vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The request must not overlap with any existing address prefixes in the VPC or any of the following reserved address ranges: 127.0.0.0/8 (IPv4 loopback addresses), 161.26.0.0/16 (IBM services), 166.8.0.0/14 (Cloud Service Endpoints), 169.254.0.0/16 (IPv4 link-local addresses), 224.0.0.0/4 (IPv4 multicast addresses). The prefix length of the client IP address pool's CIDR must be between /9 (8,388,608 addresses) and /22 (1024 addresses). A CIDR block that contains twice the number of IP addresses that are required to enable the maximum number of concurrent connections is recommended.
* --cert: The secret CRN from the secret manager for this VPN server.
* --client-auth-methods: Comma-separated of client authentication methods. One of: certificate, username, certificate,username, username,certificate.
* --client-ca: The secret CRN from the secrets manager to use for the VPN client certificate authority (CA).
* --client-crl: CRL | @CRL-file. The certificate revocation list contents, encoded in PEM format.
* --client-dns: Comma-separated of DNS server addresses that are provided to VPN clients that are connected to this VPN server. Two DNS servers can be set at most.
* --reset-client-dns: Clean up the DNS server addresses that are provided to VPN clients that are connected to this VPN server.
* --client-idle-timeout: The seconds that a VPN client can idle before this VPN server disconnects it. Specify 0 to prevent the server from disconnecting idle clients.
* --enable-split-tunnel: Indicates whether the split tunneling is enabled on this VPN server. One of: false, true. (default: false).
* --port: The port number to use for this VPN server.
* --protocol: The transport protocol to use for this VPN server.
,0.004446081351488829,0.0011709475656971335],0.004446081351488829,0.0011709475656971335],0.004446081351488829,0.0011709475656971335],0.004446081351488829,0.0011709475656971335],0.004446081351488829,0.0011709475656971335],0.004444672726094723,0.001170576550066471],0.004442169331014156,0.0011699171736836433],0.004438416566699743,0.0011689289240166545],0.004433417227119207,0.0011676122667267919],0.004427175037562847,0.0011659682495519519],0.004419694188982248,0.0011639980366453528],0.004410980269312859,0.0011617031414061785],0.004401040263473988,0.0011590851936489344],0.004389880690723658,0.0011561461724340916],0.004377509467303753,0.0011528880568221211
Dallas public.0001.voip.us-south.assistant.watson.cloud.ibm.com <br>public.0002.voip.us-south.assistant.watson.cloud.ibm.com <br>public.0003.voip.us-south.assistant.watson.cloud.ibm.com 67.228.108.82 <br>169.63.5.162 <br>150.239.30.146 
 Frankfurt public.0001.voip.eu-de.assistant.watson.cloud.ibm.com <br>public.0002.voip.eu-de.assistant.watson.cloud.ibm.com <br>public.0003.voip.eu-de.assistant.watson.cloud.ibm.com 161.156.178.162 <br>169.50.56.146 <br>149.81.86.82 
 London public.0001.voip.eu-gb.assistant.watson.cloud.ibm.com <br>public.0002.voip.eu-gb.assistant.watson.cloud.ibm.com <br>public.0003.voip.eu-gb.assistant.watson.cloud.ibm.com 158.176.120.162 <br>141.125.102.34 <br>158.175.99.34 
 Seoul public.0001.voip.kr-seo.assistant.watson.cloud.ibm.com 
 Sydney public.0001.voip.au-syd.assistant.watson.cloud.ibm.com <br>public.0002.voip.au-syd.assistant.watson.cloud.ibm.com <br>public.0003.voip.au-syd.assistant.watson.cloud.ibm.com 168.1.47.2 <br>135.90.86.50 <br>168.1.106.130
Internet address. . . . . . . . . . > . .
Line description. . . . . . . . . . ____________ Name, LOOPBACK..
Subnet mask . . . . . . . . . . . ____________
Associated local interface. . . . . . . . NONE
Type of service. . . . . . . . . . NORMAL MINDELAY, MAXTHRPUT..
Maximum transmission unit. . . . . . . . LIND 576-16388, LIND
Autostart. . . . . . . . . . . . YES YES, NO
PVC logical channel identifier. . . . . . . ____________ 001-FFF
+ for more values ____________
X.25 idle circuit timeout. . . . . . . . 60 1-600
X.25 maximum virtual circuits. . . . . . . 64 0-64
X.25 DDN interface. . . . . . . . . . NO YES, NO
TRLAN bit sequencing. . . . . . . . .
To achieve high levels of availability from the application perspective, you should consider [connectivity](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-slaconnectivity), [throughput](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-slathroughput), and [consistency and durability of messages](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-slamessage_consistency). Users are responsible for designing their applications to optimize these three elements for their business.



 Connectivity 

Because of the dynamic nature of the cloud, applications must expect connection breakages. A connection breakage is not considered a failure of service.



 Retries 

Kafka clients provide reconnect logic, but you must explicitly enable reconnects for producers. For more information, see the [retries property](http://kafka.apache.org/documentation.htmlproducerconfigs). Connections are remade within 60 seconds.





 Duplicates 

Enabling retries might result in duplicate messages. Depending on when a connection is lost, the producer might not be able to determine if a message was successfully processed by the server and therefore must send the message again when reconnected. Design applications to expect duplicate messages.

If duplicates cannot be tolerated, you can use the idempotent producer feature (from Kafka 1.1) to prevent duplicates during retries. For more information, see the [enable.idempotence property](http://kafka.apache.org/documentation.htmlproducerconfigs).







 Throughput 

Throughput is expressed as the number of bytes per second that can be both sent and received in a cluster.



 Specific guidance for the Standard plan 

For throughput guidance information, see [Limits and quotas - Standard](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-kafka_quotasstandard_throughput).





 Specific guidance for the Enterprise plan
The error message asserts the Redis name is resolving to the address 166.9.38.220 which is a Cloud [Service Endpoint](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpccloud-service-endpoints). The DNS names can not be resolved by the private DNS resolvers. Adding additional DNS forwarding rules will resolve this issue.

To make the DNS names for the VPE available outside the DNS owning service it is required to update the DNS forwarding rules.



* For enterprise appdomain.com will forward to the transit.
* For transit the fully qualified DNS name of the Databases for Redis instance will be forwarded to the spoke instance that owns the Databases for Redis instance.
* For spoke_from -> spoke_to access to Redis the spoke_from needs the DNS name for the Databases for Redis instance. The fully qualified Redis name in spoke_from DNS instance will be forwarded to the transit.
* The transit forward fully qualified Redis names to the corresponding spoke.



Zoom

![Enabling DNS for virtual private endpoints](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-dns-vpe.svg)

Enabling DNS for virtual private endpoints

The diagram uses transit-.databases.appdomain.cloud to identify the database in the transit instead of the fully qualified name like 5c60b3e4-1920-48a3-8e7b-98d5edc6c38a.c7e0lq3d0hm8lbg600bg.private.databases.appdomain.cloud.
3. Apply the vpe_dns_forwarding_rules_tf layer:

./apply.sh vpe_dns_forwarding_rules_tf
4.
curl --request POST https://api.eu-gb.logging.cloud.ibm.com/v1/config/stream -H "content-type: application/json" -H "servicekey: 0000000aaaa000000bbb00000ccc" -d '{"brokers":["kafka-0.mh-svc1-0000.eu-de.containers.appdomain.cloud:9093","kafka-1.mh-sv2.eu-de.containers.appdomain.cloud:9093","kafka-2.mh-sv3.eu-de.containers.appdomain.cloud:9093"],"topic":"la-dallas-topic","user":"token","password":"0000000_aaaa00000_0bbb00000ccc"}'

 How to fix it 

Place the data to be passed on the -d parameter in a file and then pass the file to the command instead.

In the previous example, create a file named data.json in the directory where you are running the cURL command with the following data:

{"brokers":["kafka-0.mh-svc1-0000.eu-de.containers.appdomain.cloud:9093","kafka-1.mh-sv2.eu-de.containers.appdomain.cloud:9093","kafka-2.mh-sv3.eu-de.containers.appdomain.cloud:9093"],"topic":"la-dallas-topic","user":"token","password":"0000000_aaaa00000_0bbb00000ccc"}

Then pass the file on the cURL command as follows:
[Schematic view of primary node failover](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/ha_failure.png)

Figure 2. Schematic view of primary node failover



* During failover events, you can expect between 10-20 seconds during which transactions are restricted. Your client can seamlessly fail over by using [automatic client reroute (ACR)](https://www.ibm.com/support/knowledgecenter/SSEPGG_11.5.0/com.ibm.db2.luw.admin.ha.doc/doc/r0023392.html) along with appropriate retry logic for any failed transactions.





 Managing HADR nodes 

For Enterprise and Standard HADR plans, the failover is managed for you by IBM. IBM monitors the health of your server, fail over and fail back as needed, including rolling updates and scaling to keep uptime as high as possible.
Why isn't the service route for my VPN server correct? 

For a VPN server, service routes are propagated to routing tables that have VPN server selected for the Accepts routes from attribute. These routes have names prefixed with ibm-vpn-server-.

  What’s happening 

In rare cases, you might find that these service routes are incorrect. For example, the Next hop is not same as the private IP of your VPN server. In these cases, traffic is broken even if you connected to the VPN server successfully.

  Why it’s happening 

The VPN server service keeps monitoring the health of each VPN server. When a fault is detected, the service tries to recover the VPN server automatically. The recovery process might fail and cause inaccurate routes to remain.

  How to fix it 

Follow these steps to fix the service routes:



1.  From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2.  Select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) on the upper left of the page, then click VPC Infrastructure > Routing tables in the Network section.
3.  Select your VPC from the VPC drop-down menu.
4.  Click the routing table to open its details page, then click Edit.
5.  Clear the VPN server checkbox in the Accepts routes from (optional) section and click Save. Service routes propagated by the VPN server are removed.
6.  Click Edit again.
7.  Select VPN server in the Accepts routes from (optional) section and click Save. Service routes propagated by the VPN server are generated.
* UI
* CLI







 Disaster Recovery - Fail over from an accessible primary volume 

If a catastrophic failure or disaster occurs on the primary site and performance is degraded while the primary storage is still accessible, customers can perform the following actions to quickly access their data on the secondary site.

Before you start the failover, make sure that all host-authorization is in place.

Authorized hosts and volumes must be in the same data center. For example, you can't have a replica volume in London and the host in Amsterdam. Both must be in London or both must be in Amsterdam.



 Authorizing the host in the UI 

You can authorize a host to access the IBM Cloud® Block Storage for Classic volume through the [IBM Cloud® console](https://cloud.ibm.com/cloud-storage/block).



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login) and click the menu![Menu icon](https://cloud.ibm.com/docs-content/v1/content/14cf2f2f32b430cf4ed67ad14b3cecc010f91c45/icons/icon_hamburger.svg) icon on the upper left. Select Classic Infrastructure![Classic icon](https://cloud.ibm.com/docs-content/v1/content/14cf2f2f32b430cf4ed67ad14b3cecc010f91c45/icons/classic.svg).
2. Click your source volume from the Block Storage for Classic page. Its replica volume is listed under the source volume in the inactive status.
3. Click the replica name and on the next screen, click Actions. From the menu, select Authorize Hosts.
4. Select a host type and then choose a host from the list that is available for the volume. Filter the available host list by the device type, or IP address.
5. Highlight the host that is to be authorized for replications. To select multiple hosts, use the CTRL-key and click the applicable hosts.
6.
=== Check connectivity to 169.47.174.106:30000 ===
PASS: got response back from 169.47.174.106:30000
=== Check connectivity to 169.60.92.50:30000 ===
PASS: got response back from 169.60.92.50:30000
=== Check connectivity to 169.61.74.210:30000 ===
PASS: got response back from 169.61.74.210:30000
=== Check connectivity to 169.62.9.250:30000 ===
PASS: got response back from 169.62.9.250:30000
=== Check connectivity to 169.62.10.162:30000 ===
PASS: got response back from 169.62.10.162:30000
=== Check 443 ports ===
=== Check connectivity to 169.60.73.142:443 ===
PASS: got response back from 169.60.73.142:443
=== Check connectivity to 169.60.101.42:443 ===
PASS: got response back from 169.60.101.42:443
=== Check connectivity to 169.61.83.62:443 ===
PASS: got response back from 169.61.83.62:443
=== Check connectivity to 169.61.109.34:443 ===
PASS: got response back from 169.61.109.34:443
=== Check connectivity to 169.62.10.162:443 ===
FAIL: Could not create request: dial tcp 169.62.10.162:443: connect: connection refused
=== Check connectivity to 169.63.75.82:443 ===
FAIL: Could not create request: dial tcp 169.63.75.82:443: connect: connection refused
=== Check connectivity to 169.63.88.178:443 ===
PASS: got response back from 169.63.88.178:443
Contingency Planning (CP) [CP-2 Contingency Plan](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-2) <br>[CP-6 Alternate Storage Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-6) <br>[CP-7 Alternate Processing Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-7) <br>[CP-9 Information System Backup](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-9) <br>[CP-10 Information System Recovery and Reconstitution](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10) <br>[CP-10 (2) System Recovery and Reconstitution | Transaction Recovery](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2) 







 13. Design your application for high availability (recommended) 

Requirement: Design your application for high availability (HA) to minimize downtime for your consumers.

This item is unique among the other best practices in that it represents a recommendation rather than a IBM Cloud Framework for Financial Services requirement. The IBM Cloud Framework for Financial Services only requires you to meet the RPO, RTO, and MTD goals that you define (see previous best practice). However, to be best in class, you should strive to be highly available.

Purpose & value: Consumers will be relying on your service for critical operations and have the potential to be deeply impacted by any downtime. To avoid downtime, you should implement redundancy to eliminate single points of failure. It is strongly recommended that you deploy your application to:



* Multiple availability zones within any multizone region you're using.
Configuring an HA pair requires two Netscaler VPX servers. The secondary server steps in to continue load balancing should the primary fail.](https://cloud.ibm.com/docs/citrix-netscaler-vpx?topic=citrix-netscaler-vpx-setting-up-citrix-netscaler-vpx-for-high-availability-ha-)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/depmodels/cloud/)[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture)[IBM Training<br><br>Build your skills with IBM Cloud training.<br><br>![83-Elements-of-the-cloud.svg](https://cloud.ibm.com/media/docs/images/homepage/83-Elements-of-the-cloud.svg)](https://www.ibm.com/training/cloud)[Community<br><br>Join the IBM Cloud community and collaborate with others.<br><br>![35-Connectivity.svg](https://cloud.ibm.com/media/docs/images/homepage/35-Connectivity.svg)](https://community.ibm.com/community/user/publiccloud/home)

 Latest updates
[Design your application for high availability (recommended)](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-high-availability) <br><br> * For workloads that run in IBM Cloud, deploy your application to:<br> <br> <br> <br> <br> * Multiple availability zones within the IBM Cloud regions that you're using.<br> * Multiple regions with failover between them.<br> <br> <br> <br> <br><br><br><br><br><br> * Implement a solution for autoscaling your workloads before capacity is exceeded. For more information, see [High availability for Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-high-availability).<br> * Follow best practices for high availability as defined by the specific managed services that you use such as Hyper Protect Crypto Services, Object Storage, and so on. For more information, see [High availability for IBM Cloud services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-high-availabilityibm-cloud-services).<br><br><br> <br><br> * Implement a system of high availability for all components in your IaaS / data center. For example, deploy Satellite hosts across multiple availability zones. For more information, see [High Availability, Disaster Recovery, and Disconnected Usage](https://cloud.ibm.com/docs/satellite?topic=satellite-h).<br><br><br>
Pass the transfer specification and configuration info to a transfer request.



The following is an example using Python:

import random
import string

import grpc
import json
import os.path

from urllib3.connectionpool import xrange

import transfer_pb2 as transfer_manager
import transfer_pb2_grpc as transfer_manager_grpc

def run():
 create a connection to the transfer manager daemon
client = transfer_manager_grpc.TransferServiceStub(
grpc.insecure_channel('localhost:55002'))

 create file
file_path = generate_source_file()

 create transfer spec
transfer_spec = {
"session_initiation": {
"icos": {
"api_key": os.environ.get('IBMCLOUD_API_KEY'),
"bucket": os.environ.get('IBMCLOUD_BUCKET'),
"ibm_service_instance_id": os.environ.get('IBMCLOUD_COS_INSTANCE'),
"ibm_service_endpoint": os.environ.get('IBMCLOUD_COS_ENDPOINT')
}
},
"direction": "send",
"remote_host": "https://ats-sl-dal.aspera.io:443",
"title": "strategic",
"assets": {
"destination_root": "/aspera/file",
"paths": [
{
"source": file_path
}
]
}
}
transfer_spec = json.dumps(transfer_spec)

 create a transfer request
transfer_request = transfer_manager.TransferRequest(
transferType=transfer_manager.FILE_REGULAR,
config=transfer_manager.TransferConfig(),
transferSpec=transfer_spec)

 send start transfer request to transfer manager daemon
* [Creating a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-gateway)
* [Use a VPC/VPN gateway for secure and private on-premises access to cloud resources](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-site2site-vpn)







 Full tunnel client-to-site VPN 

The third option for connectivity for your operators is to use a full tunnel client-to-site VPN, so they do not have to be on your on-premises network. However, IBM does not provide a Financial Services Validated full tunnel client-to-site VPN solution. So, if you want to use this option, you need to deploy your own. See [Setting up full tunnel VPN with FS BIG-IP](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-full-tunnel-vpn) for one example of how to do this.





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control
* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-bcdr)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-bcdr)



Most Relevant Controls:



Table 12. Related controls for business continuity and disaster recovery

 Family Control 

 Contingency Planning (CP) [CP-2 Contingency Plan](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-2) <br>[CP-6 Alternate Storage Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-6) <br>[CP-7 Alternate Processing Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-7) <br>[CP-9 Information System Backup](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-9) <br>[CP-10 Information System Recovery and Reconstitution](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10) <br>[CP-10 (2) System Recovery and Reconstitution | Transaction Recovery](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-cp-10.2) 







 13. Design your application for high availability (recommended) 

Requirement: Design your application for high availability (HA) to minimize downtime for your consumers.

This item is unique among the other best practices in that it represents a recommendation rather than a IBM Cloud Framework for Financial Services requirement.
curl -X POST "$rias_endpoint/v1/shares?version=2023-07-11&generation=2&maturity=beta" -H "Authorization: $iam_token" -d '{
"source_share": {
"id": "4aafd9c9-5555-4bdb-902d-d63d4dcf5adc"
},
"name": "replica-share-1",
"profile": "tier-3iops",
"zone": {
"name": "us-south-1"
},
"replication_cron_spec": "0 /5 * * ",
}'

You can use the API to verify that the replication succeeded, is pending, or failed. Make a GET /shares/{replica_id} call. Look at the latest_job property. For more information, see [Verify replication with the API](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-manage-replication&interface=apifs-verify-replica-api).







 Add replication to file share with Terraform 

You can use the ibm_is_share resource in Terraform to create a file share with replication, or update a file share to include replication. The following example creates a replica share in the us-south-3 zone and associates it to the parent share that is specified by its ID, ibm_is_share.example.id.

resource "ibm_is_share" "example-1" {
zone = "us-south-3"
source_share = ibm_is_share.example.id
name = "my-replica1"
profile = "tier-3iops"
replication_cron_spec = "0 /5 * * "
}

For more information about the arguments and attributes, see [ibm_is_share](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_share).





 Next steps