSH {
from {
destination-address {
169.62.79.21/32;
10.87.40.36/32;
}
protocol tcp;
destination-port ssh;
}
then accept;
}
term WEB {
from {
destination-address {
169.62.79.21/32;
10.87.40.36/32;
}
protocol tcp;
port 8443;
}
then accept;
}
term DNS {
from {
protocol udp;
source-port 53;
}
then accept;
}
}
}
routing-options {
static {
route 166.9.0.0/16 next-hop 10.87.40.1;
route 0.0.0.0/0 next-hop 169.62.79.17;
route 161.26.0.0/16 next-hop 10.87.40.1;
route 10.0.0.0/8 next-hop 10.87.40.1;
}
}
Show more

The information in the following table represents the configuration above:



Table 1: Configuration information

 Interface name Interface function Redundant interface 

 ge-0/0/1 / ge-0/0/2 Gigabit ethernet interface for SL-PRIVATE transit VLAN on node 0 reth0 
 ge-0/0/3 / ge-0/0/4 Gigabit ethernet interface for SL-PUBLIC transit VLAN on node 0 reth1
ibmcloud cbr rule-create my-rule-1 --service-name containers-kubernetes --api-type crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --zone-id ZONE-ID

The following command creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID network zone can access the cluster. This rule includes both the cluster and management API types.

ibmcloud cbr rule-create my-rule-2 --service-name containers-kubernetes --service-instance CLUSTER-ID --zone-id NETWORK-ZONE-ID

The following example command creates a rule that allows all private network connections, but allows only resources in the allow-client-ip network zone to connect to the cluster over the public network. For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr rule-create --api-types crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --description "privateAccess=allowAll, publicAccess=oneIP" --service-name containers-kubernetes --service-instance CLUSTER-ID --context-attributes endpointType=private --context-attributes endpointType=public,networkZoneId=allow-client-ip





 Creating rules from the console 



1. [Review the available contexts](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-overview) and determine the rules you want to create.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create).









 Limitations 



* After you create a rule, it might take up to 10 minutes for the rule to take effect.
ibmcloud cbr rule-create my-rule-1 --service-name containers-kubernetes --api-type crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --zone-id ZONE-ID

The following command creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID network zone can access the cluster. This rule includes both the cluster and management API types.

ibmcloud cbr rule-create my-rule-2 --service-name containers-kubernetes --service-instance CLUSTER-ID --zone-id NETWORK-ZONE-ID

The following example command creates a rule that allows all private network connections, but allows only resources in the allow-client-ip network zone to connect to the cluster over the public network. For more information about this scenario, see [Setting up context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorial).

ibmcloud cbr rule-create --api-types crn:v1:bluemix:public:containers-kubernetes::::api-type:cluster --description "privateAccess=allowAll, publicAccess=oneIP" --service-name containers-kubernetes --service-instance CLUSTER-ID --context-attributes endpointType=private --context-attributes endpointType=public,networkZoneId=allow-client-ip





 Creating rules from the console 



1. [Review the available contexts](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uicbr-overview) and determine the rules you want to create.
2. Follow the steps to [create context-based restrictions in the console](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create).









 Limitations 



* After you create a rule, it might take up to 10 minutes for the rule to take effect.
acl20="32450627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule10 $webacl allow inbound tcp 0.0.0.0/0 0.0.0.0/0 --source-port-max 80 --source-port-min 80 --before-rule-id $acl20

Insert new outbound rules before the default outbound rule.

ibmcloud is network-acl-rule-add my_web_acl_rule200e $webacl deny outbound all 0.0.0.0/0 0.0.0.0/0 --before-rule-id $outrule
acl200e="11110627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule100e $webacl allow outbound all 0.0.0.0/0 10.10.20.0/24 --before-rule-id $acl200e
acl100e="22220627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule20e $webacl allow outbound tcp 0.0.0.0/0 0.0.0.0/0 --source-port-max 443 --source-port-min 443 --before-rule-id $acl100e
acl20e="33330627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule10e $webacl allow outbound tcp 0.0.0.0/0 0.0.0.0/0 --source-port-max 80 --source-port-min 80 --before-rule-id $acl20e
set system config-sync sync-map SYNC rule 2 action 'include'
set system config-sync sync-map SYNC rule 2 location 'firewall'
set system config-sync sync-map SYNC rule 3 action 'include'
set system config-sync sync-map SYNC rule 3 location 'vpn'
set system config-sync sync-map SYNC rule 4 action 'include'
set system config-sync sync-map SYNC rule 4 location 'interfaces tunnel'
set system config-sync sync-map SYNC rule 5 action 'include'
set system config-sync sync-map SYNC rule 5 location 'firewall'
set system config-sync sync-map SYNC rule 6 action 'include'
set system config-sync sync-map SYNC rule 6 location 'zone-policy'
set system config-sync sync-map SYNC rule 7 action 'include'
set system config-sync sync-map SYNC rule 7 location 'vpn'
set system config-sync sync-map SYNC rule 8 action 'include'
set system config-sync sync-map SYNC rule 8 location 'protocols static route'
set system config-sync sync-map SYNC rule 9 action 'include'
set system config-sync sync-map SYNC rule 9 location 'protocols static table'
set system config-sync sync-map SYNC rule 10 action 'include'
set system config-sync sync-map SYNC rule 10 location 'policy route'
set system config-sync sync-map SYNC rule 11 action 'include'
set system config-sync sync-map SYNC rule 11 location 'nat'
commit
save
Show more





 Associating and routing VLANs 

After the zones and firewall rules are set up on the Brocade vRouter (Vyatta), you must associate the VLANs to it and enable routing of the VLANs via the Brocade vRouter (Vyatta).



1. Log in to the IBM Cloud customer portal and click Network, Gateway Appliance and click the Brocade vRouter (Vyatta).
2.
Access control with context-based restrictions 

After you set up your IBM® Key Protect service instance, you can manage access by using the Key Protect support for [Context-based restrictions (CBR)](https://cloud.ibm.com/context-based-restrictions).



 Managing CBR settings 

[CBR](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) allows you to manage user and service access to network resources, including Virtual Private Cloud (VPC) references and Internet Protocol (IP) addresses linking your Key Protect resources.

You must be the account owner or have an access policy with the administrator role on all account management services in order to restrict access.





 Overview 

There are two parts in the instructions to restrict access, [Creating Zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createnetwork-zones-create), and [Creating Rules](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createcontext-restrictions-create-rules), each with multiple steps. First, create a zone with the appropriate details for network or resource definitions like VPC settings. Then, attach that zone to the resource to restrict access. There are two possible paths for achieving this goal: either using a RESTful [API](https://cloud.ibm.com/apidocs/context-based-restrictions), or with [Context-based restrictions](https://cloud.ibm.com/context-based-restrictions). Note that after creating or updating a zone or a rule it may take a few minutes for the change to take effect.

CBR rules do not apply to provisioning or deprovision processes.





 About Network Zones 

By creating network zones, you can create a list of allowed locations where an access request originates. A set of one or more network locations can be specified by IP addresses such as individual addresses, ranges or subnets, and VPC IDs. After you create a network zone, you can add it to a rule.



 Create Network Zones using the CBR API
ibmcloud is public-gateways

Example output

ID Name Status Floating IP VPC Zone
5d308ea5-9f32-43b3-aaae-194d5723a3e5 pgw-b9d45630-c053-11e9-b2f8-79328ce05e7e available 169.XX.XXX.XX test-vpc us-south-1
f8b95e43-a408-4dc8-a489-ed649fc4cfec pgw-18a3ebb0-b539-11e9-9838-f3f4efa02374 available 169.XX.XXX.XX prod us-south-1
2ba9a280-fffa-4b0c-bdca-7970f09f9b8a pgw-73b62bc0-b53a-11e9-9838-f3f4efa02374 available 169.XX.XXX.XX prod us-south-2
057ddef6-631f-4b22-89eb-1e99982a54fa pgw-64c5cae0-0be2-11ea-8f26-e1565e79a36c available 52.XX.XXX.XXX prod us-south-3
5. Get the [control plane CIDRs of the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/iam-firewall-ips). These CIDRs must also be added to your allowlist.
6. Log in to the [IBM Cloud console](https://cloud.ibm.com/).
7. From the menu bar, click Manage > Access (IAM), and select Users.
8. Select the user that you found in step 1 from the list.
9. From the User details page, go to the IP address restrictions section.
10.
rule-faacfd1f-454f-4e60-95d7-8fe01158840d - Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port
rule-c0314fad-f377-465e-9f16-fa5aa3d5ebbe - Check whether Virtual Servers for VPC instance has the minimum interfaces
rule-17b54156-373a-48f9-b340-a7e47acd87b6 - Check whether Virtual Servers for VPC instance doesn't have a floating IP
rule-1af31459-ec38-4a58-91b0-956a17a38954 - Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-4aead0cd-fe26-44f1-b552-8ffdbb86422a - Check whether Virtual Servers for VPC boot volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
rule-a99b5f58-98ef-4208-9a23-e4fa25115d79 - Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Bring Your Own Key (BYOK)
rule-df7323fd-0b20-493c-89fe-c0b287817c99 - Check whether Virtual Servers for VPC data volumes are enabled with customer-managed encryption and Keep Your Own Key (KYOK)
rule-6970e312-329d-44dc-b683-5ab14acd6a42 - Check whether Virtual Servers for VPC is provisioned from an encrypted image
rule-24e259fb-608e-486f-bb9d-99b78ae0383c - Check whether Virtual Servers for VPC instances are identifable by the workload they are running based on the Auto Scale for VPC instance group definition
If you can't or don't want to enable VRF, enable [VLAN spanning](https://cloud.ibm.com/docs/vlans?topic=vlans-vlan-spanningvlan-spanning). To perform this action, you need the Network > Manage Network VLAN Spanning[infrastructure permission](https://cloud.ibm.com/docs/containers?topic=containers-access-credsinfra_access), or you can request the account owner to enable it. To check whether VLAN spanning is already enabled, use the ibmcloud oc vlan spanning get --region <region>[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_vlan_spanning_get).

When you enable VRF or VLAN spanning for your account, network segmentation is removed for your clusters.

Review the following table to see your options for how to achieve network segmentation when you enable VRF or VLAN spanning for your account.



Network segmentation options

 Security feature Description 

 Set up custom network policies with Calico You can use the built-in Calico interface to [set up custom Calico network policies](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiesnetwork_policies) for your worker nodes. For example, you can allow or block network traffic on specific network interfaces, for specific pods, or services. To set up custom network policies, you must [install the calicoctl CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-network_policiescli_install). 
 Support for IBM Cloud network firewalls Red Hat OpenShift on IBM Cloud is compatible with all [IBM Cloud firewall offerings](https://www.ibm.com/cloud/network-security). For example, you can set up a firewall with custom network policies to provide dedicated network security for your standard cluster and to detect and remediate network intrusion.
[Provision your service from the IBM Cloud Catalog](https://cloud.ibm.com/catalog/services/databases-for-mysql) and choose your IP addresses from the [Cloud Databases Allowlist page](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-allowlisting).



1. Run the following example command to create a network that includes a range of allowed IP addresses.

ibmcloud cbr zone-create --addresses=169.38.95.127/27,169.38.121.159/28,169.38.132.127/25,169.38.136.255/26,169.38.73.151/29,169.38.105.79/29,10.162.8.127/26,10.163.20.127/25,10.162.115.103/29,10.162.132.79/29 --name=tutorial_zone
2. Verify the network zone was created.

ibmcloud cbr zones







 Step 2: Creating your CBR rule in the CLI 



1. After you create your network zone (allowlist), create a context-based restrictions rule and add the network zone you created in the previous step. The following example creates a rule that uses the data-plane API type. Replace ZONE-ID with the ID of the tutorial_zone network zone that you created in [Step 1](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-cbr-tutorialcreating-your-network-zone).

ibmcloud cbr rule-create --enforcement-mode enabled --context-attributes networkZoneId=<ZONE-ID> --resource-group-id <RESOURCE_GROUP_ID> --service-name databases-for-mysql --service-instance <SERVICE-INSTANCE> --api-types crn:v1:bluemix:public:context-based-restrictions::::api-type:data-plane --description <DESCRIPTION>

Understanding the command options.

--context-attributes (string)
[Provision your service from the IBM Cloud Catalog](https://cloud.ibm.com/catalog/services/databases-for-mysql) and choose your IP addresses from the [Cloud Databases Allowlist page](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-allowlisting).



1. Run the following example command to create a network that includes a range of allowed IP addresses.

ibmcloud cbr zone-create --addresses=169.38.95.127/27,169.38.121.159/28,169.38.132.127/25,169.38.136.255/26,169.38.73.151/29,169.38.105.79/29,10.162.8.127/26,10.163.20.127/25,10.162.115.103/29,10.162.132.79/29 --name=tutorial_zone
2. Verify the network zone was created.

ibmcloud cbr zones







 Step 2: Creating your CBR rule in the CLI 



1. After you create your network zone (allowlist), create a context-based restrictions rule and add the network zone you created in the previous step. The following example creates a rule that uses the data-plane API type. Replace ZONE-ID with the ID of the tutorial_zone network zone that you created in [Step 1](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-cbr-tutorialcreating-your-network-zone).

ibmcloud cbr rule-create --enforcement-mode enabled --context-attributes networkZoneId=<ZONE-ID> --resource-group-id <RESOURCE_GROUP_ID> --service-name databases-for-mysql --service-instance <SERVICE-INSTANCE> --api-types crn:v1:bluemix:public:context-based-restrictions::::api-type:data-plane --description <DESCRIPTION>

Understanding the command options.

--context-attributes (string)