Firewalls protect valuable data from public access. If your data sources reside behind a firewall for protection, and you are not using Satellite Link or Secure Gateway for connections, then you must configure the firewall to allow the IP addresses for IBM watsonx and also for individual services. Otherwise, IBM watsonx is denied access to the data sources.
To allow IBM watsonx access to private data sources, you configure inbound firewall rules using the security mechanisms for your firewall. Inbound firewall rules are not required for connections that use either a Satellite Link or Secure Gateway, as both establish a link by performing an outbound connection.
All services in IBM watsonx actively use WebSockets for the proper functioning of the user interface and APIs. Any firewall between the user and the IBM watsonx domain must allow HTTPUpgrade. If IBM watsonx is installed behind a firewall, traffic for the wss:// protocol must be enabled.
Configuring inbound access rules for firewalls
If data sources reside behind a firewall, then inbound access rules are required for IBM watsonx. Inbound firewall rules protect the network against incoming traffic from the internet. The following scenarios require inbound access rules through a firewall:
Learn more
Parent topic: Setting up the platform for administrators