Cisco NCS and ACS 4.2

I've been playing with this all morning and can't seem to make it work. I have the new NCS1.0.2 and older ACS 3.2 and 4.2...I want to be to login to NCS using Tacacs vice local logins is this possible with the older ACS or do I need to upgrade ?

No, this should be possible. The link below details what you'll need to do.
http://www.cisco.com/en/US/docs/wireless/ncs/1.0/configuration/guide/admin.html#wp1112433
But basically, you need to define a new service type of NCS and the protocol HTTP (yes, it's case sensitive)
Then when you go to the group or user you want to assign, select the NCS HTTP and add the customer attributes. The attribute list can be found in the NCS under Administration > AAA > User groups, then just pick the TACACS+ copy all the variables and paste into the field in NCS.
HTH,
Steve
Please remember to rate helpful posts or to mark the question as answered so that it can be found later.

Similar Messages

Cisco NCS configuration backup and restore of WLC issues found

Hi,
I recently tested the process for a customer of defaulting a Cisco WLC to factory configuration and then restoring the configuration from Cisco NCS. It was not seamless to say the least and I wonder if I have just gone about it the wrong way.
Have have set the NCS platform to configuration sync with the 5508 controllers at 04:00 every day and prior to the controller defaulting I ensured that NCS also reported that the config was in sync.
I have also set NCS to complete a tftp backup of the controller every night 23:00 - interestingly though I have no idea where this is stored on the NCS platform ( a VM appliance ) or what it's filename is.
Anyway my experiences where as follows:-
1. defaulted WLC and via serial CLI ended up at the configuration wizard.
2. Set the correct LAG, management IP, hostname that NCS knew this controller by.
3. To test things just created a dummy WLAN ( SSID ) as I assumed this would be overwritten ( big mistake ! ).
At this point I connected the controller to the network and tried to restore the configuration from the config sync version.
First problem - you have to remember to set up the SNMP community string you were using as it is needed by the configuration sync process. After adding this to the controller I could push the configuration to the controller.
Second problem - failed to add the first WLAN from the backup as I have added the temporary dummy WLAN via the wizard and NCS reported a conflict. So had to delete WLAN ID 1 from the WLC GUI directly and then the config push no longer reported this error.
Third problem - for some reason did not add the TACACS server details - reported the error that it could not added them. I manually added these via a template via NCS and all was well.
Fourth problem - all but the first WLAN was in the disabled state - had to re-enable all of the WLANs
Fifth problem - any default items I had disabled or removed have not been saved - therefore I have removed the public and private SNMP communities - but these were still on the WLC after the restore. I have disabled unused ports not in the LAG as they show an error in NCS - these where not disabled after the restore.
So all in all not a very satisfactory restore process from NCS to an defaulted WLC ( ment to simulate to the customer what would be needed if they had to replace a controller due to hardware failure ).
So - anybody like to comment on what I did wrong - is there a different / better way of achieving this ??
Regards
Robert

Hello Robert,
all the tasks you did seem to be fine for me.
I was also wondering the process os restoring from NCS controller configuration backups ...
If anyone else could give another method with less drawbacks, that would be appreciated, but i doubt about it.
regards,
Guillaume.

How to configure external FTP backup server CISCO NCS 1.1

How do you configure a external FTP Server for Cisco NCS 1.1? I only get setup username/password, i also need to setup FTP server IP and directory.

from the CLI you setup a repository,
conf t
repository FTP
url ftp://
username < username> password
exit
http://www.cisco.com/en/US/docs/wireless/ncs/1.0/command/reference/cli_app_a.html#wp1013913
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

Cisco ISE and SecurID Integration Questions

I'm looking for some clarity trying to understand something conceptually. I want to integrate Cisco ISE with RSA SecurID, the idea being that if the user authenticates with RSA SecurID they end up on one VLAN, however, if they don't authenticate with (or don't use, or don't have) SecurID they'll end up on another VLAN. Note that I'm not using SecurID for wireless access...all PCs are wired to Ethernet.
We have been using RSA SecurID for a while and are currently on version 8.0. Our users are authenticating via the RSA Agent typically on Windows 8.1. Instead of the usual Windows login prompt, the RSA Agent first prompts for the username and passcode (they use an app on their smartphones to get the passcode), then after a moment or two, it prompts for their Windows domain password.
We have recently installed Cisco ISE version 1.3. With the help of a local Cisco engineer and going through the "Cisco Identity Services Engine User Guide", I have it set up and running along with a few 'test' ports on our Cisco 6809 switch, it basically works...as a test it's simply set up that if they authenticate they're on one VLAN, if not, they end up on another (this is currently without using RSA...just out-of-the-box Windows authentication).
The Cisco engineer was unable to help me with RSA SecurID, so pressing on without him, out of the same user guide I have followed the directions for "RSA Identity Sources" under the "Managing Users and External Identity Sources", and that went well as far as ISE is concerned; I am now ready to get serious about getting ISE and SecurID working together.
My mistake in this design so far was assuming that the RSA agent on the Windows client PCs would communicate with Cisco ISE...there doesn't seem to be a way to have them point to a non-RSA SecurID server for authentication. The concept I'm missing is what, or how, the end-user machine is supposed to authenticate taking advantage of both ISE and SecurID.
I have dug deeper into the Cisco ISE documentation but it seems heavily biased towards Wi-Fi and BYOD implementations and it's not clear to me what applies to wired vs wireless. Perhaps it's a case that I'm not seeing the forest for the trees, but I'm not understanding what the end-user authentication looks like. It apears that as I learn more about ISE, it should become the primary SSO source, that SecurID becomes just an identity source and the PC clients would no-longer directly communicate with the SecurID servers. That being the case, do I need to replace the SecurID client on the PCs and something else Cisco-ish fills this role? An agent for ISE? How do they continue to use their passcode without the RSA agent?
Thanks!

The external db not operation indicates that there is no communication between ACS and RSA. Did you fetch the package.cab file to analyse the auth.log file?
Have you already gone through the below listed link?
http://www.security-solutions.co.za/cisco-CSACS-1113-SE-4.2-RSA-Authentication-Manager-Integration-Configuration-Example.html
Regards,
Jatin Katyal
- Do rate helpful posts -

NCS and non US keyboard layout - Guest - Email ID and @

Problem:
The problem is that we cannot email the Guest Account Details to the guest, because the popup where we fill in the email of the guest - Email ID - Does not recognise the @ when using non US Keyboard layout.
When i use my local keyboard layout (Danish) and press AltGr+2 (this is the keyboard "shortcut" for @) it writes nothing.
When i switch to US keyboard layout and press Shift+2 it writes @ fine.
Version:
Tried this in both 1.0 and I just upgraded to 1.1 and it is still the same.
Does anyone know of a open BugID that addresses the following problem on the NCS Lobby Ambasador page ?

Thomas,
Have you tried it from different machines and different OSes and confirmed that the common denominator is NCS and not your specific KB/OS setup?
Justin
Sent from Cisco Technical Support iPhone App

Dynamic VLAN assignment with WLC and ACS for

Currently, using our autonomous APs and ACS, our users get separate VLANs per building based on their security level (students or staff). Basically, the student VLAN in one building is different from that of the student VLANs in other buildings on campus. Currently, we do this by filling the Tunnel-Private-Group-ID IETF RADIUS attribute with the VLAN name. This all works because each individual AP can map VLAN names to different VLANs like this:
dot11 vlan-name STUDENT vlan 2903
dot11 vlan-name FACSTAF vlan 2905
As we are working on our WiSM deployment, we see that the document below shows how to do the dynamic VLAN assignment on our WLAN controllers:
http://www.cisco.com/en/US/customer/products/sw/secursw/ps2086/products_configuration_example09186a00808c9bd1.shtml
However, we haven't figured out if it's possible to still provide our users with different VLANs for each building they're in.
With the instructions above, it looks like ACS uses a Cisco RADIUS Attribute to indicate the Air-Interface-Name, mapping an ACS/AD group to a single WLC interface which can only have one VLAN/subnet associated with it.
Does anybody know if what we're trying to accomplish is possible, or if we're really stuck with only one VLAN/subnet per mapped ACS group?

We only have the one WiSM for all of campus, so it's handling everything. This Cisco docs do indicate how to put differnet users in different Vlans, but we don't currently see a way to also put them in different subnets per building.
This being the case, any suggestions on how best to handle more than a Class C subnet's worth of users? Should we just subnet larger than Class C, or is there a more elegant way of handling this?

Cisco NCS admin password recovery.

Hi All
In Cisco NCS shell I have incorrectly entered the following command in order to chang ethe admin password and saved it
username admin password hash <password> role admin
and hence lost the access to shell (ssh). Is there a way to retrieve or reset the admin password. Tried to log in as single user (as in any ohter Red Hat Distribution) but didn't work. In the worst case scenario I have rebuild the server (VM) from the .ova imange, however the licenses won't work.
Any advise would be greatly appreciated.
Regards

Hello,
The only way to recover the admin password for NCS would be to use the recovery image (iso). The recovery image is not available for download from CCO. Please open a TAC case & they can special publish the image for you.
For the CLI admin password, the recovery method is the same as the physical appliance. Attach the recovery ISO, and reboot the machine. You may have to force the virtual machine to boot from the cd drive. Once it does, you will get the menu that contains the password recovery option.
Hope this helps.
Ram

Wireless Virtual LAN - SSID and ACS User Mapping

Hi Everybody
We have the following senario:
- WLC 4402 and ACS 3.3
- 2 SSID's , One for Emploies - one for gests
- All users are (guest and emploies) are authentication against the ACS Server.
We would like to only permit Guest users to use the Guest SSID.
I've been reading the Wireless Virtual LAN Deployment Guide :
http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wvlan_an.pdf
and have tried to use methode 1.
- RADIUS-based SSID access control:
"Upon successful 802.1X or MAC address authentication, the RADIUS server
passes back the allowed SSID list for the WLAN user to the access point or bridge. If the user used an SSID on the allowed SSID list, then the user is allowed to associate to the WLAN. Otherwise, the user is disassociated from the access point or bridge."
"This is configured by enableling the ?[026/009/001] cisco-av-pair? option. On the ACS Server
- Enable and configure Cisco IOS/PIX RADIUS Attribute,
009\001 cisco-av-pair
- Example: ssid=LEAP_WEP"
I've tried this, but regardless of wich SSID the user(-group) has configured, it sill can access all SSID's?
Does anyone have any idea of what I'm doing wrong?
Does this setting only apply to Accesspoint, or is it also valid for the WLC 44xx series?
Greetings
Jarle

Hi I'm sorry but this still does not help.
We have now upgraded ACS to version 4.0 and I'm still having the same problems.
This is what i have configured:
WLC:
- WLAN
- SSID : Public
- WLAN id = 3
- L2 Security : 802.1x
- Interface Name : GuestVLAN
- Controller - Interface
- management - Untagged
- GuestVLAN - VLAN 112
- Security
- RADIUS Servers
When authenticating a Guest(belonging to the proper group in acs) - the right VLAN is used, IP Adresses from DHCP is recieved, and the Guest can access internet.
Switch:
- Port connected to WLC uses Trunking.
- Guests are connected to VLAN 112 and "native VLAN" is used to connect the Private Users.
ACS:
- AAA Client is the WLC, Authenticating using Cisco Airespace
- Guest Users are member of Group 11
- Private Users are member of Group 1
Group 11
- Use Per Group NAR to only allow WLAN Access
- Cisco Airespace RADIUS Attributes
x 14179\001 - Aire-WLAN-ID = 3
- Cisco IOS / PIX RADIUS Attributes
x 009\001 Ciso-av-pair = "ssid=Public"
- IETF Radius Attributes
x 006 Service Type = Login
x 007 Framed-Prot = ppp
x 064 Tunnel-Type = VLAN
x 065 Tunnel-Medium-tye = 802.1x
x 081 Tunnel-Private-Group-ID = 112
Group (default Group)
- Cisco Airespace RADIUS
x 14179\001 Aire-WLAN-ID = 1
- Cisco IOS/PIX Radius Attrib
x 009\001 Cisco-av-pair = "ssid=Private"
- IETF RADIUS
x 008 Service-type = Login
x 064 Tunnel-Type = VLAN
x 065 Tunnel-Medium-tye = 802.1x
x 081 Tunnel-Private-Group-ID = 1
Do you have any idea of what i should change?
Greetings
Jarle

Incompatibility issue - WLC 5508 and ACS 5.4

Hi,
This is my scenario:
Cisco WLC 5508 firmware 7.4.110.20 and ACS 5.4, two WLAN eap/tls, many client can't connect to WLAN and on ACS i receive the following error:
Authentication failed : 11051 RADIUS packet contains invalid state attribute
workaround:
1 -Check the network device or AAA Client for hardware problems.
2-known RADIUS compatibility issues.
3-Check the network that connects the device to ACS for hardware problems
there are some incompatibility issue between WLC and ACS ? the compatibility matrix document for wireless imposes the 7.5 firmware for WLC.
What do you think is possibile ?

Are there any other errors shown in the details of the failed authentication?
We may need to look at service logs in debug mode, opening a TAC case would be the best way to go about this.
Javier Henderson
Cisco Systems

Using Active Directory and ACS for Concentrator 3000 VPN

Has anyone gone down the path of using Cisco ACS for network access control AND authenticating it with their W2K Active Directory for VPN 3000 concentrators? I did some research on Google, Cisco web, and this group, I did not find a definite answer on the best practice for the architecture and design, can anyone share your experience how you approached this?
Below is my understanding, I appeciate any help to piece some or all the below together
(1) The end state is once a VPN user is successfully authenticated, it is assigned to certain network access privilege based on its group's policy. How to accomplish this?
(2) AD stores a central user database for user authentication. Each user may belong to one or more groups on the AD; ACS is reponsible for network access control for the specific groups and enforces these controls to the users via the concentrators.
(3) Concentrator is the NAS, and ACS is the RADIUS server
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800949b4.shtml
(4) Concentrator can link to the AD as an external database: http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/4_1/gs/gs3mgr.htm
(5) A single "Tunnel Group" is created on the concentrator
(6) Mulpile Groups, per corporate infosec policies are created on the AD
(7) Mulpile Groups, per corporate infosec policies are also created on ACS, need to match with what're in the AD
TIA.

In order to restrict access for a specific AD group to specific SSID this is what you need to perform.
When the WLC sends an authentication request to the ACS, it will include the SSID that the user is connecting to, in the attribute Calling-Station-Id(31). We can use this information to create multiple rules in ACS 5.x in order to take actions based on the information contained in the attribute.
Under the Users and Indetity Stores > click on Directory Groups > select > check the group name you want to add and hit ok. Save the changes.
We just need to create a DNIS rule that includes the name of the SSID and use it as a condition in any rule that we create for authentication. The * is required because the attribute not only contains the SSID but also a MAC address so the * is use as a regular expression.
Now go to access-policies > default-network access > identity should be AD1.
Go to authorization > click on customize > move the AD1:ExternalGroups and end-station filter attribute on the right side and hit ok.
After that slect the appropriate ad group for teachers and end-station filter.
Save changes.
Jatin Katyal
- Do rate helpful posts -

How to create guest access in wireless by WISM and WCS and ACS?

dear sir
i neeed to know the steps of how we can make guest access to our network like hotels by using our WISM v 7.0.220 and wireless control system and ACS ?

You need to define your requirements a little bit. The WLC can do WebAuth and an employee can access either the WLC or WCS to put in the username and password credentials, but you would need to figure out what's best for you.
Here is a support doc that you can reference.
https://supportforums.cisco.com/docs/DOC-13954
Sent from Cisco Technical Support iPhone App

Migrating data from Cisco NCS 1.1.1.24 to Prime Infrastructure 1.3 Question

I am spinning up a new VM server for Prime to migrate from NCS. I have not been able to find the patch Cisco recommends to run before upgrading. My question is do I need to run this patch (ncs_patch-1.1.1.24-upgrade-12.tar.gz) if I am just gong to bring up a whole new machine and not upgrade the existing NCS? My plan is to do a back-up on the NCS and a restore from the new Prime.

Migrating from NCS 1.1.1.24 to Prime Infrastructure 1.3
To migrate to a new Prime Infrastructure 1.3 system, follow the process as described in the following two links below:
● Back Up the Data from the Existing System
● Install a New Prime Infrastructure System and Migrate the Data from the Backup
● Restoring Prime Infrastructure Database in a High Availability Environment

Cisco NCS - FTP Error

Hi!
I got a couple of questions regarding Cisco NCS (Network Control System) Version 1.1.0.58.
1. I've just installed Cisco NCS appliance(Red Hat) in vmware vsphere and l need to backup and transfer a Backup Repository to a Windows FTP Server. I can reach the FTP Share with Filezilla and other FTP clients on my local computer, but when I create a manual backup it fails on file transfer. I can ping the FTP Server from the Cisco ncs ssh session. In "Administration --> Background Tasks --> NCS Server Backup" I've succesfully entered the FTP Servers credentials without any errors. Any suggestions? See the output from debug option(attached file):
2. Is it possible to mount either an Samba/CIFS/- or NFSshare and directly backup repository on them? I feel a bit "tied behind my back" when there's no possibility to reach Red Hat OS shell, without a Root Patch (wich seems impossible to get hands of )

Hi,
So you made a repository for backup purpose on NCS?
When you do a sh repository "name of the repository" you must see a directory listing of the FTP directory. If not than there is something wrong with the repository

Cisco NCS install signed certificate

Hello!
I have difficulties to install wildcard certificate(*.domain.com) into Cisco NCS Prime.
admin#ncs key importkey key.pem cert.perm repository ftpRepo
INFO: no staging url defined, using local space. rval:2
INFO: no staging url defined, using local space. rval:2
The WCS server is running
Changes will take affect on the next server restart
Importing RSA key and matching certificate
Everything looks good! But after server restart I see old, self-signed certificate.
Please help me with this issue.

restore.log:
Mon Mar 4 15:37:29 NOVT 2013: dowload of 2015_02_16.crt from repository ftpRepo: success.
Mon Mar 4 15:37:29 NOVT 2013: dowload of 2015_02_16.key from repository ftpRepo: success.
ADE.log:
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer_util.c[125] [admin]: full url is ftp://10.54.111.20/2015_02_16.key
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:backup: br_backup.c[41] [admin]: flushing the staging area
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: locks:file: lock.c[385] [admin]: released backup lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[252] [admin]: running date
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[52] [admin]: created backup history lock file
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[76] [admin]: obtained backup history lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[160] [admin]: loaded history file /var/log/restore.log
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[118] [admin]: stored backup history file
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[118] [admin]: stored backup history file
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[90] [admin]: released backup history lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[310] [admin]: added record to history
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: locks:file: lock.c[371] [admin]: obtained backup lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: config:backup: br_stage.c[72] [admin]: staging config set to default settings
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:backup: br_backup.c[41] [admin]: flushing the staging area
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: locks:file: lock.c[371] [admin]: obtained repos-mgr lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: config:repository: rm_repos_cfg.c[173] [admin]: loaded repository ftpRepo
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: locks:file: lock.c[385] [admin]: released repos-mgr lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer.c[54] [admin]: ftp copy in of 2015_02_16.crt requested
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer_util.c[92] [admin]: ftp get source - 2015_02_16.crt
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer_util.c[93] [admin]: ftp get destination - /opt/CSCOncs/migrate/restore/2015_02_16.crt
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer_util.c[112] [admin]: initializing curl
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: transfer: cars_xfer_util.c[125] [admin]: full url is ftp://10.54.111.20/2015_02_16.crt
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:backup: br_backup.c[41] [admin]: flushing the staging area
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: locks:file: lock.c[385] [admin]: released backup lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[252] [admin]: running date
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[76] [admin]: obtained backup history lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[160] [admin]: loaded history file /var/log/restore.log
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[118] [admin]: stored backup history file
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[118] [admin]: stored backup history file
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[90] [admin]: released backup history lock
Mar 4 15:37:29 sib-ncs01 debugd[3452]: [6990]: backup-restore:history: br_history.c[310] [admin]: added record to history
keyadmin-0-1.log:
03/01/13 16:00:14.962 INFO [system] [main] Setting management interface address to 10.54.11.108
03/01/13 16:00:14.968 INFO [system] [main] Setting peer server interface address to 10.54.11.108
03/01/13 16:00:14.968 INFO [system] [main] Setting client interface address to 10.54.11.108
03/01/13 16:00:14.968 INFO [system] [main] Setting local host name to sib-ncs01
03/01/13 16:00:17.647 INFO [admin] [main] The WCS server is running
03/01/13 16:00:17.647 INFO [admin] [main] Changes will take affect on the next server restart
03/01/13 16:00:17.647 INFO [admin] [main] Importing RSA key and matching certificate
Other logs dont show issues.

Failed to send E-Mail Alerts using Cisco NCS

Hi,
I was trying to configure the Email Alert Notication on Cisco NCS but it is not working.
I SMTP server is configured and I add the server IP to NCS (Administration > Setting > Mail Server Configuration). When I click the Test button I always end up with the error message saying "Failed to send mail to primary SMTP server. Please make sure that you save mail configuration by hitting 'Save' button.". I tried saving it but I still end up with the same error. Did anybody encountered this on NCS?
Regards,
Leonard

I have a slightly different issue. We have an existing NCS box with the email account configured and it emails to one person. When I add my name to the list of recipients, it only emails the first person in the list. It seems to ignore the second person.
Oddly enough, when I click on "test", it sends an email to the first person in the list, and that person can see in the email that I was copied on the email. But my email never appears. I even added my Yahoo! email account, and don't get it there either.
Don't see anything in spam folders either. Anyone know if there's a bug with adding more than one email address in NCS?

Cisco NCS and ACS 4.2

Similar Messages

Maybe you are looking for