Allen-Bradley 1756-EN2TSC User manual

EtherNet/IP Secure Communication
Catalog Number 1756-EN2TSC
User Manual

Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required
to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the
use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
Allen-Bradley, Rockwell Software, Rockwell Automation, ControlFLASH, ControlLogix, FactoryTalk, FLEX, Logix5000, POINT I/O, PowerFlex, RSLinx, RSView, Stratix 5900, and Studio 5000 are trademarks of Rockwell
Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 3
Summary of Changes
This manual contains new and updated information. Changes throughout this
revision are marked by change bars, as shown to the right of this paragraph.
New and Updated
Information
This table contains the changes made to this revision.
Topic Page
Updated all web page interface screens from Series A to Series B module
firmware.
Throughout
Added references to the Stratix 5900 Security Appliance 11, 9, 51, 51
Added information about mobile clients 15
Updated information about Transport Layer Security (TLS) 1.2 11
Added new features Throughout
Added Security Configuration Parameter Descriptions 16

4Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Summary of Changes
Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 5
Table of Contents
Preface Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Chapter 1
Secure Communication Architecture
Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Local Chassis Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Network Access Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
IPsec Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Traffic Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Security Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Chapter 2
Get Started
Initial Powerup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Default Credentials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Assign Network Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Change Network Settings Via the Module Web Page. . . . . . . . . . . . 23
Create User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Bad Login Attempts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Generate HTTPS Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Backup / Restore. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Chapter 3
Configure a Secure Connection to a
Microsoft Windows Client
L2TP Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Create Windows Client Connection By Using a Windows Profile . . . 35
Configure Mobile Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configure an L2TP Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Configure a Connection from a Microsoft Windows Client . . . . . . . . . 40
Interface Metric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Open the VPN Connection to the 1756-EN2TSC Module. . . . . . . . . . 47
Communicate to the Module Via an RSLinx Driver. . . . . . . . . . . . . . . . . 49
Chapter 4
Configure Secure Communication
Between Two 1756-EN2TSC Modules
Configure the First (Local) Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Configure the Second (Remote) Module . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Test the Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Chapter 5
Configure a Secure Connection to a
VPN Appliance
Configure the Module to Connect to a VPN Appliance . . . . . . . . . . . . . 59
Edit the Security Association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

6Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Table of Contents
Chapter 6
Diagnostics
Diagnostic Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Secure Tunnel Diagnostics Web Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Link (LINK) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Network (NET) Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
OK Status Indicator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Index

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 7
Preface
The 1756-EN2TSC is a security-enhanced version of the 1756-EN2T
EtherNet/IP communication module. This module is designed for applications
that limit network access to a control system from within the plant network. This
module is not intended to connect any devices in the local 1756 backplane to
devices outside of the plant firewall.
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
You can view or download publications at
http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Allen-Bradley distributor or
Rockwell Automation® sales representative.
Resource Description
1756 ControlLogix® Communication Modules Specifications Technical Data, publication 1756-TD003 Specifications for ControlLogix communication modules
EtherNet/IP Network Configuration User Manual, publication ENET-UM001 Guidelines for configuring EtherNet/IP network parameters
EtherNet/IP Modules Installation Instructions, publication ENET-IN002 Guidelines for installing EtherNet/IP modules
Ethernet Design Considerations Reference Manual, publication ENET-RM002 Guidelines for Ethernet networks
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Guidelines for installing a Rockwell Automation industrial system
Product Certifications website, http://www.ab.com Declarations of conformity, certificates, and other certification details

8Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Preface
Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 9
Chapter 1
Secure Communication Architecture
Many control systems currently use 1756-EN2T and 1756-ENBT modules to
connect ControlLogix® systems to plant-level systems. A 1756-EN2TSC module
offers the same connectivity and additional security options that help protect
access to resources on the local backplane from the plant network. Use the
1756-EN2TSC module to establish secure tunnels with peer modules,
Windows 7 clients, and VPN appliances.
Topic Page
Local Chassis Security 12
Network Access Security 13
IPsec Association 14
Performance 15
Traffic Filtering 15

10 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
Figure 1 - 1756-EN2TSC module Establishes Secure Tunnels with Peer Modules, Windows 7 Clients,
and VPN Appliances
The 1756-EN2TSC module provides a level of protection against unauthorized
network access, either malicious or accidental, to a ControlLogix® controller via
an EtherNet/IP connection. The 1756-EN2TSC module uses the Internet
Protocol Security (IPsec) protocol suite to provide a secure communication
tunnel.
The 1756-EN2TSC module is intended for use behind an existing
firewall/DMZ that help protect the plant network from outside access. This
module is not intended to be connected directly to the public Internet or to
provide a mechanism by which remote access is provided to a network. The
module does not provide the ability to expose a private network address range via
IPsec; only the module’s IP address is available.
Enterprise Zone
Levels 4 and 5
Demilitarized Zone (DMZ)
Demilitarized Zone (DMZ)
Manufacturing Zone
Site Manufacturing
Operations and Control
Level 3
Level 0…2
Secure Tunnel Between 1756-EN2TSC
Module and Windows 7 Client.
Peer-to-peer Secure Tunnel
Between 1756-EN2TSC Modules
ControlLogix Chassis with
1756-EN2TSC Module
Secure Tunnel Between 1756-EN2TSC
Module and VPN Appliance
IMPORTANT
HMIs are not supported by the 1756-EN2TSC/B.
HMIs don’t support IPsec.

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 11
Secure Communication Architecture Chapter 1
Considerations
Out-of-the-box, the module functions just like a 1756-EN2T module, except
that the module does not support the following:
•Integrated motion on EtherNet/IP networks
•ControlLogix® redundancy systems
•SIL 2 applications
•Email capabilities
•EtherNet/IP socket interface
Once security is enabled, modules like POINT I/O™ adapters, FLEX™ I/O
adapters, and PowerFlex® drives are not able to establish a secure connection
because they do not support secure tunnels.
When security is enabled, the module connects with:
•Upper level systems and user workstations with Windows 7 operating
systems
•Stratix 5900™ Services Router
•Cisco ASA security appliances
•Other 1756-EN2TSC modules
The module supports the current versions of common web browsers, such as
Internet Explorer (8 and 9). For security reasons, Secure Sockets Layer (SSL) 2.0
and 3.0 are disabled in the module. Browsers must enable support for Transport
Layer Security (TLS) 1.2.
The 1756-EN2TSC module lets only those devices with proper credentials
access the module. This module is intended for use behind an existing
firewall/DMZ that help protects the plant network from outside access.
To minimize complexity, the module supports the following authentication and
encryption methods.
•IPsec technology with as many as eight VPN tunnels (only one of which
can be a VPN appliance.
•Mobile Client
•Pre-shared key authentication
•AES encryption (128 bit, 192 bit, and 256 bit)

12 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
Local Chassis Security
You can use the 1756-EN2TSC module with the following features to prevent
unauthorized access to a controller in the local chassis.
•The trusted slot feature (in the controller properties) designates slots in
the local chassis as trusted. When the trusted slot feature is enabled, the
controller denies communication through paths that are not trusted. This
requires authentication to the module for anyone to access the controller
with programming software.
•The serial number lock feature (in the 1756-EN2TSC module properties)
with the trusted slot features restricts communication through a module in
the trusted slot with the specific serial number.

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 13
Secure Communication Architecture Chapter 1
The trusted slot and serial number lock features are for applications that have
concern with physical access to and tampering with the controller.
Network Access Security The 1756-EN2TSC module uses the Internet Protocol Security (IPsec)
technology to provide secure communication over the Ethernet network. IPsec is
widely deployed, and is often used to create Virtual Private Networks (VPN).
IPsec provides the following security features:
•Authentication of the communication end points (both client and server)
•Data authenticity and integrity (via message integrity checks)
•Data confidentiality (via encryption algorithms)
Use of the IPsec protocol suite lets you use the Microsoft Windows VPN client
to connect securely to the module. IPsec also lets the module create secure
tunnels with other 1756-EN2TSC modules and with off-the-shelf, VPN
appliances.
While the module supports secure communication, the module is not intended
to be connected directly to the public Internet and provide a VPN function, or be
the mechanism by which remote access is provided to a network. The module
does not provide the ability to expose a private network address range via
IPsec—only the module’s IP address is available.
The module does the following:
•Secures access to the controller and I/O modules in the local chassis
•Secures bridge access to other networks accessible within the local chassis
IMPORTANT
Use caution with these features and make sure you have the controller project
backed up in a secure location. If the module becomes disabled for any reason,
you have to download to the controller to recover.
IMPORTANT
The module does not provide access to a private network.
EtherNet/IP™
RUN SD OKFORCE
Logix5575
EtherNet/IP™
DeviceNet Access Via 1756-DNB
EtherNet/IP Access Via 1756-EN2T
Secure Plant Network Access via
1756-EN2TSC
ControlLogix
Chassis

14 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
As part of establishing the secure tunnel, both endpoints must authenticate with
each other and exchange information to help ensure secure data transfer.
IPsec Association
Once the IPsec association is established, data between the two endpoints is fully
encrypted (except for produced/consumed tags) or optionally sent unencrypted,
but with a cryptographic message integrity code.
As long as the IPsec traffic is received, the connection is considered alive. Your
VPN connection can recover without having to reauthenticate if you lose your
connection for a short time (few seconds). However, if the time since the last
received packet is greater than the timeout interval, the connection times out.
This interval is common to all IPsec connections and is not configurable. The
default keepalive-timeout is 30 seconds.
Table 1 - IPsec Capability Descriptions
Capability Description
Authentication Method Pre-shared key (PSK). Configure a secret key on each of the endpoints.
Header Format Encapsulating Security Payload (ESP)
Encapsulation Mode Tunnel mode, default
Transport mode used with Microsoft Windows 7 client
Internet Key Exchange •IKE version 1
•IKE version 2
Negotiation Mode •Passive
•Active
Lifetime(s) IKE and IPsec lifetimes user-configurable
PFS Group None
DH Key Group MODP groups
•2 (1024-bit, default)
•5 (1536-bit)
•14 (2048-bit)
IKE Encryption Algorithm •AES(128 bit)
•AES(192 bit)
•AES(256 bit)
IKE Authentication Algorithm SHA-1
IPsec Encryption Algorithm •AES(128 bit)
•AES(192 bit)
•AES(256 bit)
•None
IPsec Authentication Algorithm SHA-1

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 15
Secure Communication Architecture Chapter 1
Performance The communication capability of the module is the same as the 1756-EN2T
module. The 1756-EN2TSC supports the following:
•The same number of TCP and CIP connections as the 1756-EN2T
module (256 CIP connections and 128 TCP/IP connections)
•The configuration of IPsec associations with as many as eight IP addresses
(devices); only one of which can be a VPN appliance connection
•Mobile clients
•CIP Sync communication
Traffic Filtering
When IPsec is enabled, the module blocks traffic that is not received via a VPN
client, another peer with an IPsec connection, or an appliance with an IPsec
connection, with these exceptions:
•BOOTP/DHCP traffic (to let the module obtain an IP address)
•HTTPS traffic (configure the module)
•CIP Sync packets (disable CIP Sync option)
•Logix produced/consumed tags (the establishment of the
produced/consumed connection occurs over via IPsec)
•1756 I/O connections in a remote chassis
If the 1756-EN2TSC module is the trusted slot for a ControlLogix® chassis, the
following traffic to the controller must go through the 1756-EN2TSC module.
•RSLinx® Classic traffic (such as Studio 5000® and ControlFLASH™
communication)
•RSLinx® Enterprise traffic (such as FactoryTalk® View SE and FactoryTalk®
View ME communication)

16 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
Security Configuration You can enable and disable features of the module to enhance security.
•The USB port can be disabled.
•The remote factory reset via a CIP message can be disabled.
•The remote reset via a CIP message can be disabled. When you disable the
remote reset, the ControlFlash update is also disabled.
Tab le 2 describes the IKE and IPsec SA parameters that you can configure. The
module profile dictates whether some parameters are configurable or not. There
are also other parameters that you cannot configure (some of them are displayed,
for example hash algorithm).
Table 2 - IKE and IPsec SA Parameter Descriptions
Parameter Description
General
SA Identifier IPsec security association name.
Profile Profiles have values that are preconfigured for a specific type of connection.
The generic client profile offers full customization.
•Peer-to-peer (two 1756-EN2TSC modules)
•Windows Client
•VPN Appliance (CISCO ASA 5500 series, Stratix 5900™)
Negotiation mode If active, the module tries to initiate connection. If passive, the module waits
for the other side to initiate connection.
•Passive for Windows and Mobile client
•Active for peer-to-peer and VPN Appliance
•Active or passive for Generic Client (user-selectable)
Exchange version Phase 1 (IKE) exchange version. We recommend IKEv2.
•IKEv1 Main mode for Windows and Mobile client
•IKEv2 for peer-to-peer
•IKEv1 Main mode, IKEv1 Aggressive mode, or IKEv2 for Generic Client and
VPN Appliance (user-selectable). IKEv1 Aggressive mode is faster but less
secure than Main mode.
Phase 1 (IKE negotiation)
Local device identifier
(Except Windows and Mobile client)
Identifier of this device. It must match other side remote identifier.
•IP address
•FQDN (fully qualified domain name)
•User FQDN (in form user@domain)

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 17
Secure Communication Architecture Chapter 1
Remote device identifier
(Except Windows and Mobile client)
Identifier of remote device. It must match other side local identifier.
•IP address
•FQDN (fully qualified domain name)
•User FQDN (in form user@domain)
Remote device IP address IP address of other side of IKE/IPsec connection.
Remote network IP
(Only for VPN appliance)
Base address of subnet reachable through VPN appliance tunnel.
Remote network netmask
(Only for VPN appliance)
Netmask of subnet reachable through VPN appliance tunnel.
Encryption algorithm Encryption algorithm for IKE exchange.
•AES 256 for Windows and Mobile client
•AES 128, 192, 256 otherwise (user-selectable)
Pre-shared key PSK text. Must match other side PSK.
DH groups MODP Groups 2, 5 and 14 are supported. Higher number of group offers
increased security, but requires more time and resources to establish
connection.
•At least 2 - accepts 2, 5 and 14, initiates connection with 2.
•At least 5 - accepts 5 and 14, initiates connection with 5.
•At least 14 - accepts only 14, initiates with 14.
Key life time limit After this time, Phase 1 (IKE) keys are renegotiated.
•8 hours by default for Windows and Mobile Client
•24 hours by default otherwise
•10 minutes minimum
We recommended that you use the default values.
Phase 2 (IPsec negotiation)
Encryption algorithm Encryption algorithm for data inside IPsec tunnel.
•NULL or AES 128 for Windows and Mobile client
•NULL, AES 128, 192, 256 otherwise (user-selectable)
Key life time limit After this time, Phase 2 (IPsec) keys are renegotiated.
•8 hours by default for VPN appliance
•1 hour by default otherwise
•10 minutes minimum
We recommended that you use the default values.
Key life data limit When this amount of data has been transferred inside IPsec tunnel, Phase 2
(IPsec) keys are renegotiated.
•Disabled (0) by default for Windows and Mobile Client
•100000 KiB by default for peer-to-peer and Generic Client
•4608000 KiB by default for VPN appliance
We recommended that you use the default values.
Table 2 - IKE and IPsec SA Parameter Descriptions (continued)
Parameter Description

18 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 1 Secure Communication Architecture
Notes:

Rockwell Automation Publication ENET-UM003C-EN-P - November 2015 19
Chapter 2
Get Started
This chapter describes the initial configuration settings that are required for the
module. After installing the module, see the next chapters for security
configuration examples.
For information on how to install the module, see EtherNet/IP Network
Modules Installation Instructions, publication ENET-IN002.
Add the module to a controller project the same as you add a 1756-EN2T
module. All security-related configuration is via the module web pages.
Topic Page
Initial Powerup 20
Configuration Overview 22
Assign Network Settings 23
Configuration Overview 22
Create User Accounts 25
Generate HTTPS Certificate 26
Backup / Restore 28
IMPORTANT
When you finish using the web pages, make sure to use the logout link in the
upper right corner of the web page. Close all browsers to prevent others from
potentially accessing the web pages.

20 Rockwell Automation Publication ENET-UM003C-EN-P - November 2015
Chapter 2 Get Started
Configure all security parameters via the web server. In the Address field of your
web browser, enter the IP address that displays on the front of the module.
The 1756-EN2TSC module has an embedded HTTPS server that it uses to
provide secure web communication. An HTTPS server uses a certificate so that
the client can verify server authenticity. For websites connected to the Internet,
certificates are normally signed by a trusted certificate authority. Web browsers
are then able to verify the authenticity of the web server by virtue of its certificate.
The module uses a self-signed certificate. The module uses this certificate because
the IP address is not known (at manufacture time) and cannot be signed by
certificate authority (CA). Self-signed certificates are not signed by a known,
trusted authority, so they must explicitly be accepted by you (the user) when
connecting via the web browser.
Initial Powerup On initial powerup, the module generates a new certificate for the embedded
HTTPS server. The certificate generation process can take up to a minute.
During this process, the message ‘SSL certificate generation in progress’ is shown
on the module display. Wait until the module is fully booted and ‘OK’ is shown
on the display before accessing the module by using a web browser.
1. In the Address field of your web browser, enter the IP address that displays
on the front of the module.
After the web browser connects to the server, a warning message is shown
about the certificate that is not signed by a trusted authority.
Specify the IP address of the web server
module in the Address window of your
web browser.
After you login, the Home page appears.
IMPORTANT
When you enter the IP address, you must enter the prefix https:// in the
address. If you enter an http:// prefix, the module redirects to the
https:// prefix.