vania-janet/multiturn-rag-retrieval-data huggingface dataset:
set security zones security-zone trust tcp-rst
set security zones security-zone trust interfaces reth0.0 host-inbound-traffic system-services all
set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust interfaces reth1.0 host-inbound-traffic system-services all
set interfaces ge-0/0/1 gigether-options redundant-parent reth0
set interfaces ge-0/0/2 gigether-options redundant-parent reth2
set interfaces ge-0/0/3 gigether-options redundant-parent reth1
set interfaces ge-0/0/4 gigether-options redundant-parent reth3
set interfaces ge-7/0/1 gigether-options redundant-parent reth0
set interfaces ge-7/0/2 gigether-options redundant-parent reth2
set interfaces ge-7/0/3 gigether-options redundant-parent reth1
set interfaces ge-7/0/4 gigether-options redundant-parent reth3
set interfaces fab0 fabric-options member-interfaces ge-0/0/0
set interfaces fab1 fabric-options member-interfaces ge-7/0/0
set interfaces fxp0 unit 0 family inet address 10.135.70.20/26
set interfaces lo0 unit 0 family inet address 127.0.0.1/32
set interfaces reth0 mtu 9000
set interfaces reth0 redundant-ether-options redundancy-group 1
set interfaces reth0 unit 0 description "SL Private VLAN interface"
set interfaces reth0 unit 0 family inet address 10.135.70.22/26
set interfaces reth1 redundant-ether-options redundancy-group 1
set interfaces reth1 unit 0 description "SL Public VLAN interface"
set interfaces reth1 unit 0 family inet address 169.50.51.92/29
set interfaces reth1 unit 0 family inet6 address 2a03:8180:1201:0129:0000:0000:0000:0005/64
The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Access Control (AC) [AC-20 Use of External Information Systems](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-20) 
 Security Assessment and Authorization (CA) [CA-3 System Interconnections](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ca-3) 
 System and Communications Protection (SC) [SC-5 Denial of Service Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-5) <br>[SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7(4) Boundary Protection | External Telecommunications Services](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.4) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) <br>[SC-7 (10) Boundary Protection | Prevent Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10) 







 Next steps
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-10, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-10-attestation.crt)
* [Encryption certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-10-encrypt.crt)
* [Intermediate certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-10-intermediate.crt)







 9 May 2023 

New -a100 GPU profile is available (LA)
: A new profile is available for customers with special approval to preview this service that is for provisioning instances based on NVIDIA's A100 Amperere GPU attached to a single virtual server instance. The gx2-80x1280x8a100 profile supports artificial intelligence and machine language frameworks and includes instance storage. Only Red Hat and Ubuntu are supported for this profile. This profile is only available in the Washington DC region. For more information, see [GPU profiles](https://test.cloud.ibm.com/docs/vpc?topic=vpc-profiles&interface=uigpu). To request access to this profile, you must open a [support case](https://cloud.ibm.com/unifiedsupport/supportcenter).







 April 2023 





 27 April 2023 

Documentation enhancement: Deploying an application for financial transactions with Confidential Computing on Hyper Protect Virtual Server for VPC
SC-7 (b) <br><br> * Check whether Security Groups for VPC contains no outbound rules in security groups that specify source IP 8.8.8.8/32 to DNS port<br> * Check whether Event Streams network access is restricted to a specific IP range<br> * Check whether Virtual Servers for VPC instance doesn't have a floating IP<br> * Check whether OpenShift clusters are accessible only by using private endpoints<br> * Check whether Hyper Protect DBaaS for MongoDB is accessible only using private endpoints<br> * Check whether Event Streams is accessible only by using private endpoints<br> * Check whether Hyper Protect DBaaS for PostgreSQL is accessible only using private endpoints<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached<br> * Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port<br> * Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached<br> * Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning<br> * Check whether App ID redirect URIs are not using wildcards (*)<br> * Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled
Example output

150.XXX.XXX.XXX
169.XX.XXX.XXX
3. Create outbound security rules to each of the IP address that you retrieved earlier and port 443.

ibmcloud is security-group-rule-add <sg> outbound tcp --port-min 443 --port-max 443 --remote 150.XXX.XXX.XXX



If the Ingress or console operators fail their health checks, you can repeat these steps to see if the LoadBalancer IP addresses changed. While rare, if the amount of traffic to your LoadBalancers varies widely, these IP addresses might change to handle the increased or decreased load.
Subnet ranges for Delivery Pipeline 

If your firewall configuration prevents the Delivery Pipeline from communicating with environments that are behind a firewall, you must update the configuration, including subnet ranges, to access resources that are behind the firewall.

Use the following subnet ranges for your specific region.

jp-tok
10.129.147.64/26
10.129.50.128/27
10.133.46.152/29
10.192.14.0/27
10.192.72.0/26
10.193.16.192/27
10.193.40.128/26
128.168.108.0/26
128.168.68.192/27
161.202.235.192/27
165.192.107.64/26
165.192.70.32/27
169.56.10.128/26
====
jp-osa
10.10.15.128/26
10.8.29.128/26
10.9.10.128/26
163.68.73.192/27
163.68.73.80/28
163.69.65.16/28
163.69.67.224/27
163.73.67.240/28
163.73.68.0/27
====
au-syd
10.139.55.128/26
10.195.7.128/26
10.63.14.64/26
130.198.80.128/28
130.198.85.32/27
135.90.66.176/28
135.90.66.96/27
168.1.36.32/27
168.1.59.208/28
====
us-south
10.177.11.128/26
10.185.130.0/26
10.37.91.0/26
169.47.72.160/27
169.48.221.240/28
169.61.249.80/28
Moving left to right the firewall-router in the middle zone, zone 2, of the diagram is selected. On the return path zone 1 is selected.

To fix this a few more specific routes need to be added to force the higher number zones to route to the lower zone number firewalls when a lower zone number destination is specified. When referencing an equal or higher numbered zone continue to route to the firewall in the same zone.

Zoom

![Cross zone routing enabled](https://cloud.ibm.com/docs-content/v1/content/6a28e4ae2660b609a18e90e1239ed772f80373d6/transit-gateway/includes/solution-tutorials/includes/solution-tutorials/images/vpc-transit/vpc-transit-asymmetric-spoke-fw-fix.svg)

Cross zone routing enabled

Routes in each spoke's default egress routing table (shown for Dallas/us-south):



 Zone Destination Next hop 

 Dallas 2 10.1.0.0/16 10.1.0.196 
 Dallas 3 10.1.0.0/16 10.1.0.196 
 Dallas 3 10.2.0.0/16 10.2.0.196 



These routes are also going to correct a similar transit <--> spoke cross zone asymmetric routing problem. Consider transit worker 10.1.0.4 -> spoke worker 10.2.1.4. Traffic from transit worker in zone 1 will choose the firewall-router in the zone 1 (same zone). On the return trip instead of firewall-router in zone 2 (same zone) now firewall-router in zone 1 will be used.



1. Apply the all_firewall_asym layer:

./apply.sh all_firewall_asym_tf
2. Run the test suite.

Your expected results are: all tests PASSED, run them in parallel:

pytest -n 10 -m curl



All traffic between VPCs is now routed through the firewall-routers.
Moving left to right the firewall-router in the middle zone, zone 2, of the diagram is selected. On the return path zone 1 is selected.

To fix this a few more specific routes need to be added to force the higher number zones to route to the lower zone number firewalls when a lower zone number destination is specified. When referencing an equal or higher numbered zone continue to route to the firewall in the same zone.

Zoom

![Cross zone routing enabled](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-asymmetric-spoke-fw-fix.svg)

Cross zone routing enabled

Routes in each spoke's default egress routing table (shown for Dallas/us-south):



 Zone Destination Next hop 

 Dallas 2 10.1.0.0/16 10.1.0.196 
 Dallas 3 10.1.0.0/16 10.1.0.196 
 Dallas 3 10.2.0.0/16 10.2.0.196 



These routes are also going to correct a similar transit <--> spoke cross zone asymmetric routing problem. Consider transit worker 10.1.0.4 -> spoke worker 10.2.1.4. Traffic from transit worker in zone 1 will choose the firewall-router in the zone 1 (same zone). On the return trip instead of firewall-router in zone 2 (same zone) now firewall-router in zone 1 will be used.



1. Apply the all_firewall_asym layer:

./apply.sh all_firewall_asym_tf
2. Run the test suite.

Your expected results are: all tests PASSED, run them in parallel:

pytest -n 10 -m curl



All traffic between VPCs is now routed through the firewall-routers.







 Step 2: High Performance High Availability (HA) Firewall-Router
IPv4 and IPv6 are supported.

--excluded (string)
: The list of excluded addresses in the zone. Only addresses of type ipAddress, ipRange, and subnet are allowed in a comma delimited format.

--service-ref (string)
: The service refs in the zone. Input in the form service_name=VALUE,service_name=VALUE,....
: To find a list of available service refs, run the ibmcloud cbr service-ref-targets[command](https://cloud.ibm.com/docs/account?topic=account-cbr-plugincbr-cli-service-ref-targets-command).

--vpc (string)
: The VPCs allowed in the zone. Input in the form value,value,....

--file (string)
: The supplied file is used to create the zone. This flag is unique and cannot be used with other flags. The file needs to follow the JSON schema for the zone create API. For more information, see the [Context-based restrictions API](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-zone-request).







 ibmcloud cbr zones 

This operation lists network zones in the specified account.

ibmcloud cbr zones [--name NAME] [--sort SORT]



 Example 

ibmcloud cbr zones





 Command options 

--name (string)
: The name of the zone.

--sort (string)
: Sorts results by using a valid sort field. To learn more, see [Sorting](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-sorting).







 ibmcloud cbr zone 

This operation retrieves the network zone that is identified by the specified zone ID.

ibmcloud cbr zone ZONE-ID



 Example 

ibmcloud cbr zone 65810ac762004f22ac19f8f8edf70a34







 ibmcloud cbr zone-update
IPv4 and IPv6 are supported.

--excluded (string)
: The list of excluded addresses in the zone. Only addresses of type ipAddress, ipRange, and subnet are allowed in a comma delimited format.

--service-ref (string)
: The service refs in the zone. Input in the form service_name=VALUE,service_name=VALUE,....
: To find a list of available service refs, run the ibmcloud cbr service-ref-targets[command](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugincbr-cli-service-ref-targets-command).

--vpc (string)
: The VPCs allowed in the zone. Input in the form value,value,....

--file (string)
: The supplied file is used to create the zone. This flag is unique and cannot be used with other flags. The file needs to follow the JSON schema for the zone create API. For more information, see the [Context-based restrictions API](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-zone-request).







 ibmcloud cbr zones 

This operation lists network zones in the specified account.

ibmcloud cbr zones [--name NAME] [--sort SORT]



 Example 

ibmcloud cbr zones





 Command options 

--name (string)
: The name of the zone.

--sort (string)
: Sorts results by using a valid sort field. To learn more, see [Sorting](https://cloud.ibm.com/docs/api-handbook?topic=api-handbook-sorting).







 ibmcloud cbr zone 

This operation retrieves the network zone that is identified by the specified zone ID.

ibmcloud cbr zone ZONE-ID



 Example 

ibmcloud cbr zone 65810ac762004f22ac19f8f8edf70a34







 ibmcloud cbr zone-update
It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is network-acl-rule-add 

Add a rule to a network ACL.

ibmcloud is network-acl-rule-add ACL ACTION DIRECTION PROTOCOL SOURCE DESTINATION [--vpc VPC] [--name NAME] [--icmp-type ICMP_TYPE] [--icmp-code ICMP_CODE] [--source-port-min PORT_MIN] [--source-port-max PORT_MAX] [--destination-port-min PORT_MIN] [--destination-port-max PORT_MAX] [--before-rule BEFORE_RULE | --reset-before-rule] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is network-acl-rule-add 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 allow inbound all 10.2.2.2 10.2.2.3
* ibmcloud is network-acl-rule-add my-acl allow inbound all 10.2.2.2 10.2.2.3
* ibmcloud is network-acl-rule-add my-acl allow inbound all 10.2.2.2 10.2.2.3 --vpc my-vpc
* ibmcloud is network-acl-rule-add 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 allow inbound all 10.2.2.2 10.2.2.3 --name my-acl-rule
For example resources in spoke 0 can connect to other resources on spoke 0 directly. To accomplish this additional more specific routes can be added to delegate internal traffic. For example in spoke 0, which has the CIDR ranges: 10.1.1.0/24, 10.2.1.0/24, 10.3.1.0/24 the internal routes can be delegated.

Routes in spoke 0's default egress routing table (shown for Dallas/us-south):



 Zone Destination Next hop 

 Dallas 1 10.1.1.0/24 delegate 
 Dallas 1 10.2.1.0/24 delegate 
 Dallas 1 10.3.1.0/24 delegate 
 Dallas 2 10.1.1.0/24 delegate 
 Dallas 2 10.2.1.0/24 delegate 
 Dallas 2 10.3.1.0/24 delegate 
 Dallas 3 10.1.1.0/24 delegate 
 Dallas 3 10.2.1.0/24 delegate 
 Dallas 3 10.3.1.0/24 delegate 



Similar routes are added to the transit and other spokes.





 Firewall Subnets 

What about the firewall-router itself? This was not mentioned earlier but in anticipation of this change there was a egress_delegate router created in the transit VPC that delegates routing to the default for all destinations. It is only associated with the firewall-router subnets so the firewall-router is not effected by the changes to the default egress routing table used by the other subnets. Check the routing tables for the transit VPC for more details. Visit the [VPCs](https://cloud.ibm.com/vpc-ext/network/vpcs) in the IBM Cloud console. Select the transit VPC and then click on Manage routing tables, click on the egress-delegate routing table, click on the Subnets tab and note the -s3 subnets used for firewall-routers.





 Apply and Test More Firewall 



1. Apply all the layers through the all_firewall_tf:

./apply.sh all_firewall_tf
2. Run the test suite.
This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:64490 
 local_gateway_ip <br>string Local gateway IP address. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:192.168.100.1 
 local_tunnel_ip <br>string Local tunnel IP address. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:192.168.129.2 
 mtu <br>integer GRE tunnel MTU. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:9000 
 remote_bgp_asn <br>integer Remote network BGP ASN. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:65010 
 remote_gateway_ip <br>string Remote gateway IP address. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:10.242.63.12 
 remote_tunnel_ip <br>string Remote tunnel IP address. This field only applies to network type gre_tunnel and unbound_gre_tunnel connections. <br>Example:192.168.129.1 
 request_status <br>string Only visible for cross account connections, this field represents the status of a connection request between IBM Cloud accounts. The list of enumerated values for this property may expand in the future. Code and processes using this field must tolerate unexpected values. <br>Possible values: [pending,approved,rejected,expired,detached] 
 status <br>string Connection's current configuration state. The list of enumerated values for this property may expand in the future. Code and processes using this field must tolerate unexpected values. <br>Possible values: [attached,failed,pending,deleting,detaching,detached]
ibmcloud cbr rule-create --description 'Example Rule Description' --service-name kms --context-attributes endpointType=private --zone-id 93de8d3f588ab2c457ff576c364d1145 --enforcement-mode report

For the enforcement-mode option, the CLI accepts the values enabled, disabled, and report. If no enforcement is specified, the rule is enabled by default. For more informaiton, see [Rule enforcement](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisrule-enforcement).





 Creating rules by using the API 

To create restrictions to your cloud resources by creating rules, call the [Context-based restrictions API](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule). The following example creates an enabled rule that targets the Kubernetes Service and allows requests only from the specified network zone to access the service.



* Curl
* Java
* Python
* Go
* Node



curl -X POST --location --header "Authorization: Bearer {iam_token}" --header "Accept: application/json" --header "Content-Type: application/json" --data '{ "description": "this is an example of rule", "resources": [ { "attributes": { "name": "accountId", "value": "12ab34cd56ef78ab90cd12ef34ab56cd" }, { "name": "serviceName", "value": "kms" } ] } ], "contexts": [ { "attributes": { "name": "networkZoneId", "value": "65810ac762004f22ac19f8f8edf70a34" } ] } ], "enforcement_mode": "enabled" }' "{base_url}/v1/rules"

RuleContextAttribute ruleContextAttributeModel = new RuleContextAttribute.Builder()
.name("networkZoneId")
2607:f0d0:2001::1 lladdr 00:1b:0d:e6:57:c0 router REACHABLE
root@server:

If the neighbor cache shows a fe80 entry, one of the following conditions can apply:



* The gateway is not set
* The IP is not bound to the correct interface
* The IP is not bound correctly to the public interface
* The software firewall is blocking IPv6 ICMP.







 IPv6 default gateway 

root@server: ip -6 route show dev eth1
2607:f0d0:2001::/64 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit 4294967295
default via 2607:f0d0:2001::1 metric 1024 mtu 1500 advmss 1440 hoplimit 4294967295
root@server:

If the default gateway is not listed, you can use the ping6 command to find your default gateway then add it manually using this IP command:

root@server: ip -6 route add default via 2607:f0d0:2001::1
root@server:
set firewall group network-group SLSERVICES network 10.2.64.0/20
set firewall group network-group SLSERVICES network 10.0.64.0/19
set firewall group network-group SLSERVICES network 10.2.128.0/20
set firewall group network-group SLSERVICES network 10.2.200.0/24
set firewall group network-group SLSERVICES network 10.1.0.0/24
set firewall group network-group SLSERVICES network 10.1.24.0/24
set firewall group network-group SLSERVICES network 10.2.208.0/24
set firewall group network-group SLSERVICES network 10.1.236.0/24
set firewall group network-group SLSERVICES network 10.1.56.0/24
set firewall group network-group SLSERVICES network 10.1.8.0/24
set firewall group network-group SLSERVICES network 10.1.224.0/24
set firewall group network-group SLSERVICES network 10.2.192.0/24
set firewall group network-group SLSERVICES network 10.1.16.0/24
set firewall group network-group SLSERVICES network 10.0.0.0/14
set firewall group network-group 1101PRIMARY network ... (Primary Private Subnet 1101/Management)
set firewall group network-group 1101MGMT network ... (Portable Private Subnet 1101/Management VMs)
set firewall group network-group 1102PRIMARY network ... (Primary Private Subnet 1102/Storage)
set firewall group network-group 1102STORAGEA network ... (Portable Private Subnet 1102/Storage Path A)
set firewall group network-group 1102STORAGEB network ... (Portable Private Subnet 1102/Storage Path B)
set firewall group network-group 1103VMACCESS network ... (Portable Private Subnet 1103/Virtual Machines)
commit
"value": "3bd0bc3c-232c-4886-a0c4-72aa26ec0d38"
}
]
}
]
}





 Creating rules by using the CLI 



1. To create rules from the CLI, [install the CBR CLI plug-in](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugininstall-cbr-plugin).
2. Use the [ibmcloud cbr rule-create command](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugincbr-cli-rule-create-command) to create CBR rules. For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugincbr-zones-cli).



The examples in this section are enforcement rules. You can make them report-only by adding --enforcement-mode report.

The following example CLI command creates a context-based restriction rule for a DNS Services instance in the current account:

ibmcloud cbr rule-create --zone-id 65810ac762004f22ac19f8f8edf70a34 --description "example CBR rule" --service-name dns-svcs --service-instance 3bd0bc3c-232c-4886-a0c4-72aa26ec0d38







 How DNS Services authorizes VPC resource access 

DNS Services requires you have appropriate access to VPC resources in one of the following operations:



* Add a VPC to permitted networks of a DNS zone.
* Create custom resolver on a particular VPC.
* Create GLB origin pool with healthcheck on VPC subnets.



You must work with an account administrator to ensure appropriate VPC operator permission for IAM access policy, and to ensure that no CBR rules blocking you operate on the VPC.