IEEE 802.3u and IEEE 802.3z Compatibility

Hello everyone!
Does anyone know if these 2 fiber optic SFPs are compatible with each other?
We have and old HP J4853A transceiver which is 802.3u and Cisco SFP LX Module which is 802.3z
Thank you!

Hello
For your reference, when talking about fiber transceiver you want to check the following details:
- There exists two modes: Single mode, and multi-mode, you want to make sure both use the same mode.
- Wavelenght, there are 850nm, 950nm, 1310nm.... You need to make sure it matches.
- No all switches/routers support all types of modules, so check the following compatibility matrix to make sure hardware and tranceiver are compatible.
http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6981.html
Regards.
Wilson B.

Similar Messages

Connecting AX (802.11n) and AX (802.11g) to create WDS

Hello I'm currently trying to connect my new Airport Extreme (802.11n) to my old Airport (802.11g)
in the aim of extending my network. So I would like to have the 11n as my main.
and 11g as a remote I think?
can anybody give me a step by step on how I would go about this on Airport Utility?
I think my main problem is that my old Airport is connected to a different network.
Kyle

You would need to configure the 802.11n AirPort Extreme base station (AEBS) to operate in an 802.11g compatible mode. You would need to configure one AEBS to operate as a WDS main. You would need to configure the other AEBS to operate as a WDS remote (or relay). An Unfortunate side effect of WDS is that each link cuts your available wireless bandwidth in half. Therefore the maximum wireless bandwidth achievable is 1/2 the 802.11g rate.

Airport Express 802.11n and high speeds *impossible*

Hi there,
well I have been playing around for the last 24-48hrs with an AirportExpress 802.11n wiht the latest firmware on it, to achieve high speed wifi ~300mbps as 802.11n allows. The following hardware was used during this tests:
Airport Express Model: A1264 Firmware: 7.4.2
1) Macbook Pro AirPort Extreme (0x14E4, 0x88)|Broadcom BCM43xx 1.0 (5.10.91.26)
and an
2) 24" iMac - AirPort Extreme (0x14E4, 0x8E)|Broadcom BCM43xx 1.0 (5.10.91.26)
Goal: Achieve to establish a high speed wireless-n infrastructure network.
Comparing to: Ad Hoc Network Wireless-N iMac to Macbook Pro
Basic Ad Hoc Network Setup:
Macbook Pro:
PHY Mode: 802.11n
Channel: 11 (2.4Ghz)
Security: none
RSSI: -54
Transmit Rate: 130
MCS Index: 15
iMac 9.1:
Channel: 11 (2.4Ghz)
Security: none
RSSI: -48
Transmit Rate: 1117
MCS Index: 14
Testing: copy 1GB file via Finder Desktop to Desktop
Reault: achieved an avarage transfer-rate: 9.7MB/s
Infrastructure Tests:
1st Setup: identical setup with airport express
Configuration: Airport Express
Radio Mode: 802.11n only (2.4 Ghz)
Channel: 11
Security: none
Macbook Pro:
PHY Mode: 802.11n
Channel: 11 (2.4Ghz)
Security: none
RSSI: -36
Transmit Rate: 130
MCS Index: 15
iMac 9.1:
Channel: 11 (2.4Ghz)
Security: none
RSSI: -38
Transmit Rate: 130
MCS Index: 15
Testing: copy 1GB file via Finder Desktop to Desktop
Reault: achieved an avarage transfer-rate: 3.2MB/s
2nd Setup: airport express
Configuration: Airport Express
Radio Mode: 802.11n only (2.4 Ghz)
Channel: 11
Security: WPA2
Macbook Pro:
PHY Mode: 802.11n
Channel: 11 (2.4Ghz)
Security: WPA2 Personal
RSSI: -34
Transmit Rate: 130
MCS Index: 15
iMac 9.1:
Channel: 11 (2.4Ghz)
Security: WPA2 Personal
RSSI: -37
Transmit Rate: 145
MCS Index: 15
Testing: copy 1GB file via Finder Desktop to Desktop
Reault: achieved an avarage transfer-rate: 3.0MB/s
3rd Setup: airport express
Configuration: Airport Express
Radio Mode: 802.11n (802.11b/g compatible)
Channel: 11
Security: WPA2
Macbook Pro:
PHY Mode: 802.11n
Channel: 11 (2.4Ghz)
Security: WPA2 Personal
RSSI: -33
Transmit Rate: 130
MCS Index: 15
iMac 9.1:
Channel: 11 (2.4Ghz)
Security: WPA2 Personal
RSSI: -39
Transmit Rate: 145
MCS Index: 15
Testing: copy 1GB file via Finder Desktop to Desktop
Reault: achieved an avarage transfer-rate: 2.9MB/s
4th Setup: airport express
Configuration: Airport Express
Radio Mode: 802.11n (802.11a compatible)
Channel: Automatic
Security: WPA2
Macbook Pro:
PHY Mode: 802.11n
Channel: 36 (5Ghz)
Security: WPA2 Personal
RSSI: -48
Transmit Rate: 270
MCS Index: 15
iMac 9.1:
Channel: 36 (5Ghz)
Security: WPA2 Personal
RSSI: -46
Transmit Rate: 300
MCS Index: 15
Testing: copy 1GB file via Finder Desktop to Desktop
Reault: achieved an avarage transfer-rate: 5.5MB/s
Enabling/ disabling wide channels doesnt change the avarage transfer rate significantly.
These are just a few examples of all tests I have done, I have tried every possible configuration and took screen shots of almost 80% of the test (if someone is interested in reviewing this).
I couldnt find a single configuration in infrastructure mode that is as fast as the ad-hoc connection, so I assume either apple's setup for ad hoc and using channels is different to infrastructure or the airport express simply is unable to perform the same way as the wifi cards being used inside my Macs (which is my conclusion unless someone proves me wrong).
-------------------------------------------------------------------- Keep in mind, my findings show a 100% faster network in Ad hoc mode on a 2.4 Ghz connection
This is quite unsatisfying as I have bought the airport express on Feb 9th 2010 and it was the latest available model according to local genius bar.
So to quote apple: "The AirPort Express Base Station is based on an IEEE 802.11n draft specification and is compatible with IEEE 802.11a, IEEE 802.11b, and IEEE 802.11g." yes it might be compatible but doesnt allow you to fully operate at those specifications or has anyone been able to achieve this somehow?

why didnt I find this any earlier ...
http://www.applesource.com.au/mac-accessories/soa/Apple-AirPort-Express-Base-Sta tion-802-11n-/0,2000451112,339287629,00.htm

Wireless 802.11r and .k on WLC

Hello all,
I've seen that in 7.4 and later Release on the WLC5508 you can configure 802.11r and 11k support using Fast Transaction so that iOS7 won't experience connection loss during Roaming...my question is on the same WLAN can I configure 802.1X and FT-802.1X Authentication so that I'll be able to have on the same SSID non802.11r and 802.11r capable client? Or this setup will create association problem ?
BR
OG

Maybe this can help explain it also:
http://www.cisco.com/en/US/docs/wireless/controller/7.3/configuration/guide/b_wlc-cg_chapter_0111.html#d155467e2632a1635
Legacy clients cannot associate with a WLAN that has 802.11r enabled if the driver of the supplicant that is responsible for parsing the Robust Security Network Information Exchange (RSN IE) is old and not aware of the additional AKM suites in the IE. Due to this limitation, clients cannot send association requests to WLANs. These clients, however, can still associate with non-802.11r WLANs. Clients that are 802.11r capable can associate as 802.11i clients on WLANs that have both 802.11i and 802.11r Authentication Key Management Suites enabled. The workaround is to enable or upgrade the driver of the legacy clients to work with the new 802.11r AKMs, after which the legacy clients can successfully associate with 802.11r enabled WLANs. Another workaround is to have two SSIDs with the same name but with different security settings (FT and non-FT).
Sent from Cisco Technical Support iPhone App

Compatibility 802.1X and mac-filter from ACS

If the clients identities and mac address are stored in the same ACS server.
In WLC,could a wlan be configured layer2 security with both 802.1x and mac-filtering?
this is really a critical problem for me!
Thanks~

Hi,
I am assuming you are asking if you configure a x mac of wlan client in MAC filer and the same as user naem in 802.1x ACS database as user name , could you configure it ? what is the effect?
If my understading of your queston is correct the answer is
Any wlan client will not be allowed to associate to the network unless a match is seen in mac filter in wlc.
But once that is done it will not able to access network resources unless 802.1x authentication is completed by ACS against the wlan clients user name which is again a mac address of client.
i dont see a value for doing this. except that you will block unnecessary authentication request getting to ACS by filtering it in the 1st instance.
another scenario is if you are using mac filtering also on ACS , it should be preceeded by mac filtering and then ACS authentication , as above as far as ssequence goes hence the same logic applies here.
Thanks

Cisco Systems vs "CSIRO" 802.11a and 802.11g infringed upon the '069 patent

Hi,
any news about Cisco Systems and the "CSIRO" 802.11a and 802.11g infringed upon the '069 patent ?
http://www.buffalotech.com/products/wireless/
Dear Customer
As you may be aware, Commonwealth Scientific and Industrial Research Organisation ("CSIRO") sued Buffalo, Inc. and Buffalo Technology (USA), Inc. ("Buffalo"), for alleged infringement of United States Patent No. 5,487,069 ("the '069 patent"). Subsequently, CSIRO also asserted its patent against the entire wireless LAN industry, including, Microsoft, Intel, Accton, SMC and Netgear.
In it's lawsuit against Buffalo, CSIRO claimed certain Buffalo wireless networking products compliant with IEEE standards 802.11a and 802.11g infringed upon the '069 patent. Buffalo believed at that time and continues to believe that there are no grounds for CSIRO's allegations of infringement. The United States district court, however, found Buffalo to infringe the '069 patent and enjoined the importation and sale of Buffalo's IEEE 802.11a and 802.11g compliant products.
CSIRO's lawsuits are against the entire wireless LAN industry and could affect the supply of wireless LAN products by any manufacturer, not just Buffalo. The entire industry is resisting CSIRO's attempts to enjoin the sale of wireless LAN products. Recently, Microsoft, 3COM Corporation, SMC Networks, Accton Technology Corporation, Intel, Atheros Communications, Belkin International, Dell, Hewlett-Packard, Nortel Networks, Nvidia Corporation, Oracle Corporation, SAP AG, Yahoo, Nokia, and the Consumer Electronics Association filed briefs in support of Buffalo's position that injunctive relief is inappropriate in this case.
During the period of time that the injunction is in effect (10/1/2007), Buffalo cannot offer for sale, sell, import, or use its IEEE 802.11a and 802.11g compliant products in the United States. A list of the products covered by the injunction is attached here . The injunction does not prohibit sales of pre-existing inventories of products by Buffalo's customers. In addition, Buffalo has secured CSIRO's agreement to permit the replacement of defective products under warranty. None of Buffalo's other products are currently affected by this injunction.
While Buffalo believes that it will be successful in reversing the district court's decision and will obtain a stay of the injunction pending a decision on the merits, the Court of Appeals has not yet issued a decision. Should the Court of Appeals issue a decision staying the injunction, you will be promptly notified. After the stay is issued or a favorable decision on the merits is obtained, Buffalo will be able to resume the supply of IEEE 802.11a and 802.11g products
Please rest assured that Buffalo continues to stand behind their products and will continue to support all of our loyal customers as it relates to product warranties, technical support and the like without interruption.

I suspect after reading the patent and the litigation that you mentioned above, that the US District Court decision will be reversed as the patent appears to be very vague in its contsruction and verbage. Furthermore, the intent to hold the IEEE hostage on the ratification of 802.11n will not bode well in the court's eyes. If in fact the case is reversed, I believe that the members of CSIRO will be in danger of lost profits litigation from Buffalo. Stay tuned to this bat channel.

802.1x and Voice VLAN

I had read articles on cco, and I believed for the same switch port we can have 802.1x configure and the voice vlan configure. It mean the IP phone is connect to the switch port with 802.1x configured, but the phone will not autheticate, only the workstation connect to phone data port will get authenticate.
I had configured 802.1x and test with notebook logon and able to access the network. Now I would like to test the notebook attached to IP phone data port, and the phone connect to switch port configure with 802.1x. But I failed to add voice vlan commmand. Why ?
interface GigabitEthernet9/48
description temporary port
switchport
switchport access vlan 12
switchport mode access
no ip address
dot1x port-control auto
spanning-tree portfast
CIG01-ENT-SW1(config-if)#switchport voice vlan 14
Command rejected: Gi9/48 is Dot1x enabled port.

Using IEEE 802.1x Authentication with Voice VLAN Ports
A voice VLAN port is a special access port associated with two VLAN identifiers:
?VVID to carry voice traffic to and from the IP phone. The VVID is used to configure the IP phone connected to the port.
?PVID to carry the data traffic to and from the workstation connected to the switch through the IP phone. The PVID is the native VLAN of the port.
In single-host mode, only the IP phone is allowed on the voice VLAN. In multiple-hosts mode, additional clients can send traffic on the voice VLAN after a supplicant is authenticated on the PVID. When multiple-hosts mode is enabled, the supplicant authentication affects both the PVID and the VVID.
A voice VLAN port becomes active when there is a link, and the device MAC address appears after the first CDP message from the IP phone. Cisco IP phones do not relay CDP messages from other devices. As a result, if several Cisco IP phones are connected in series, the switch recognizes only the one directly connected to it. When IEEE 802.1x authentication is enabled on a voice VLAN port, the switch drops packets from unrecognized Cisco IP phones more than one hop away.
When IEEE 802.1x authentication is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN.
Waht kind of switch do you have? In 3550 I can configure the port for both vvid and pvid:
interface FastEthernet0/1
switchport access vlan 3
switchport mode access
switchport voice vlan 2
no ip address
dot1x port-control auto
spanning-tree portfast
end
Nevertheless, as the statement above indicates, the port will need to be configured for multi-host in order the PC behind the phone get autehntication:
under the interface configure "dot1x host-mode multi-host"
Nevermind, I just realized that you might have a 5600 running native, checking the configuration guide and realese notes it does not looks like dot1x and vvlan can play together in that platform.

802.11a/g/n optimizing for compatibility

How to ensure maximum client compatibility and stability in 802.11a/b/g/n networks?
I am running a Wireless network based on the WLC 5508 6 SW version, (with WCS mgmt) and 1142 APs. I would like a broad variety of clients, old G clients and new N clients to experience a stable connection to the network. I see Apple Macbooks, Lenovo-, Dell- and HP laptops in addition to HTC smartphones and iPhones on this network.
I am having issues with some types of clients experiencing "unstable" connections. They are able to get a link for a variable ammount of time, then suddenly loose connection for a short period of time before reconnecting. These clients mostly use a third party SSL-VPN link over my wireless, therefore the loss of connection can be quite annoying. From time to time some of these clients seem to be flapping between access points but not seamless like roaming should be, rather with a short stop in connectivity before reconnecting.
Previously we had a 802.11g Aruba wireless network in the same location. It had no such difficulties. This points me toward the config parametres in the controller.
Which 802.11 b/g/n and WLAN parameters can affect this? I am looking for a document describing a best practice for setting up these parameters, or if someone here has input to a successful stable setup as the configuration guide only says e.g. "Enable if you want Aironet Information Elements" does not help in deciding if I want this
My WLAN is set up with WPA2/AES PSK
and a guest network with web auth
Examples of parameters:
which Radio policy (bgn or gn)
Aironet IE?
MFP (disabled or enabled)
QoS profile?
can CCX location measurement affect performance?
Which Data rates should be set mandatory/enabled/disabled?
MCS (data rate) settings for 802.11n
anything I have forgotten?
The goal is:
A simple, no hassle network providing maximum compatibility with different clients with a plus of 802.11n speeds for compatible clients
wbr
-LA

Hey! I implemented your suggested improvements and the first impression is good!
on 802.11a and b/g I disabled lower datarates, set 12Mbps to mandatory and the higher ones to supported. The instant improvement was the RTT measurements I made (previously they averaged at about 13ms (to an internet site) after the change they dropped to about 3-4 ms on average! I would say this is a very significant improvement!
I have not been able to get any feedback from the user community yet :), but it sounds promising...
I am still looking for some more insight into these issues, so if someone still has some ideas, please let us know!
-LA

What's the difference between using and 802.11a and 5GHz only?

What's the difference between using "802.11n (802.11a compatible)" and "802.11n only (5GHz)" modes on the Airport Extreme?

802.11a gives you 802.11g speeds but using 5GHz (54mbps
802.11n gives you 144Mbps (600 peak) at 2.4GHz or 5GHz

MAB/802.1x and Alkatel IP Phones

Hi All
We have a distributed deployment where Alkatel ip-touch phones are authentictaed via MAB. Alkatel ip touch phones has 802.1x enabled by default and the phone tries eapol first and then switch authenticates via MAB which is fine. Once authenticated its working as expected. The issue is the phone keeps on periodic retry after x amount of minutes for 802.1x again which triggers the phone to reboot again and goes via the whole process. This interupts the voice. We could disable 802.1x but its per phone basis. Has anyone came across this issue and found a way to diable globally via the call manager etcc. or any workarounf from ISE/switch side?
Thanks
G

Hi Tarik,
Thanks for the reply, please find below the switch port config lines, its a 370x switch, IPbase and universalon 15.2-1.E1 image
Note- Since the 8021x is enabled by default the phone initially tries 802.1x and after failing , the switch goes to the next auth method which is MAB which is successful. The issue is the phone again initiales a 802.1x packet after some time and the whole process starts again and because 8021x is failed the phone reboots again. I think this is the way this type of phone work and we cannot do much unless disable 802.1x or install the Alkatel CA certs in the ISE cert store?
Interface gi x/y
switchport access vlan xx
switchport mode access
switchport voice vlan yy
ip access-group ACL_ALLOW in
authentication event fail action next-method
authentication event server dead action reinitialize vlan xx
authentication event server dead action authorize voice
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication timer reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast

Potential Security Hole with 802.1x and Voice VLANs?

I have been looking at 802.1x and Voice VLANs and I can see what I think is a bit of a security hole.
If a user has no authentication details to gain access via 802.1x - i.e. they have not been given a User ID or the PC doesn't have a certificate etc. If they attach a PC to a switchport that is configured with a Voice VLAN (or disconnect an IP Phone and plug the PC direct into the switchport) they can easily see via packet sniffing the CDP packets that will contain the Voice VLAN ID. They can then easily create a Tagged Virtual NIC (via the NIC utilities or driver etc) with the Voice VLAN 802.1q Tag. Assuming DHCP is enabled for the Voice VLAN they will get assigned an IP address and have access to the IP network. I appreciate the VLAN can be locked down at the Layer-3 level with ACL's so any 'non-voice related' traffic is blocked but in this scenario the user has sucessfully bypassed 802.1x authentication and gain access to the network?
Has anyone done any research into this potential security hole?
Thanks
Andy

Thanks for the reply. To be honest we would normally deploy some or all of the measures you list but these don't around the issue of being able to easily bypass having to authenticate via 802.1x.
As I said I think this is a hole but don't see any solutions at the moment except 802.1x on the IP Phone, although at the moment you can't do this with Voice VLANs?
Andy

MAB, 802.1x and ACS 4.2

Hi all,
Currently i'm using an ACS4.2 as radius server, some switch 2960-s ios 12.2.(55)se5, ipphone Alcatel iptouch 4018 and i would like to assign dinamic vlan to some specific users/laptop Daisy-chained to ip phone.
Logic connection is: users laptop---->ipphone---->switch---->radius
What i need is:
if I connect MY laptop to the ipphone port, i receive a specific vlan ( vlan 58 )
if SOMEONE else ( i.e. a consultant ) connect his laptop to the SAME ipphone port (if available) he has to receive a different vlan ( vlan 1).
I've been able to reach the goal using MACRO but it tooks too much time to authenticate ( approx 1 min ) so i give up and tried a different faster way ( 802.1x and MAB ).
i've been able to authenticate the ip-phone using 802.1x auth and to receive the correct vlan when i connect MY laptop (MAB auth) but i was not able to provide the VLAN 1 to the Consultant when he connect his laptop even if the "authentication event fail action authorize vlan 1" is configured.
I used the dot1x auth-fail vlan because i'm not able to use MAB or 802.1x auth on external laptop. I also tried with guest vlan with no luck.
In both case the "consultant" remain in "auth failed"
Here my current configuration
dot1x system-auth-control
dot1x guest-vlan supplicant
identity profile default
interface GigabitEthernet1/0/1
switchport mode access
switchport voice vlan 30
authentication host-mode multi-auth
authentication event fail action authorize vlan 1
authentication order mab dot1x
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 2
dot1x max-reauth-req 1
storm-control broadcast level 2.00
storm-control multicast level 2.00
spanning-tree portfast
On ACS side i have 2 groups
first Group authenticate the iphone and supply the voice vlan ( vlan 30)
Second Group authenticate using MAB and supply the vlan 58
is there a different way to accomplish this task?
Thank you in advance

hi,
any ideas?
thx

802.1x and IP Phone

Is it possible to enable dot1x and voice on the same interface? If so which switches and IOS support this feature ?
Any references to documents ?
Commands that cannot be configured together :-
switch voice vlan xxx
dot1x port-control auto

It is possible to enable 802.1X and voice on the same port. If the phone does CDP, it is allowed through, regardless of the 802.1X state of the port with this config. Here's the following switches that support this, with the minimum required releases:
CatOS (6500) - 7.6(1)
IOS (4500) - 12.1(20)EWA
IOS (3750) - 12.2(25)SEA
IOS (3560) - 12.2(25)SEA
IOS (3550) - 12.1(12c)EA1
IOS (2960) - 12.2(25)FX
IOS (2950) - 12.1(12c)EA1
IOS (2940) - 12.1(13)AY
Hope this helps,

802.1X and CAT Express 500

Hi guys,
I want to know if the Cat Express 500 support dynamic vlan assigment through 802.1X.

Hi,
You can do the vlan arrisgnment using 802.1x on CE500. The configuration for 802.1X and Radius authentication server can be done with the help of Cisco Network Assistant (CNA). In the menu Network Security Settings you have to put the
security level on high. There is the possibility to configure the IP address of the RADIUS server and the RADIUS key.
In case you don?t have the CNA, you can download it for free from:
http://www.cisco.com/cgi-bin/tablebuild.pl/NetworkAssistant
HTH, Please rate if it does.
-amit singh

Macintosh clients, 802.1x and NAC.

I'm prototyping a NAC setup which has to cater for Macintosh clients as well as Windows. I can get the Macs to authenticate via 802.1x (surprisingly easy using the built in software!) but what I can't do is setup a Posture Validation Rule to identify that the client is a Mac and not a Windows machine. I've tried using the Cisco:PA:OS-Version condition set specifying "contains" MAC. I've also tried "contains" 10 but it doesn't work. I think it probably doesn't work as the condition set depends on the CTA being installed on the Mac which it isn't (and it's not an option either).
EDIT: Anyone tried installing the CTA on a MAC? It's horrific. Extract the files and run the install, OK so far. It then puts the config ini file in a directory no user (not even Admins) has permissions to so you can't modify it and BOY do you need to modify it!
Any ideas?

I'm on the home straight with this one. Essentially to get the CTA to work using the built in 802.1x supplicant on Windows or MacOS you need to run a mix of NAC L2 IP and NAC L2 802.1x. This requires a little extra config on the switch but nothing tragic (it's all in the (NAC Framework Configuration Guide).
The reason for this is that the CTA requires a network channel to be open so it can run EAP over UDP (EOU) to do posture validation and the 802.1x part of the process gets the machine onto the network so the CTA can do it's stuff.
With this setup in place and the CTA properly configured (as mentioned previously this is the permissions setup on the Mac created by the CTA install makes this far more difficult than it should be) the process works pretty well, popup messages work, browser launch and URL redirection work. Looks good.
The fly in the ointment is wireless. The freebie CTA doesn't support it, no way. For a PC the answer is to buy the Cisco Secure Services Client which does support wireless and (I think) run that alongside the CTA (haven't fully worked this one out yet). If you have a wireless Mac, you're stuffed, Simple as that, which from my point of view is a real pain as the customer I'm developing this for wants posture validation for PCs and Macs, wired and wireless.
Hope this helps someone somewhere avoid a little pain! : )

IEEE 802.3u and IEEE 802.3z Compatibility

Similar Messages

Maybe you are looking for