vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The Direct Link product is meant for your remote networks to be able to privately communicate with your IBM Cloud infrastructure.
6. Direct Link Dedicated only: After you confirm that your circuit reached the Direct Link PoP, you must place an order with the service provider to extend service to the Direct Link Demarcation point.

IBM will supply a Letter of Authorization/Connecting Facility Assignment (LOA/CFA) with port information to order the cross connect.
7. Be aware if you use Classic IaaS, that infrastructure uses the 10.x.x.x network and you cannot overlap your on-premises hosts within IBM Cloud or with the IBM Cloud services network (10.0.0.0/14, 10.198.0.0/15, and 10.200.0.0/14).
8. Virtual Routing and Forwarding (VRF) is not compatible with IBM Cloud SSL and IPsec VPN services. An alternative is to use the Direct Link itself for management of your servers, or run your own VPN solution (such as a Vyatta) that can be configured with different types of VPNs. Your account must be migrated to VRF before you can enable a Direct Link Classic virtual connection. Failure to migrate account can result in packet loss interruption.

After migrating to a VRF, SSL VPN typically works when a VPN connection is made to the same data center location as the compute that's being accessed, but does not allow access globally.
9. Direct Link Cloud requires Border Gateway Protocol (BGP) to implement routes to a customer's remote network.
10. If you choose to use auto-assign IP addressing, IBM will assign two IP addresses from this network, 169.254.0.0/16 for the BGP point-to-point addresses.

IBM will use the first IP address in the /30 subnet. The customer can use the second IP address from this subnet.
IBM Cloud will not allow customers to backhaul traffic between their remote sites across the IBM Cloud backbone.

The Direct Link product is meant for your remote networks to be able to privately communicate with your IBM Cloud infrastructure.
6. After you confirm that your circuit reached the Direct Link PoP, you must place an order with the service provider to extend service to the Direct Link Demarcation point.

IBM will supply a Letter of Authorization/Connecting Facility Assignment (LOA/CFA) with port information to order the cross connect.
7. Be aware if you use Classic IaaS, that infrastructure uses the 10.x.x.x network and you cannot overlap your on-premises hosts within IBM Cloud or with the IBM Cloud services network (10.0.0.0/14, 10.198.0.0/15, and 10.200.0.0/14).
8. Virtual Routing and Forwarding (VRF) is not compatible with IBM Cloud SSL and IPsec VPN services. An alternative is to use the Direct Link itself for management of your servers, or run your own VPN solution (such as a Vyatta) that can be configured with different types of VPNs.

After migrating to a VRF, SSL VPN typically works when a VPN connection is made to the same data center location as the compute that's being accessed, but does not allow access globally.
9. Direct Link Cloud requires Border Gateway Protocol (BGP) to implement routes to a customer's remote network.
10. If you choose to use auto-assign IP addressing, IBM will assign two IP addresses from this network, 169.254.0.0/16 for the BGP point-to-point addresses.

IBM will use the first IP address in the /30 subnet. The customer can use the second IP address from this subnet.
These local resolving name servers are on the IBM private network, so they don't use up public bandwidth.



* Authoritative name servers



* ns1.softlayer.com 67.228.254.4
* ns2.softlayer.com 67.228.255.5



* Resolving name servers



* rs1.service.softlayer.com 10.0.80.11
* rs2.service.softlayer.com 10.0.80.12





* What IBM Cloud DNS servers will answer for my secondary domains?

The IBM Cloud Anycast, IPv-enabled authoritative DNS Servers will answer for your secondary domains. These servers are found at the following addresses:



* ns1.softlayer.com
* ns2.softlayer.com



* Which IP addresses are used for my secondary domain zone transfers?

Transfers for your secondary domains come from one of the following four IP addresses:



* 66.228.118.67
* 67.228.119.235
* 208.43.119.235
* 12.96.161.249



* What is the difference between the public and private name servers?

Our public name servers act as authoritative name servers for domain names that reside in our DNS servers and are managed through the [IBM Cloud console](https://%7BDomainName%7D/). These servers answer and resolve domain names to your IP address for the general internet population.

Our resolving name servers are located on the private network and act as DNS resolvers for your server. The private resolvers query the internet's root name servers for domain lookups. For example, sending mail from your server requires an NSlookup of the destination domain name. The private DNS servers resolve this information over the private network to keep your bandwidth usage down, reduce the load on the authoritative servers, and offer quick resolution. Private network resolvers are a convenience service for our customers.
* What are my name server options?

With a bare metal server there are four typical options for name servers:



* Use your domain name registrar's name servers to manage your domain names.
* Use IBM Cloud name servers to manage your domain names.
"warnings_and_errors": [
{
"code": "CWSMR0033W",
"message": "CWSMR0033W: The inbound RTP audio stream jitter of 43 ms exceeds the maximum jitter threshold of 30 ms."
},
{
"code": "CWSMR0070W",
"message": "CWSMR0070W: A request to the Watson Speech To Text service failed for the following reason = Unexpected server response: 403, response headers = {"strict-transport-security":"max-age=31536000; includeSubDomains;","content-length":"157","content-type":"application/json","x-dp-watson-tran-id":"23860083-88b6-41d7-9130-30bbfebe647e","x-request-id":"23860083-88b6-41d7-9130-30bbfebe647e","x-global-transaction-id":"6c764df3-81db-41bb-a14f-62384facffca","server":"watson-gateway","x-edgeconnect-midmile-rtt":"1","x-edgeconnect-origin-mex-latency":"28","date":"Thu, 13 May 2021 20:31:12 GMT","connection":"keep-alive"}, response body = {"code":403,"trace":"23860083-88b6-41d7-9130-30bbfebe647e","error":"Forbidden","more_info":"https://cloud.ibm.com/docs/watson?topic=watson-forbidden-error](https://cloud.ibm.com/docs/watson?topic=watson-forbidden-error)"}, x-global-transaction-id = 6c764df3-81db-41bb-a14f-62384facffca.
For example, if you are using a VPC instance or a VPC Kubernetes cluster, a security group might be blocking access. Ensure your security groups allow traffic from your VPC to the CSE endpoint IP and port.
4. Verify that your endpoint is configured correctly and the on-prem application is listening on the configured Destination FQDN or IP and Destination Port. If your on-prem application is using a container, its IP address might have changed. For more information, see [Why can't I reach my endpoint from IBM Cloud](https://cloud.ibm.com/docs/satellite?topic=satellite-ts-connector-cannot-reach).
5. If you are running multiple agents to the same Connector, ensure all agents have network access to the endpoint. Each connection request is routed to a random agent and therefore all agents must have network connectivity to the all the on-prem endpoints. There is no mechanism to target an individual agent for a specific Connector.
Approximate latency: Latency is approximately 1.5 ms within the local area (data centers with the same three-letter prefix, such as DAL, AMS, MEL). See [Looking Glass](http://lg.softlayer.com/) for live PoP-to-PoP (P2P) location latency measurements.

IBM colocation services: None.

Redundancy: IBM Cloud does not provide redundancy as part of the product. To establish redundant connectivity, customer must acquire two connections on diverse cross connect routers (XCRs) and configure BGP on each Direct Link on Classic connection as they prefer. Examples include options such as: prefer Lowest MED, prefer highest local-preference, or prefer shorter AS paths.

Local and global routing options: The default routing option is Local routing. It provides access to data centers within the same market as the Direct Link PoP (denoted, for example, as DAL, AMS, or MEL). The Global routing option is required as an add-on to connect your IBM Cloud resources to other IBM Cloud resources in data centers outside the local market. It is used to share workloads between IBM Cloud resources (for example Dallas to Ashburn, or Dallas to Frankfurt).





 The Direct Link Dedicated on Classic solution 

The Direct Link Dedicated on Classic solution lets customers terminate a single-tenant, fiber-based cross-connect into their own IBM Cloud private network connection. This offering can be used by customers with colocation facilities that are next to IBM Cloud PoPs and data centers. It can also be used by network service providers that deliver circuits to customer premises or to other data centers.

Common use cases: Best for working with hybrid workloads, cross-provider workloads, large or frequent data transfers, private workloads, and environment administration. This option is usually selected: (1) when the wanted PoP does not have the wanted carrier or network service provider, (2) for high-performance workloads requiring high throughput, or (3) for compliance requirements that cannot be satisfied by either the Exchange on Classic or Connect on Classic implementation model.



 Use Case 1: Customer facility to IBM Cloud 

Zoom

!
Port speed options: Select 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, or 5 Gbps.

Approximate latency: Latency is approximately 1.5 ms within the local area (data centers with the same three-letter prefix, such as DAL, AMS, MEL). See [Looking Glass](http://lg.softlayer.com/) for live PoP-to-PoP (P2P) location latency measurements.

IBM colocation services: None.

Redundancy: IBM Cloud does not provide redundancy as part of the product. To establish redundant connectivity, you must acquire two connections on diverse cross connect routers (XCRs) and configure BGP on each IBM Cloud Direct Link on Classic connection as they prefer. Examples include: prefer Lowest MED, prefer highest local-preference, or prefer shorter AS paths.

Local and global routing options: The default routing option is Local routing. It provides access to data centers within the same market as the Direct Link PoP (denoted, for example, as DAL, AMS, or MEL). The global routing option is required as an add-on to connect your IBM Cloud resources to other IBM Cloud resources in data centers outside the local market. It is used to share workloads between IBM Cloud resources (for example, Dallas to Ashburn, or Dallas to Frankfurt).





 Direct Link Connect use case 3: Location connectivity using Power Systems Virtual Servers and Transit Gateway 

Direct Link is a hybrid cloud connectivity service providing secure, private, high-bandwidth connectivity between customer on-premises and IBM Cloud resources. Paired with Power Systems Virtual Servers and IBM Cloud Transit Gateway, Direct Link offers options for high-bandwidth customer demand.

For deployment topologies using Direct Link and Power Systems Virtual Servers, see [Network architecture diagrams](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-network-architecture-diagrams).







 Direct Link Dedicated use cases 

These use cases are best for working with hybrid workloads, cross-provider workloads, large or frequent data transfers, private workloads, and environment administration. Use these use cases:



* When you want dedicated connectivity for mission-critical workloads.
Cross-connect details: Physical cross-connects for the secure Cloud Exchange Interconnect are maintained between IBM Cloud and the Cloud Exchange provider. Customers request a "Virtual Circuit" from the Cloud Exchange Provider, which establishes logical connectivity to IBM Cloud, after the customer is interconnected to the Cloud Exchange Provider.

Port speed options: Select 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, or 5 Gbps.

Approximate latency: Latency is approximately 1.5 ms within the local area (data centers with the same three-letter prefix, such as DAL, AMS, MEL). See [Looking Glass](http://lg.softlayer.com/) for live PoP-to-PoP (P2P) location latency measurements.

IBM colocation services: None.

Redundancy: IBM Cloud does not provide redundancy as part of the product. To establish redundant connectivity, customer must acquire two connections on diverse cross connect routers (XCRs) and configure BGP on each Direct Link on Classic connection as they prefer. Examples include options such as: prefer Lowest MED, prefer highest local-preference, or prefer shorter AS paths.

Local and global routing options: The default routing option is Local routing. It provides access to data centers within the same market as the Direct Link PoP (denoted, for example, as DAL, AMS, or MEL). The Global routing option is required as an add-on to connect your IBM Cloud resources to other IBM Cloud resources in data centers outside the local market. It provides a way to share workloads between IBM Cloud resources (for example Dallas to Ashburn, or Dallas to Frankfurt).
However, these logs are stored and when the link has been restored will resume at the interruption point

If the disruption between the Satellite location and IBM Cloud lasts longer than 30 minutes, the authorization cache will expire and Key Protect on Satellite will be unavailable. Similarly, if the storage limit for auditing logs is reached, additional logs can no longer be stored. At this point, only the logs that have already been stored are sent when service is resumed.







 Deploying or modifying an HSM to work with Key Protect 

As part of the infrastructure responsibility to support a Satellite location, you must deploy your own HSMs, configure them, and connect Key Protect to them.

You can either procure a new HSM or configure a new partition in an existing HSM as long as it meets the following criteria:



* To ensure high availability, you must deploy two separate HSMs. You can create one or more partitions in each one of the HSMs. However, Key Protect requires one partition from each HSM.
* For this release, Key Protect only supports [Thales HSM A7xx models](https://thalesdocs.com/gphsm/luna/7.4/docs/network/Content/PDF_Network/Installation%20Guide.pdf). For more information about the models, firmware, and software versions that are supported, check out [About the HSMs supported for use with Key Protect on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-hsm-deploysatellite-hsm-supported). You are responsible for the procurement and general setup of these HSMs using the [Thales documentation](https://thalesdocs.com/gphsm/luna/7/docs/network/Content/Home_Luna.htm) and support infrastructure. Issues with the HSMs, unrelated to specific Key Protect errors or bugs, must be handled through the Thales support process.
* The HSM (or the relevant partition) must be configured to create keys that Key Protect can use, and using the least privileged access rule. To ensure the right configuration is followed it is recommended to engage with the IBM support representative.
The purpose of a DHCP server is to lease IP addresses on the newly created instances. In the case of failure, existing virtual servers might continue to operate. However, the system might not be able to lease IP addresses to newly created instances until DHCP VM comes up. If you have mission-critical applications and you need high availability beyond the auto-evacuation feature, you want to configure DHCP in hot standby mode. Complete the following steps.



1. Order another virtual server instance in the same data center and VLAN through the [IBM Cloud catalog](https://cloud.ibm.com/catalog?category=computeservices). Select CPU, memory, and storage specifications similar to your existing DHCP server.
2. Create the sub interfaces on the secondary DHCP server similar to the primary.
3. Configure both DHCP servers with failover-peer tags. Configure one as primary and the second one as secondary. An example configuration is available from ISC [A Basic Guide to Configuring DHCP Failover](https://kb.isc.org/docs/aa-00502).
4. Restart and enable DHCP services.







 Proxy server 

All virtual servers are configured with an auto-evacuation feature. A proxy server is also configured on a virtual server. To improve availability, you can order and configure another virtual server instance as a second proxy server through the [IBM Cloud catalog](https://cloud.ibm.com/catalog?category=computeservices). You can use a load balancer to manage traffic between the proxy servers. For more information, see [Getting started with IBM Cloud Load Balancer](https://cloud.ibm.com/docs/loadbalancer-service?topic=loadbalancer-service-getting-started).





 Active Directory server 

If you deployed an active directory server in IBM Cloud, you can improve resiliency by ordering another Windows virtual server instance and then installing a secondary domain controller.
FAILED py/test_transit.py::test_curl[l-enterprise-z1 -> r-spoke1-z1] - assert False
FAILED py/test_transit.py::test_curl[l-transit-z1 -> r-enterprise-z1] - assert False
FAILED py/test_transit.py::test_curl[l-transit-z1 -> r-spoke0-z1] - assert False
FAILED py/test_transit.py::test_curl[l-transit-z1 -> r-spoke1-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke0-z1 -> r-enterprise-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke0-z1 -> r-transit-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke0-z1 -> r-spoke1-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke1-z1 -> r-enterprise-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke1-z1 -> r-transit-z1] - assert False
FAILED py/test_transit.py::test_curl[l-spoke1-z1 -> r-spoke0-z1] - assert False
=============== 12 failed, 4 passed, 276 deselected in 72.80s (0:01:12) ================
Show more



A change to the network configuration can take a couple of test runs for the underlying VPC network system to become consistent. If you do not see the expected results initially be prepared to run the test again a couple of times.

The r- and l- stand for right and left.
Zoom

![Connect with diversity and global routing](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/connect-diversity-global.png)

Figure 5: Direct Link Connect with diversity and global routing

Zoom

![Dedicated with diversity and global routing](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/dedicated-diversity-global.png)

Figure 6: Direct Link Dedicated with diversity and global routing







 Achieving redundancy 

If you are looking for High Availability (HA), or full redundancy, set up two links into different XCRs in the same data center (for example DAL03). Then, fail over as needed using BGP configurations.

Zoom

![ECMP Dual XCR Model](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/ecmp-with-diversity.png)

Figure 7: ECMP with Dual XCRs
Connectivity from 192.168.0.4 <--ICMP--> 10.2.1.4 via ICMP is possible. You can run the ping marked tests to verify via copy paste of the failed output. The l- is for left and r- is for right:

Expect success:

pytest -m ping -k 'l-enterprise-z1 and r-spoke0-z2'

Expect failure:

pytest -m curl -k 'l-enterprise-z1 and r-spoke0-z2'

If the goal is to create an architecture that is resilient across IBM Cloud zonal failures then cross zone traffic should generally be avoided. Routing on the enterprise could insure that all traffic destined to the cloud be organized and routed to avoid the cross zone traffic in the cloud. The enterprise concept of zones will need to be understood. In this tutorial the phantom VPC address prefixes will identify the zone associated with an enterprise device.





 Spoke Egress routing 

To resolve this problem transit <-> spoke(s) traffic will be routed to stay in the same zone. The spoke -> transit traffic can be routed using an egress routing table in the spokes.

Zoom

![Routing traffic from spoke to transit with an egress routing table](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-spoke-egress.svg)

Routing traffic from spoke to transit with an egress routing table

In the diagram below this is represented by the egress dashed line.

Zoom

!
Select the transit VPC and then click on Manage routing tables, click on the egress-delegate routing table, click on the Subnets tab and note the -s3 subnets used for firewall-routers.





 Apply and Test More Firewall 



1. Apply all the layers through the all_firewall_tf:

./apply.sh all_firewall_tf
2. Run the test suite.



* Expected fail: cross zone transit <-> spoke and spoke <-> spoke.



pytest -m "curl and lz1 and (rz1 or rz2)"







 Fix cross zone routing 

As mentioned earlier for a system to be resilient across zonal failures it is best to eliminate cross zone traffic. If cross zone support is required additional egress routes can be added. The problem for spoke 00 to spoke 1 traffic is shown in this diagram

Zoom

![Fixing cross zone routing](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-asymmetric-spoke-fw.svg)

Fixing cross zone routing

The green path is an example of the originator spoke 0 zone 2 10.2.1.4 routing to spoke 1 zone 1 10.1.2.4. The matching egress route is:



 Zone Destination Next hop 

 Dallas 2 10.0.0.0/8 10.2.0.196 



Moving left to right the firewall-router in the middle zone, zone 2, of the diagram is selected. On the return path zone 1 is selected.

To fix this a few more specific routes need to be added to force the higher number zones to route to the lower zone number firewalls when a lower zone number destination is specified. When referencing an equal or higher numbered zone continue to route to the firewall in the same zone.

Zoom

!
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8nist-supplemental-guidance)



[CP-8 (1) - Priority of Service Provisions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.1cp-8.1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.1nist-supplemental-guidance)



[CP-8 (2) - Single Points of Failure](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.2cp-8.2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.2control-requirements)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-8.2scc-fs-cloud-profile)



[CP-9 - Information System Backup](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-9cp-9)