WEBVTT

1
00:00.000 --> 00:03.920
All right, let's go ahead and start with iOS Xe. We're going to start with the

2
00:03.920 --> 00:07.340
modern platform because chances are this is where everybody is migrating

3
00:07.340 --> 00:07.720
towards.

4
00:07.720 --> 00:11.460
But again, as always, it's important for us to understand how arrow s works.

5
00:11.460 --> 00:16.660
What we'll find is that this iOS Xe interface, the graphical user interface,

6
00:16.660 --> 00:20.800
this was largely based on how arrow s was configured.

7
00:20.800 --> 00:23.790
And so once we learn our way around one of these, we can pretty well figure out

8
00:23.790 --> 00:27.000
our way around the other one, just keeping in mind on the back end.

9
00:27.000 --> 00:30.430
And I was Xe does things just a little bit different than arrow s at times,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.000 --> 00:30.430
And I was Xe does things just a little bit different than arrow s at times,

10
00:30.430 --> 00:34.120
even if the end user experience and ultimately the security protocols that we

11
00:34.120 --> 00:37.000
're configuring are going to be the same between them.

12
00:37.000 --> 00:40.000
So the way we do this is we go to configuration.

13
00:40.000 --> 00:45.000
And we're going to go over here to our WLANs so under tags and profiles WLANs.

14
00:45.000 --> 00:50.000
And I've just removed the WLAN that we made earlier.

15
00:50.000 --> 00:55.250
I'm just going to create a new one. So we're going to call this CBT and let's

16
00:55.250 --> 00:56.000
just go ahead and call this iOS Xe.

17
00:56.000 --> 01:01.000
So we can differentiate here. And so I'm going to copy that and just whoops.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:56.000 --> 01:01.000
So we can differentiate here. And so I'm going to copy that and just whoops.

18
01:01.000 --> 01:05.000
That's right. It automatically assumes the SSID is going to be the same.

19
01:05.000 --> 01:08.520
And so we'll just leave it like that. I'm going to enable it. Always very

20
01:08.520 --> 01:10.000
important that we remember to enable it.

21
01:10.000 --> 01:14.410
And we go over to the security tab. Now, before when we were just getting this

22
01:14.410 --> 01:18.470
online, we just said none over here and get rid of most of the options down

23
01:18.470 --> 01:19.000
here.

24
01:19.000 --> 01:23.150
We're going to want to use one of these options. Let's just go ahead and go

25
01:23.150 --> 01:26.000
through these and kind of talk through them.

26
01:26.000 --> 01:29.590
So again, at the top here, we do see some sub tabs. We've got layer two

27
01:29.590 --> 01:31.000
security, layer three security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:29.590 --> 01:31.000
security, layer three security.

28
01:31.000 --> 01:35.460
This would be our web auth. So we'd want to enable web policy here and triple A

29
01:35.460 --> 01:39.000
, which is going to be important for us when we're configuring 802.1x.

30
01:39.000 --> 01:43.340
So coming over to layer two, the first thing we have to do is to do is decide

31
01:43.340 --> 01:46.000
which version of WPA we're going to run.

32
01:46.000 --> 01:49.580
Now again, none over here would just disable layer two security and there's a

33
01:49.580 --> 01:51.000
place for that static web.

34
01:51.000 --> 01:55.280
There is absolutely no place for that. We should never configure static web

35
01:55.280 --> 01:58.000
outside of very peculiar requirements.

36
01:58.000 --> 02:03.700
Instead, we should really be focusing in on either WPA two plus and well, plus
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:58.000 --> 02:03.700
Instead, we should really be focusing in on either WPA two plus and well, plus

37
02:03.700 --> 02:05.000
and WPA three.

38
02:05.000 --> 02:10.000
This would be again, WPA three running backwards compatible with WPA two.

39
02:10.000 --> 02:15.970
Or we could do WPA three alone. We could go WPA and WPA two if there's a real

40
02:15.970 --> 02:17.000
need again.

41
02:17.000 --> 02:22.100
I've seen medical environments with very old equipment like IV pumps that

42
02:22.100 --> 02:23.000
require WPA.

43
02:23.000 --> 02:26.000
That would be a scenario where we just would have to enable it.

44
02:26.000 --> 02:30.000
But we see we can't get WPA and WPA three running at the same time.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:26.000 --> 02:30.000
But we see we can't get WPA and WPA three running at the same time.

45
02:30.000 --> 02:34.000
So we just have to pick the one that makes the most sense again for most of us.

46
02:34.000 --> 02:39.000
That will be backward compatibility with WPA two for the reasons we discussed.

47
02:39.000 --> 02:44.000
If we can go full on WPA three, then that's a wonderful thing if we can.

48
02:44.000 --> 02:47.000
So we're going to start with our pre shared key configuration.

49
02:47.000 --> 02:50.540
Again, when we looked at our options, our methods, we started with pre shared

50
02:50.540 --> 02:51.000
key.

51
02:51.000 --> 02:55.660
So we're going to scroll down here and this authentication key management is

52
02:55.660 --> 02:58.000
going to be one of the primary configuration boxes.

53
02:58.000 --> 03:00.000
We're going to spend a lot of time in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:58.000 --> 03:00.000
We're going to spend a lot of time in.

54
03:00.000 --> 03:04.000
And the reason for that is because we're going to enable 802.1x in here.

55
03:04.000 --> 03:06.000
We're going to enable pre shared key.

56
03:06.000 --> 03:10.000
We do see some options, some other options in here as well.

57
03:10.000 --> 03:13.000
In fact, let's just go ahead and talk about some of these.

58
03:13.000 --> 03:20.000
So real quick, we have Cisco centralized key management or CCKM.

59
03:20.000 --> 03:25.200
CCKM was a way to share credentials between access points which would stream

60
03:25.200 --> 03:26.000
line our roaming process.

61
03:26.000 --> 03:30.610
But as we see here, Cisco is going to deprecate that because it's kind of old
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
03:26.000 --> 03:30.610
But as we see here, Cisco is going to deprecate that because it's kind of old

62
03:30.610 --> 03:33.000
at this point and we really shouldn't be using it.

63
03:33.000 --> 03:38.320
Instead, we should be using fast transition, which is the industry standard 802

64
03:38.320 --> 03:45.310
.11r and it allows us to very seamlessly roam bypassing credentials between

65
03:45.310 --> 03:46.000
access points.

66
03:46.000 --> 03:48.000
It's the same thing that Cisco's solution did.

67
03:48.000 --> 03:51.000
We just don't need Cisco's proprietary solution anymore.

68
03:51.000 --> 03:53.000
So that's where we see FT down here.

69
03:53.000 --> 03:54.000
FT is talking about fast transition.

70
03:54.000 --> 03:58.550
So maybe I'd want fast transition with pre shared key or fast transition with

71
03:58.550 --> 04:00.000
802.1x.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:58.550 --> 04:00.000
802.1x.

72
04:00.000 --> 04:01.000
So these are our options.

73
04:01.000 --> 04:03.000
We also see a couple of other acronyms.

74
04:03.000 --> 04:08.150
We see OWE, which is opportunistic wireless encryption, and we see SAE, the

75
04:08.150 --> 04:10.000
simultaneous authentication of equals.

76
04:10.000 --> 04:14.000
These are WPA3 concepts and they're actually pretty cool.

77
04:14.000 --> 04:18.000
SAE is basically a new version of pre shared key.

78
04:18.000 --> 04:21.690
It's where I just enter a key and I share that with everybody and that's my

79
04:21.690 --> 04:24.000
authentication and encryption method.

80
04:24.000 --> 04:28.910
The difference is SAE makes it so that we don't use the pre shared key to

81
04:28.910 --> 04:33.710
derive the encryption keys, meaning that the encryption keys are derived out of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
04:28.910 --> 04:33.710
derive the encryption keys, meaning that the encryption keys are derived out of

82
04:33.710 --> 04:34.000
band.

83
04:34.000 --> 04:37.600
And therefore, if you and I both have the same key, I can't decrypt your

84
04:37.600 --> 04:38.000
traffic.

85
04:38.000 --> 04:40.000
You can't decrypt my traffic.

86
04:40.000 --> 04:44.000
It's a lot better than the pre shared key system of WPA2.

87
04:44.000 --> 04:47.000
Now, is it still a pre shared key?

88
04:47.000 --> 04:52.000
It is, but we use this fancy term SAE and so we use that instead.

89
04:52.000 --> 04:54.000
OWE is really cool.

90
04:54.000 --> 05:00.000
So OWE is the concept that I should be able to go again to a cafe or something.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:54.000 --> 05:00.000
So OWE is the concept that I should be able to go again to a cafe or something.

91
05:00.000 --> 05:04.720
And if it's open Wi-Fi, where I don't have to use a password to join, remember,

92
05:04.720 --> 05:08.000
pre shared key helps us derive the encryption keys.

93
05:08.000 --> 05:13.430
Well, WPA3 separates that and suggests, hey, rather than just saying, hey, if

94
05:13.430 --> 05:18.080
you either have to use the same key for everybody or you have to use no key,

95
05:18.080 --> 05:21.000
and this is encrypted, but everybody has the same key, this is not encrypted.

96
05:21.000 --> 05:24.000
And everybody can just listen to each other.

97
05:24.000 --> 05:28.120
Well, why not say, okay, we don't need a password to join, but you will still

98
05:28.120 --> 05:30.000
negotiate an encryption key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:28.120 --> 05:30.000
negotiate an encryption key.

99
05:30.000 --> 05:32.000
And that's what OWE is.

100
05:32.000 --> 05:36.000
It allows us to join a open wireless network.

101
05:36.000 --> 05:40.580
And yet, I still encrypt my traffic to the access point because why broadcast

102
05:40.580 --> 05:44.000
my wireless traffic in a way everybody can understand.

103
05:44.000 --> 05:48.300
So a little bit about WPA3 thrown in there, really outside the scope of the

104
05:48.300 --> 05:52.340
course, but it is how our modern wireless networks are doing security and it's

105
05:52.340 --> 05:54.000
certainly where we're going.

106
05:54.000 --> 05:57.000
So we see SAE and OWE.

107
05:57.000 --> 06:00.000
We know we're talking about WPA3 here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
05:57.000 --> 06:00.000
We know we're talking about WPA3 here.

108
06:00.000 --> 06:02.000
So in our case, we're going to keep things simple.

109
06:02.000 --> 06:05.000
I'm just going to configure a pre shared key.

110
06:05.000 --> 06:08.000
So that's what PSK is right here.

111
06:08.000 --> 06:14.880
Now we are seeing some information in here about WPA3 security and SAE and PSK

112
06:14.880 --> 06:16.000
and such.

113
06:16.000 --> 06:21.160
And so in order to basically make pre shared key work because that's a WPA2

114
06:21.160 --> 06:25.000
concept, I'm going to have to come up here to WPA parameters.

115
06:25.000 --> 06:30.750
This is where I can take a look at WPA, WPA2 and WPA3 configurations and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
06:25.000 --> 06:30.750
This is where I can take a look at WPA, WPA2 and WPA3 configurations and

116
06:30.750 --> 06:33.000
ultimately enablement.

117
06:33.000 --> 06:37.000
So if I uncheck WPA3, notice my errors go away.

118
06:37.000 --> 06:43.000
That's because I'm choosing to run WPA2 mechanisms and not WPA3.

119
06:43.000 --> 06:48.200
So I checked the PSK box, I scroll down, I see that my PSK format, I can

120
06:48.200 --> 06:50.000
technically put it into hexadecimal.

121
06:50.000 --> 06:52.000
Usually we leave that as ASCII.

122
06:52.000 --> 06:55.000
And now I'm ready to enter a pre shared key.

123
06:55.000 --> 07:00.000
Something like CBTN1234, there we go.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
06:55.000 --> 07:00.000
Something like CBTN1234, there we go.

124
07:00.000 --> 07:05.000
Notice that if it's ASCII, it has to be at least eight characters long.

125
07:05.000 --> 07:10.000
So CBTN1234 lowercase CBTN, that should work fine.

126
07:10.000 --> 07:12.000
So I'm going to say apply to the device.

127
07:12.000 --> 07:17.000
So now that I have the WLAN configured, I have to remember that this is iOSXE,

128
07:17.000 --> 07:19.000
it doesn't automatically get pushed out.

129
07:19.000 --> 07:21.000
I have to deploy this using the policy tag.

130
07:21.000 --> 07:26.830
So I'm going to come down to my tags and I'm going to just modify the default

131
07:26.830 --> 07:29.000
policy tag here and say I'm going to add my...

132
07:29.000 --> 07:35.800
...WLAN profile to my policy profile and we'll use the lab configured one and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
07:29.000 --> 07:35.800
...WLAN profile to my policy profile and we'll use the lab configured one and

133
07:35.800 --> 07:38.000
then apply to the device.

134
07:38.000 --> 07:43.000
So at this point, we should have our access point broadcasting our SSID.

135
07:43.000 --> 07:46.000
And so let's go ahead and go take a look at that.

136
07:46.000 --> 07:51.270
By looking at the bottom of my screen here, I'm going to pull up my Wi-Fi

137
07:51.270 --> 07:52.000
options.

138
07:52.000 --> 07:56.000
And I do see that CBTN iOSXE SSID.

139
07:56.000 --> 08:00.710
So I can click on this, say connect, it's going to require that security key of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
07:56.000 --> 08:00.710
So I can click on this, say connect, it's going to require that security key of

140
08:00.710 --> 08:02.000
CBTN1234.

141
08:02.000 --> 08:07.750
If I hit next, I should be able to join, maybe I shouldn't have shared on this

142
08:07.750 --> 08:12.000
very suspicious network that I'm joining, but, you know, is what it is.

143
08:12.000 --> 08:15.000
So we will be able to join and here we go.

144
08:15.000 --> 08:17.000
We are connected via that pre-shared key.

145
08:17.000 --> 08:20.000
So that is iOSXE PSK.

146
08:20.000 --> 08:26.760
But let's go ahead and show the configuration for our 802.11 and what is

147
08:26.760 --> 08:29.000
ultimately WPA Enterprise.

148
08:29.000 --> 08:32.000
So let's go and go back to our WLAN.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
08:29.000 --> 08:32.000
So let's go and go back to our WLAN.

149
08:32.000 --> 08:34.000
Click on it here.

150
08:34.000 --> 08:38.000
Go to the security tab and we're going to scroll down.

151
08:38.000 --> 08:43.950
So now I'm going to uncheck the PSK box and I'm going to check the 802.1x box

152
08:43.950 --> 08:45.000
over here.

153
08:45.000 --> 08:49.000
Now notice there's nothing for me to configure on this screen.

154
08:49.000 --> 08:54.330
That's because I have to come over here to this other sub tab, the AAA tab, and

155
08:54.330 --> 08:58.420
this is where I need to select, well, this is interesting, an authentication

156
08:58.420 --> 08:59.000
list.

157
08:59.000 --> 09:00.000
What's going on here?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
08:59.000 --> 09:00.000
What's going on here?

158
09:00.000 --> 09:05.490
Well, the reality is that, again, iOSXE is trying to use its normal mechanism

159
09:05.490 --> 09:09.000
for configuring AAA and radius and TAC-AC servers.

160
09:09.000 --> 09:13.030
Meaning that I can't actually select a server that can't enter my own server IP

161
09:13.030 --> 09:14.000
address here.

162
09:14.000 --> 09:17.000
I'm actually going to have to close out of this and go perform that

163
09:17.000 --> 09:18.000
configuration.

164
09:18.000 --> 09:20.000
So let's go ahead and go to configuration.

165
09:20.000 --> 09:24.000
Look in the security section and specifically AAA.

166
09:24.000 --> 09:28.740
So my goal is to simply get a radius server or a TAC-X plus server connected

167
09:28.740 --> 09:32.000
into the WLAN for the sake of 802.1x.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
09:28.740 --> 09:32.000
into the WLAN for the sake of 802.1x.

168
09:32.000 --> 09:36.030
So what I'm going to do here is I'm just going to configure a radius server by

169
09:36.030 --> 09:37.000
saying add here.

170
09:37.000 --> 09:40.000
And we're going to add a name for the server.

171
09:40.000 --> 09:42.000
This is just for reference purposes.

172
09:42.000 --> 09:47.420
I'll just say CBT-N, maybe lab, and then the IP address, I'm just going to

173
09:47.420 --> 09:51.160
create a dummy address since my lab doesn't have a radius server, 10, 0, 0, 1,

174
09:51.160 --> 09:53.000
and then the secret key.

175
09:53.000 --> 09:59.000
So this will just be something like CBT-N 1, 2, 3, 4 again.

176
09:59.000 --> 10:03.020
And I can change the ports if I need to or any other configuration tuning for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
09:59.000 --> 10:03.020
And I can change the ports if I need to or any other configuration tuning for

177
10:03.020 --> 10:04.000
the most part.

178
10:04.000 --> 10:06.000
I'm just going to hit apply and now I have a server.

179
10:06.000 --> 10:10.930
But again, iOSX-E likes to refer to server groups. And so I'm going to have to

180
10:10.930 --> 10:18.000
come over to server group, hit add, create a CBT-N radius group.

181
10:18.000 --> 10:21.980
And from here we can add the server I just configured. Again, this is where

182
10:21.980 --> 10:23.000
that name shows up.

183
10:23.000 --> 10:27.000
It's important for reference there. Put it into the assigned server's window.

184
10:27.000 --> 10:32.000
And now I have created a server group that has all of my radius servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
10:27.000 --> 10:32.000
And now I have created a server group that has all of my radius servers.

185
10:32.000 --> 10:35.980
In theory, I might have more than one server over here. I can add them all into

186
10:35.980 --> 10:37.000
the same group.

187
10:37.000 --> 10:41.420
But we're not actually done yet. We have to go over here to this AAA method

188
10:41.420 --> 10:42.000
list.

189
10:42.000 --> 10:48.000
So the AAA method list is basically telling the server how to go about

190
10:48.000 --> 10:51.000
referencing different server groups.

191
10:51.000 --> 10:55.470
So we think about the AAA command in iOSX-E that allows us to specify a check

192
10:55.470 --> 10:59.540
radius and then check tacks, and then maybe check nothing or something along

193
10:59.540 --> 11:00.000
those lines.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
10:59.540 --> 11:00.000
those lines.

194
11:00.000 --> 11:04.150
And that's exactly what this method list is doing is it's thinking along the

195
11:04.150 --> 11:08.590
lines of iOSX-E configuration and saying, "Okay, where should I start and what

196
11:08.590 --> 11:11.000
should I check in what order?"

197
11:11.000 --> 11:16.210
And so what I'm going to do here is just edit the default. We'll just go here.

198
11:16.210 --> 11:21.000
And we see that, well, there's, it looks like, radius is there already.

199
11:21.000 --> 11:27.760
I'm going to move my radius group into here. And I could add more TACX servers

200
11:27.760 --> 11:29.000
or radius servers.

201
11:29.000 --> 11:34.080
But again, I have just told the wireless lane controller that I'm essentially,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

201
11:29.000 --> 11:34.080
But again, I have just told the wireless lane controller that I'm essentially,

202
11:34.080 --> 11:39.000
I'm just really going to want you to check this one group full of servers.

203
11:39.000 --> 11:41.950
In this case, it's one server, but it's this group. I can also fall back to

204
11:41.950 --> 11:45.000
local authentication and create local usernames and passwords.

205
11:45.000 --> 11:50.540
But I'm just going to configure that. And that is what we had to do from a

206
11:50.540 --> 11:53.000
security AAA perspective.

207
11:53.000 --> 11:58.720
So now I'm going to go back to configuration and WLANs, click on my WLAN, go to

208
11:58.720 --> 12:02.000
my security tab, and scroll down.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

208
11:58.720 --> 12:02.000
my security tab, and scroll down.

209
12:02.000 --> 12:07.970
Now I'm going to uncheck PSK, add 802.1X. Remember, now go over to AAA to

210
12:07.970 --> 12:09.000
finish this.

211
12:09.000 --> 12:14.000
This authentication list is now going to give me what the list that I created.

212
12:14.000 --> 12:15.000
Now I edited the default.

213
12:15.000 --> 12:18.270
We could certainly have created our own. I'm just going to select this. And

214
12:18.270 --> 12:19.000
that's it.

215
12:19.000 --> 12:24.230
Because the list defines the order of operations, which groups to check and

216
12:24.230 --> 12:28.750
what order and what those IP addresses are, it's all wrapped up in this one

217
12:28.750 --> 12:30.000
dropdown.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

217
12:28.750 --> 12:30.000
dropdown.

218
12:30.000 --> 12:34.990
And so I can say update and apply to device. And now we can see over here,

219
12:34.990 --> 12:36.000
could have seen this earlier as well.

220
12:36.000 --> 12:42.010
So it showed WPA2 and PSK with AES encryption. Well, now it's showing us WPA2

221
12:42.010 --> 12:44.000
with 802.1X and AES.

222
12:44.000 --> 12:48.570
And since the radio server is a dummy address, I'm not going to be able to test

223
12:48.570 --> 12:49.000
this.

224
12:49.000 --> 12:53.510
But this is how we would log in using one of the EAT methods that we've talked

225
12:53.510 --> 12:57.000
about by either providing username and password or possibly a certificate.

226
12:57.000 --> 13:02.360
But this is our WLAN security configuration iOSXE. So much of it just comes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

226
12:57.000 --> 13:02.360
But this is our WLAN security configuration iOSXE. So much of it just comes

227
13:02.360 --> 13:04.000
down to picking our method.

228
13:04.000 --> 13:09.020
Going to the security tab layer two. And after we decide which version of WPA

229
13:09.020 --> 13:10.000
we're going to use,

230
13:10.000 --> 13:14.560
figuring out how to configure the authentication key management section, making

231
13:14.560 --> 13:20.190
sure to either check, let me get rid of that, either check PSK or 802.1X at

232
13:20.190 --> 13:24.000
which point we need to make sure AAA servers are properly configured.

233
13:24.000 --> 13:34.000
[BLANK_AUDIO]