text:
Israel to U.S.: Russia Selling Arms to Syria
WSJ's Adam Entous reports the U.S. is looking into claims by Israel that Russia is planning a sale of more arms and missiles to Syria as that country's civil war continues. Photo: Getty Images
This transcript has been automatically generated and may not be 100% accurate.
... the the ... of all seven I ... e tensions between Syria United States and the Middle East Israel has revealed to the US that Russia plans and aam cell with Syria ... the jails national security correspondent Adam and says joins us from Washington that the cells ... good morning ... good morning ... I'm that this is true that this does not help matters but did in the U S efforts to help set the tensions in the region ... what is it like this ... well I mean what it really shows is this the underlying tension between the United States and Russia ... over how to deal with the situation in Syria ... and the Russians are showing that they're not backing down from their ... partnership with the sign ... up with the U S wants to see step aside ... and Dom what what exactly is it that that the Russians ... are said to be ... delivered to Syria ... right ... this is a very advanced of ground to air missile system called the S S S three hundred ... which is AEI which is the kind of system that the US had ... sought to block ... the Russians from selling to the Syrians ... chair at the end of the Bush administration ... and the Bush administration officials who we spoke to for this story ... as told is that they were successful in stopping that deal ... so for the for the Russians to revive it now ... as though as we reached order that tipping point potential tipping point ... in the conflict in Syria ... I would be yet would be very clear message to the United States into other Western powers in ... an Arab allies the United States ... that they need to keep their distance from I'll what's going on in Syria not try to intervene ... one also would actually physically make it difficult writing these these of Philly sophisticated that sophisticated Miss aisles and and would like to walk out of the planes to get in ... write a mean it this year is Ardi have a world class system ... that American officials are arty very concerned about it feel would be very difficult to penetrate and maintain ... of the presents over for sustained period of time ... so you throw in the mix that said this new system ... and it becomes a much more deadly and in fact said the US has lobbied ... very hard to ... afford food not to sell the system ... for years because it was worried that the Syrians were going to pass it to the Iranians ... who would use it for to defend its nuclear sites including for Dell ... so I said this is deftly been on the American radar for a long time and ... and and officials that we spoke to are viewing this Israeli intelligence ... DCI how imminent they feel the deal is ... the Israelis believed a sale could go forward ... as soon as the three months from now ... so I this is all coming to head right now and it's likely to raise tensions between ... the US and Russia ... don't cover the costs of the Dubuis ... none of these parties are ever in a ... disinterested parties and and ... as his top notch as the ... Israeli intelligence can be is often agenda there as well on them when it is often be doubts about Israel's take on ... a few rounds preparedness for example for nuclear attack ... this is some skepticism in this this is well it is the market to provide us into action ... oh well I think that I think what what we've seen repeatedly years said the Israelis will be the first to get the intelligence about ... the prospective transfers of arms from Russia ... to Syria or Iran and then typically what happens is these release ... common make their case to the Americans ... to try to get the Americans to effectively surging to the provider ... go to the Russians and and that can go to the Europeans ... to try to lobby against it so it's it's a way that these release typically respond to this sort of thing ... um as for the yet ... the information itself ... um it the officials that we spoke to ... are not are not dismissing it I mean they had they are looking at a very closely ... so it's not so much that that the ... senses that the Israelis may be chaining up ... of this that this Intel ... what what could be the case in what some officials have suggested ... is that this is that this could be a message that the Russians are trying to send ... to the Obama administration ... which is now looking at arming the rebels what I in Syria ... so in other words it's it's a way of Russia to show that it has leverage ... I in this in this conflict ... and it's a way for them to exercise power which ... of which there which there are attempting to do which they have done via the filling arms contracts with the Syrians over the US is injections since this conflict began in March two thousand won ... want an incredibly complicated she biblical story Adam thank you very much new both to stay on top of this


text:
1 Min Read
April 26 (Reuters) - Shanghai Shimao Co Ltd:
* SAYS Q1 NET PROFIT UP 1.1 PERCENT Y/Y Source text in Chinese: bit.ly/2I1Y5Xc Further company coverage: (Reporting by Hong Kong newsroom)
All quotes delayed a minimum of 15 minutes. See here for a complete list of exchanges and delays.
© 2018 Reuters. All Rights Reserved.

subset: commoncrawl


text:
A role model for overcoming the odds
Some of you may remember the name Leon Stennis, The Vindicator's former religion editor and reporter.
For those who don't know him, let me introduce you to a man who has overcome some daunting personal challenges to achieve a lifelong goal — earning his doctoral degree in English at Indiana University of Pennsylvania, which he received last month.
Here are just some of the odds he has overcome in his life to achieve his doctorate:
He was reared in poverty in the rural South by a single mother in a family of five children.
He rose up from a segregated Little Rock, Ark., which he will speak to in a few moments.
He overcame the death of his first wife, Juanita, which thrust him into becoming the sole provider for his three children.
He labored, studied and overcame some setbacks for 61/2 years to obtain his doctorate.
Stennis, who turned 69 on Mother's Day, refers to himself as one of the "Little Rock Nine Hundred," as opposed to being one of the "Little Rock Nine," who made history by desegregating the city's all-white Central High School in 1957.
That action prompted others in the South to initiate efforts to further implement the U.S. Supreme Court's historic Brown v. Board of Education ruling. Violence occurred in Little Rock as a result of school desegregation, prompting President Dwight D. Eisenhower to dispatch federal troops to quell it.
Nine hundred is Stennis' estimate of the number of black students affected when Arkansas Gov. Orville E. Faubus closed all four of the city's high schools — three white and one black — in 1958, in an attempt to block the federal court-ordered desegregation of Little Rock Central.
Stennis recalls that many, if not most, of the white high-school students attended private schools that were set up as a result of the school closings.
"I remember that history, and I have the emotional scars caused by my family's impoverishment and the stress from racial tensions to prove it," Stennis says. "I was one of the casualties of the civil-rights movement then, but now I consider myself a success story from the movement. Unfortunately, so many students that I knew, including two of my sisters, were not as blessed with good outcomes," he adds.
Stennis believes the difficulties of the impoverished conditions his family faced in John Barrow, then a rural suburb of Little Rock, in those days contributed to the mental and physical health issues that his sister, Odessa, faced before her death in 2009.
He attributes the death of one of his other sisters, Betty Lou, in the 1950s, from pneumonia and diphtheria to his family's poverty. Poverty, he says, was tough on everyone in John Barrow. The year of missed schooling, he said, made it tougher.
After a U.S. Supreme Court ruling in 1959, Stennis was able to resume his schooling as a 10th-grader, a year behind some of his classmates, at Little Rock's all-black Horace Mann High School.
He then told me about another event that had a lasting impact on his life.
During the 1959-60 school year, his English teacher told him, "Just go ahead into the Army," when he did not do a research paper on the origins of jazz, because the male teacher "apparently felt that I would never succeed academically."
Embarrassed by his family's welfare status and lack of transportation, Stennis failed to tell his English teacher why he did not do his research paper. After admonishing him, his teacher had him transferred to a remedial English class.
Stennis also suffered a near tragedy when a male student put a belt around his neck and tried to choke him at an all-black high school in Wrightsville, Ark. He also witnessed the results of a fire in an all-black boys industrial school in which 21 young men died, including one of his classmates.
German philosopher Friedrich Nietzsche said that which does not kill us makes us stronger.
Stennis said those negative incidents would become a driving force to help him accomplish positive things in his life.
After completing 11th grade in Little Rock in 1961, he moved to Youngstown, where he graduated from East High School in 1962. He later served with the Navy and Navy Reserve for six years, attaining the rank of journalist second class.
He earned a bachelor's degree in business administration in 1973 from Youngstown State University and a master's degree in English from YSU in 2000. He has worked in health-care administration, journalism, public relations and university administration.
I met Leon in 1976 when I began my career at the paper. He left the paper in 1992 to accept a position at YSU, where he later served as coordinator of diversity initiatives.
After retiring from YSU in 2005, Stennis was accepted into the literature and criticism doctoral program at IUP in Indiana, Pa.
He is the father of three adult children, Leon Jr. of Youngstown, and Leenisha J. Stennis and Pamela Stennis Sarratt, both of Columbus. He lives in Youngstown with his wife, Cheryl Hutchins-Stennis.
He told me he plans to pursue an adjunct- teaching position in literature or composition at the university level and try his hand at creative writing, including writing either a memoir or a novel about his family's ordeal during the Little Rock school- desegregation crisis.
"After being blessed to survive or overcome so many obstacles in my life, I hope I can still do something to make at least a minor contribution to the betterment of our society," he said. "In that regard, I hope I can be a role model to someone else."
Dr. Stennis, you already are a role model.
Ernie Brown Jr., a Regional Editor at The Vindicator, writes a monthly column. You can contact him at email@example.com
More like this from vindy.com
- June 2, 2012 midnight
A role model for overcoming the odds
Don't Miss a Story
Sign up for our newsletter to receive daily news directly in your inbox.


text:
Abu Dhabi: The United Arab Emirates (UAE) and Italy have held talks over relations between the two countries and also about international developments.
The meet was participated by UAE President Sheikh Khalifa bin Zayed Al Nahyan and visiting Italian Prime Minister Mario Monti and other officials of both sides.
They also stressed at the need to strengthen international understanding and cooperation to enhance security and stability in the Gulf region, the Middle East and the world as a whole, within the framework of international resolutions.


text:
UCLA Women's Soccer Wins NCAA Title on Lavrusky's Golden Goal
The UCLA women's soccer team won its first NCAA championship in program history on Sunday afternoon, defeating the Florida State Seminoles, 1-0, in overtime. The title represents UCLA's 110th NCAA championship in school history, the most in the nation. Sophomore Kodi Lavrusky scored the game-winner for the Bruins in the 97th minute after taking a great through ball in the box from junior Megan Oyster and scoring far post past Florida State keeper Kelsey Wys.
The Bruins finished the season with a 22-1-3 record and defeated three No. 1 seeds en route to the championship. Florida State concludes their season with a 23-2-3 record.
UCLA controlled the majority of possession in the first half, but was unable to generate any chances in the early going. Sophomore Taylor Smith had the first serious chance of the match for either side in the 30th minute, controlling a free kick from junior Sarah Killion in the box before wheeling around and putting a shot on frame. The ball beat Wys, but clanged off the crossbar and out of play, keeping the match scoreless.
Then right before the half, UCLA almost went ahead again when junior Caprice Dydasco took a long shot that forced Wys to make a diving save. Smith gathered the rebound and put a shot towards the far post, but once again the ball bounced off the post and away from danger, sending the teams into the locker room tied at 0-0.
The Bruins continued to keep the ball in their third of the field at the start of the second half, and created another good scoring opportunity in the 59th minute. Freshman Darian Jenkins did well to keep the ball on the left side of the Seminole box and was able to cross the ball back to the top of the box to senior Jenna Richmond. Richmond one-timed a shot on goal but once again Wys was there to make the save. Lavrusky had another shot at putting the Bruins on top in the 66th minute, when a cross from junior Rosie White trickled to the front of the goal to Lavrusky. She could not get a foot on it though and Wys eventually gathered the ball for Florida State.
UCLA continued to push forward, consistently keeping the possession. In the 87th minute however, the Seminoles nearly took the lead when Kristin Grubka headed a long throw-in on net. Oyster came up big for the Bruins though, heading the ball off the line to prevent the goal. From there, neither side could find the back of the net before regulation ended and the match went to overtime.
In the first overtime, Killion had a chance to end the game for the Bruins in the 96th minute when she controlled a corner and took a shot towards an open net after Wys came out. Her shot was cleared off the line by the Seminoles though and the match stayed scoreless. Then in the 97th minute, Lavrusky finally handed the Bruins the title when she took a terrific through ball in the box from Oyster and finished far post for her seventh goal of the year.
UCLA head coach Amanda Cromwell became just the second women's soccer coach ever to win the NCAA title in her first season with a team, as well as only the second female coach to win the title, joining Becky Burleigh, who led Florida to victory in 1998.
Defender Ally Courtnall, who scored the game-tying goal in the semifinal, was named the College Cup's Most Outstanding Defensive Player and selected to the all-tournament team along with Killion, Oyster and goalkeeper Katelyn Rowland.
Airing on:
- Pac-12 Network
TODAY | 4:00pm PTLive
Airing on:
- Pac-12 Network
- Pac-12 Bay Area
TODAY | 6:00pm PTLive
TODAY | 8:00pm PTLive


text:
Heavy Iron, the studio responsible for the upcoming Wall-E videogame, have been working with Pixar for a long time. This is its fifth Pixar-film-to-game effort, and its content and quality should be instantly familiar to people who have played the previous four games. That is, it looks like a game that kids will enjoy playing when they're not watching "Wall-E," but it's unlikely to tear you from your normal videogame fare.
Let's Get Some Trash Thrown Out!
You play as Wall-E, the recycling robot left to clean Earth after humanity has left it a ruined trash pile. That's literal; humanity has abandoned the Earth to live amongst the stars, because the Earth is covered in garbage. Wall-E is one of the robots left behind to recycle this garbage, and has been living his lonely life for 700 years. Everything is shaken up by the arrival of EVE, a new-model robot.
EVE is one of the scout robots sent to Earth by humanity for reasons currently unknown. Wall-E and EVE are a study in contraries; he's square and on treads; she's a hovering iPod. He's lived on Earth for centuries; she lives on a giant spaceship. The story's impetus is Wall-E sneaking off with EVE when she returns to the Axiom, her home ship.
Living on the massive Axiom, humanity has gotten very fat. The glimpse we got of the ship's citizenry was in a "hover chair" corridor, where dozens of bloated humans zipped by on their floating loungers. It seems like the overall message of "Wall-E" is going to be an anti-consumerist one, with ruined worlds and a dangerously obese humanity.
Although there are some control constraints from system to system, and a few unique modes (like a motion-guided rail shooter for the Wii), it looks like the various platforms will all get a largely identical game. You'll adventure through the various "in-between moments," the could-be stories. In the movie, we see Wall-E with a gun for just a moment, so in the game, there's a shooter level. In the film, we see Wall-E get out of EVE's transport ship and onto the Axiom, so in the game, you can guide Wall-E through the surprisingly hostile environment of the hangar.
Play time is divided between playing as Wall-E, playing as EVE, and playing as both together. Wall-E's levels are focused on platforming, EVE's on shooting and jet-racing (since she can fly), and their shared levels are basically just playing as Wall-E, but EVE can pick him up and carry him for some super-jumps.
The Wii version of the title features some console-specific local multiplayer, such as the "EVE shooting gallery" we saw. This was a straightforward first-person shooter gallery, with each player being represented as a separate targeting reticule. On the HD versions of the game, multiplayer will be local, split-screen only.
Wall-E doesn't look horrible, but we don't think it's going to change gamer's minds about licensed games. If your household has a child in it, you'll probably end up picking up a copy of Wall-E while you wait for the DVD release. If not, you're probably not going to bother with a licensed game!


text:
A Perfect Day MovieEnjoy A Perfect Day For Free with duration 106 Min and released on 2015-08-28 and MPAA rating is 15.
- Original Title : A Perfect Day
- Movie title in your country : A Perfect Day
- Year of movie : 2015
- Genres of movie : Drama,
- Status of movie : Released
- Release date of movie : 2015-08-28
- Companies of movie : Reposado Producciones, Televisión Española (TVE), Mediapro,
- Countries of movie : Spain,
- Language of movie : Français, , Español, English,
- Durationof movie : 106 Min
- Average vote of movie : 5.9
- Youtube ID of movie :
- Translation of movie : ES,EN,FR,DE,ZH,IT,HE,
- Cast of movie :
- Olga Kurylenko ( Katya )
- Benicio del Toro ( Mambrú )
- Tim Robbins ( B )
- Mélanie Thierry ( Sophie )
- Fedja Stukan ( Damir )
A Perfect Day Synopsis:
Play Streaming A Perfect Day Film about a group of aid workers trying to resolve a crisis in an armed conflict zone in the Balkans. Movie A Perfect Day Online Streaming
A Perfect Day Enjoy Movie streaming movie in HD without downloading, Enjoy Movie A Perfect Day Full online movie streaming free and fun A Perfect Day Free Movie Stream only here Today, we can see that hundreds thousands of people looking for free A Perfect Day and watch it on their sweat house with internet connection. Be happy, you can reach hundreds of thousands of satisfied members who became tired of waiting for DVDs in the mail, and now you can watch for free A Perfect Day Film, get some free new movie online free watch and download new movie new releases and the hottest classics on our site. It is fast. It is easy. And best of all, it is free to try
Director : Fernando León de Aranoa, Writer : Fernando León de Aranoa, Music : Arnau Bataller, Cinematography : Alex Catalán
Yes, now you can Watch Movie A Perfect Day Full Movie Streaming and get the link to A Perfect Day In HD


text:
Cisco WAAS Troubleshooting Guide for Release 4.1.3 and Later -- Troubleshooting the SSL AO
From DocWiki
(→Troubleshooting Certificate Expiry Alarms on NME and SRE Modules)
(→Troubleshooting Certificate Expiry Alarms on NME and SRE Modules)
|Line 755:
|Line 755:
===Troubleshooting Certificate Expiry Alarms on NME and SRE Modules===
===Troubleshooting Certificate Expiry Alarms on NME and SRE Modules===
The SSL AO generates alarms when the self-signed machine certificate has expired (or is within 30 days of expiration) and a custom global machine certificate is not configured on the WAAS device. The WAAS software generates factory self-signed certificates with an expiration date of 5 years from the first startup of the WAAS device.
The SSL AO generates alarms when the self-signed machine certificate has expired (or is within 30 days of expiration) and a custom global machine certificate is not configured on the WAAS device. The WAAS software generates factory self-signed certificates with an expiration date of 5 years from the first startup of the WAAS device.
|Line 790:
|Line 788:
* Update the self-signed factory certificate with a later expiration date. This solution requires a script that you can obtain by contacting Cisco TAC.
* Update the self-signed factory certificate with a later expiration date. This solution requires a script that you can obtain by contacting Cisco TAC.
Revision as of 20:16, 6 April 2011
This article describes how to troubleshoot the SSL AO.
SSL Accelerator Overview
The SSL accelerator (available in 4.1.3 and later) optimizes encrypted Secure Sockets Layer (SSL) and Transport Layer Security (TLS) traffic. The SSL accelerator provides traffic encryption and decryption within WAAS to enable end-to-end traffic optimization. The SSL accelerator also provides secure management of the encryption certificates and keys.
In a WAAS network, the data center WAE acts as a trusted intermediary node for SSL requests by the client. The private key and server certificate are stored on the data center WAE. The data center WAE participates in the SSL handshake to derive the session key, which it distributes securely in-band to the branch WAE, allowing the branch WAE to decrypt client traffic, optimize it, reencrypt it, and send it over the WAN to the data center WAE. The data center WAE maintains a separate SSL session with the origin server.
The following services are relevant for SSL/TLS optimization:
- Accelerated Service – A configuration entity that describes acceleration characteristics to be applied for a SSL server or set of servers. Specifies the certificate and private key to be used while posing as a trusted intermediary, ciphers to be used, SSL version allowed, and certificate verification settings.
- Peering Service – A configuration entity that describes acceleration characteristics to be applied for in-band SSL connections between branch and data-center WAEs. This service is used for transferring session key information from data-center to branch WAEs for optimizing SSL connections.
- Central Manager Admin Service – Not used directly by the SSL accelerator, but to be used by an administrator for the configuration management of SSL accelerated services. Also used to upload certificates and private keys to be used in SSL accelerated services.
- Central Manager Management Service – Not used directly by the SSL accelerator, but used for communication between application accelerator devices and the Central Manager. This service is used for configuration management, secure store encryption key retrieval, and device status updates.
The Central Manager secure store is essential for the SSL AO to operate because it stores secure encryption keys for all WAEs. After each Central Manager reload, the administrator needs to reopen the secure store by providing the passphrase with the cms secure-store open command. A WAE automatically retrieves its secure store encryption key from the Central Manager whenever the WAE reboots, so no action is required on the WAE after a reload.
If clients are using an HTTP proxy solution, the initial connection is handled by the HTTP AO, which recognizes it as an SSL tunnel request to port 443. The HTTP AO looks for a matching SSL accelerated service defined on the data center WAE and when it finds a match, hands off the connection to the SSL AO. However, the traffic that the HTTP AO hands off to the SSL AO for an HTTPS proxy gets reported as part of the web application statistics, not in the SSL application. If the HTTP AO does not find a match, the connection is optimized as per static HTTPS (SSL) policy configuration.
The SSL AO can use self-signed certificates rather than CA-signed certificates, which can be helpful in deploying proof of concept (POC) systems and in troubleshooting SSL issues. By using self-signed certificates, you can quickly deploy a WAAS system without having to import the origin server certificates, and you can eliminate certificates as a potential source of problems. You can configure a self-signed certificate in the Central Manager when creating an SSL Accelerated Service. However, when you use a self-signed certificate, the client browser will display a security alert that the certificate is untrusted (because it is not signed by a well-known CA). To avoid this security warning, install the certificate in the Trusted Root Certification Authorities store on the client browser. (On Internet Explorer, on the security warning, click View Certificate, then on the Certificate dialog click Install Certificate and complete the Certificate Import Wizard.)
Configuring the SSL Management Services is optional, and allows you to change the SSL version and cipher list used for Central Manager communications to WAEs and to the browser (for administrative access). If you configure ciphers that are not supported by your browser, you will lose the connection to the Central Manager. In this case, use the crypto ssl management-service configuration command from the CLI to set the SSL management service settings back to the default.
Troubleshooting the SSL AO
You can verify the general AO configuration and status with the show accelerator and show license commands, as described in the Troubleshooting Application Acceleration article. The Enterprise license is required for SSL accelerator operation.
Next, verify the status that is specific to the SSL AO on both the data center and branch WAEs by using the show accelerator ssl command, as shown in Figure 1. You want to see that the SSL AO is Enabled, Running, and Registered, and that the connection limit is displayed. If the Config State is Enabled but the Operational State is Shutdown, it indicates a licensing problem. If the Operational State is Disabled, it may be because the WAE cannot retrieve the SSL keys from the Central Manager secure store, either because the secure store is not open or the Central Manager is unreachable. Use the show cms info and ping commands to confirm that the Central Manager is reachable.
- Figure 1. Verifying the SSL Accelerator Status
If you see an Operational State of Gen Crypto Params, wait until the status becomes Running, which may take a few minutes following a reboot. If you see a state of Retrieving Keys from CM for more than a few minutes, it could indicate that the CMS service on the Central Manager is not running, that there is no network connectivity to the Central Manager, that the WAAS versions on the WAE and Central Manager are incompatible, or that the Central Manager secure store is not open.
You can verify that the Central Manager secure store is initialized and open by using the show cms secure-store command as follows:
cm# show cms secure-store secure-store is initialized and open.
If the secure store is not initialized or open, you will see critical alarms such as mstore_key_failure and secure-store. You can open the secure store with the cms secure-store open command or from the Central Manager, choose Admin > Secure Store.
Tip: Document the secure store password to avoid having to reset the secure store if you forget the password.
If there is a problem with the disk encryption on a WAE, that can also prevent the SSL AO from operating. Use the show disk details command to verify that disk encryption is enabled and check if the CONTENT and SPOOL partitions are mounted. If these partitions are mounted, it indicates that the disk encryption keys were successfully retrieved from the Central Manager and encrypted data can be written and read from the disks. If the show disk details command shows "System is initializing," that indicates the encryption keys have not yet been retrieved from the Central Manager and the disks have not yet been mounted. The WAE will not provide acceleration services in this state. If the WAE is unable to retrieve disk encryption keys from the Central Manager, it will raise an alarm.
You can verify that the SSL accelerated service is configured and its status is "Enabled" on the data center WAE (in the Central Manager, choose the device, then choose Configure > Acceleration > SSL Accelerated Services ). A configured and enabled accelerated service may be rendered inactive by the SSL accelerator due to the following conditions:
- The certificate configured in the accelerated service been deleted from the WAE. Use the show running-config command to determine the certificate being used in the accelerated service, then use the show crypto certificates and show crypto certificate-details commands to confirm that the certificate is present secure store. If the certificate is missing, reimport the certificate.
- The accelerated service certificate has expired. Use the show crypto certificates and show crypto certificate-details commands to check the certificate expiry date.
- The accelerated service certificate has a valid date starting in the future. Use the show crypto certificates and show crypto certificate-details commands and check the validity section of the command output. Also, ensure that the WAE clock and timezone information is accurate.
You can verify that SSL connections have the correct policy applied, that is, they have full optimization with SSL acceleration, as shown in Figure 2. In the Central Manager, choose the WAE device, then choose Monitor > Optimization > Connections Statistics.
- Figure 2. Verifying the Correct Policy on SSL Connections
Use the show running-config command to verify that the HTTPS traffic policy is properly configured. You want to see optimize DRE no compression none for the SSL application action and you want to see appropriate match conditions listed for the HTTPS classifier, as follows:
WAE674# sh run | include HTTPS classifier HTTPS name SSL classifier HTTPS action optimize DRE no compression none <------------- WAE674# sh run | begin HTTPS ...skipping classifier HTTPS match dst port eq 443 <------------- exit
An active accelerated service inserts dynamic policies corresponding to the server IP:port, server name:port, or server domain:port configured within the accelerated service. These policies can be inspected using the show policy-engine application dynamic command. The Dst field in each displayed policy indicates the server IP and port matching the accelerated service. For the wildcard domain (for example, server-domain *.webex.com port 443), the Dst field will be 'Any:443'. For the server-name configuration, forward DNS lookup is performed when the accelerated service is activated and all the IP addresses returned in the DNS response will be inserted in the policy engine. This command is useful to catch situations where an accelerated service is marked "inservice" but the accelerated service is rendered inactive because of some other error. For example, all accelerated services are dependent on the peering service, and if the peering service is inactive because of a missing/deleted certificate, then an accelerated service will also be marked as inactive although it appears to be "inservice" in the show running-config output. You can verify that the SSL dynamic policy is active on the data center WAE by using the show policy-engine application dynamic command. You can verify the peering service status by using the show crypto ssl services host-service peering command.
An SSL AO accelerated service configuration can have four types of server entries:
- Static IP (server-ip)--available in version 4.1.3 and later
- Catch All (server-ip any)--available in 4.1.7 and later
- Hostname (server-name)--available in 4.2.1 and later
- Wildcard domain (server-domain)--available in 4.2.1 and later
Once the connection is received by the SSL AO, it decides which accelerated service should be used for optimization. The static IP configuration is given the highest preference, followed by server name, server domain, and then the server ip any. If none of the configured and activated accelerated services match with the server IP for the connection, the connection is pushed down to the generic AO. The cookie inserted into the policy engine by the SSL AO is used to determine which accelerated service and what type of server entry is matched for a particular connection. This policy engine cookie is a 32-bit number and is meaningful only to the SSL AO. The higher bits are used to indicate different server entry types and the lower bits indicate the accelerated service index, as follows:
|Cookie Value
|Server Entry Type
|Server IP address
|Static IP address configuration
|Server hostname
|Data center WAE performs a forward DNS lookup for the hostname and it adds the IP addresses that are returned into the dynamic policy configuration. Refreshed every 10 minutes by default.
|Server domain name
|Data center WAE performs a reverse DNS lookup on the destination host IP address to determine if it matches with the domain. If it matches, then SSL traffic is accelerated, and if it does not match, the traffic is handled according to the static HTTPS policy.
|Server Any
|All SSL connections are accelerated using this accelerated service configuration
Example 1: Accelerated Service with server-ip Configuration:
WAE(config)#crypto ssl services accelerated-service asvc-ip WAE(config-ssl-accelerated)#description "Server IP acceleration" WAE(config-ssl-accelerated)#server-cert-key server.p12 WAE(config-ssl-accelerated)#server-ip 184.108.40.206 port 443 WAE(config-ssl-accelerated)#inservice
The corresponding policy engine entry is added as follows:
WAE# sh policy-engine application dynamic Dynamic Match Freelist Information: Allocated: 32768 In Use: 3 Max In Use: 5 Allocations: 1751 < snip > Individual Dynamic Match Information: Number: 1 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: 18.104.22.168:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32764 Hits: 25 Flows: - NA - Cookie: 0x80000001 <----------------
Example 2: Accelerated Service with server-name Configuration:
This configuration allows easy deployment for optimization of enterprise SSL applications. It is adaptable to DNS configuration changes and reduces IT administrative tasks.
WAE(config)#crypto ssl services accelerated-service asvc-name WAE(config-ssl-accelerated)#description "Server name acceleration" WAE(config-ssl-accelerated)#server-cert-key server.p12 WAE(config-ssl-accelerated)#server-name www.google.com port 443 WAE(config-ssl-accelerated)#inservice
The corresponding policy engine entry is added as follows:
WAE# sh policy-engine application dynamic Dynamic Match Freelist Information: Allocated: 32768 In Use: 3 Max In Use: 5 Allocations: 1751 < snip > Individual Dynamic Match Information: Number: 1 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: 184.108.40.206:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32762 Hits: 0 Flows: - NA - Cookie: 0x40000002 <---------------- DM Ref Index: - NA - DM Ref Cnt: 0 Number: 2 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: 184.108.40.206:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32763 Hits: 0 Flows: - NA - Cookie: 0x40000002 <---------------- DM Ref Index: - NA - DM Ref Cnt: 0 Number: 3 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: 220.127.116.11:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32764 Hits: 0 Flows: - NA - Cookie: 0x40000002 <---------------- DM Ref Index: - NA - DM Ref Cnt: 0 Number: 4 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: 22.214.171.124:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32765 Hits: 0 Flows: - NA - Cookie: 0x40000002 <---------------- DM Ref Index: - NA - DM Ref Cnt: 0
Example 3: Accelerated Service with server-domain Configuration:
This configuration allows WAAS devices to configure a single wildcard domain that avoids the need to know IP addresses for all the servers. The data center WAE uses reverse DNS (rDNS) to match traffic belonging to the configured domain. Configuring a wildcard domain avoids configuring multiple IP addresses, making the solution scalable and applicable for SaaS architecture.
WAE(config)#crypto ssl services accelerated-service asvc-domain WAE(config-ssl-accelerated)#description "Server domain acceleration" WAE(config-ssl-accelerated)#server-cert-key server.p12 WAE(config-ssl-accelerated)#server-name *.webex.com port 443 WAE(config-ssl-accelerated)#inservice
The corresponding policy engine entry is added as follows:
WAE# sh policy-engine application dynamic Dynamic Match Freelist Information: Allocated: 32768 In Use: 3 Max In Use: 5 Allocations: 1751 < snip > Individual Dynamic Match Information: Number: 1 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: ANY:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32762 Hits: 0 Flows: - NA - Cookie: 0x2FFFFFFF <---------------- DM Ref Index: - NA - DM Ref Cnt: 0
Example 4: Accelerated Service with server-ip any Configuration:
This configuration provides a catch-all mechanism. When an accelerated service with server-ip any port 443 is made active, it allows all connections on port 443 to be optimized by the SSL AO. This configuration can be used during POCs to optimize all traffic on a particular port.
WAE(config)#crypto ssl services accelerated-service asvc-ipany WAE(config-ssl-accelerated)#description "Server ipany acceleration" WAE(config-ssl-accelerated)#server-cert-key server.p12 WAE(config-ssl-accelerated)#server-ip any port 443 WAE(config-ssl-accelerated)#inservice
The corresponding policy engine entry is added as follows:
WAE# sh policy-engine application dynamic Dynamic Match Freelist Information: Allocated: 32768 In Use: 3 Max In Use: 5 Allocations: 1751 < snip > Individual Dynamic Match Information: Number: 1 Type: Any->Host (6) User Id: SSL (4) <---------------- Src: ANY:ANY Dst: ANY:443 <---------------- Map Name: basic Flags: SSL Seconds: 0 Remaining: - NA - DM Index: 32762 Hits: 0 Flows: - NA - Cookie: 0x10000004 <---------------- DM Ref Index: - NA - DM Ref Cnt: 0
You can verify the ciphers being used with the show statistics crypto ssl ciphers commands, as shown in Figure 3.
- Figure 3. Verifying Ciphers
You can verify that these ciphers match those configured on the origin server. Note: Ciphers that include DHE are not supported by Microsoft IIS servers.
On an Apache server, you can verify the SSL version and cipher details in the httpd.conf file. These fields may also be in a separate file (sslmod.conf) referenced from httpd.conf. Look for the SSLProtocol and SSLCipherSuite fields as follows:
SSLProtocol -all +TLSv1 +SSLv3 SSLCipherSuite HIGH:MEDIUM:!aNULL:+SHA1:+MD5:+HIGH:+MEDIUM . . . SSLCertificateFile /etc/httpd/ssl/server.crt SSLCertificateKeyFile /etc/httpd/ssl/server.key
To verify the certificate issuer on an Apache server, use the openssl command to read the certificate as follows:
> openssl x509 -in cert.pem -noout -issuer -issuer_hash issuer= / C=US/ST=California/L=San email@example.com be7cee67
In the browser, you can view a certificate and its details to determine the certificate chain, version, encryption key type, issuer common name (CN), and subject/site CN. In Internet Explorer, click the padlock icon, click View Certificate, and then look at the Details and Certification Path tabs for this information.
Most browsers require that client certificates be in the PKCS12 format rather than the X509 PEM format. To export the X509 PEM format to PKCS12 format, use the openssl command as follows on an Apache server:
> openssl pkcs12 -export -in cert.pem -inkey key.pem -out cred.p12 Enter Export Password: Verifying - Enter Export Password:
If the private keys are encrypted, the passphrase is required for export. The export password is used again for importing credentials to the WAAS device.
Use the show statistics accelerator ssl command to see the SSL AO statistics.
WAE7326# show statistics accelerator ssl SSL: Global Statistics ----------------- Time Accelerator was started: Mon Nov 10 15:28:47 2008 Time Statistics were Last Reset/Cleared: Mon Nov 10 15:28:47 2008 Total Handled Connections: 17 <---------------- Total Optimized Connections: 17 <---------------- Total Connections Handed-off with Compression Policies Unchanged: 0 <---------------- Total Dropped Connections: 0 <---------------- Current Active Connections: 0 Current Pending Connections: 0 Maximum Active Connections: 3 Total LAN Bytes Read: 25277124 <---------------- Total Reads on LAN: 5798 <---------------- Total LAN Bytes Written: 6398 <---------------- Total Writes on LAN: 51 <---------------- Total WAN Bytes Read: 43989 <---------------- Total Reads on WAN: 2533 <---------------- Total WAN Bytes Written: 10829055 <---------------- Total Writes on WAN: 3072 <---------------- . . .
Failed sessions and certificate verifications statistics can be useful for troubleshooting and are more easily retrieved by using the following filter on the show statistics accelerator ssl command:
WAE# show statistics accelerator ssl | inc Failed Total Failed Handshakes: 47 Total Failed Certificate Verifications: 28 Failed certificate verifications due to invalid certificates: 28 Failed Certificate Verifications based on OCSP Check: 0 Failed Certificate Verifications (non OCSP): 28 Total Failed Certificate Verifications due to Other Errors: 0 Total Failed OCSP Requests: 0 Total Failed OCSP Requests due to Other Errors: 0 Total Failed OCSP Requests due to Connection Errors: 0 Total Failed OCSP Requests due to Connection Timeouts: 0 Total Failed OCSP Requests due to Insufficient Resources: 0
DNS related statistics can be useful for troubleshooting server name and wildcard domain configuration. To retrieve these statistics use the show statistics accelerator ssl command, as follows:
WAE# show statistics accelerator ssl . . . Number of forward DNS lookups issued: 18 Number of forward DNS lookups failed: 0 Number of flows with matching host names: 8 Number of reverse DNS lookups issued: 46 Number of reverse DNS lookups failed: 4 Number of reverse DNS lookups cancelled: 0 Number of flows with matching domain names: 40 Number of flows with matching any IP rule: 6 . . . Pipe-through due to domain name mismatch: 6 . . .
SSL rehandshake related statistics can be useful for troubleshooting and can be retrieved using the following filter on the show statistics accelerator ssl command:
WAE# show statistics accelerator ssl | inc renegotiation Total renegotiations requested by server: 0 Total SSL renegotiations attempted: 0 Total number of failed renegotiations: 0 Flows dropped due to renegotiation timeout: 0
Use the show statistics connection optimized ssl command to check that the WAAS device is establishing optimized SSL connections. Verify that "TDLS" appears in the Accel column for a connection. "S" indicates that the SSL AO was used as follows:
WAE674# sh stat conn opt ssl Current Active Optimized Flows: 3 Current Active Optimized TCP Plus Flows: 3 Current Active Optimized TCP Only Flows: 0 Current Active Optimized TCP Preposition Flows: 1 Current Active Auto-Discovery Flows: 0 Current Active Pass-Through Flows: 0 Historical Flows: 100 D:DRE,L:LZ,T:TCP Optimization, A:AOIM,C:CIFS,E:EPM,G:GENERIC,H:HTTP,M:MAPI,N:NFS,S:SSL,V:VIDEO ConnID Local IP:Port Remote IP:Port PeerID Accelerator 342 10.56.94.101:3406 10.10.100.100:443 0:1a:64:d3:2f:b8 TDLS <-----Look for "S"
You can check connection statistics for closed connections by using the show statistics connection closed ssl command.
If the connections are not getting optimized, check if WCCP/PBR is properly configured and working, and check for asymmetric routing.
You can view the SSL connection statistics by using the show statistics connection optimized ssl detail command, where you will see the dynamic policy that results from the configured SSL accelerated service. Note: The configured policy is TFO optimization only, but full optimization is applied as a result of the configured SSL service.
WAE674# sh stat connection optimized ssl detail Connection Id: 1633 Peer Id: 00:14:5e:84:24:5f Connection Type: EXTERNAL CLIENT Start Time: Wed Jul 15 06:35:48 2009 Source IP Address: 10.10.10.10 Source Port Number: 2199 Destination IP Address: 10.10.100.100 Destination Port Number: 443 Application Name: SSL Classifier Name: HTTPS Map Name: basic Directed Mode: FALSE Preposition Flow: FALSE Policy Details: Configured: TCP_OPTIMIZE <------TFO only is configured Derived: TCP_OPTIMIZE + DRE + LZ Peer: TCP_OPTIMIZE Negotiated: TCP_OPTIMIZE + DRE + LZ Applied: TCP_OPTIMIZE + DRE + LZ <------Full optimization applied Accelerator Details: Configured: None Derived: None Applied: SSL <------SSL acceleration applied Hist: None Original Optimized -------------------- -------------------- Bytes Read: 1318 584 Bytes Written: 208 1950 . . .
Later in this output, extended SSL session level details are shown as follows:
. . . SSL : 1633 Time Statistics were Last Reset/Cleared: Tue Jul 10 18:23:20 2009 Total Bytes Read: 0 0 Total Bytes Written: 0 0 Memory address: 0x8117738 LAN bytes read: 1318 Number of reads on LAN fd: 4 LAN bytes written out: 208 Number of writes on LAN fd: 2 WAN bytes read: 584 Number of reads on WAN fd: 23 WAN bytes written out: 1950 Number of writes on WAN fd: 7 LAN handshake bytes read: 1318 LAN handshake bytes written out: 208 WAN handshake bytes read: 542 WAN handshake bytes written out: 1424 AO bytes read: 0 Number of reads on AO fd: 0 AO bytes written out: 0 Number of writes on AO fd: 0 DRE bytes read: 10 Number of reads on DRE fd: 1 DRE bytes written out: 10 Number of writes on DRE fd: 1 Number of renegotiations requested by server: 0 Number of SSL renegotiations performed: 0 Flow state: 0x00080000 LAN work items: 1 LAN conn state: READ LAN SSL state: SSLOK (0x3) WAN work items: 0 WAN conn state: READ WAN SSL state: SSLOK (0x3) W2W work items: 1 W2W conn state: READ W2W SSL state: SSLOK (0x3) AO work items: 1 AO conn state: READ DRE work items: 1 DRE conn state: READ Hostname in HTTP CONNECT: <-----Added in 4.1.5 IP Address in HTTP CONNECT: <-----Added in 4.1.5 TCP Port in HTTP CONNECT: <-----Added in 4.1.5
Troubleshooting HTTP AO to SSL AO Handoff Connections
If a client must go through a proxy to reach an HTTPS server, the client's request first goes as an HTTP CONNECT message to the proxy (with the actual HTTPS server IP address embedded in the CONNECT message). At this point, the HTTP AO handles this connection on the peer WAEs. The proxy creates a tunnel between the client and server port and relays subsequent data between the client and that server IP address and port. The proxy responds back to the client with a "200 OK" message and hands off the connection to the SSL AO because the client intends to talk to the server over SSL. The client then initiates an SSL handshake with the SSL server over the TCP connection (tunnel) that was set up by the proxy.
Check the following things when troubleshooting issues with handed-off connections:
- Check the output of the show statistics accelerator http command to confirm that a connection was handled by the HTTP AO and then handed off to the SSL AO. Look at the Total Handled Connections and Total Connections Handed-off to SSL counters. If there are any issues, verify the following:
- The HTTP AO is enabled and in the running state on the peer WAEs.
- The SSL accelerated service is configured with the port used by the client in the CONNECT URL (or implied port 443 if HTTPS is being used). Often the proxy port is different from the CONNECT URL port and this proxy port should not be configured in the SSL accelerated service. However, the proxy port should be included in the traffic classifier that is mapped to the HTTP AO.
- Check the output of the show statistics accelerator http command to confirm that this connection was handled and optimized by the SSL AO. Look at the Total Handled Connections and Total Optimized Connections counters. If the statistics counters are not correct, perform basic SSL troubleshooting as discussed in the previous section.
- On the data center WAE, verify that the show statistics connection optimized detail command output shows the actual SSL server's hostname, IP address, and TCP port. If these fields are not set correctly, check the following:
- Verify that the client browser proxy settings are correct.
- Verify that the DNS server is configured on the data center WAE and is reachable. You can configure a DNS server on the WAE with the ip name-server A.B.C.D command.
Troubleshooting Server Certificate Verification
Server certificate verification requires that you import the correct CA certificate to the data center WAE.
To troubleshoot server certificate verification follow these steps:
1. Inspect the server certificate and retrieve the Issuer name. This Issuer name within the server certificate must match the subject name within the matching CA certificate. If you have PEM encoded certificates, you can use the following openssl command on a server with openssl installed:
> openssl x509 –in cert-file-name –noout –text
2. Ensure that the matching crypto pki ca configuration exists on the data center WAE by using show running-config command. For a CA certificate to be used by the WAE in the verification process, a crypto pki ca configuration item is required for each CA certificate imported. For example, if a CA certificate company1.ca is imported, then the following configuration must be made on the data center WAE:
crypto pki ca company1 ca-certificate company1.ca exit
Note: If a CA certificate is imported using the Central Manager GUI, the Central Manager automatically adds the above crypto pki ca configuration to include the imported CA certificate. However, if the CA certificate is imported via the CLI, then you will need to manually add the above configuration.
3. If the certificate being verified includes a certificate chain, then ensure that the certificate chain is coherent, and the topmost issuer's CA certificate is imported on the WAE. Use the openssl verify command to verify the certificate separately first.
4. If verification still fails, then examine the SSL accelerator debug log. Use the following commands to enable debug logging:
wae# config wae(config)# logging disk priority debug wae(config)# logging disk enable wae(config)# exit wae# undebug all wae# debug accelerator ssl verify wae# debug tfo connection all
5. Initiate a test connection and then examine the /local/local1/errorlog/sslao-errorlog.current log file. This file should indicate the issuer name that was included in the server certificate. Ensure that this issuer name exactly matches the subject name of the CA certificate.
If there are any other internal errors in the logs, it may be helpful to enable additional debug options.
6. Even if the Issuer name and Subject names match, the CA certificate may not be the correct one. In such cases, if the server certificate is issued by a well-known CA, then a browser can be used to directly (without WAAS) reach the server. When the browser sets up the connection, the certificate can be examined by clicking the Lock icon that appears on the bottom right of the browser window or within the browser's address bar. The certificate details may indicate the appropriate CA certificate matching this server certificate. Check the Serial Number field within the CA certificate. This serial number should match the serial number of the certificate that is being imported on the data center WAE.
7. If you have OCSP revocation checking enabled, disable it and check that certificate verification by itself works. For help troubleshooting OCSP settings see the "Troubleshooting OCSP Revocation Checking" section.
Troubleshooting Client Certificate Verification
Verification of the client certificate may be enabled on the origin server and/or on the data center WAE. When WAAS is used to accelerate SSL traffic, the client certificate received by the origin server is the certificate indicated in the machine-cert-key specified in the crypto ssl services global-settings command on the data center WAE or the data center WAE machine self signed certificate, if the machine-cert-key is not configured. As a result, if client certificate verification is failing on the origin server, it may be because the data center WAE machine-certificate is not verifiable on the origin server.
If client certificate verification on the data center WAE is not working, it is likely because the CA certificate matching the client certificate is not imported on the data center WAE. See the "Troubleshooting Server Certificate Verification" section for instructions how to check if you have the correct CA certificate imported on the WAE.
Troubleshooting Peer WAE Certificate Verification
To troubleshoot peer certificate verification issues follow these steps:
1. Verify that the certificate being verified is a CA signed certificate. A self signed certificate by one WAE is not verifiable by another WAE. WAEs by default are loaded with self signed certificates. A self signed certificate must be configured using the crypto ssl services global-settings machine-cert-key command.
2. Verify that the correct CA certificate is loaded on the device that is verifying the certificate. For example, if peer-cert-verify is configured on the data center WAE, then it is essential for the branch WAE certificate to be CA-signed and the same signing CA's certificate should be imported on the data center WAE. Do not forget to create a CA using the crypto pki ca command to use the imported certificate, if you are importing the certificate manually through the CLI. When imported by the Central Manager GUI, the Central Manager automatically creates a matching crypto pki ca configuration.
3. If verification of the peer WAE still fails, check the debug logs as described in the "SSL AO Logging" section.
Troubleshooting OCSP Revocation Checking
If the system is having trouble making successful SSL connections with Online Certificate Status Protocol (OCSP) revocation checking enabled, follow these troubleshooting steps:
- Ensure that the OCSP responder service is running on the responder server.
- Ensure good connectivity between the WAE and the responder. Use the ping and telnet commands (to the appropriate port) from the WAE to check.
- Confirm that the certificate being validated is indeed valid. The expiry date and correct responder URL are typically areas where there are issues.
- Verify that the certificate for OCSP responses is imported on the WAE. Responses from an OCSP responder are also signed and the CA certificate matching the OCSP responses must reside on the WAE.
- Check the show statistics accelerator ssl command output to check for OCSP statistics and check the counters corresponding to OCSP failures.
- If the OCSP HTTP connection is going through an HTTP proxy, try disabling the proxy to see if it helps. If it does help, then check that the proxy configuration is not causing the connection failure. If the proxy configuration is fine, then there may be some HTTP header peculiarity which may be causing some incompatibility with the proxy. Capture a packet trace for further investigation.
- If all else fails, you may have to capture a packet trace of the outgoing OCSP request for further debugging. You can use the tcpdump or tethereal commands as described in the section "Capturing and Analyzing Packets" in the Preliminary WAAS Troubleshooting article.
The URL used by the data center WAE to reach an OCSP responder is derived in one of two ways:
- The static OCSP URL configured by the crypto pki global-settings configuration command
- The OCSP URL specified in the certificate being checked
If the URL is derived from the certificate being checked, then it is essential to ensure that the URL is reachable. Enable the SSL accelerator OCSP debug logs to determine the URL and then check for connectivity to the responder. See the next section for details on using debug logs.
Troubleshooting DNS Configuration
If the system is having trouble optimizing SSL connections with server name and server domain configurations, follow these troubleshooting steps:
1. Ensure that the DNS server configured on the WAE is reachable and can resolve names. Use the following command to check the configured DNS server:
WAE# sh running-config | include name-server ip name-server 184.108.40.206 Try to perform DNS or reverse DNS lookup on the WAE using the following commands: WAE# dnslookup www.cisco.com The specified host/domain name is unknown !
This response indicates the name cannot be resolved by the configured name servers.
Try ping/traceoute for the configured name servers to check their reachability and the round trip time.
WAE# ping 22.214.171.124 PING 220.127.116.11 (126.96.36.199) 56(84) bytes of data. --- 22.214.171.124 ping statistics --- 5 packets transmitted, 0 received, 100% packet loss, time 4008ms
WAE# traceroute 126.96.36.199 traceroute to 184.108.40.206 (22.214.171.124), 30 hops max, 38 byte packets 1 126.96.36.199 (184.108.40.206) 0.604 ms 0.288 ms 0.405 ms 2 * * * 3 * * * 4 * * * 5 * * *
2. If the DNS server is reachable and it can resolve names and still the SSL connections are not getting optimized, make sure the accelerated service configuring the specified domain or hostname is active and there are no alarms for the SSL AO. Use following commands:
WAE# show alarms Critical Alarms: ---------------- Alarm ID Module/Submodule Instance --------------- -------------------- --------------- 1 accl_svc_inactive sslao/ASVC/asvc-host accl_svc_inactive 2 accl_svc_inactive sslao/ASVC/asvc-domain accl_svc_inactive Major Alarms: ------------- None Minor Alarms: ------------- None
The presence of the "accl_svc_inactive" alarm is an indication that there is some discrepancy in the accelerated service configuration and there might be one or more accelerated services having overlapping configuration for server entries. Check the accelerated service configuration and make sure the configuration is correct. Use the following command to verify the configuration:
WAE# show crypto ssl accelerated service Accelerated Service Config State Oper State Cookie ------------------- ------------ ----------- ------ asvc-ip ACTIVE ACTIVE 0 asvc-host ACTIVE INACTIVE 1 asvc-domain ACTIVE INACTIVE 2
To check details about a particular accelerated service use the following command:
WAE# show crypto ssl accelerated service asvc-host Name: asvc-host Config state: ACTIVE, Oper state: INACTIVE, Cookie: 0x3, Error vector: 0x0 No server IP addresses are configured The following server host names are configured: lnxserv.shilpa.com port 443 Host 'lnxserv.shilpa.com' resolves to following IPs: --none-- No server domain names are configured
One reason that the operational state of the accelerated service might be INACTIVE is a DNS failure. For example, if there is a server hostname in the accelerated service configuration and the WAE cannot resolve the server IP address, then it cannot configure the appropriate dynamic policy.
3. If the statistics counter for "Pipe-through due to non-matching domain name" is increasing, it is an indication that the SSL connection is for a server that is configured for optimization. Check the policy engine entries using following command:
WAE#sh policy-engine application dynamic Number: 1 Type: Any->Host (6) User Id: SSL (4) Src: ANY:ANY Dst: 18.104.22.168:443 Map Name: basic Flags: TIME_LMT DENY Seconds: 10 Remaining: 5 DM Index: 32767 Hits: 1 Flows: - NA - Cookie: 0x2EEEEEEE DM Ref Index: - NA - DM Ref Cnt: 0
Check the connection status using the show statistics connection command. The first connection should show an Accelerator of TSGDL and the subsequent connections, until the lifetime of the TIME_DENY policy entry, should be TDL.
4. If the DNS server is across the WAN with respect to the data center WAE, or if the reverse DNS response time is too long, then some connections may be dropped. This depends on the client timeout and the rDNS response time. In this case, the counter for "Number of reverse DNS lookups cancelled" increases and the connection is dropped. This situation is an indication that the DNS server is not responsive or very slow and/or NSCD on WAAS is not working. The NSCD status can be checked using the show alarms command. The probability of this happening is very low since in most deployments, the DNS server is expected to be on the same LAN as the data center WAE.
Troubleshooting HTTP to SSL AO Chaining
NOTE: HTTP to SSL AO chaining was introduced in WAAS version 4.3.1. This section is not applicable to earlier WAAS versions.
Chaining allows an AO to insert another AO at any time during the lifetime of a flow and both AOs can apply their AO-specific optimization independently on the flow. AO chaining is different from the AO handoff feature provided by WAAS in pre-4.3.1 releases because with AO chaining the first AO continues to optimize the flow.
The SSL AO handles two types of connections:
- Byte-0 SSL: The SSL AO receives the connection first and completes the SSL handshake. It parses the initial part of the payload to check for an HTTP method. If the payload indicates HTTP, it inserts the HTTP AO; if not, it applies the regular TSDL optimization.
- Proxy CONNECT: The HTTP AO receives the connection first. It identifies the CONNECT header method in the client's request and inserts the SSL AO after the proxy confirms with a 200 OK message.
The SSL AO uses a lightweight HTTP parser that detects the following HTTP methods: GET, HEAD, POST, PUT, OPTIONS, TRACE, COPY, LOCK, POLL, BCOPY, BMOVE, MKCOL, DELETE, SEARCH, UNLOCK, BDELETE, PROPFIND, BPROPFIND, PROPPATCH, SUBSCRIBE, BPROPPATCH, UNSUBSCRIBE, and X__MS_ENUMATTS. You can use the debug accelerator ssl parser command to debug issues related to the parser. You can use the show stat accel ssl payload http/other command to view statistics of traffic classified based on the payload type.
Troubleshooting tips:
- Make sure the HTTPS feature is enabled in the HTTP AO configuration as this is owned by the HTTP AO. For details, see the Troubleshooting the HTTP AO article.
- Check the connection state using the show stat connection command. If correctly optimized, it should show THSDL indicating TCP, HTTP, SSL and DRE-LZ optimization. If any of these optimizations are missing, debug further on that optimizer (SSL, HTTP, and so forth). For example, if the connection state shows THDL, it means SSL optimization was not applied on the connection. Details on debugging issues related to the SSL AO follow.
- Make sure the SSL AO is enabled and is in the running state (see the section "Troubleshooting the SSL AO").
- Make sure there are no alarms by using the show alarms command.
- If SSL traffic is not being optimized, make sure the server IP address, host-name, or domain-name and port number is added as part of the accelerated service.
- Make sure the accelerated service is in the ACTIVE state by using the show crypto ssl services accelerated-service ASVC-name command (see the "Troubleshooting DNS Configuration" section).
- Make sure the policy engine has an entry for this server and port by using the show policy-engine application dynamic command.
- If the destination server is using SSL on a non-default port (the default is 443), make sure this is reflected in the policy engine configuration. The Central Manager relies on this information for reporting SSL traffic data.
- Make sure the configured host-name resolves to a valid IP address by using the show crypto ssl services accelerated-service ASVC-name command. If no IP address is found, check if the name server is configured correctly. Also check the output of the dnslookup IP-address command.
wae# sh run no-policy . . . crypto ssl services accelerated-service sslc version all server-cert-key test.p12 server-ip 22.214.171.124 port 4433 server-ip any port 443 server-name mail.yahoo.com port 443 server-name mail.google.com port 443 inservice
wae# sh crypto ssl services accelerated-service sslc Name: sslc Config state: ACTIVE, Oper state: ACTIVE, Cookie: 0x0, Error vector: 0x0 The following server IP addresses are configured: 18.104.22.168 port 4433 any port 443 The following server host names are configured: mail.yahoo.com port 443 Host 'mail.yahoo.com' resolves to following IPs: 220.127.116.11 mail.google.com port 443 Host 'mail.google.com' resolves to following IPs: 220.127.116.11 22.214.171.124 126.96.36.199 18.104.22.168
wae# dnslookup mail.yahoo.com Official hostname: login.lga1.b.yahoo.com address: 188.8.131.52 Aliases: mail.yahoo.com Aliases: login.yahoo.com Aliases: login-global.lgg1.b.yahoo.com wae# dnslookup mail.google.com Official hostname: googlemail.l.google.com address: 126.96.36.199 address: 18.104.22.168 address: 126.96.36.199 address: 220.127.116.11 Aliases: mail.google.com
SSL AO Logging
The following log files are available for troubleshooting SSL AO issues:
- Transaction log files: /local1/logs/tfo/working.log (and /local1/logs/tfo/tfo_log_*.txt)
- Debug log files: /local1/errorlog/sslao-errorlog.current (and sslao-errorlog.*)
For easier debugging, you should first set up an ACL to restrict packets to one host.
WAE674(config)# ip access-list extended 150 permit tcp host 10.10.10.10 any WAE674(config)# ip access-list extended 150 permit tcp any host 10.10.10.10
To enable transaction logging, use the transaction-logs configuration command as follows:
wae(config)# transaction-logs flow enable wae(config)# transaction-logs flow access-list 150
You can view the end of a transaction log file by using the type-tail command as follows:
wae# type-tail tfo_log_10.10.11.230_20090715_130000.txt Wed Jul 15 14:35:48 2009 :1633 :10.10.10.10 :2199 :10.10.100.100 :443 :OT :START :EXTERNAL CLIENT :00.14.5e.84.24.5f :basic :SSL :HTTPS :F :(TFO) (DRE,LZ,TFO) (TFO) (DRE,LZ,TFO) (DRE,LZ,TFO) :<None> :(None) (None) (SSL) :<None> :<None> :0 :332 Wed Jul 15 14:36:06 2009 :1633 :10.10.10.10 :2199 :10.10.100.100 :443 :SODRE :END :165 :15978764 :63429 :10339 :0 Wed Jul 15 14:36:06 2009 :1633 :10.10.10.10 :2199 :10.10.100.100 :443 :OT :END :EXTERNAL CLIENT :(SSL) :468 :16001952 :80805 :27824
To set up and enable debug logging of the SSL AO, use the following commands.
NOTE: Debug logging is CPU intensive and can generate a large amount of output. Use it judiciously and sparingly in a production environment.
You can enable detailed logging to the disk as follows:
WAE674(config)# logging disk enable WAE674(config)# logging disk priority detail
You can enable debug logging for connections in the ACL as follows:
WAE674# debug connection access-list 150
The options for SSL AO debugging are as follows:
WAE674# debug accelerator ssl ? accelerated-svc enable accelerated service debugs alarm enable SSL AO alarm debugs all enable all SSL accelerator debugs am enable auth manager debugs am-generic-svc enable am generic service debugs bio enable bio layer debugs ca enable cert auth module debugs ca-pool enable cert auth pool debugs cipherlist enable cipherlist debugs client-to-server enable client-to-server datapath debugs dataserver enable dataserver debugs flow-shutdown enable flow shutdown debugs generic enable generic debugs ocsp enable ocsp debugs oom-manager enable oom-manager debugs openssl-internal enable opnessl internal debugs peering-svc enable peering service debugs session-cache enable session cache debugs shell enable SSL shell debugs sm-alert enable session manager alert debugs sm-generic enable session manager generic debugs sm-io enable session manager i/o debugs sm-pipethrough enable sm pipethrough debugs synchronization enable synchronization debugs verify enable certificate verification debugs waas-to-waas enable waas-to-waas datapath debugs
You can enable debug logging for SSL connections and then display the end of the debug error log as follows:
WAE674# debug accelerator ssl all WAE674# debug connection all Enabling debug messages for all connections. Are you sure you want to do this? (y/n) [n]y WAE674# type-tail errorlog/sslao-errorlog.current follow
Troubleshooting Certificate Expiry Alarms on NME and SRE Modules
The SSL AO generates alarms when the self-signed machine certificate has expired (or is within 30 days of expiration) and a custom global machine certificate is not configured on the WAAS device. The WAAS software generates factory self-signed certificates with an expiration date of 5 years from the first startup of the WAAS device.
The clock in all WAAS NME and SRE modules is set to January 1, 2006 during first startup, even though the NME or SRE module is more recent. This causes the self-signed certificate to expire on January 1, 2011 and the device generates certificate expiration alarms.
If you are not using the default factory certificate as the global certificate, and instead are using a custom certificate for the SSL AO, you will not experience this unexpected expiration and you can update the custom certificate whenever it expires. Also, if you have updated the NME or SME module with a new software image and have synchronized the clock to a more recent date, you may not experience this issue.
The symptom of certificate expiration is one of the following alarms (shown here in the output of the show alarms command):
Major Alarms: ------------- Alarm ID Module/Submodule Instance --------------- -------------------- --------------- 1 cert_near_expiration sslao/SGS/gsetting cert_near_expiration
Alarm ID Module/Submodule Instance --------------- -------------------- --------------- 1 cert_expired sslao/SGS/gsetting cert_expired
The Central Manager GUI reports the following alarm: "Certificate__waas-self__.p12 is near expiration it is configured as machine cert in global settings"
You can use one of the following solutions to resolve this problem:
- Configure a different certificate for global settings:
SRE# crypto generate self-signed-cert waas-self.p12 rsa modulus 1024 SRE# config SRE(config)# crypto ssl services global-settings machine-cert-key waas-self.p12
- Update the self-signed factory certificate with a later expiration date. This solution requires a script that you can obtain by contacting Cisco TAC.
NOTE: This issue is fixed by the resolution of caveat CSCte05426, released in WAAS software versions 4.1.7b, 4.2.3c, and 4.3.3. The certification expiration date is changed to 2037.


text:
You are currently browsing the tag archive for the 'roasted chicken' tag.
Game hens are perfectly sized birds for a dinner of two. Rather than roasting up legs, breasts, thighs or drumsticks, a whole feathery friend at the dinner table can make it a little fancier.
Years ago I made this for a quick dinner, serving the bird with a delicate thyme velouté, fresh ripe figs and homemade gnocchi. Having a partial kitchen to cook in, the dinner was delicious and perfect after the day's construction tasks.
Velouté you say? One of my favorite grand French sauces, which here in America its fancy for gravy. A sauce thickened with flour and butter where stock is added. Gravy on the other hand is sometimes made by adding a mixture of water and flour to the pan juices or stock and simmered to thicken. I do prefer a velouté for its depth of flavor and velvety texture; velouté meaning velvety.
Sage White Wine Roasted Game Hen Recipe
2 game hens, rinsed and dried
3 large garlic cloves, peeled
¼ cup fresh sage leaves
3 Tablespoons dry white wine
3 Tablespoons olive oil
2 Tablespoons fresh thyme
¼ teaspoon sea salt
1/8 teaspoon freshly ground black pepper
8 whole garlic cloves
1 lemon, halved
2 sprigs thyme
1. In a food processor, puree the garlic, sage, wine, olive oil, thyme, sea salt and black pepper into a course puree.
2. Rub mixture into prepared game hens and stuff each hen with 4 garlic cloves, lemon half and a sprig of thyme. Tie up legs and fold under wings. Marinate for an hour or overnight. Bring hen to room temperature before roasting.
3. Place game hens into pan and sprinkle with additional salt and pepper to taste.
4. Roast game hens in a 450ºF oven for 15 minutes, reduce temperature to 350ºF and continue for another 45-60 minutes until juices run clear and bird is golden.
Serves 4.
*notes: I often brush roasting birds with melted unsalted butter during the last 30 minutes to enrich their flavor and help the browning process along. Also, if you plan to roast one bird, reduce cooking Roasting at 450ºF oven for 15 minutes, reduce temperature to 350ºF and continue for another 30-40 minutes.
Delicate Thyme Velouté Recipe
2 cups homemade chicken stock [recipe here]
2 Tablespoons butter
2 Tablespoons flour
½ teaspoon sea salt
1 medium shallot, diced
1 Tablespoon garlic butter
1 Tablespoon cognac -or- white wine
1 Tablespoon fresh thyme leaves
¼ teaspoon freshly ground black pepper
1 Tablespoon heavy cream [optional]
1. Melt butter in a pan over medium heat. Remove from heat and whisk in flour. Return to heat and cook to a blond roux, approximately 2 minutes until a toasted aroma develops.
2. Remove from heat and whisk in 1 cup of stock. Return to the heat and whisk in the remaining stock. Bring to a simmer and cook for 15 minutes and skim the surface when necessary.
3. In a small sauté pan, sauté the shallots in butter until softened and starting to brown. Deglaze with cognac and add fresh thyme. Remove from heat and continue to stir to allow the thyme to sweat.
4. Stir shallots and thyme into the sauce. Heat for a couple of minutes to infuse the sauce with the shallots and thyme. Strain the sauce again and press solids against the fine mess of the strainer to bruise thyme for a further extraction of flavor.
5. Bring sauce up to heat and stir in cream or omit.


text:
4 Arrested On Drug Charges
WAYNESFIELD — Four people were arrested on Tuesday on a slew of drug-related charges.
In a news release, Auglaize County Sheriff Al Solomon said members of the Auglaize / Mercer County Grand Lake Drug Task Force, Waynesfield Police, Wapakoneta Police and sheriff's deputies served three arrest warrants Tuesday morning at two locations in and around Waynesfield.
The arrests were a result of drug buys made inside the village of Waynesfield and the Waynesfield area during the past several months.
The drugs involved in the purchases included heroin, methamphetamine, cocaine and prescription drugs.
Three Waynesfield residents were arrested and transported to the Auglaize County Correctional Center Tuesday morning. One person still remains at large.
Those arrested are:
• Samuel M. Brown, 23, of Waynesfield, on three counts of trafficking — with one count each in cocaine, methamphetamine and prescription drugs.
• Shawn L. Robinson, 19, of Waynesfield, on three counts trafficking in drugs — two counts of cocaine and one of heroin.
• Justin M. James, 30, of Lima and formerly of Waynesfield, one two counts trafficking in drugs' with one count each of methamphetamine and cocaine.
A female was also arrested on Tuesday but not connected with the Waynesfield arrests. Kristie Gillette, 20, of Celina, was arrested on two counts of trafficking in heroin. She remains in custody at the Mercer County Correctional Facility. Gillette is being held on drug-related charges.
"The drug issues in this county stretch from the cities to the rural areas to the small villages and we will work all of it," Solomon said in a news release.
Investigations continue into the illegal drug problems in this area. More arrests are expected in the future.


text:
Submitted by stefanieb on October 30, 2012
Today Dr. Walker discusses the exhibition Larry Sultan's Homeland: American Story. The artist Dru Donovan, who was a student of Sultan's, will speak to both his and her work in a free lecture on November 15 at 6 pm.
Registration is required; visit cartermuseum.org for more details. Please join us.


text:
Event: Amitabh Bachchan donates the proceeds from the sale of art works that were unveiled at the B Seventy art show on his 70th birthday for quality education of girl child. The Bachchan family including Jaya, Aishwarya and Abhishek were also snapped at the press conference.
Guest List: Amitabh Bachchan, Jaya Bachchan, Abhishek Bachchan, Aishwarya Rai Bachchan
Bollywood celeb Aamir Khan along with wife Kiran Rao were spotted at PVR.
Bollywood producers-directors Vidhu Vinod Chopra, Krishan Kumar, Ravi Bahl, Divya Khosla Kumar, Sajid Nadiadwala, Wardha Nadiadwala celebrate diwali with Bhushan Kumar
Bollywood celebs Kareena Kapoor Khan, Malaika Arora, Sonali Bendre, Nimrat Kaur among others were snapped by paparazzi.Bebo looked super cool in a casual look. She wore a white t-shirt with yoga pants...
Bollywood actress Shama Sikander celebrated Diwali festival at her residence.
Bollywood celebs Aamir Khan, Zaira Wasim, Fatima Sana Shaikh, Sanya Malhotra, Anil Kapoor, Nitesh Tiwari, Aparshakti Khurrana, Bhushan Kumar, Javed Akhtar, Shabana Azmi, Sachin Tendulkar, Rajkumar Hir...


text:
NOBODY'S WATCHING (Nadie Nos Mira)
A film by Julia Solomonoff
Cast: Michael Patrick Nicholson, Nadja Settel, Katty Velasquez, Pascal Yen-Pfister
Argentina, USA, Spain | 2017 | 102 min | Drama | Not Rated
In English and Spanish
NADIE NOS MIRA is a film about the struggle of self-imposed exile; how the pleasures of anonymity and freedom contrast with the pain of loneliness and loss that shapes the immigrant experience. Nico, mid 30's, is a young Argentine actor fighting to build a career in the US, without assistance or connections. Nico has left a promising acting career in Argentina, after a tumultuous break-up with his mentor/producer. He lands in New York, lured into believing that his talent will help him find success "on his own" and prove his self-worth. But that's not what he finds. Too blonde to play latino, his accent too strong to play anything else, Nico gets stuck between identities: that of the successful South American actor, and temporary immigrant needing to juggle odd jobs, in search of the ever-elusive acting part that will provide an adjustment of status. When Andrea, his beautiful Argentinean ex-roommate and confidante, asks him to take care of her baby Theo; Nico becomes his male nanny ("manny") and doesn't suspect how deeply this new bond will affect him.
NOBODY'S WATCHING examines an immigrant experience that doesn't often land on the screen; the bittersweet struggle of choosing to make a new land your own, and the realization that actual success lies in the journey of self- discovery and the unexpected gains that "failure" can provide.
Screenplay: Christina Lazaridi, Julia Solomonoff
Producer(s): Maria Teresa Arida, Natalia Agudelo Campillo, Nicolas Herreño, Elisa LLeras
Cinematography: Lucio Bonelli
Editing: Pablo Barbieri, Karen Sztajnberg, Andres Tambornino
Composer: Sacha Amback, Pablo Mondragon
2017 Tribeca Film Festival: Won, Jury Award Best Actor in an International Narrative Feature (Guillermo Pfening) for "A performance of extraordinary vulnerability"
VILLAGE VOICE CRITICS' PICK: "Solomonoff…exhibits a scrupulous control of her material and milieu that's all too rare in episodic, humanistic indie-movie life studies. There's nothing fussy about any shot of Nobody's Watching, but there's also no shot wasted, and no shot that doesn't communicate something vital about the city or her protagonist."- Alan Scherstuhl, The Village Voice| full review
"This compelling tale of this thirty-something-year-old man going into self-exile like this to find himself is quite a tour-de-force performance from the immensely talented Pfening, who picked up Best Actor in an International Feature at Tribeca for his trouble." – Roger Walker-Dack, queerguru.com | full review
"It was intriguing to follow Julia Solomonoff's vision through the movie, the way she saw a male protagonist character that eventually you will find as someone who tries hard to face the challenges of life all by himself…" – Ulkar Alakbarova, MOVIEMOVESME.COM | full review
"Nobody's Watching in a multitude of ways, including as a reflection on the forms of self-deception we hide behind when we lack the courage to face up to conflict." – Alfonso Rivera, cineuropa.org | full review
"Pfening delivers a masterful, low-key performance that subtly unpacks the psychology of how immigration can turn lives into lies." - Jonathan Holland, Hollywood Reporter | full review


text:
Brianna Perry "Demp Week 2013" Vlog Ft. Trinidad James, Trina & More [Poe Boy Music Group Submitted]
New single "Dolla Signs" feat. Future out now
Listen here: Brianna Dolla Signs
'Symphony No. 9' mixtape out now
Posted by @Worldstarvids
Please click the "Report" button below if the video on this page is not working properly.
Comments will only be displayed by verified emails. No Spamming or Racism.


text:
Worcester, MA --- Western Connecticut senior Octavias McKoy (Stratford, CT) raced for an All-NCAA Division III record 455 yards and five touchdowns as he helped pace the Colonials to a 55-35 victory over Worcester State this afternoon in MASCAC football action.
McKoy, who averaged 10.6 yards on 43 carries, reset the previous standard (441 yards) that had been set by Dante Brown of Marietta against Baldwin-Wallace on Oct. 5, 1996. McKoy entered the contest leading Division III in scoring (18.0 PPG) and second nationally in rushing yardage (183.5 YPG).
Junior Will Arndt (Newtown, CT) also had 14 rushes for 64 yards and a pair of touchdowns in the triumph for West Conn.
The Lancers (3-4, 1-4 MASCAC) were paced by junior Dana Valentine (Roxbury, MA) also had a fine day with 106 yards rushing and a trio of touchdowns while he added 80 yards on six kickoff returns.
Third-year Pat Viencek (Bernardston, MA) went 20-for-42 through the air with 273 yards passing and two scores while classmate Casey Hippert (Douglas, MA) hauled in nine receptions for 163 yards and one touchdown.
With the Lancers up midway through third quarter, Western Connecticut (5-2, 4-2 MASCAC) scored 21 unanswered points to take a 42-28 margin on the back of a 53-yard scoring burst by McCoy with 9:10 left in regulation.
The visitors took advantage with great field position on a short punt with an 11 yard touchdown by Arndt with 4:47 on the clock in the third quarter and Arndt found the end-zone again on an eight-yard score just 55 seconds into the fourth.
With their backs against the wall, junior Mike Goulden (Rehoboth, MA) helped give Worcester State some life with his interception at midfield to help set-up a score on a 43-yard touchdown pass by Viencek to junior Jack Sprague (Maynard, MA).
On the fourth-and long play, WSCU Torey Mack (Stratford, CT) nearly had the ball picked at the 15 yard-line, but Sprague caught the deflection, tipped the ball to himself as he made the score 42-35 with 6:36 remaining.
The Lancers nearly regained possession on a successful onside kick, but were whistled for an offsides on the kickoff. After booting the deep ball to the Colonials, McCoy took the second play from scrimmage for a 71-yard blast to ice the contest with 5:49 left in the final stanza.
Western Connecticut registered the final points of the game when freshman Eddy Williams (West Haven, CT) punched in a touchdown into the end zone for the final score at the 2:42 mark (PAT missed).
The Lancers took their opening drive to the house on an 81-yard scoring hook-up between Viencek and Hippert (PAT missed) for the early 6-0 lead.
The Colonials responded midway through the first stanza on their second series of the game with a 15-yard rumble into the end-zone by McKoy with 6:22 remaining in the period for the 7-6 edge.
Worcester State came right back on their next possession with the go-ahead points and the 13-7 advantage on a one-yard dive by Valentine four minutes later.
After the two squads traded the ball on punts, McKoy did the dirty work with six rushes for 60 yards that culminated in him rushing for one-yard score with 10:33 left in the second quarter.
The Lancers then went three and out before the Colonials promptly took their second lead of the contest on a 41-yard dash by McCoy for the 21-13 score.
Before the end of the frame, the homecoming crowd was treated to three consecutive turnovers by both squads.
The chain of events started with a graduate student Michael Lacaria (Watertown, CT) interception at his own 45-yardline, continued on a WSU sophomore Brian Gencarelli (Niantic, CT) pick on the very next play on the Worcester State 33 and finished with a fumble recovery by freshman Jacob Jean-Baptiste (Bridgeport, CT).
Western Connecticut then missed a 37-yard field goal by junior Michael Killoran (West Hartford, MA) before the hosts tied the score 21-21 at the intermission on a 20-yard run by Valentine.
Worcester State took control to start off the third quarter by scoring on their first series of the second half.
The Lancers converted three times on third down and Valentine added 53 yards on the ground for a drive that was finished off by a one-yard Valentine score for the 28-21 game with 8:13 left in the third.
Defensively, junior Zach Skerry (Milford, MA) finished with a game-best 13 tackles (10 solo) including two for a loss and one sack. Classmate Bryan Narcisse (Medway, MA) also finished with seven stops, one sack for 11 yards and a fumble recovery.
Lacaria propelled the Colonials with eight solo tackles – including one TFL and one interception. Junior Devin Myers (Waterbury, CT) and Baptiste both chipped in with salvages off of fumbles.
Both punters had solid days with the wind. Senior Alex Blakeslee (Shrewsbury, MA) averaged 42.7 yards on nine punts with a long one of 73 yards while his counterpart, junior Ryan Falaguerra (Milford, CT), had a trio of blasts for 50.7 yards with two inside the 20 yardline.
Western Connecticut piled up 599 yards of total offense, 552 yards of which were rushing, while the Lancers had a solid attack offensively with 417 yards (144 yards rushing – 273 yards passing). The visitors also led in first downs (28-20) and had the ball for nearly 10 more minutes of play (34:42-25:18).
After starting off the game going 10-for-13 on third downs midway through the third quarter, they finished 0-for-6. West Conn was 5-for-13 on third down attempts.
Hippert moved into seventh on the all-time receptions list (93) and he now has 1,623 recieving yards, just 274 off fifth all-time. Hippert started the week leading Division III in recieving yards for a tight end (113.8 YPG - 631 yards) for a top 20 spot in the rankings.
Today's meeting marked the first-ever matchup between the two storied programs. They will both continue their MASCAC schedule with road games next week at 1 PM. Worcester State heads to Plymouth State while the Colonials head to UMass Dartmouth.


text:
Welcome to the Paul Engler College of Agriculture and Natural Sciences at West Texas A&M University. The mission of the college is to provide excellence in teaching, research, and professional service in the major areas we serve and, ultimately, to prepare students for employment by providing them with a skill set that will make them successful now and into the future, regardless of their chosen path.
The internationally recognized faculty of the college is eager to work with students in the classroom, in the laboratory and in the field. Students can pursue a variety of activities, from assisting faculty in conducting cutting-edge research to completing an internship with a company competing in the global marketplace. These real-world experiences in the various disciplines are the hallmark of our college and University.
In addition to the outstanding academic training our students receive, the college offers a wide variety of extracurricular activities including judging teams, departmental clubs, service learning activities and leadership opportunities.
Thank you for your interest in and support of the Paul Engler College of Agriculture and Natural Sciences. If you have questions, please feel free to contact me or one of the departments in the college.
Lal K. Almas, Ph.D.
Interim Dean
Paul Engler College of Agriculture and Natural Sciences
|Undergraduate Enrollment
|Graduate Enrollment
|Total Enrollment
|Number of Faculty
|Faculty with Terminal Degrees
|Number of Baccalaureate Programs
|Number of Master Programs
|Number of Doctoral Programs


text:
Ergonomic design encourages neutral wrist position. Soothing gel filling provides comfortable support. Upscale leatherette covering is soft and easy to clean. Durable nonskid backing keeps product firmly in place. Guaranteed not to leak. Antimicrobial product protection inhibits the growth of microorganisms, such as bacteria, that can cause stains, odors and product degradation. Wrist Filling Material: Gel; Mouse Pad/Wrist Rest Type: Compact Wrist Rest; Color(s): Black; Theme: Solid Color.
We Also Recommend


text:
Eight years ago, the Anaheim Ducks won the Stanley Cup, bringing the most famous trophy in sports to Southern California for the first time. The team held a rally to show off its prize, and 15,000 fans showed up.
Compare that to the 2 million people who jammed into Grant Park to watch the Chicago Blackhawks hoist the cup in 2013, just three years after the team's previous championship, and you'll get an idea of the size of the respective fan bases. That's the just the start of the disparities.
Blackhawks players have two of the three best-selling


text:
Shopping Angels necesitaba un nuevo diseño de página web y lanzó un concurso de diseño en 99designs.
Un ganador ha sido elegido entre 68 diseños de 14 diseñadores freelance.
SHOPPING ANGELS - http://www.shoppingangels.com.au
My name is Katie from Australia...G'day!!
I have a DREAM and seek your assistance to make it reality. My idea was born while having a few drinks with a friend at a bar, as I'm most creative when a tad tipsy..aren't we all? ...HaHa.
Ok..Let me ask you a few question first? Do you hate rushing around at Christmas looking for gifts? Have you ever forgotten a special occasion (ie, anniversary) and been severely punished for it?
If you're a 'male' (or female) and have answered YES to all these questions, then you'll definitely use my service- Shopping Angels!!.
Shopping Angels is a brand new start-up online business that offers a tailored gift purchasing service to busy people (ie, executives, managers) or people who hate shopping.
This is not to be confused with another ecommerce website or a 'grocery shopping service' nor a business that runs errands for people . It's a premium, high-end shopping service that specialises in finding the perfect gifts for your family and friends, while saving you time and money.
The messages that I would like to get across on the site are:
- Reliable and professional service
- Save time and money
- Takes all the hard work away
The site needs to show images of presents, giving and happy times. Therefore the web site should be seen to be: fresh, easy, simple, fast to use and uncluttered.
How Shopping Angels work
People 'join' the site by paying a small annual membership fee… they then enter the profiles of people for whom they may want to give gifts (wife, partner, husband, relatives, co-workers, etc.) incl. their likes and dislikes.
Members also indicate dates for which they'd like gifts purchased (birthdays, Christmas, Valentine's Day, etc.)
Shopping Angels then source a selection of 5 possible gifts per person, tailored to each individual's likes, from which the member makes a choice.
The selected gift is then wrapped and delivered either to the member or to the person for whom he or she is buying the gift.
Target Audience
Time-poor, busy individuals (mainly corporate)
a. Male, 45+ (high level executives) earning $150K+ p.a.
b. Female, 40-45 earning $100K+ p.a.
c. Male, 30-35 earning $100K+ p.a.
d. Must be Internet users
2. Corporate Personal Assistance
a. Those who organise gifts for staff, clients, etc.
5 Pages design including:
1. Homepage
2. About Us
3. Service
4. My Account
5. Contact Us
- Logo and tagline (see attached logo- STYLE 38)
- Right side banner area: my account (login username and password)
- Navigation bar: home, about us , Service, my account, contac us
- Text area : Welcome to Shopping Angels and short description. More Info link to 'Service' Page
- Sign Up section: asking for first name, last name and email address.
- 4 Easy How It Works section ( ie step 1, step 2, step, 3, step 4
- 'How it works' video demo. Button
Social networking icons – e.g. links to facebook, twitter, blog
- Pictures of people receiving gifts, happy times. Use images of presents (flash images)
- Designated area for 'Next Upcoming Occasions' , ie Valentines' Day . Would like to be able to change the content in this section with other upcoming events.
- Testimonials
- Contact Us button
- Call to action button - Sign Up Now
- Footer area: copyright S.A., privacy policy, terms & conditions, contact us
Please use imagery, colours to suit with the logo (ie blue and orange). Background should be white or light colour sky blue.
Use colourful presents and present icons where possible
Most importantly, please be creative.
About Us Page
Need a text section to describe what is shopping angels, benefits..et
Must have 'Sign Up' icon in red
Must have link to 'How It Works' page
Sign Up button (red)
How it Works Page
- Clear Step-by Step of how SA work : 1) Sign Up 2) Complete gift requirements 3) Review gift ideas 4) Make purchase 5) Sit back and Relax-
- Flash Demo video section (in You Tube format)
- Sign Up button (red)
My Account Page
Once a user has signed up and listed profiles of gift recipients, he/she is not expected to re-visit the web site on a regular basis. User will come back to the web site and log into their account to do the following:
a. check the status of their orders
b. update their details
c. add/edit/delete more gift recipients to their list
d. renew their membership
e. update credt card details
f track status of their gifts purchase
g contact Shopping Angels (S.A.) to inquire, make a complaint..etc
Contact Us Page
Section for:
First and Last Name
Submit button
Really like this site..it looks very fresh - try to mirror this as much as possible, however feel free to come up with a better layout.