paloaltonetworks:vmseries:aws_transit_gateway
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| paloaltonetworks:vmseries:aws_transit_gateway [2020/12/20 19:04] – created bstafford | paloaltonetworks:vmseries:aws_transit_gateway [2022/11/23 12:49] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| In this lab, we have three VPCs. Security, Spoke1 and Spoke2. | In this lab, we have three VPCs. Security, Spoke1 and Spoke2. | ||
| + | |||
| + | |||
| + | |||
| Line 23: | Line 26: | ||
| * Create an Internet Gateway lab-igw-security-main | * Create an Internet Gateway lab-igw-security-main | ||
| * Attach the new Internet Gateway to the security VPC | * Attach the new Internet Gateway to the security VPC | ||
| - | Add a default route in the management and the public routing tables in the security VPC that points to the Internet Gateway as a next hop. Leave the tgw route table without a default route. | + | * Add a default route in the management and the public routing tables in the security VPC that points to the Internet Gateway as a next hop. Leave the tgw route table without a default route. |
| - | Rename the default Network ACL in the security VPC to | + | |
| - | lab-nacl-default | + | |
| - | Create | + | |
| - | lab-sg-security-public " | + | |
| - | lab-sg-security-mgmt " | + | * For the security group lab-sg-security-public, |
| - | lab-sg-security-private " | + | |
| - | For the public | + | |
| - | For the managment SG, allow all traffic inbound from 10.0.0.0/ | + | ===== Deploy the Firewall VMs ===== |
| - | For the private | + | * Under EC2, launch two instances (both firewalls). BYOL. Change from m5.2xlarge to m5.xlarge. This will make it a VM-100 instead of a VM-300. |
| + | * For both firewalls, deploy in the security VPC. (If you have to create a key-pair, go and read the notes on converting it to PuTTY format). | ||
| + | * For the first firewall | ||
| + | * Set the network interface to be in the subnet ' | ||
| + | * Add a tag where the Key is ' | ||
| + | * For the security group, use existing, lab-sg-security-mgmt | ||
| + | * For the second firewall | ||
| + | * Set the network interface to be in the subnet ' | ||
| + | * Add a tag where the Key is ' | ||
| + | * For the security group, use existing, lab-sg-security-mgmt | ||
| + | * Under EC2, rename the existing to network interfaces as follows. You will need to refence the instance ID though it should be sufficient to use the Zone (a or b) to identify which is fw1 (a) and fw2 (b). | ||
| + | * lab-eni-security-fw1-mgmt | ||
| + | * lab-eni-security-fw2-mgmt | ||
| + | * Under EC2, create two network interfaces | ||
| + | * lab-eni-security-fw1-public | ||
| + | * In subnet lab-subnet-security-public-a. | ||
| + | * Set IPv4 Private IP to Custom and set 10.0.11.5 | ||
| + | * Set Security Group to lab-sg-security-public | ||
| + | * Set tag ' | ||
| + | * lab-eni-security-fw2-public | ||
| + | * In subnet lab-subnet-security-public-a. | ||
| + | * Set IPv4 Private IP to Custom and set 10.0.21.5 | ||
| + | * Set Security Group to lab-sg-security-public | ||
| + | * Set tag ' | ||
| + | * Under EC2, create four Elastic IPs. After creating them, rename them as follows: | ||
| + | * lab-eip-security-fw1-mgmt | ||
| + | * lab-eip-security-fw1-public | ||
| + | * lab-eip-security-fw2-mgmt | ||
| + | * lab-eip-security-fw2-public | ||
| + | * For the four interfaces you just created, disable " | ||
| + | * Under EC2, for the four interfaces you just created, attach them with their respective VM firewalls. MAKE SURE YOU ASSOCIATE PUBLIC FIRST TO ENSURE IT IS ETHERNET1/1 on the firewall. | ||
| + | * Then associate the elastic IP addresses WITH NETWORK INTERFACE (NOT ' | ||
| + | * lab-eip-security-fw1-mgmt -> lab-eni-security-fw1-mgmt with private | ||
| + | * lab-eip-security-fw2-mgmt -> lab-eni-security-fw2-mgmt with private IP as 10.0.20.5 | ||
| + | * lab-eip-security-fw1-public -> lab-eni-security-fw1-public with private IP as 10.0.11.5 | ||
| + | * lab-eip-security-fw2-public -> lab-eni-security-fw2-public with private IP as 10.0.21.5 | ||
| + | |||
| + | On Security VPC, we need two route tables. | ||
| + | * One public with 0.0.0.0/0 as IGW public subnet gets this | ||
| + | * One private with 0.0.0.0/0 as IGW and 10.0.0.0/8 as Transit VPC management subnet get this. | ||
| + | |||
| + | |||
| + | ===== Login to Firewalls ===== | ||
| + | By this point your VM firewalls should have booted. Now that they have public IP addresses, try and HTTPS to them. | ||
| + | HOWEVER, we can't log in because we can only SSH in with the private key we created. Once we have SSHed in, we can set a password and then use the web GUI. | ||
| + | To set the password on the CLI: | ||
| + | < | ||
| + | set mgt-config users admin password | ||
| + | commit</ | ||
| + | |||
| + | Remember, if the management security group has been correctly configured, only your public IP (home/ | ||
| + | |||
| + | ===== Configure the Firewalls ===== | ||
| + | Setup the firewall with basic managment settings. The AWS DNS server is 169.254.169.253. | ||
| + | |||
| + | You can use the following CLI | ||
| + | < | ||
| + | set deviceconfig system hostname VM1 | ||
| + | set deviceconfig system timezone Europe/ | ||
| + | set deviceconfig system dns-setting servers primary 169.254.169.253 | ||
| + | set deviceconfig system dns-setting servers secondary 1.1.1.1 | ||
| + | set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.uk.pool.ntp.org | ||
| + | set deviceconfig system ntp-servers secondary-ntp-server ntp-server-address 1.uk.pool.ntp.org | ||
| + | commit | ||
| + | exit | ||
| + | request license fetch auth-code V1234567</ | ||
| + | The ssh session will disconnect around a minute after issuing this command and retrieving licenses. Wait another few minutes for the restart to complete and then re-establish your SSH session or login to the web console. | ||
| + | |||
| + | On the VM, enable Cloud Watch monitoring (Device > VM-Series) | ||
| + | |||
| + | * Create Interface Managment Profile imp-ping that allows Ping from anywhere. | ||
| + | * Create Interface Managment Profile imp-mgmt-ping that allows SSH, HTTPS and Ping from anywhere. | ||
| + | * Rename the default virtual router from ' | ||
| + | * Create two security zones, sz-untrust and sz-trust. | ||
| + | * Configure ethernet1/1 as a member of sz-untrust, vr-main with imp-mgmt-ping. Set IPv4 to DHCP and " | ||
| + | * Create default log forwarding profile and default security group. | ||
| + | |||
| + | Security Policies | ||
| + | * Create a security policy rule that allows SSH, HTTPS and Ping to the firewall' | ||
| + | * Create a rule to allow all from Trust to Untrust. | ||
| + | * Create a rule to allow all from Trust to Trust. | ||
| + | * Create a default 'deny any' rule. | ||
| + | |||
| + | |||
| + | ===== Configure Transit Gateway ===== | ||
| + | Create a Transit Gateway under ' | ||
| + | * Name tag: lab-tgw-hub | ||
| + | * Amazon side ASN: 64514 (pick anything you like between 64514 and 65534) | ||
| + | * ENABLE "DNS support" | ||
| + | * ENABLE "VPN ECMP support" | ||
| + | * DISABLE " | ||
| + | * DISABLE " | ||
| + | |||
| + | Wait for the gateway to be created | ||
| + | |||
| + | Create two TGW route tables that are associated with TGW we just created. | ||
| + | * lab-tgwrt-spoke | ||
| + | * lab-tgwrt-security | ||
| + | * | ||
| + | Now create an attachment between the Security VPC and the TGW | ||
| + | * lab-tgwattach-hub-security-vpc. When you do this, select the lab-subnet-security-tgw-a and lab-subnet-security-tgw-b as the subnets to peer with. This is what will allow the management subnet routes to be shared from the Security VPC directly to the TWG without going over the VPN tunnels that we will establish later. | ||
| + | |||
| + | Remember, the spoke VPCs will default route to the route table lab-tgwrt-spoke. This means that lab-tgwrt-spoke needs to learn the security VPC route and propagate it out. More specifically, | ||
| + | * lab-tgwrt-spoke needs to be propagated with both security VPC attachments. | ||
| + | * lab-tgwrt-security needs to be associated with security VPC attachments. | ||
| + | |||
| + | Finally, make sure you name the VPN attachment to the TGW that was created automatically (with no name) when you created the VPN in AWS. name it lab-tgwattach-hub-security-vpn1. | ||
| + | ===== Panorama and Management ===== | ||
| + | Note for future updates, this would be a good point to deploy Panorama and import the firewalls. This would make it simpler to configure both firewalls going forward. | ||
| + | |||
| + | ===== TWG VPN Configuration ===== | ||
| + | Now we need to create a TGW attachment that is the VPN tunnel type. VPN tunnel on each firewall to the TGW. The tunnels will be used for outbound/ | ||
| + | The TGW will use ECMP to load balance outbound traffic. East/West traffic must be sent through the primary firewall to prevent asymmetric routing. Use BGP path pre-pending to achieve this. | ||
| + | |||
| + | **At this point you will need to pick a BGP AS number that you will use on the firewalls. Each of the two firewalls will use the same AS number. In this example, we will use 64515.** | ||
| + | |||
| + | Always create the VPN configuration in AWS first before configuring on the firewall. This is because you already have the public IP addresses of each firewall that you can put into the AWS Customer Gateway config. However, you will have to create the VPN in AWS before you can find out what the AWS VPN IP addresses are. Remember, for the tunnel /30 subnet, you can't control which IP from the /30 AWS will assign to the config. If you don't like the result, you have to keep recreating it until it picks the other IP. In general, AWS will probably pick the firewall IP out of the two in a /30. | ||
| + | |||
| + | Under VPC create two Customer gateways (one for each firewall) | ||
| + | * Name tag: lab-cgw-fw1 | ||
| + | * Routing: Dynamic | ||
| + | * BGP AS: 65515 | ||
| + | * IP Address: 1.2.3.4 (fw1 public IP on eth1/1) | ||
| + | |||
| + | * Name tag: lab-cgw-fw2 | ||
| + | * Routing: Dynamic | ||
| + | * BGP AS: 65515 | ||
| + | * IP Address: 5.6.7.8 (fw1 public IP on eth1/1) | ||
| + | |||
| + | **You begin with the 169.254.x.4/ | ||
| + | |||
| + | Create a site-to-site VPN connection. | ||
| + | * Name tag: lab-vpn-security-fw1 | ||
| + | * Type: transit gateway (select your tgw) | ||
| + | * Customer Gateway: existing / lab-cgw-fw1 | ||
| + | * Local IPv4 Network CIDR (leave blank) | ||
| + | * Remote | ||
| + | * Inside IPV4 CIDR for Tun1 169.254.11.4/ | ||
| + | * PSK for Tun1 (Cannot contain special characters) | ||
| + | * Inside IPV4 CIDR for Tun2 169.254.21.4/ | ||
| + | * PSK for Tun2 (Cannot contain special characters) | ||
| + | * customer gateway lab-cgw-hub. | ||
| + | * BGP AS to what ever you set as the TGW AS (ie. 64514) | ||
| + | |||
| + | Once you have created the two VPN configurations, | ||
| + | |||
| + | Download the configuration and look for the two sections starting with < | ||
| + | |||
| + | Ensure there is a security policy on the firewalls allowing access between the firewall public interface and the TGW peer IP. | ||
| + | |||
| + | You now have all the information you need to create the two tunnels on each firewall. | ||
| + | |||
| + | Note, IPsec Crypto (Phase 2) on the firewalls must use **aes-256-cbc** if you don't edit the AWS defaults. | ||
| + | |||
| + | ===== Firewall VPN Configuration ===== | ||
| + | This section assumes that you have the AWS VPN IP addresses from the previous section. | ||
| + | |||
| + | Both firewalls will use the same BGP AS number. In this case 64515. For each firewall, set the router ID to be the firewalls' | ||
| + | |||
| + | Create two tunnel interface on each firewall tunnel interface in the sz-trust zone and attached to the vr-main virtual router. Set it as pingable and set IP of the tunnel interfaces to | ||
| + | * FW1 - Tunnel 1 -169.254.11.6 | ||
| + | * FW1 - Tunnel 2 -169.254.12.6 | ||
| + | * FW2 - Tunnel 1 -169.254.21.6 | ||
| + | * FW2 - Tunnel 2 -169.254.21.6 | ||
| + | |||
| + | For each tunnel interface, set the tunnel interface MTU to 1427. | ||
| + | |||
| + | Create an IKE Crypto profile on both firewalls called " | ||
| + | |||
| + | Create an IPSec Crypto profile on both firewalls called ipsec-aes-256-sha256-dh14" | ||
| + | |||
| + | On each firewall, create two IKE gateways ike-gw-tgw-1 and ike-gw-tgw-2: | ||
| + | * Set Version to "IKEv1 only mode." | ||
| + | * Set interface to " | ||
| + | * Leave Local IP Address as " | ||
| + | * Set Peer IP address Type to " | ||
| + | * Set the Pre-Shared key (alphanumeric characters as well as the period and underscore characters). | ||
| + | * Leave Local Identification as " | ||
| + | * Leave Peer Identification as " | ||
| + | * Disabled passive mode | ||
| + | * Disable NAT traversal | ||
| + | * Set exchange mode as " | ||
| + | * Set IKE crypto profile as " | ||
| + | * Disabled fragmentation | ||
| + | * Enable dead peer detection with interval of 10 and retry of 3. | ||
| + | |||
| + | On each firewall, create two IPsec tunnels ipsec-tun-tgw-1 and ipsec-tun-tgw-2. | ||
| + | * Set IPsec Crypto Profile to ipsec-aes-256-sha256-dh14 | ||
| + | * Enable Replay Protection (show advanced options) to see this option) | ||
| + | |||
| + | The tunnels should come up after you commit. | ||
| + | |||
| + | ===== Configure Firewall BGP ===== | ||
| + | |||
| + | Basic BGP Configuration for the virtual routes should be as follows: | ||
| + | * Reject Default Route - Yes | ||
| + | * Install Route - Yes | ||
| + | * Aggregate MED - Yes | ||
| + | * Default Local Preference should be 100 | ||
| + | * AS Format should be 2 Byte | ||
| + | * Always Compare MED - No | ||
| + | * Deterministic MED comparison - Yes | ||
| + | |||
| + | Peer Group – Create one peer group on each firewall virtual router | ||
| + | * Name: pg-aws-tgw. | ||
| + | * Enabled : True | ||
| + | * Aggregated Confed AS Path : True | ||
| + | * Soft Reset With Stored Info : False | ||
| + | * Type: eBGPG. | ||
| + | * Import Next Hop: Use Peer | ||
| + | * Export Next Hop : Use Self | ||
| + | * Remove Private AS : No | ||
| + | |||
| + | On each firewall, configure two peers within the peer group. When configuring a peer, the " | ||
| + | * Auth Profile: None (not supported on AWS) | ||
| + | * Keep Alive Interval (Sec) : 10 | ||
| + | * Multi Hop : 0 | ||
| + | * Open Delay Time (sec) : 0 | ||
| + | * Hold Time (sec) : 30 | ||
| + | * Idle Hold Time (sec) : 15 | ||
| + | * Min Route Advertisement Interval (sec) :30 | ||
| + | |||
| + | Redistribution: | ||
| + | |||
| + | We have one import rule that is used by the peer group. Set action to allow and list the specific prefixes. | ||
| + | |||
| + | We need two export rules where both are to the same peer group. The default is done without any path pre-pending. That rule exports the default route and the public subnet route. Note that both firewalls will need to be unique. Firewall 1's first rule will export 0.0.0.0/0 and 10.0.11.0/ | ||
| + | |||
| + | The second export rule exports 10.0.0.0/8. The internal routes are prepended on the secondary firewall. The secondary firewall uses BGP prepending to make sure the neighbouring VPCs prefer the primary firewall for routing. In the PAN-OS GUI, this is set this under < | ||
| + | |||
| + | ===== Create Spoke VPCs ===== | ||
| + | Create spoke VPCs | ||
| + | * lab-vpc-spoke1 (10.10.0.0/ | ||
| + | * lab-vpc-spoke2 (10.20.0.0/ | ||
| + | Rename VPC default Route tables | ||
| + | * lab-rt-spoke1-main | ||
| + | * lab-rt-spoke2-main | ||
| + | Create Security Groups | ||
| + | * lab-sg-spoke1-main | ||
| + | * lab-sg-spoke2-main | ||
| + | Both security groups should | ||
| + | |||
| + | |||
| + | lab-vpc-spoke1 (10.10.0.0/ | ||
| + | * lab-subnet-spoke1-web-a (10.10.10.0/24) availability zone A | ||
| + | * lab-subnet-spoke1-web-b (10.10.20.0/ | ||
| + | lab-vpc-spoke2 (10.20.0.0/ | ||
| + | * lab-subnet-spoke2-web-a (10.20.10.0/ | ||
| + | * lab-subnet-spoke2-web-b (10.20.20.0/ | ||
| + | |||
| + | Add Linux VM to lab-subnet-spoke1-web-a lab-vm-spoke1-web-a1 and use spoke1 security group | ||
| + | |||
| + | ===== Spoke VPC to TGW ===== | ||
| + | Under VPC, create a VPN transit Gateway attachment. | ||
| + | |||
| + | * lab-tgwrt-spoke needs to be associated with both spoke VPC attachments. | ||
| + | * lab-tgwrt-security needs to be propagated with both spoke VPC attachments need to export default route and then also export Spoke routes. | ||
| + | |||
| + | Security Routing table is associated with both VPNs and the firewall VPC. | ||
| + | |||
| + | Then the security routing table is propagated for both VPNs and the firewall VPC. | ||
| + | |||
| + | The Spoke VPCs are attached to a separate route table so you can select which routes are propagated to them to control east/west traffic flow. If you are not doing east-west security, you could use one transit gateway route table. | ||
| + | |||
| + | This means that spoke1 and spoke2 VPCs are " | ||
| + | |||
| + | |||
| + | Create two VPC attachement in TWG | ||
| + | lab-tgwattach-hub-spoke1-vpc - include both subnets | ||
| + | lab-tgwattach-hub-spoke2-vpc - include both subnets | ||
| + | |||
| + | Associate these two spoke attachments to the spoke route table. | ||
| + | In spoek route table, propogate to security VPC | ||
| + | In security, propogate to spoke1, and spoke2 | ||
| + | |||
| + | Update both spoke1 route table and spoke2 route table to use TGW as default route | ||
| + | |||
| + | ===== Inbound Load Balancer ===== | ||
| + | AWS Load Balancer - must have one listener and supports up to 10. Routing tables are defined on listeners. Listener is the portal and port on which the load balancer listens for incoming connection. | ||
| + | |||
| + | |||
| + | |||
| + | Create a load balancer. Create a listener for port 80 and a target group for that port 80. Create a second listener for 22 and a target group for 22. | ||
| + | |||
| + | |||
| + | |||
| + | Remember, when you deploy a public load balancer that points at the firewall public interface private IP addresses, the health probe with come from the load balancer' | ||
| + | |||
| + | When you add extra IP addresses onto the firewall public interface, make sure you DNAT these to a loopback | ||
| + | |||
| + | load balancer listener 22 and 80 with target being the new extra Ip on both firewalls. Configure both firewalls to DNAT their extra IP to the same backend IP. | ||
| + | Remember the load balancer - you just configure tcp-80. It is the target groups that you need to open up the other port (22 3389, | ||
| + | |||
| + | < | ||
| + | |||
| + | Remember: for inbound NAT via load balancer, we need to translate to FQDN | ||
| + | Remember: The AWS external load balancer translates the source of the traffic. | ||
| + | The deploy a public network load balancer under EC2 | ||
| + | Name: lab-nlb-public-1 | ||
| + | Add TCP80 and TCP22 as listeners | ||
| + | VPC = security. | ||
| + | Subnet = public a and public b. | ||
| + | Assign IP by AWS. | ||
| + | |||
| + | Create a target group | ||
| + | Name; lab-tg-web | ||
| + | Target type: IP | ||
| + | health check protocol and path " | ||
| + | advanced health check settings - interval 10 seconds | ||
| + | |||
| + | add targets for VPC security as 10.0.11.5 and 10.0.21.5 | ||
| + | |||
| + | |||
| + | |||
| + | ===== Clone Firewall Configuration ===== | ||
| + | If you export the firewall 1 configuration and import it into firewall 2, you can load the configuration using the following commands. In this case we assume the imported configuration file is called **working.xml**. | ||
| + | < | ||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | |||
| + | load config partial from-xpath / | ||
| + | load config partial from-xpath / | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| - | Under EC2, launch two instances (both firewalls). BYOL. Change from m5.2xlarge to m5.xlarge. This will make it a VM-100 instead of a VM-300. | ||
| - | For both firewalls, deploy in the security VPC. (If you have to create a key-pair, go and read the notes on converting it to PuTTY format). | ||
| - | For the first firewall | ||
| - | Set the network interface to be in the subnet ' | ||
| - | Add a tag where the Key is ' | ||
| - | For the security group, use existing, lab-sg-security-mgmt | ||
| - | For the second firewall | ||
| - | Set the network interface to be in the subnet ' | ||
| - | Add a tag where the Key is ' | ||
| - | For the security group, use existing, lab-sg-security-mgmt | ||
| - | Under EC2, rename the existing to network interfaces as follows. You wil need to refence the instance ID though it should be sufficient to use the Zone (a or b) to identify which is fw1 (a) and fw2 (b). | ||
| - | lab-eni-security-fw1-mgmt | ||
| - | lab-eni-security-fw2-mgmt | ||
| - | Under EC2, create four network interfaces | ||
| - | lab-eni-security-fw1-public | ||
| - | In subnet lab-subnet-security-public-a. | ||
| - | Set IPv4 Private IP to Custom and set 10.0.11.5 | ||
| - | Set Security Group to lab-sg-security-public | ||
| - | Set tag ' | ||
| - | lab-eni-security-fw1-private | ||
| - | In subnet lab-subnet-security-private-a. | ||
| - | Set IPv4 Private IP to Custom and set 10.0.12.5 | ||
| - | Set Security Group to lab-sg-security-private | ||
| - | Set tag ' | ||
| - | lab-eni-security-fw2-public | ||
| - | In subnet lab-subnet-security-public-a. | ||
| - | Set IPv4 Private IP to Custom and set 10.0.21.5 | ||
| - | Set Security Group to lab-sg-security-public | ||
| - | Set tag ' | ||
| - | lab-eni-security-fw2-private | ||
| - | In subnet lab-subnet-security-private-a. | ||
| - | Set IPv4 Private IP to Custom and set 10.0.22.5 | ||
| - | Set Security Group to lab-sg-security-private | ||
| - | Set tag ' | ||
| - | Under EC2, create four Elastic IPs. After creating them, rename them as follows: | ||
| - | lab-eip-security-fw1-mgmt | ||
| - | lab-eip-security-fw1-public | ||
| - | lab-eip-security-fw2-mgmt | ||
| - | lab-eip-security-fw2-public | ||
| - | For the four interfaces you just created, disable " | ||
| - | Under EC2, for the four interfaces you just created, attach them with their respective VM firewalls. MAKE SURE YOU ASSOCIATE PUBLIC FIRST TO ENSURE IT IS ETHERNET1/1 on the firewall. | ||
| - | Then associate the elastic IP addresses WITH NETWORK INTERFACE (NOT ' | ||
| - | lab-eip-security-fw1-mgmt -> lab-eni-security-fw1-mgmt with private IP as 10.0.10.5 | ||
| - | lab-eip-security-fw2-mgmt -> lab-eni-security-fw2-mgmt with private IP as 10.0.20.5 | ||
| - | lab-eip-security-fw1-public -> lab-eni-security-fw1-public with private IP as 10.0.11.5 | ||
| - | lab-eip-security-fw2-public -> lab-eni-security-fw2-public with private IP as 10.0.21.5 | ||
paloaltonetworks/vmseries/aws_transit_gateway.1608491058.txt.gz · Last modified: (external edit)