on 03-17-2015 10:49 AM
Policy Based Tunnel Selection feature, as the name indicates, is made up of two parts - one policy definition (or classification), and, Tunnel configuration. Hence, it will be much easier to troubleshoot any problems with this issue, if these two parts are analyzed individually.
PBTS feature is implemented using PBR (Policy Based Routing) infrastructure/framework, and as such the keyword 'pbr' is used in all CLI commands. (Note that same set of commands are used for other features implemented using PBR infrastructure. HTTP Redirect feature is one such example). (The term PBR and PBTS are used inter-changeably in this document, but they refer to the PBTS feature).
Enabling and collecting debug logs for PBR Classification
Before discussing the steps to perform basic validation/troubleshooting, it is important to describe the procedure to collect debug logs for PBTS. The following commands are used to turn on the PBR debugs.
#debug pbr all
#debug policymgr all
#debug pbr-pal all location <line-card-location>
Note that, just like any other IOS-XR feature, the debugs are disabled by default. This means that the following steps need to be executed to collect debug information.
1) Remove the PBR service policy from the ingress interface (if it is already applied) via 'no service-policy type pbr input <policy-name>' command.
2) Clear left over logs via 'clear log' command
3) Enable the debug, via above described debug commands
4) Apply the PBR service policy via 'service-policy type pbr input <policy-name>' command
5) Collect logs via 'sh log' command
6) Disable debugs via 'undebug all' command
Steps to troubleshoot PBR Classification
1) Make sure that PBR policy is configured and applied to the ingress interface properly via the following commands :
RP/0/RSP0/CPU0:ios#sh running-config interface gigabitEthernet 0/3/0/0
Fri Feb 8 20:59:31.325 UTC
interface GigabitEthernet0/3/0/0
service-policy type pbr input prec
ipv4 address 80.80.80.1 255.255.255.0
!
RP/0/RSP0/CPU0:ios#sh running-config policy-map type pbr prec
Fri Feb 8 20:59:35.431 UTC
policy-map type pbr prec
class type traffic pre-2
set forward-class 2
!
class type traffic class-default
!
end-policy-map
RP/0/RSP0/CPU0:ios#sh running-config class-map type traffic pre-2
Fri Feb 8 20:59:39.143 UTC
class-map type traffic match-any pre-2
match access-group ipv4 pre-1
end-class-map
!
If there is a failure during configuration, enable the debugs and collect logs (Refer Enabling and collecting debug logs section).
2) If the configuration is present, but the classification still doesn't work, check if the packets are classified to the correct class, via the following commands :
RP/0/RSP0/CPU0:ios#sh policy-map type pbr interface gigabitEthernet 0/3/0/0
Fri Feb 8 21:31:55.254 UTC
GigabitEthernet0/3/0/0 input: prec
Policy Name: prec
Class pre-2
Classification statistics (packets/bytes) (May be 10secs old)
Matched : 0/0
Transmitted statistics (packets/bytes) (May be 10secs old)
Total Transmitted : 0/0
Class class-default
Classification statistics (packets/bytes) (May be 10secs old)
Matched : 0/0
RP/0/RSP0/CPU0:ios#sh pbr-pal interface gigabitEthernet 0/3/0/0 location 0/3/cpu0
Fri Feb 8 21:35:53.141 UTC
Interface:GigabitEthernet0/3/0/0 Underlying interface:Unknown Port:0
uidb_index:2 uidb_policy_map_id:40964 uidb_tcam_format:15
Policy:prec Num Classes:8
Flags:: Bundle:0 km_unique:1
--------------------------------------------------
Class:0 ACL:pre-2 fwd_class_id:2
Stats Ptr: 0x5302b8 Pkts: 0, Bytes: 0
--------------------------------------------------
Class:7 ACL: fwd_class_id:0
Stats Ptr: 0x5302bf Pkts: 0, Bytes: 0
- If the traffic is matched to incorrect class, check if the traffic pattern/keys match with the policy configured on the interface, and the keys are supported in 4.3.1 release. If they match, check if the PBR/QOS feature ordering is set correctly using the following command :
RP/0/RSP0/CPU0:ios#sh running-config | incl apply
Fri Mar 29 18:28:22.773 UTC
Building configuration...
service-policy apply-order qos pbr
RP/0/RSP0/CPU0:ios#
RP/0/RSP0/CPU0:ios#sh controllers np portmap all | incl GigE0/3/0/0
Fri Mar 29 18:32:44.582 UTC
16 GigE0/3/0/0 63 (unmapped)
RP/0/RSP0/CPU0:ios#sh controllers np configSram 16 np0 location 0/3/cpu0 | incl PBR
Fri Mar 29 18:32:46.541 UTC
Qos before PBR 0x1
RP/0/RSP0/CPU0:ios#
Note that, by default, PBR feature is processed before QOS. Make sure the configuration matches what the customer wants to do. If still packets are classified to incorrect class , then proceed to next step.
- If the traffic is not matched to any traffic, check and make sure the ingress interface is the correct one, and the PBTS feature itself is supported in 4.3.1 release. If the interface is correct/supported one, then, proceed to next step.
3) Collect the hardware state of the PBR feature using the following commands, while the system is in failed state.
RP/0/RSP0/CPU0:ios#sh uidb data location 0/3/cpu0 gigabitEthernet 0/3/0/0 ingress | incl PBR
Fri Mar 29 18:54:22.145 UTC
PBR Enable 0x1
RP/0/RSP0/CPU0:ios#
RP/0/RSP0/CPU0:ios#sh pbr-pal km policy prec vmr interface gigabitEthernet 0/3/0/0 hw
Fri Feb 8 21:36:21.142 UTC
================================================================================
B : type & id E : ether type VO : vlan outer VI : vlan inner
Q : tos/exp/group X : Reserved DC : discard class Fl : flags
F2: L2 flags F4: L4 flags SP/DP: L4 ports
T : IP TTL D : DFS class# L : leaf class#
Pl: Protocol G : QoS Grp M : V6 hdr ext. C : VMR count
================================================================================
policy name prec and format type 0
Total Ingress TCAM entries: 7
|B Q T Fl Pl SP DP G IPv4 SA IPv4 DA
================================================================================
V|A004 20 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=0 11000200 00000000 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 60 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=1 11000100 00000001 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 80 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=2 11000200 00000002 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 A0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=3 11000100 00000003 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 C0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=4 11000200 00000004 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 E0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=5 11000100 00000005 00000000 00000000 00000000 00000000 00000000 00000000
V|A004 00 00 00 00 0000 0000 00 00000000 00000000
M|0003 FF FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=6 11000000 00000007 00000000 00000000 00000000 00000000 00000000 00000000
================================================================================
Total Ingress and Egress TCAM entries: 7
RP/0/RSP0/CPU0:ios#sh pbr-pal km policy prec vmr interface gigabitEthernet 0/3/0/0 sw
Fri Feb 8 21:36:27.454 UTC
================================================================================
B : type & id E : ether type VO : vlan outer VI : vlan inner
Q : tos/exp/group X : Reserved DC : discard class Fl : flags
F2: L2 flags F4: L4 flags SP/DP: L4 ports
T : IP TTL D : DFS class# L : leaf class#
Pl: Protocol G : QoS Grp M : V6 hdr ext. C : VMR count
================================================================================
policy name prec and format type 0
Total Ingress TCAM entries: 7
|B Q T Fl Pl SP DP G IPv4 SA IPv4 DA
================================================================================
V|A004 20 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=0 D=0 L=0
V|A004 60 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=1 D=1 L=1
V|A004 80 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=2 D=2 L=2
V|A004 A0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=3 D=3 L=3
V|A004 C0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=4 D=4 L=4
V|A004 E0 00 00 00 0000 0000 00 00000000 00000000
M|0000 1F FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=5 D=5 L=5
V|A004 00 00 00 00 0000 0000 00 00000000 00000000
M|0003 FF FF FF FF FFFF FFFF FF FFFFFFFF FFFFFFFF
R| C=6 D=7 L=7
=========================================================================
Total Ingress and Egress TCAM entries: 7
RP/0/RSP0/CPU0:ios#sh pbr-pal km policy prec info location 0/3/cpu0
Fri Feb 8 21:36:08.005 UTC
KM policy info
name prec
pnum = 1 ingress_format = 0 egress_format = 35 km policy flags = 0x00004000 class# = 8
ref# = 1 num_intfs = 1
Interface Details
=================
No. Interface Name VMR ID
GigabitEthernet0/3/0/0 3
RP/0/RSP0/CPU0:ios#sh pbr-pal ha state location 0/3/cpu0
Fri Feb 8 21:37:26.426 UTC
SYSDB path: ha/state
PBR_EA state: process pbr_ma_ea
sm state 1 event 0 prm_up 1 uidb_up 1 np_up 1 iir_eor 1 defer_qsize 0
RP/0/RSP0/CPU0:ios#sh pbr-pal ha chkpt all info location 0/3/cPU0
Fri Feb 8 21:37:44.043 UTC
Table: name KM LABEL (1) tblid 7936 ver 1 rec_len 164 info_len 0 indexed 0 remote 0 varec 0
nobj 1 max_entries 2048
Table: name IF PBR (2) tblid 7680 ver 1 rec_len 128 info_len 0 indexed 0 remote 0 varec 0
nobj 1 max_entries 32000
Table: name IF CLASS (3) tblid 7424 ver 1 rec_len 840 info_len 0 indexed 0 remote 0 varec 0
nobj 8 max_entries 196000
RP/0/RSP0/CPU0:ios#sh pbr-pal ha chkpt 1 all location 0/3/cpu0
Fri Feb 8 21:38:01.368 UTC
KM LABEL: objid 12248, size 840 chan_id 0 pnum 1 in_tcam 1 num_ent 7 ent_sz 18 policy prec
vmr id 3 dev 0 lt 2 app 5 nr_ent 7 keysize 0 result_size 32
RP/0/RSP0/CPU0:ios#
RP/0/RSP0/CPU0:ios#sh prm server tcam summary 144-LT PBR all location 0/3/cpu0
Fri Mar 29 18:58:20.465 UTC
Node: 0/3/CPU0:
----------------------------------------------------------------
TCAM summary for NP0:
TCAM Logical Table: TCAM_LT_ODS2 (2), free entries: 16436, resvd 128
ACL Common Region: 0 entries allocated. 0 entries free
Application ID: NP_APP_ID_PBR (5)
Total: 1 vmr_ids, 7 active entries, 7 allocated entries.
TCAM summary for NP1:
TCAM Logical Table: TCAM_LT_ODS2 (2), free entries: 16443, resvd 128
ACL Common Region: 0 entries allocated. 0 entries free
Application ID: NP_APP_ID_PBR (5)
Total: 0 vmr_ids, 0 active entries, 0 allocated entries.
In addition, to the above commands, it will be best to capture the debug logs, by following the procedure listed in the Enabling and collecting Debug Logs Section.
Most of the troubleshooting techniques used for FIB/MPLS/MPLS-TE in IOS-XR are applicable for PBTS as well, as PBTS just enhances the basic forwarding, through the use of 'forward-class' element. This section assumes that the user has already confirmed the working of PBR classification and confirmed that the correct forward-class is being derived for the given traffic. (If this is not the case, pl. refer to 'TROUBLESHOOTING POLICY-DEFINITION PART OF PBTS section).
Collecting Debug Logs
FIB module makes use of tracing infrastructure, so by default, tracing is enabled. The following commands output the captured tracing information.
sh cef ipv4 platform trace common both all loca <LC>
sh cef mpls platform trace common both all loc <LC>
show cef platform trace all all location <LC>
Steps to troubleshoot PBTS Tunnel configuration
1) Make sure the MPLS-TE tunnels are configured and they are UP. Pl. refer to MPLS-TE document for detailed set of commands, but the following commands are applicable/relevant to PBTS feature :
RP/0/RSP0/CPU0:ios#sh cef 6.6.6.6 hardware ingress location 0/0/cpu0
Fri Feb 8 18:10:22.866 UTC
6.6.6.6/32, version 180, internal 0x4004001 (ptr 0x8a39ef64) [2], 0x0 (0x89c826f0), 0x440 (0x8cec9050)
Updated Feb 8 17:59:52.434
Prefix Len 32, traffic index 0, precedence n/a, priority 1
via 6.6.6.6, tunnel-te61, 7 dependencies, weight 0, forward class 1 [flags 0x0]
path-idx 0 [0x896fa948 0x8a1bc8e0]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te62, 5 dependencies, weight 0, forward class 2 [flags 0x0]
path-idx 1 [0x896faa98 0x8a1bc640]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te63, 5 dependencies, weight 0, class 0 [flags 0x0]
path-idx 2 [0x896fbf98 0x8a1bca30]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te64, 5 dependencies, weight 0, forward class 2 [flags 0x0]
path-idx 3 [0x896fbcf8 0x8a1bcb80]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
RP/0/RSP0/CPU0:ios#sh running-config interface tunnel-te 1
Fri Mar 29 20:35:56.524 UTC
interface tunnel-te1
ipv4 unnumbered Loopback33
signalled-bandwidth 1000
autoroute announce
destination 66.66.66.66
forward-class 1
path-option 1 explicit identifier 1
!
RP/0/RSP0/CPU0:ios#sh ip int br
Fri Mar 29 20:36:16.564 UTC
Interface IP-Address Status Protocol
Loopback33 33.33.33.33 Up Up
Loopback44 44.44.44.44 Up Up
tunnel-te1 33.33.33.33 Up Up
tunnel-te2 33.33.33.33 Up Up
tunnel-te3 33.33.33.33 Up Up
RP/0/RSP0/CPU0:ios#sh int tunnel-te 3 accounting
Fri Mar 29 20:46:03.794 UTC
tunnel-te3
Protocol Pkts In Chars In Pkts Out Chars Out
IPV4_UNICAST 0 0 70484 4246428
Note that only requirements for PBTS is to configure the 'forward-class' interface command for each MPLS-TE that must be part of PBTS feature. If the above commands confirm that MPLS-TEs are properly configured and UP, and, if the PBTS feature is still not functional, then, proceed to the next step.
2) Collect the hardware state of the FIB entry using the following command :
RP/0/RSP0/CPU0:ios#sh cef 6.6.6.6 hardware ingress location 0/0/cpu0
Fri Feb 8 18:10:22.866 UTC
6.6.6.6/32, version 180, internal 0x4004001 (ptr 0x8a39ef64) [2], 0x0 (0x89c826f0), 0x440 (0x8cec9050)
Updated Feb 8 17:59:52.434
Prefix Len 32, traffic index 0, precedence n/a, priority 1
via 6.6.6.6, tunnel-te61, 7 dependencies, weight 0, forward class 1 [flags 0x0]
path-idx 0 [0x896fa948 0x8a1bc8e0]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te62, 5 dependencies, weight 0, forward class 2 [flags 0x0]
path-idx 1 [0x896faa98 0x8a1bc640]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te63, 5 dependencies, weight 0, class 0 [flags 0x0]
path-idx 2 [0x896fbf98 0x8a1bca30]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
via 6.6.6.6, tunnel-te64, 5 dependencies, weight 0, forward class 2 [flags 0x0]
path-idx 3 [0x896fbcf8 0x8a1bcb80]
next hop 6.6.6.6
local adjacency
local label 16005 labels imposed {ImplNull}
LEAF - HAL pd context :
sub-type : IPV4, ecd_marked:0, has_collapsed_ldi:0, collapse_bwalk_required:0, ecdv2_marked:0
Leaf H/W Result:
Physical Result: 0x11d50200 (LE)
Raw Data0: 0x11810009 c0030000 00000000 00000000
Raw Data1: 0x00000000 00000000 00200000 00000000
leaf_resolve_control_byte0
reserved: 0 match: 1 valid: 1
txadj_internal: 0
recursive: 0
rec_fs: 0
leaf_resolve_control_byte1
fwd: 1 default_rte: 0
dc_rte: 0
ifib_lookup: 0
fast_switch: 0
feature_lkup: 0
igp_pref: 0 non_recursive: 1
leaf_resolve_control_byte2
more_features: 0
bgp_pa_valid: 0
fast_switch: 0
ecmp_size: 9
non_recursive_fwd_entry
ldi_ptr: 0xc00300 (LE)
prefix_length: 20
QPPB Prec: 0 QPPB Prec_valid: 0
QPPB QOS Group: 0 QPPB QOS Group_valid: 0
l2tpv3ov6_xid: 0, cookie bits Hi: 0 Lo: 0 (size 0 bytes)
l2tpv3ov6_leaf_adj: 0
l2tpv3ov6_de_cookie_lo: 0
l2tpv3ov6_de_cookie_hi: 0
PBTS NR-LDI H/W Result for path 4 [Common to all NPs: index: 0x3c4 (BE)]
Raw Data0: 0x31060003 000300c0 03000000 00000000
Raw Data1: 0x00000000 00000000 00000000 00000000 PBTS LDI:
ecmp size : 0x3 nr_ldi_base : 0x300 (LE)
pbts_ldi_base: 0xc00300 (LE)
PBTS NR-LDI H/W Result for path 5 [Common to all NPs: index: 0x3c5 (BE)]
Raw Data0: 0x31060003 000300c0 03000000 00000000
Raw Data1: 0x00000000 00000000 00000000 00000000 PBTS LDI:
ecmp size : 0x3 nr_ldi_base : 0x300 (LE)
pbts_ldi_base: 0xc00300 (LE)
PBTS NR-LDI H/W Result for path 6 [Common to all NPs: index: 0x3c6 (BE)]
Raw Data0: 0x31060003 000300c0 03000000 00000000
Raw Data1: 0x00000000 00000000 00000000 00000000 PBTS LDI:
ecmp size : 0x3 nr_ldi_base : 0x300 (LE)
pbts_ldi_base: 0xc00300 (LE)
PBTS NR-LDI H/W Result for path 7 [Common to all NPs: index: 0x3c7 (BE)]
Raw Data0: 0x31060003 000300c0 03000000 00000000
Raw Data1: 0x00000000 00000000 00000000 00000000 PBTS LDI:
ecmp size : 0x3 nr_ldi_base : 0x300 (LE)
pbts_ldi_base: 0xc00300 (LE)
NR-LDI H/W Result for path 0 [index: 0x300 (BE), common to all NPs]:
Raw Data0: 0x110a00ff 0d000000 00000000 00000000
Raw Data1: 0x00000008 00050000 00e00000 00000000
ldi_resolve_control_byte0:
bvi: 0 reserved: 0
match: 1 valid: 1
txadj_internal: 0
ldi_resolve_control_byte1:
mldp: 0 default_action: 1
rx_adj: 0 te_IpFrr_adj: 1
label_1_valid: 0 label_2_valid: 0
local_label_valid: 0 ldpBkup_label_valid: 0
ldi_resolve_control_byte2:
pwhe_nrldi: 0 spare: 0
ipldp_FRR_TE: 0 bvi: 0
np_bit_map: 0xff
label_stats_index: 0x0
igp_local_label:
label_msb: 0 label_lsb: 0
exp: 0 eos: 0
output_label:
label_msb: 0 label_lsb: 0
exp: 0 eos: 0
Adj (te_nh):
te_nh_adj_ptr: 0xd00 (LE)
te_nh_control:
reserved: 0 doNotIncStatsIng: 0
isMPinNR_LDI: 0 uturn_check: 0
backup_LDP_label:
label_msb: 0(null) exp: 0(null) eos: 0
PQ_label:
label: 0(null) exp: 0 eos: 0
In addition to the above output, it is important to collect the debug logs using the commands listed in the Collecting Debug Logs section.
Xander,
Great article. I wonder these Troubleshooting commands are still relevant on version 5.3.3.
hi jm,
they sure are :) yup can still use them,
cheers!
xander
Xander,
I wonder whether PBTS is now supported on satellite interfaces on 5.3.3 code?
The configuration is accepted as below, however the show policy output says not installed. the router is running 5.3.3 with sp3, and satellite 9000v with 533.101
interface GigabitEthernet100/0/0/2
service-policy type pbr input POLICY_INET_TRAFFIC
RP/0/RSP0/CPU0:CIPC4-Lab#sh policy-map type pbr int gigabitEthernet 100/0/0/2
GigabitEthernet100/0/0/2 direction input: Service Policy not installed
Thanks,
Mei
I believe not yet. Is there a business to support it, let us know.
Cheers,
Dinesh
is using PBR/policy based routing an option?
with that we can define classification criteria provided by PBR and set the next hop to be the remote tunnel endpoint and force tunnel selection based on that?
cheers!!
xander
Thanks xander for your suggestion. But that will be a complete routing redesign and additional set of tunnel creation which we would prefer to avoid.
Could you advise where on road map now for PBTS to be available on satellite interfaces?
Thanks,
Mei
hi mei,
the way we implemented PBTS is by means of PBR selection, this will work on satellite interfaces also since that is driven out of the a9k host.
is there a func missing in PBR that you need the selection for? if so, yeah as per dinesh, let us know what the func is and what the use case is so we can pursue it (possibly)...
xander
Hi xander,
TAC Engineer [Rahul Kukreja] just informed me this other command "show policy-map type pbr interface all" to use, and it shows policy-map pbr IS installed on satellite interface, further we verified the feature is functioning on satellite interfaces.
As long as the function is there, we can live with and get used to this other verification command.
Cheers.
Mei
sh policy-map type pbr interface all
Wed Oct 5 22:37:01.478 UTC
node0_0_CPU0:
GigabitEthernet100/0/0/2 input: POLICY_INET_TRAFFIC
Policy Name: POLICY_INET_TRAFFIC
Class INET-TRAFFIC
Classification statistics (packets/bytes) (May be 10secs old)
Matched : 105/12382
Transmitted statistics (packets/bytes) (May be 10secs old)
Total Transmitted : 105/12382
Class class-default
Classification statistics (packets/bytes) (May be 10secs old)
Matched : 65949/5643415
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: