vania-janet/multiturn-rag-retrieval-data huggingface dataset:
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 advertise-interval '1'
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 preempt 'false'
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 priority '253'
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 'rfc3768-compatibility'
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 sync-group 'vgroup1'
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 virtual-address ‘<GATEWAY ADDRESS/MASK of Primary Private VLAN Bound to 1102/Storage>’
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 virtual-address ‘<GATEWAY
ADDRESS/MASK of Portable Private VLAN Bound to 1102/Storage Path A>’
set interfaces bonding bond0 vif 1102 vrrp vrrp-group 3 virtual-address ‘<GATEWAY ADDRESS/MASK of Portable Private VLAN Bound to 1102/Storage Path B>’
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 advertise-interval '1'
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 preempt 'false'
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 priority '253'
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 'rfc3768-compatibility'
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 sync-group 'vgroup1'
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 virtual-address ‘<GATEWAY ADDRESS/MASK of Primary Private VLAN Bound to 1103/Virtual Machines>’
set interfaces bonding bond0 vif 1103 vrrp vrrp-group 4 virtual-address ‘<GATEWAY ADDRESS/MASK of Portable Private VLAN Bound to 1103/Virtual Machines>’
commit
save
Show more





 Brocade vRouter (Vyatta) 2
You need to install and manage your own bastion solution within your management VPC. There are various ways a bastion solution can be implemented. For one example that uses Teleport Enterprise Edition, see [Setting up a bastion host for secure connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion-tutorial-teleport).





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Audit and Accountability (AU) [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-14) 
 Access Control (AC) [AC-6 (9) Least Privilege | Auditing Use of Privileged Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6.9) <br>[AC-17 Remote Access](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-17) 
 Identification and Authentication (IA) [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1) 







 Next steps 



* [Consumer connectivity to workload VPC](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-workload)
"integration": "email",
"emails": "LIST OF EMAILS"], // array of strings (emails) that are comma-separated
"triggerlimit": 15,
"triggerinterval": "5m",
"immediate": true,
"terminal": true,
"operator": "presence",
"timezone": "TIMEZONE"
},
{
"integration": "webhook",
"url": "WEBHOOK_URL",
"triggerlimit": 25,
"triggerinterval": "30",
"operator": "presence",
"immediate": true,
"terminal": true,
"method": "post",
"headers": {
"X-MY-HEADER": "My Header Value"
},
"bodyTemplate": {
"my_log_lines": "{{ lines }}"
}
},
{
"integration": "pagerduty",
"key": "PAGERDUTY_KEY",
"triggerlimit": 150,
"triggerinterval": "15m",
"operator": "absence",
"immediate": false,
"terminal": true
}
]
Show more





 category (array of strings) 

Specifies the classification of views.



* You can include a view in 1 or more categories.



For example, to associate a view to a category named My category, you can set it as follows:

"category": ["My category"],







 Examples of using the Configuration API 

The following are examples of how to use the Configuration API.

A category must exist before you create a view. In these examples, replace <MY_CATEGORY> with your category.

In these examples, <SERVICE_KEY> is the [service key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keys) for your IBM Cloud Activity Tracker instance.
set interfaces st0 unit 3 family inet next-hop-tunnel 169.254.0.5 ipsec-vpn ibm-vpc-gateway-secondary-vpn
set interfaces st0 unit 3 family inet address 169.254.0.6/30

set security ipsec vpn ibm-vpc-gateway-secondary-vpn bind-interface st0.3

set security ipsec vpn ibm-vpc-gateway-secondary-vpn ike gateway ibm-vpc-gateway-secondary
set security ipsec vpn ibm-vpc-gateway-secondary-vpn ike ipsec-policy ibm-vpc-ipsec-policy
set security ipsec vpn ibm-vpc-gateway-secondary-vpn establish-tunnels immediately
11. Configure a control plane firewall to permit IKE/IPsec protocol traffic from the secondary tunnel:

set firewall filter PROTECT-IN term IPSec-IKE from source-address <VPN for VPC Gateway Big Public IP>/32
set firewall filter PROTECT-IN term IPSec-ESP from source-address <VPN for VPC Gateway Big Public IP>/32
set firewall filter PROTECT-IN term IPSec-4500 from source-address <VPN for VPC Gateway Big Public IP>/32
12. Add the VTI into a security zone:

set security zones security-zone vpn-zone interfaces st0.3
13. Add a route to the secondary tunnel:

set routing-options static route <your-VPC-subnet> qualified-next-hop 169.254.0.5 preference 30







 Verifying the configuration 

Follow these steps to verify the configuration:



1. Verify IKE Phase 1 is working for both tunnels: run show security ike sa
2. Verify IKE Phase 2 is working for both tunnels: run show security ipsec sa
3. Show the route: run show route <static route>
For example, sharepoint.mycointernal.





 Prerequisite step 

Before you can connect to a SharePoint On Prem data source, you must install and configure IBM® Secure Gateway for IBM Cloud®.

For more information, see [Installing IBM Secure Gateway for on-premises data](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-sourcesgatewaypublic).





 Connecting to the data source 

To configure the Microsoft SharePoint On Prem data source, complete the following steps in Discovery:



1. From the navigation pane, choose Manage collections.
2. Click New collection.
3. Click SharePoint On Prem, and then click Next.
4. Add values to the following fields:



* Username
* Password
* Web Application URL
* Domain



Click Next.
5. Name the collection.
6. If the language of the documents on the site is not English, select the appropriate language.

For a list of supported languages, see [Language support](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-language-support).
7. Optional: Change the synchronization schedule.

For more information, see [Crawl schedule options](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionscrawlschedule).
8. If you want to limit the types of files to add to the collection, you can list the file extensions for file types to either include or exclude.

When you choose to list extensions for file types to exclude, you must add at least one file extension.

For a list of supported file types, see [Supported file types](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionssupportedfiletypes).
9. If you want the crawler to extract text from images on the site, expand More processing settings, and set Apply optical character recognition (OCR) to On.
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-15.9implementation-guidance)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-15.9nist-supplemental-guidance)







 System and Communications Protection (SC) 

[SC-1 - System and Communications Protection Policy and Procedures](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-1sc-1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-1nist-supplemental-guidance)



[SC-2 - Application Partitioning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2sc-2)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-2scc-fs-cloud-profile)
Your app must be exposed by a Kubernetes service to be included in the Ingress load balancing.



oc expose deploy <app_deployment_name> --name my-app-svc --port <app_port> -n <namespace>





 Step 2: Set up TLS termination with TLS certificates and Kubernetes secrets 

Your TLS certificate must be stored as a Kubernetes secret in each namespace where your apps exist.



* To use the IBM-managed Ingress domain, see [Setting up TLS secrets for the IBM-provided Ingress subdomain](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-default).
* To use a domain that you created yourself, such as a domain registered with an external provider, see [Setting up TLS secrets for custom subdomains](https://cloud.ibm.com/docs/containers?topic=containers-secretstls-custom).







 Step 3: Create the Ingress resource 

Ingress resources define the routing rules that the Ingress controller uses to route traffic to your app service.



1. Define an Ingress resource configuration file that uses the IBM-provided domain or your custom domain to route incoming network traffic to the services that you created earlier.

apiVersion: networking.k8s.io/v1 For 4.5 or earlier, use networking.k8s.io/v1beta1 instead
kind: Ingress
metadata:
name: myingressresource
spec:
tls:
- hosts:
- <custom_domain>
secretName: <custom_secret_name>
rules:
- host: <domain>
http:
paths:
- path: /<app1_path>
backend:
service:
name: <app1_service>
port:
number: 80
- path: /<app2_path>
backend:
service:
name: <app2_service>
port:
number: 80
Show more

tls
* [Objectives](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-objectives)
* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-prerequisites)
* [Task flow](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-steps)
* [Deploy Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-deploy-kp)
* [Connect Unified Key Orchestrator to Key Protect on Satellite](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-connect-uko-kp)
* [Manage Key Protect keys through Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-manage-kp-keys)
* [Next steps](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-uko-satellitetutorial-uko-satellite-next-step)







 Provisioning service instances 

[Provisioning service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provisionprovision)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provisionprovision-prerequisites)
* Golang code snippet

VerifySingleRequest := &pb.VerifySingleRequest {
PubKey: GenerateKeyPairResponse.PubKeyByytes,
Mech: &pb.Mechanism{Mechanism: ep11.CKM_SHA256_RSA_PKCS},
Data: msgHash[:],
Signature: SignSingleResponse.Signature,
}

VerifySingleResponse, err := cryptoClient.VerifySingle(context.Background(), VerifySingleRequest)
* JavaScript code snippet

client.VerifySingle({
Mech: {
Mechanism: ep11.CKM_SHA256_RSA_PKCS
},
PubKey: keys.PubKey,
Data: digest,
Signature: signature
}, (err, response) => {
callback(err, response);
});









 Protecting data integrity through message digests 

GREP11 provides a set of functions to create message digests that are designed to protect the integrity of a piece of data. You might need to call a series of subfunctions to perform a digesting operation. For example, the multi-part digesting operation consists of the DigestInit, DigestUpdate, and DigestFinal suboperations.



 DigestInit 

The DigestInit function initializes a message-digesting operation. You need to run this function first to perform a digesting operation.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_DigestInit, which is an implementation of PKCS #11 C_DigestInit. 
 Parameters message DigestInitRequest { Mechanism Mech = 2; } message DigestInitResponse { bytes State = 1; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

DigestInitRequest := &pb.DigestInitRequest {
Within a hardware security module, the system uses the private key to decrypt the symmetric key. Finally, the system uses the symmetric key and the IV to decrypt the nonce and verify the request.

If the API request fails with an import token expired error, [return to step 3](https://cloud.ibm.com/docs/key-protect?topic=key-protect-tutorial-import-keystutorial-import-create-token) to create a new import token. Remember that import tokens and their associated public keys expire based on the policy that you specify at creation time.
3. View details for the encryption key.

jq '.' createRootKeyResponse.json

The following snippet shows an example output.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"type": "application/vnd.ibm.kms.key+json",
"name": "encrypted-root-key",
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"extractable": false,
"imported": true
}
]
}

The id value is a unique identifier that is assigned to your key and is used for subsequent calls to the Key Protect API.
[CheckPoint Connection Configure the IKE and IPsec Proposals](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-configure-ike-ipsec-proposal.png)

Figure 6: CheckPoint connection configure the IKE and IPsec proposals
7. To configure tunnel management, click Tunnel Management on the VPN community. Then, select On all tunnels in the community and One VPN tunnel per Gateway Pair.

Zoom

![CheckPoint Connection Configure Tunnel Management](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-configure-tunnel-manangement.png)

Figure 7: CheckPoint connection configure tunnel management
8. To configure the pre-shared key, click Shared Secret on the VPN community. Set the same pre-shared key as the IBM VPN route-based gateway.

Zoom

![CheckPoint Connection Configure Pre-shared Key](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-checkpoint-configure-pre-shared-key.png)

Figure 8: CheckPoint connection configure pre-shared key
9. To enable directional match, select Menu > Global properties > VPN > Advanced, then click Enable VPN Directional Match in VPN Column.

Zoom

!
AU-6 (1) - Process Integration 



  Control requirements 

AU-6 (1) - 0
:   The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Audit logging of application provider events and SIEM](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit-provider)
*  [Audit logging of IBM Cloud events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  NIST supplemental guidance 

Organizational processes benefiting from integrated audit review, analysis, and reporting include, for example, incident response, continuous monitoring, contingency planning, and Inspector General audits.
For more information about the inventory and promotion process, see [Inventory promotion](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-inventory).





 Promotion pull/merge requests 

The information from the body of the promotion pull/merge request is used to create the change request. Files that are changed by the promotion pull/merge request represent the entries, such as images, that are deployed by the continuous deployment pipeline. If the changes were made because of an emergency, the promotion pull/merge request is marked with an emergency label. The change request that is created by the continuous deployment pipeline is also marked as emergency.

The evidence that is collected in the continuous integration pipeline is summarized and attached to the change request in the continuous deployment pipeline. You can optionally perform the evidence aggregation and summary generation in the promotion pipeline as well, and set the evidence statuses on the promotion pull/merge request (PR) after the PR is created by setting opt-in-promotion-validation to 1. This action allows for early validation of the promotion PR before the PR is merged to the target branch (environment). Based on the status of the PR, users can either proceed with the promotion (when all the evidence statuses are green), or choose to fix the problem in the continuous integration pipeline (when the evidence status is red). Opting in to the validation also adds the aggregated summary of evidences for one or more apps in the inventory to the promotion pull/merge request as a comment in a user-friendly tabular format (as shown in Figure 3). The table provides useful links, such as links to pipeline runs, app repos, and issues created for each of the apps.

Set opt-in-promotion-validation to 1, to perform the promotion PR validation. While the validation is in progress, merging of the promotion pull/merge request is blocked. Once the validation is completed, the evidence status is set on the pull/merge request. Clicking on each entry in the status takes the user to the specific stage in the corresponding CI pipeline run.





 Inputs 



Table 1. Promotion pipeline inputs

 Variable Description Default value Required or optional 

 source-environment The source inventory branch of the promotion. master Required
- {claim: "email", value: "<Email Address>", roles: ["teleport-admin"]}

Example claim names can be email, family_name, given_name, or name. The value is what that claims value will be set to.
13. Using the [tctl](https://goteleport.com/docs/cli-docs/) to apply the yamls:



* tctl create /var/lib/teleport/role.yaml
* tctl create /var/lib/teleport/oidc.yaml



14. Set up forwarding of Teleport logs and system logs. Teleport logs are located in the directory /var/lib/teleport and system logs in /var/logs.



Logs must be forwarded to an operational logging solution. For more information, see [operational logging](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-logging-operational)





 Step 7: Log in to the bastion host 

You can log in to the bastion host through the web console or tsh client as described in the following sections.



 Log in through the the web console 



1. Access the web console on port 3080.

https://<fqdn of node>:3080
2. Start a terminal session under Servers. There should be a single server with a connect button. Click connect and select the user that you would like to log in with.







 Log in through the tsh client 



1. Install the [Teleport client tool tsh](https://goteleport.com/docs/user-manual/installing-tsh).
2. [Log in using tsh](https://goteleport.com/docs/user-manual/logging-in).

tsh login --proxy=<fqdn of telport server>:3080
3.
If you are using App Configuration CLI or API to create integration with a Event Notifications service instance, ensure that you have enabled authorization to grant access between services before integrating with Event Notifications. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-int-enac-using-auth-access-between-services1).

To integrate with a Event Notifications service, perform the following steps:



1. From your App Configuration service instance dashboard, click Integrations. By default, the integrations display the services that are supported along with integrations in the current App Configuration service.
2. From Event Notifications tile, click Connect +. This displays the Connect to Event Notifications side panel.

Zoom

![Create Event Notifications integration](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-integrations-en-create.png)

Figure 1. Create Event Notifications integration
3. Enter the Source Details. The source details provided will be referenced in Event Notifications.



* Name - Enter the name for your App Configuration instance to be referenced in Event Notifications.
* Description - Optionally, provide a short description about this source.



4. Provide the following Event Notifications instance details, if you already have an Event Notifications instance. Otherwise, click the Create new instance.



* Resource Group - Select the resource group where your Event Notifications instance is created from the list.
* Event Notifications service instance - Select the Event Notifications service instance from the list.



5. Click Save to apply the integration.

An error is displayed if no IAM service-to-service authorization enabled, and the integration details will not be saved.



The integrated Event Notifications details are listed under Connected instance.

The overflow menu of the Connected instance consists of:



* Refresh - Select this option to refresh the details of Event Notifications instance integration.