Tks Lee its as follows ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 lifetime 1800 crypto isakmp key #### address x.x.x.x ! ! crypto ipsec transform-set aptset esp-3des esp-md5-hmac ! crypto map aptmap 1 ipsec-isakmp set peer x.x.x.x set transform-set aptset set security-association lifetime seconds 3600 match address 110 ! ! ! ! interface Ethernet0 ip address x.x.x.x x.x.x.x no ip redirects no ip unreachables no ip proxy-arp ip nat outside half-duplex ntp disable no cdp enable crypto map aptmap ! interface FastEthernet0 ip address 10.25.0.1 255.255.255.224 ip nat inside speed auto no cdp enable ! ip nat inside source list 112 interface Ethernet0 overload ip classless ip route 0.0.0.0 0.0.0.0 ####### no ip http server no ip http secure-server ! ! ! access-list 110 permit ip 10.25.0.0 0.0.0.31 172.16.0.0 0.0.0.31 access-list 112 permit ip 10.25.0.0 0.0.0.31 172.16.0.0 0.0.0.31
-----Original Message----- From: Lee Robinson [mailto:[EMAIL PROTECTED] Sent: Thursday, February 19, 2004 9:54 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Cisco 1700 Ipsec Tunnel to Checkpoint Ng Fw Cluster Ah I had this same exact problem. I ended up calling for support on it. My first suggestion would be to add two rules to the NAT tab on your Checkpoint policy. Add the rules at the top. The first one (being rule 1) should be: Source: internal checkpoint network Destination: remote network (cisco 1700 internal net) Service: any Source: original Destination: original Service: original The second rule should be: Source: remote network (cisco 1700 internal net) Destination: internal checkpoint network Service: any Source: original Destination: original Service: original Try that and we'll work from there. Seeing your router config would help. Looks like the mailing list botched your original email. Lee Robinson Network Administrator -----Original Message----- From: Jason Cameron [mailto:[EMAIL PROTECTED] Sent: Wednesday, February 18, 2004 4:16 AM To: [EMAIL PROTECTED] Subject: [FW-1] Cisco 1700 Ipsec Tunnel to Checkpoint Ng Fw Cluster Please note I have the Following problem I am setting up a ipsec tunnel from a 1700 cisco router to my firewall The network look like this 10.25.0.0/27---router-----------internet----router-(nat fw internet ip addrees to internal ) ----(internal -privaterange )----fw-----172.16.0.0/27. I have checked the the router config ------------- fw config Crypto isakmp policy1 ike security associations = 30 minutes Renogiate ipsec security associations = 3600 seconds Encr 3des Hash md5 Auth pre-share Lifetime 1800 Under cryto map t 1 ipsec-isakmp Security asscociation lifetime is 3600 In the firwall logs we have the following Information: IKE: Main Mode completion. IKE: Quick Mode Sent Notification: Responder Lifetime IKE: Quick Mode completion IKE IDs: subnet: 172.16.0.0 (mask= 255.255.255.224) and subnet: 10.25.0.0 (mask= 255.255.255.224) IKE: Informational Exchange Received Delete IPSEC-SA from Peer: d1585ea3 SPIs: ac3bd8b9 IKE: Quick Mode Sent Notification: Responder Lifetime IKE: Quick Mode completion IKE IDs: host: 172.16.0.22 and subnet: 10.25.0.0 (mask= 255.255.255.224) The rule for fw is client_netw > dmz_network encrypt --- slected there router as peer dmz_network< client_netw I see the packets outgoing from our server to there network as encrypt logs when I try ping but no response. I have Check the router config and its ok .and the fw config has been checked It seems as if the there a problem with the ipsec tunnel ?? Can any help The debug for the router is Feb 17 23:54:58.901 sat: IPSEC(sa_request): , (key eng. msg.) OUTBOUND local= omitted, remote= omitted, local_proxy= 10.25.0.0/255.255.255.224/0/0 (type=4), remote_proxy= 172.16.0.0/255.255.255.224/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 1800s and 4608000kb, spi= 0xA92AFA1A(2838166042), conn_id= 0, keysize= 0, flags= 0x400A Feb 17 23:54:58.905 sat: ISAKMP: received ke message (1/1) Feb 17 23:54:58.905 sat: ISAKMP (0:0): SA request profile is (NULL) Feb 17 23:54:58.905 sat: ISAKMP: local port 500, remote port 500 Feb 17 23:54:58.909 sat: ISAKMP: set new node 0 to QM_IDLE Feb 17 23:54:58.909 sat: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 814BBA7C Feb 17 23:54:58.909 sat: ISAKMP (0:2): Can not start Aggressive mode, trying Main mode. Feb 17 23:54:58.909 sat: ISAKMP: Looking for a matching key for omitted in default : success Feb 17 23:54:58.909 sat: ISAKMP (0:2): found peer pre-shared key matching omitted Feb 17 23:54:58.909 sat: ISAKMP (0:2): constructed NAT-T vendor-03 ID Feb 17 23:54:58.909 sat: ISAKMP (0:2): constructed NAT-T vendor-02 ID Feb 17 23:54:58.909 sat: ISAKMP (0:2): Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM Feb 17 23:54:58.913 sat: ISAKMP (0:2): Old State = IKE_READY New State = IKE_I_MM1 Feb 17 23:54:58.913 sat: ISAKMP (0:2): beginning Main Mode exchange Feb 17 23:54:58.913 sat: ISAKMP (0:2): sending packet to omitted my_port 500 peer_port 500 (I) MM_NO_STATE Feb 17 23:54:59.365 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) MM_NO_STATE Feb 17 23:54:59.365 sat: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Feb 17 23:54:59.369 sat: ISAKMP (0:2): Old State = IKE_I_MM1 New State = IKE_I_MM2 Feb 17 23:54:59.369 sat: ISAKMP (0:2): processing SA payload. message ID = 0 Feb 17 23:54:59.369 sat: ISAKMP: Looking for a matching key for omitted in default : success Feb 17 23:54:59.369 sat: ISAKMP (0:2): found peer pre-shared key matching omitted Feb 17 23:54:59.369 sat: ISAKMP (0:2) local preshared key found Feb 17 23:54:59.369 sat: ISAKMP : Scanning profiles for xauth ... Feb 17 23:54:59.369 sat: ISAKMP (0:2): Checking ISAKMP transform 1 against priority 1 policy Feb 17 23:54:59.373 sat: ISAKMP: encryption 3DES-CBC Feb 17 23:54:59.373 sat: ISAKMP: hash MD5 Feb 17 23:54:59.373 sat: ISAKMP: default group 2 Feb 17 23:54:59.373 sat: ISAKMP: auth pre-share Feb 17 23:54:59.373 sat: ISAKMP: life type in seconds Feb 17 23:54:59.373 sat: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80 Feb 17 23:54:59.373 sat: ISAKMP (0:2): atts are acceptable. Next payload is 0 Feb 17 23:54:59.373 sat: CryptoEngine0: generate alg parameter Feb 17 23:54:59.373 sat: CryptoEngine0: CRYPTO_ISA_DH_CREATE(hw)(ipsec) Feb 17 23:54:59.621 sat: CRYPTO_ENGINE: Dh phase 1 status: 0 Feb 17 23:54:59.621 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Feb 17 23:54:59.621 sat: ISAKMP (0:2): Old State = IKE_I_MM2 New State = IKE_I_MM2 Feb 17 23:54:59.625 sat: ISAKMP (0:2): sending packet to omitted my_port 500 peer_port 500 (I) MM_SA_SETUP Feb 17 23:54:59.625 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Feb 17 23:54:59.625 sat: ISAKMP (0:2): Old State = IKE_I_MM2 New State = IKE_I_MM3 Feb 17 23:55:00.105 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) MM_SA_SETUP Feb 17 23:55:00.109 sat: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Feb 17 23:55:00.109 sat: ISAKMP (0:2): Old State = IKE_I_MM3 New State = IKE_I_MM4 Feb 17 23:55:00.109 sat: ISAKMP (0:2): processing KE payload. message ID = 0 Feb 17 23:55:00.109 sat: CryptoEngine0: generate alg parameter Feb 17 23:55:00.109 sat: CryptoEngine0: CRYPTO_ISA_DH_SHARE_SECRET(hw)(ipsec) Feb 17 23:55:00.417 sat: ISAKMP (0:2): processing NONCE payload. message ID = 0 Feb 17 23:55:00.417 sat: ISAKMP: Looking for a matching key for omitted in default : success Feb 17 23:55:00.417 sat: ISAKMP (0:2): found peer pre-shared key matching omitted Feb 17 23:55:00.421 sat: CryptoEngine0: create ISAKMP SKEYID for conn id 2 Feb 17 23:55:00.421 sat: CryptoEngine0: CRYPTO_ISA_SA_CREATE(hw)(ipsec) Feb 17 23:55:00.453 sat: ISAKMP (0:2): SKEYID state generated Feb 17 23:55:00.453 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Feb 17 23:55:00.453 sat: ISAKMP (0:2): Old State = IKE_I_MM4 New State = IKE_I_MM4 Feb 17 23:55:00.457 sat: ISAKMP (0:2): Send initial contact Feb 17 23:55:00.457 sat: ISAKMP (0:2): SA is doing pre-shared key authentication using id type ID_IPV4_ADDR Feb 17 23:55:00.457 sat: ISAKMP (2): ID payload next-payload : 8 type : 1 addr : omitted protocol : 17 port : 500 length : 8 Feb 17 23:55:00.457 sat: ISAKMP (2): Total payload length: 12 Feb 17 23:55:00.457 sat: CryptoEngine0: generate hmac context for conn id 2 Feb 17 23:55:00.457 sat: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec) Feb 17 23:55:00.465 sat: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT(hw)(ipsec) Feb 17 23:55:00.469 sat: ISAKMP (0:2): sending packet to omitted my_port 500 peer_port 500 (I) MM_KEY_EXCH Feb 17 23:55:00.469 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Feb 17 23:55:00.469 sat: ISAKMP (0:2): Old State = IKE_I_MM4 New State = IKE_I_MM5 Feb 17 23:55:00.953 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) MM_KEY_EXCH Feb 17 23:55:00.957 sat: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT(hw)(ipsec) Feb 17 23:55:00.957 sat: ISAKMP (0:2): Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH Feb 17 23:55:00.961 sat: ISAKMP (0:2): Old State = IKE_I_MM5 New State = IKE_I_MM6 Feb 17 23:55:00.961 sat: ISAKMP (0:2): processing ID payload. message ID = 0 Feb 17 23:55:00.961 sat: ISAKMP (0:2): processing HASH payload. message ID = 0 Feb 17 23:55:00.961 sat: CryptoEngine0: generate hmac context for conn id 2 Feb 17 23:55:00.961 sat: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec) Feb 17 23:55:00.969 sat: ISAKMP (0:2): processing NOTIFY RESPONDER_LIFETIME protocol 1 spi 0, message ID = 0, sa = 814BBA7C Feb 17 23:55:00.969 sat: ISAKMP (0:2): SA has been authenticated with omitted Feb 17 23:55:00.969 sat: ISAKMP (0:2): peer matches *none* of the profiles Feb 17 23:55:00.969 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE Feb 17 23:55:00.969 sat: ISAKMP (0:2): Old State = IKE_I_MM6 New State = IKE_I_MM6 Feb 17 23:55:00.973 sat: CryptoEngine0: clear dh number for conn id 1 Feb 17 23:55:00.973 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE Feb 17 23:55:00.973 sat: ISAKMP (0:2): Old State = IKE_I_MM6 New State = IKE_P1_COMPLETE Feb 17 23:55:00.973 sat: CryptoEngine0: CRYPTO_ISA_DH_DELETE(hw)(ipsec) Feb 17 23:55:00.977 sat: ISAKMP (0:2): beginning Quick Mode exchange, M-ID of 567506243 Feb 17 23:55:00.977 sat: CryptoEngine0: generate hmac context for conn id 2 Feb 17 23:55:00.981 sat: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec) Feb 17 23:55:00.985 sat: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT(hw)(ipsec) Feb 17 23:55:00.989 sat: ISAKMP (0:2): sending packet to omitted my_port 500 peer_port 500 (I) QM_IDLE Feb 17 23:55:00.989 sat: ISAKMP (0:2): Node 567506243, Input = IKE_MESG_INTERNAL, IKE_INIT_QM Feb 17 23:55:00.989 sat: ISAKMP (0:2): Old State = IKE_QM_READY New State = IKE_QM_I_QM1 Feb 17 23:55:00.989 sat: ISAKMP (0:2): Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE Feb 17 23:55:00.993 sat: ISAKMP (0:2): Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Feb 17 23:55:01.049 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) QM_IDLE Feb 17 23:55:01.053 sat: ISAKMP (0:2): phase 1 packet is a duplicate of a previous packet. Feb 17 23:55:01.053 sat: ISAKMP (0:2): retransmitting due to retransmit phase 1 Feb 17 23:55:01.053 sat: ISAKMP (0:2): retransmitting phase 1 QM_IDLE ... Feb 17 23:55:01.153 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) QM_IDLE Feb 17 23:55:01.153 sat: ISAKMP (0:2): phase 1 packet is a duplicate of a previous packet. Feb 17 23:55:01.153 sat: ISAKMP (0:2): retransmitting due to retransmit phase 1 Feb 17 23:55:01.153 sat: ISAKMP (0:2): retransmitting phase 1 QM_IDLE ... Feb 17 23:55:01.449 sat: ISAKMP (0:2): received packet from omitted dport 500 sport 500 Global (I) QM_IDLE Feb 17 23:55:01.449 sat: CryptoEngine0: CRYPTO_ISA_IKE_DECRYPT(hw)(ipsec) Feb 17 23:55:01.453 sat: CryptoEngine0: generate hmac context for conn id 2 Feb 17 23:55:01.453 sat: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec) Feb 17 23:55:01.461 sat: ISAKMP (0:2): processing HASH payload. message ID = 567506243 Feb 17 23:55:01.461 sat: ISAKMP (0:2): processing SA payload. message ID = 567506243 Feb 17 23:55:01.461 sat: ISAKMP (0:2): Checking IPSec proposal 1 Feb 17 23:55:01.461 sat: ISAKMP: transform 1, ESP_3DES Feb 17 23:55:01.461 sat: ISAKMP: attributes in transform: Feb 17 23:55:01.461 sat: ISAKMP: encaps is 1 Feb 17 23:55:01.461 sat: ISAKMP: SA life type in seconds Feb 17 23:55:01.461 sat: ISAKMP: SA life duration (basic) of 1800 Feb 17 23:55:01.461 sat: ISAKMP: SA life type in kilobytes Feb 17 23:55:01.465 sat: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 Feb 17 23:55:01.465 sat: ISAKMP: authenticator is HMAC-MD5 Feb 17 23:55:01.465 sat: CryptoEngine0: validate proposal Feb 17 23:55:01.465 sat: ISAKMP (0:2): atts are acceptable. Feb 17 23:55:01.465 sat: IPSEC(validate_proposal_request): proposal part #1, (key eng. msg.) INBOUND local= omitted, remote= omitted, local_proxy= 10.25.0.0/255.255.255.224/0/0 (type=4), remote_proxy= 172.16.0.0/255.255.255.224/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 0s and 0kb, spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2 Feb 17 23:55:01.469 sat: CryptoEngine0: validate proposal request Feb 17 23:55:01.469 sat: IPSEC(kei_proxy): head = aptmap, map->ivrf = , kei->ivrf = Feb 17 23:55:01.469 sat: ISAKMP (0:2): processing NONCE payload. message ID = 567506243 Feb 17 23:55:01.469 sat: ISAKMP (0:2): processing ID payload. message ID = 567506243 Feb 17 23:55:01.469 sat: ISAKMP (0:2): processing ID payload. message ID = 567506243 Feb 17 23:55:01.469 sat: ISAKMP (0:2): processing NOTIFY RESPONDER_LIFETIME protocol 3 spi 2838166042, message ID = 567506243, sa = 814BBA7C Feb 17 23:55:01.473 sat: ISAKMP (0:2): processing responder lifetime Feb 17 23:55:01.473 sat: CryptoEngine0: generate hmac context for conn id 2 Feb 17 23:55:01.473 sat: CryptoEngine0: CRYPTO_ISA_IKE_HMAC(hw)(ipsec) Feb 17 23:55:01.477 sat: CryptoEngine0: ipsec allocate flow Feb 17 23:55:01.481 sat: CryptoEngine0: ipsec allocate flow Feb 17 23:55:01.481 sat: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE(hw)(ipsec) Feb 17 23:55:01.505 sat: CryptoEngine0: CRYPTO_ISA_IPSEC_KEY_CREATE(hw)(ipsec) Feb 17 23:55:01.533 sat: ISAKMP (0:2): Creating IPSec SAs Feb 17 23:55:01.533 sat: inbound SA from omitted to omitted (f/i) 0/ 0 (proxy 172.16.0.0 to 10.25.0.0) Feb 17 23:55:01.533 sat: has spi 0xA92AFA1A and conn_id 200 and flags 2 Feb 17 23:55:01.533 sat: lifetime of 1800 seconds Feb 17 23:55:01.533 sat: lifetime of 4608000 kilobytes Feb 17 23:55:01.533 sat: has client flags 0x0 Feb 17 23:55:01.533 sat: outbound SA from omitted to omitted (f/i) 0/ 0 (proxy 10.25.0.0 to 172.16.0.0 ) Feb 17 23:55:01.533 sat: has spi -541287687 and conn_id 201 and flags A Feb 17 23:55:01.537 sat: lifetime of 1800 seconds Feb 17 23:55:01.537 sat: lifetime of 4608000 kilobytes Feb 17 23:55:01.537 sat: has client flags 0x0 Feb 17 23:55:01.537 sat: CryptoEngine0: CRYPTO_ISA_IKE_ENCRYPT(hw)(ipsec) Feb 17 23:55:01.537 sat: IPSEC(key_engine): got a queue event... Feb 17 23:55:01.537 sat: IPSEC(initialize_sas): , (key eng. msg.) INBOUND local= omitted, remote= omitted, local_proxy= 10.25.0.0/255.255.255.224/0/0 (type=4), remote_proxy= 172.16.0.0/255.255.255.224/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 1800s and 4608000kb, spi= 0xA92AFA1A(2838166042), conn_id= 200, keysize= 0, flags= 0x2 Feb 17 23:55:01.541 sat: IPSEC(initialize_sas): , (key eng. msg.) OUTBOUND local= omitted, remote= omitted, local_proxy= 10.25.0.0/255.255.255.224/0/0 (type=4), remote_proxy= 172.16.0.0/255.255.255.224/0/0 (type=4), protocol= ESP, transform= esp-3des esp-md5-hmac , lifedur= 1800s and 4608000kb, spi= 0xDFBC9AF9(3753679609), conn_id= 201, keysize= 0, flags= 0xA Feb 17 23:55:01.541 sat: IPSEC(kei_proxy): head = aptmap, map->ivrf = , kei->ivrf = Feb 17 23:55:01.541 sat: IPSEC(add mtree): src 10.25.0.0, dest 172.16.0.0, dest_port 0 Feb 17 23:55:01.545 sat: IPSEC(create_sa): sa created, (sa) sa_dest= omitted, sa_prot= 50, sa_spi= 0xA92AFA1A(2838166042), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 200 Feb 17 23:55:01.545 sat: IPSEC(create_sa): sa created, (sa) sa_dest= omitted, sa_prot= 50, sa_spi= 0xDFBC9AF9(3753679609), sa_trans= esp-3des esp-md5-hmac , sa_conn_id= 201 Feb 17 23:55:01.549 sat: ISAKMP (0:2): sending packet to omitted my_port 500 peer_port 500 (I) QM_IDLE Feb 17 23:55:01.549 sat: ISAKMP (0:2): deleting node 567506243 error FALSE reason "" Feb 17 23:55:01.549 sat: ISAKMP (0:2): Node 567506243, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH Feb 17 23:55:01.549 sat: ISAKMP (0:2): Old State = IKE_QM_I_QM1 New State = IKE_QM_PHASE2_COMPLETE Feb 17 23:55:01.653 sat: ISAKMP (0:2): retransmitting phase 1 QM_IDLE ... Feb 17 23:55:01.653 sat: ISAKMP (0:2): incrementing error counter on sa: retransmit phase 1 Feb 17 23:55:01.653 sat: ISAKMP (0:2): no outgoing phase 1 packet to retransmit. QM_IDLE Feb 17 23:55:08.049 sat: ISAKMP (0:1): purging SA., sa=81B23F90, delme=81B23F90 Feb 17 23:55:08.049 sat: CryptoEngine0: delete connection 1 Feb 17 23:55:08.049 sat: CryptoEngine0: CRYPTO_ISA_SA_DELETE(hw)(ipsec) Feb 17 23:55:51.549 sat: ISAKMP (0:2): purging node 567506243 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
