Solved: ASA 5510 annoyance

Zebedee007 · ‎02-28-2012

Hi Cisco Guru's,

I hope someone can help to resolve this issue we are having with our ASA....

A little background on the setup, our LAN is connected via the inside interface (inside int & LAN are on the same subnet), we have an MPLS link connected to another interface on the ASA (mpls) with a security level of 50.

The MPLS link is for a remote site we have, all communication to this site works as it should, the only problem being I get flooded with these ASDM logs -> Deny IP Spoof from (192.168.50.31) to 192.168.102.253 on interface inside

192.168.102.253 is a core switch at the remote site.

Please see sanitised config below (possible typo's):

: Saved

!

ASA Version 8.2(5)

!

hostname UK-FW-1

domain-name company.local

enable password ********* encrypted

passwd ******** encrypted

names

name 192.168.44.0 Visitors-Wifi

name 192.168.48.0 LAN

name 192.168.50.3 Int-SFTP

name 192.168.50.133 Int-Linux_SSH

name 10.0.0.0 Servers

name 10.20.30.0 VPN

name xxx.xxx.xxx.xxx Ext-PRTG

name xxx.xxx.xxx.xxx Ext-Linux_SSH

name xxx.xxx.xxx.xxx Ext-SFTP

name 192.168.57.0 Phone-Network

name 10.255.255.248 Admin-VPN

name 172.31.0.0 Cisco-Admin

name 10.0.0.62 Int-PRTG

name 192.168.255.0 MPLS

name 192.168.103.0 Network2

name 192.168.104.0 Network3

name 192.168.105.0 Network4

name 192.168.102.0 Network1

name xxx.xxx.xxx.xxx Ext-Partner_Extranet

name 10.0.0.13 Int-Partner_Extranet

!

interface Ethernet0/0

description External Interface

nameif outside

security-level 0

ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

!

interface Ethernet0/1

description Internal Interface

nameif inside

security-level 100

ip address 192.168.50.31 255.255.248.0 standby 192.168.50.30

!

interface Ethernet0/1.5

description Visitors Wifi

vlan 5

nameif visitors

security-level 25

ip address 192.168.44.1 255.255.255.0

!

interface Ethernet0/2

description MPLS

nameif mpls

security-level 50

ip address 192.168.255.254 255.255.255.0

!

interface Ethernet0/3

description LAN/STATE Failover Interface

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

management-only

!

banner login -

banner login ACCESS IS RESTRICTED TO AUTHORIZED PERSONNEL ONLY!!

banner login -

banner motd -

banner motd ACCESS IS RESTRICTED TO AUTHORIZED PERSONNEL ONLY!!

banner motd This is a privately owned computing system.

banner motd Access is permitted only by authorized employees or agents of the company.

banner motd The system may be used only for authorized company business.

banner motd Company management approval is required for all access privileges.

banner motd This system is equipped with a security system intended to prevent and

banner motd record unauthorized access attempts.

banner motd Unauthorized access or use is a crime under the law.

banner motd -

boot system disk0:/asa825-k8.bin

ftp mode passive

clock timezone GMT/BST 0

clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00

dns domain-lookup outside

dns domain-lookup inside

dns server-group DefaultDNS

name-server 192.168.50.72

name-server 192.168.50.82

name-server 8.8.8.8

domain-name company.local

object-group service Guest-tcp-group tcp

port-object eq ftp

port-object eq ftp-data

port-object eq www

port-object eq https

port-object eq imap4

port-object eq pop3

port-object eq smtp

port-object eq ssh

object-group service Guest-udp-group udp

port-object eq domain

port-object eq ntp

object-group service PRTG-Group tcp

port-object eq https

object-group service SFTP-Group tcp

port-object eq ssh

object-group network TEST

network-object Network1 255.255.255.0

network-object Network2 255.255.255.0

network-object Network3 255.255.255.0

network-object Network4 255.255.255.0

network-object 192.168.42.0 255.255.255.0

object-group service Extranet-Group tcp

port-object eq https

port-object eq www

access-list inside_outbound_nat0_acl extended permit ip LAN 255.255.248.0 VPN 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip LAN 255.255.248.0 Admin-VPN 255.255.255.248

access-list inside_outbound_nat0_acl extended permit ip LAN 255.255.248.0 object-group TEST

access-list inside_outbound_nat0_acl extended permit ip LAN 255.255.248.0 MPLS 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip Servers 255.255.255.192 VPN 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip Servers 255.255.255.192 Admin-VPN 255.255.255.248

access-list inside_outbound_nat0_acl extended permit ip Servers 255.255.255.192 object-group TEST

access-list inside_outbound_nat0_acl extended permit ip Servers 255.255.255.192 MPLS 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip Phone-Network 255.255.255.0 VPN 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip Phone-Network 255.255.255.0 Admin-VPN 255.255.255.248

access-list inside_outbound_nat0_acl extended permit ip Phone-Network 255.255.255.0 object-group TEST

access-list inside_outbound_nat0_acl extended permit ip Phone-Network 255.255.255.0 MPLS 255.255.255.0

access-list inside_outbound_nat0_acl extended permit ip Cisco-Admin 255.255.255.224 Admin-VPN 255.255.255.248

access-list split_tunnel_acl standard permit LAN 255.255.248.0

access-list split_tunnel_acl standard permit Servers 255.255.255.192

access-list split_tunnel_acl standard permit Network1 255.255.255.0

access-list split_tunnel_acl standard permit Phone-Network 255.255.255.0

access-list split_tunnel_acl standard permit Cisco-Admin 255.255.255.224

access-list split_tunnel_acl standard permit Network2 255.255.255.0

access-list split_tunnel_acl standard permit Network3 255.255.255.0

access-list split_tunnel_acl standard permit Network4 255.255.255.0

access-list outside_access_in extended permit tcp any host Ext-PRTG object-group PRTG-Group

access-list outside_access_in extended permit tcp any host Ext-SFTP object-group SFTP-Group

access-list outside_access_in extended permit tcp any host Ext-Linux_SSH object-group SFTP-Group

access-list outside_access_in extended permit tcp any host Ext-Partner_Extranet object-group Extranet-Group

access-list outside_access_in extended permit icmp any any echo-reply

access-list outside_access_in extended permit icmp any any time-exceeded

access-list outside_access_in extended deny ip any any log

access-list visitors_access_in extended permit ip any any

access-list visitors_access_in extended deny ip any any

access-list mpls_nat0_outbound extended permit ip MPLS 255.255.255.0 LAN 255.255.248.0

access-list mpls_nat0_outbound extended permit ip MPLS 255.255.255.0 Servers 255.255.255.192

access-list mpls_nat0_outbound extended permit ip MPLS 255.255.255.0 Phone-Network 255.255.255.0

access-list mpls_nat0_outbound extended permit ip object-group TEST Admin-VPN 255.255.255.248

access-list mpls_nat0_outbound extended permit ip object-group TEST VPN 255.255.255.0

access-list mpls_nat0_outbound extended permit ip object-group TEST LAN 255.255.248.0

access-list mpls_nat0_outbound extended permit ip object-group TEST Servers 255.255.255.192

access-list mpls_nat0_outbound extended permit ip object-group TEST Phone-Network 255.255.255.0

access-list mpls_acl extended permit ip any any log

access-list mpls_acl extended permit icmp any any log

access-list mpls_acl extended deny ip Network4 255.255.255.0 any

access-list mpls_acl extended deny ip any any log

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit icmp any any

access-list inside_access_in extended deny ip any any log

pager lines 24

logging enable

logging timestamp

logging list email-alert message 716001-716002

logging list email-alert message 722022-722023

logging list email-alert message 713049

logging list email-alert message 113019

logging list email-alert message 713119-713120

logging list email-alert message 113015

logging list email-alert message 713184

logging list email-alert message 113012

logging list email-alert message 315004

logging list email-alert message 315011

logging list email-alert message 105007

logging list email-alert message 105043

logging list email-alert message 111001-111003

logging list email-alert message 111005-111006

logging list email-alert message 111008-111010

logging buffer-size 8192

logging buffered alerts

logging asdm errors

logging mail email-alert

logging from-address

from@company.com

logging recipient-address

me@somecompany.com

level notifications

mtu outside 1500

mtu inside 1500

mtu visitors 1500

mtu mpls 1500

ip local pool VPN-Pool 10.20.30.5-10.20.30.254 mask 255.255.255.0

ip local pool VPNAdmin-Pool 10.255.255.249-10.255.255.254 mask 255.255.255.248

ip local pool SSLVPN-Pool 10.20.30.2-10.20.30.4 mask 255.255.255.0

ip verify reverse-path interface outside

failover

failover lan unit primary

failover lan interface LAN/STATE Ethernet0/3

failover key *******

failover link LAN/STATE Ethernet0/3

failover interface ip LAN/STATE 1.1.1.1 255.255.255.252 standby 1.1.1.2

monitor-interface visitors

icmp unreachable rate-limit 1 burst-size 1

icmp permit any echo inside

icmp permit any echo-reply inside

icmp permit any time-exceeded inside

icmp permit any echo visitors

icmp permit any echo-reply visitors

icmp permit any time-exceeded visitors

icmp permit any echo mpls

icmp permit any echo-reply mpls

icmp permit any time-exceeded mpls

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 Cisco-Admin 255.255.255.224

nat (inside) 1 Servers 255.255.255.192

nat (inside) 1 Phone-Network 255.255.255.0

nat (inside) 1 Network1 255.255.255.0

nat (inside) 1 Network2 255.255.255.0

nat (inside) 1 Network3 255.255.255.0

nat (inside) 1 Network4 255.255.255.0

nat (inside) 1 MPLS 255.255.255.0

nat (inside) 1 LAN 255.255.248.0

nat (visitors) 1 Visitors-Wifi 255.255.255.0

nat (mpls) 0 access-list mpls_nat0_outbound

nat (mpls) 1 192.168.42.0 255.255.255.0

nat (mpls) 1 Network1 255.255.255.0

nat (mpls) 1 Network2 255.255.255.0

nat (mpls) 1 Network3 255.255.255.0

nat (mpls) 1 Network4 255.255.255.0

nat (mpls) 1 MPLS 255.255.255.0

nat (mpls) 1 LAN 255.255.248.0

static (inside,outside) Ext-PRTG Int-PRTG netmask 255.255.255.255

static (inside,outside) Ext-SFTP Int-SFTP netmask 255.255.255.255

static (inside,outside) Ext-Linux_SSH Int-Linux_SSH netmask 255.255.255.255

static (outside,inside) Int-PRTG Ext-PRTG netmask 255.255.255.255

static (outside,inside) Int-SFTP Ext-SFTP netmask 255.255.255.255

static (outside,inside) Int-Linux_SSH Ext-Linux_SSH netmask 255.255.255.255

static (inside,outside) Ext-Partner_Extranet Int-Partner_Extranet netmask 255.255.255.255

static (outside,inside) Int-Partner_Extranet Ext-Partner_Extranet netmask 255.255.255.255

static (inside,mpls) LAN LAN netmask 255.255.248.0

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group visitors_access_in in interface visitors

access-group mpls_acl in interface mpls

route inside Network1 255.255.255.0 192.168.50.13 1 track 1

route outside 0.0.0.0 0.0.0.0 86.188.161.81 1

route inside Servers 255.255.255.192 192.168.50.13 1

route inside Cisco-Admin 255.255.255.224 192.168.50.13 1

route mpls 192.168.42.0 255.255.255.0 192.168.255.1 1

route inside Phone-Network 255.255.255.0 192.168.50.13 1

route mpls Network1 255.255.255.0 192.168.255.1 254

route mpls Network2 255.255.255.0 192.168.255.1 1

route mpls Network3 255.255.255.0 192.168.255.1 1

route mpls Network4 255.255.255.0 192.168.255.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

webvpn

svc ask enable default svc

aaa-server ActiveDirectory protocol radius

aaa-server ActiveDirectory (inside) host 192.168.50.82

key *******

radius-common-pw *******

aaa authentication serial console LOCAL

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

aaa authorization command LOCAL

aaa local authentication attempts max-fail 5

aaa authorization exec authentication-server

no snmp-server location

no snmp-server contact

snmp-server community public

sysopt noproxyarp inside

sla monitor 1

type echo protocol ipIcmpEcho 192.168.102.253 interface inside

num-packets 3

frequency 10

sla monitor schedule 1 life forever start-time now

service resetoutside

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map dmap 65535 set pfs group1

crypto dynamic-map dmap 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map imap 10 ipsec-isakmp dynamic dmap

crypto map imap interface outside

crypto ca trustpoint localtrust

enrollment self

fqdn xxx.xxx.xxx.xxx

subject-name CN=xxx.xxx.xxx.xxx

keypair sslvpnkey

crl configure

crypto ca certificate chain localtrust

quit

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

!

track 1 rtr 1 reachability

no vpn-addr-assign dhcp

telnet timeout 1

console timeout 15

management-access inside

dhcpd address 192.168.44.100-192.168.44.254 visitors

dhcpd dns 8.8.8.8 8.8.4.4 interface visitors

dhcpd domain company.net interface visitors

dhcpd enable visitors

!

threat-detection basic-threat

threat-detection scanning-threat shun except ip-address 192.168.50.72 255.255.255.255

threat-detection scanning-threat shun except ip-address 192.168.50.82 255.255.255.255

threat-detection scanning-threat shun duration 3600

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server 212.13.197.135 prefer

ntp server 192.168.50.72

ssl trust-point localtrust outside

webvpn

enable outside

svc image disk0:/anyconnect-win-2.5.3055-k9.pkg 1

svc image disk0:/anyconnect-macosx-i386-2.5.3055-k9.pkg 2

svc image disk0:/anyconnect-linux-2.5.3055-k9.pkg 3

svc enable

tunnel-group-list enable

group-policy SSLVPNUsers internal

group-policy SSLVPNUsers attributes

wins-server none

dns-server value 192.168.50.72 192.168.50.82

vpn-simultaneous-logins 3

vpn-idle-timeout 30

vpn-session-timeout 240

vpn-tunnel-protocol webvpn

group-lock value SSLVPN

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel_acl

default-domain value company.local

address-pools value SSLVPN-Pool

webvpn

svc ask none default svc

customization value DfltCustomization

group-policy DfltGrpPoicy internal

group-policy DfltGrpPoicy attributes

dns-server value 192.168.50.72 192.168.50.82

group-policy VPNAdmin internal

group-policy VPNAdmin attributes

dns-server value 192.168.50.72 192.168.50.82

vpn-simultaneous-logins 6

vpn-idle-timeout 15

vpn-session-timeout 120

vpn-tunnel-protocol IPSec l2tp-ipsec webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel_acl

default-domain value company.local

group-policy VPNUsers internal

group-policy VPNUsers attributes

dns-server value 192.168.50.72 192.168.50.82

vpn-simultaneous-logins 200

vpn-idle-timeout 60

vpn-session-timeout 480

vpn-tunnel-protocol IPSec l2tp-ipsec webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel_acl

default-domain value company.local

group-policy VPNRadius internal

group-policy VPNRadius attributes

dns-server value 192.168.50.72 192.168.50.82

vpn-simultaneous-logins 250

vpn-idle-timeout 60

vpn-session-timeout 480

vpn-tunnel-protocol IPSec l2tp-ipsec webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel_acl

default-domain value company.local

vpn-group-policy VPNUsers

service-type remote-access

tunnel-group DefaultWEBVPNGroup general-attributes

authentication-server-group ActiveDirectory

tunnel-group VPNUsers type remote-access

tunnel-group VPNUsers general-attributes

address-pool VPN-Pool

default-group-policy VPNUsers

tunnel-group VPNUsers ipsec-attributes

pre-shared-key *********

tunnel-group VPNRadius type remote-access

tunnel-group VPNRadius general-attributes

address-pool VPN-Pool

authentication-server-group ActiveDirectory

default-group-policy VPNRadius

tunnel-group VPNRadius ipsec-attributes

pre-shared-key *********

tunnel-group VPNAdmin type remote-access

tunnel-group VPNAdmin general-attributes

address-pool VPNAdmin-Pool

default-group-policy VPNAdmin

tunnel-group VPNAdmin ipsec-attributes

pre-shared-key **********

tunnel-group SSLVPN type remote-access

tunnel-group SSLVPN general-attributes

address-pool SSLVPN-Pool

authentication-server-group ActiveDirectory

default-group-policy SSLVPNUsers

tunnel-group SSLVPN webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

class-map qos

match access-list visitors_access_in

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect xdmcp

inspect icmp

inspect ip-options

class class-default

set connection decrement-ttl

policy-map qos

class qos

police input 5000000

police output 5000000

!

service-policy global_policy global

service-policy qos interface visitors

smtp-server xxx.xxx.xxx.xxx

prompt hostname context

no call-home reporting anonymous

: end

Many thanks in advance.

Zeb.

johuggin · ‎02-29-2012

Zeb,

Your issue is with the SLA monitor and tracking...

-----------

name 192.168.102.0 Network1

route inside Network1 255.255.255.0 192.168.50.13 1 track 1

route mpls Network1 255.255.255.0 192.168.255.1 254

track 1 rtr 1 reachability

sla monitor 1

type echo protocol ipIcmpEcho 192.168.102.253 interface inside

num-packets 3

frequency 10

sla monitor schedule 1 life forever start-time now

-----------

You're tracking an inside route to Network1 using the inside interface but the ping test is going to the core switch at 192.168.102.253 which is in the mpls network. This is impossible.

Turn off your SLA monitor and I bet the logs stop.

I'm not sure what requirement you are trying to meet with the tracking. Either 192.168.102.0/24 is off the inside interface or its off the mpls interface. It can not be both.

View solution in original post

johuggin · ‎02-28-2012

Zeb,

You've got some NAT statements setup for inside > MPLS traffic.. do you have any normal, expected traffic to the core switch at 192.168.102.253? If so, what kind of traffic is it?

Are you getting any other logs in about the same frequency as the deny IP spoofs?

Thanks

Joey

Zebedee007 · ‎02-29-2012

Hi Joey,

We have servers at both sites running file backups etc. however the core switch shouldn't be getting any other traffic.

The backup generally runs for an hour or so late in the evening, so seeing these logs is very strange.

These 2 log shows up in between the IP spoof logs

-> 192.168.50.13 Denied ICMP type=5, code=0 from 192.168.50.13 on interface inside

-> 192.168.50.31 4527 192.168.102.253 0 Built outbound ICMP connection for faddr 192.168.102.253/0 gaddr 192.168.50.31/4527 laddr 192.168.50.31/4527

I do have an IP SLA Monitor set up on the ASA that pings 192.168.102.253, but those pings shouldn't be coming from 192.168.50.13

Many thanks.

Zeb.

johuggin · ‎02-29-2012

Zeb,

Your issue is with the SLA monitor and tracking...

-----------

name 192.168.102.0 Network1

route inside Network1 255.255.255.0 192.168.50.13 1 track 1

route mpls Network1 255.255.255.0 192.168.255.1 254

track 1 rtr 1 reachability

sla monitor 1

type echo protocol ipIcmpEcho 192.168.102.253 interface inside

num-packets 3

frequency 10

sla monitor schedule 1 life forever start-time now

-----------

You're tracking an inside route to Network1 using the inside interface but the ping test is going to the core switch at 192.168.102.253 which is in the mpls network. This is impossible.

Turn off your SLA monitor and I bet the logs stop.

I'm not sure what requirement you are trying to meet with the tracking. Either 192.168.102.0/24 is off the inside interface or its off the mpls interface. It can not be both.

Zebedee007 · ‎02-29-2012

Joey,

Many thanks for your answer, you were spot on total genius......

The reason the IP SLA Monitor was set up was to swap the route from inside to mpls, the remote site gets pulled down and moved back to the factory on a regular basis (we are a motorsport team) & it is then connected to the inside lan on a Vlan.

We were trying to get the route change automated as to not make our lives to complex.

If you have any ideas how I can do this, I would love to hear them.

Many many thanks for helping with the ip spoof issue.

Zeb.

johuggin · ‎02-29-2012

Zeb,

Glad I could help!

It's possible that your SLA monitoring could do the job you want it to do. Obviously right now the 192.168.102.x network is off the mpls interface, but if it were suddenly available via the inside, the SLA monitor might indeed install the inside route and all would be well again.

The problem with the logs is just because the SLA monitor will continue to try pinging 192.168.102.253 from the inside even if it's not there. So you'll continue to get weird log messages.

That being said, the SLA monitor setup may work, but you'll have to deal with the fact that the ASA is going to complain that something isn't right.

Thanks!

Joey

Zebedee007 · ‎02-29-2012

Joey,

I am thinking of reducing num-packets & set frequency to 10-15 minutes or so, that way I should olny get a few logs now and again.

Now I know what is causing the issue it isn't so worrying!

I very much appreciate your help and input on this matter.

Cheers,

Zeb.