IPS 6.0

We currently have an IDS4215 that has been upgraded to IPS 6.0, i can access the device via ssh but whenever i try to fire up the GUI i get an error loading java applet failed. and the application just hangs there. what version of java should i use, i'm currently using 1.6.0-b105

The JAVA version you are running is not a recommended one. Please refer to following link and download appropriate JAVA version:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids13/idmguide/dmintro.htm#wp1039249
Hope this helps.
Regards,
Vibhor.

Similar Messages

  • How to allow access only from certain IPs?

    I have Portal Server 6.0 on Sun ONE Web Server and want to allow access to it only from certain IPs, i.e. if my IP differs from predefined, then access is denied (no page is opened).
    How can I implement this with minimal efforts?
    Thanks in advance!

    Where did you set the ACLs?
    When webclients connect direct to the portal/ids this is pretty straight forward using htttpacl files. When SRAP GW's are used for Internet portal access the web or app-server never sees the client IP thus those ACLs don't get applied.
    Am I missing something (won't be the first time... or the last:-)
    Cheers,
    -psr

  • Can i upgrade my HP ENVY J001TX Laptop Screen to IPS Screen.

    Hi,
    I am currently using HP Envy J001tx Laptop. All are exceptional in this other than the laptop display.Is there any way i can upgrade my laptop screen to IPS Screen or some othe screen with good color calibration with better viewing angles???????
    Note : My Display is FHD Brighview display (but viewing angles and color richness is very poor)

    Hello Vashif, welcome to the HP Forums.
    According to the Maintenance and Service guide for your notebook, these are the screen's available for your notebook:
    (2) 17.3-in, LED. HD, BrightView display panel (includes 2 rubber screw covers):
     17.3-in, AG, FHD, LED 720256-001
     17.3-in, BV, HD, LED 720257-001
    You can find this on page 28.
    I hope this answers your question. Thank you for posting on the HP Forums.
    I worked on behalf of HP.

  • How to change the default servcie port number to be checked for the IPS sig

    Dear
    i have an AIP-SSM (IPS) installed in a an ASA firewall.
    i have configured an access-list in the firewall to forward the traffic coming from the internet toward the internal server to be checked by the IPS module.
    but the case is that the services have to be checked is not the default services port numbers.
    http port is 8081
    oracle port is 2006
    and many other services.
    the question now, is how to change the default service number in the IPS in order to be checked by the corresponding service signatures?
    Thanks

    You would set those as part of the signature variables.
    http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_definitions.html#wp1040009

  • Routing issue- seeing same IPs for two hops

    Hello All,
    I'm seeing two same IPs in the traceroute output. Is that due to routing issue that nexhop is as the same device for the first time?
    Log:
    6  10.30.102.26  61.060 ms 10.30.100.142  61.266 ms 10.30.102.26  61.071 ms
    7  10.30.102.26  61.139 ms  61.211 ms 10.61.191.2  60.948 ms
    Can you  guys help me to fix the issue??
    Regards,
    Thiyagu

    Are you load balancing anywhere?
    6 10.30.102.26  61.060 ms
       10.30.100.142  61.266 ms
       10.30.102.26  61.071 ms
    7 10.30.102.26  61.139 ms  61.211 ms
       10.61.191.2  60.948 ms
    HTH,
    John
    *** Please rate all useful posts ***

  • Decoding IPS logs

    Hi,
    Need guidance on decoding IPS syslogs(alerts). We monitor IPS logs and there we could see some decoded messages appearing for cid.context.cid:fromTarget, cid.context.cid.fromAttacket, cid.triggerPacket fields. Would like to understand what these fields are, how to decode these messages (any tools/url for decoding), why cisco has made these contents to appear decoded (any specific reason), how this will help us in analyzing such alerts.
    Thanks!
    -Jag.

    Please use the below guide for message fields
    http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_packets.html

  • DNS Issues - Can ping server name and IPs but not FQDNs.

    Hi All, 
    Hopefully some one can help me here, I am having an issue where one of my domain attached servers cannot ping any FQDNs in the environment but it can ping the host names and the IPs and look up the host names from a reverse look up. 
    We have done the following troubleshooting:
    Flushed and registered DNS cache.
    Restarted the DNS client and net logon services on the effected server
    Preformed standard checks and commands such as:
    Checked the event logs and found there were warnings for DNS registration.
    Compared the DNS settings in the network adapters across the rest of the servers in the environment and found that they were all the same. DNS Suffixes are added in the correct order and are set to register.
    Pinging FQDNs which is not giving any results.
    Tracert FQDNs which is also not giving any results.
    Nslookup which is querying the DNS server directly and giving results as expected
    Ran the command which reported successful: dcdiag /test:registerindns /dnsdomain:sub.domain.net /v
    Checked and updated the permissions on DNS for the affected server to give the server full control of its own DNS entry. 
    Replaced the DNS Client service DLL with one from a server that is working as expected. 
    Also worth noting is that the affected server (as well as every other server in the environment) has 2 NICs, one that communicates with DNS and AD and the other does not have any DNS IPs set. 
    Not this is not the first time this happened, a reboot fixed the issue before but it seems to be a reoccurring problem now. 
    If any one can shed some light on this issue I would be grateful.
    Regards,
    Steve. 

    Hi Steve,
    First, we should confirm if this issue is caused by DNS.
    When you ping the FQDN, does the server show the correct corresponding IP address?
    If no, there should be some error messages. If it is possible, please post the screenshot of this issue.
    To check the process about how does server resolve the FQDN, please follow the steps below:
    clear local DNS cache with command ipconfig /flushdns
    perform the network capture
    ping the specified FQDN
    Check the DNS traffic
    To download Network Monitor, please click the link below:
    http://www.microsoft.com/en-hk/download/details.aspx?id=4865
    Besides, have you tried to update the NIC driver to the latest version?
    Best Regards.
    Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • How to use two gtx transceivers in one quad for two aurora ips

    hera mgt bank is 113
    i am using two aurora ips 64b66b .for one ip GTX_X1Y0, another GTX_X1Y2.while simulating ,results are good.Coming to implementation its showing error in implementaion.that in MAP.
    Pack:2811 - Directed packing was unable to obey the user design constraints (LOC=GTXE2_COMMON_X1Y1) which requires the combination of the symbols listed below to be packed into a single GTXE2_COMMON component.
    The directed pack was not possible because: The target component type can only contain one fragment.
    The symbols involved are:
    GTXE2_COMMON symbol "Source2/Aurora_2/src_2_wrapper_i/Src_2_multi_gt_i/gtxe2_common_i" (Output Signal = NULL)
    GTXE2_COMMON symbol "Source1/Aurora_1/src_1_wrapper_i/Src_1_multi_gt_i/gtxe2_common_i" (Output Signal = NULL)
    What is the solution for it?
     find attachments.

    i got following error while implementing project in vivado.
    "[DRC 23-20] Rule violation (REQP-1739) GTx R/TXOUTCLK drives inappropriate load - GTXE2_CHANNEL cell design_1_i/aurora_64b66b_0/inst/design_1_aurora_64b66b_0_0_core_i/design_1_aurora_64b66b_0_0_wrapper_i/design_1_aurora_64b66b_0_0_multi_gt_i/design_1_aurora_64b66b_0_0_gtx_inst/gtxe2_i pin design_1_i/aurora_64b66b_0/inst/design_1_aurora_64b66b_0_0_core_i/design_1_aurora_64b66b_0_0_wrapper_i/design_1_aurora_64b66b_0_0_multi_gt_i/design_1_aurora_64b66b_0_0_gtx_inst/gtxe2_i/TXOUTCLK (net: design_1_i/aurora_64b66b_0/inst/design_1_aurora_64b66b_0_0_core_i/design_1_aurora_64b66b_0_0_wrapper_i/design_1_aurora_64b66b_0_0_multi_gt_i/design_1_aurora_64b66b_0_0_gtx_inst/tx_out_clk) should only drive BUFG, BUFH, BUFMR, MMCM or PLL loads, but drives one or more invalid loads such as FDRE cell CORE_STATUS_channel_up_master_reg. Please insert a BUFHCE (or a BUFMR, if the load is a BUFR) between the GT and its load(s).
    [DRC 23-20] Rule violation (REQP-1739) GTx R/TXOUTCLK drives inappropriate load - GTXE2_CHANNEL cell design_1_i/aurora_64b66b_1/inst/design_1_aurora_64b66b_1_0_wrapper_i/design_1_aurora_64b66b_1_0_multi_gt_i/design_1_aurora_64b66b_1_0_gtx_inst/gtxe2_i pin design_1_i/aurora_64b66b_1/inst/design_1_aurora_64b66b_1_0_wrapper_i/design_1_aurora_64b66b_1_0_multi_gt_i/design_1_aurora_64b66b_1_0_gtx_inst/gtxe2_i/TXOUTCLK (net: design_1_i/aurora_64b66b_1/inst/design_1_aurora_64b66b_1_0_wrapper_i/design_1_aurora_64b66b_1_0_multi_gt_i/design_1_aurora_64b66b_1_0_gtx_inst/tx_out_clk) should only drive BUFG, BUFH, BUFMR, MMCM or PLL loads, but drives one or more invalid loads such as FDRE cell CORE_STATUS_1_channel_up_slave_reg. Please insert a BUFHCE (or a BUFMR, if the load is a BUFR) between the GT and its load(s).
    [USF-XSim 62] 'compile' step failed with error(s) while executing 'F:/PERSONAL/XilinxVivado2014.2/shared_logic/shared_logic.sim/sim_1/behav/compile.bat' script. Please check that the file has the correct 'read/write/execute' permissions and the Tcl console output for any other possible errors or warnings.
    [Vivado_Tcl 4-23] Error(s) found during DRC. Placer not run."
    i am attaching topmodule file
    need solution
    thanks in advance
    razz

  • How can I solve the problem of panic.ips in my iphone 5?

    Hi to all. I'm new on this kind of communities. I've updated my Iphone 5 to IOS 7.1.1, my problem is that since a did this updated mi iphone began to restart automatically no matter wich aplication im working.
    I've revised the use diagnostice and it shows a text about panic.ips.  Somebody can help me to know if this is a hardware problem or software problem and if it can be solve?
    Thank you.

    Hi Odragde,
    Thanks for visiting Apple Support Communities.
    If your iPhone is restarting unexpectedly after updating the iOS software, start with step 5 in this troubleshooting guide:
    iPhone: Hardware troubleshooting
    http://support.apple.com/kb/TS2802
    Will not turn on, will not turn on unless connected to power, or unexpected power off
    Verify that the Sleep/Wake button functions. If it does not function, inspect it for signs of damage. If the button is damaged or is not functioning when pressed, seek service.
    Check if a Liquid Contact Indicator (LCI) is activated or there are signs of corrosion. Learn about LCIs and corrosion.
    Connect the iPhone to the iPhone's USB power adapter and let it charge for at least ten minutes.
    After at least 30 minutes, if:
    The home screen appears: The iPhone should be working. Update to the latest version of iOS if necessary. Continue charging it until it is completely charged and you see this battery icon in the upper-right corner of the screen . Then unplug the phone from power. If it immediately turns off, seek service.
    The low-battery image appears, even after the phone has charged for at least 20 minutes: See "iPhone displays the low-battery image and is unresponsive" symptom in this article.
    Something other than the Home screen or Low Battery image appears, continue with this article for further troubleshooting steps.
    If the iPhone did not turn on, reset it while connected to the iPhone USB power adapter.
    If the display turns on, go to step 4.
    If the display remains black, go to next step.
    Connect the iPhone to a computer and open iTunes. If iTunes recognizes the iPhone and indicates that it is in recovery mode, attempt to restore the iPhone. If the iPhone doesn't appear in iTunes or if you have difficulties in restoring the iPhone, see this article for further assistance.
    If restoring the iPhone resolved the issue, go to step 4. If restoring the iPhone did not solve the issue, seek service.
    Best,
    Jeremy

  • Solaris 11 IPS:  How do you post multiple versions of the same package?

    How do you post multiple versions of the same software package on a single IPS instance(port)? Oracle was able to do it here with versions 151 and 175 of S11:
    http://pkg.oracle.com/solaris/release/
    Unfortunately, based on my searches, no where in the documentation (http://www.oracle.com/technetwork/server-storage/solaris11/technologies/ips-323421.html) does it explain to the development community how this is done. The best I can do is create pkg repo instances on different ports to host each different software version.
    We are trying to deploy an IPS repository for our drivers and utilities that our customers can link to and pull updates from. We have been able to post a software package to the repository using the command:
    pkgsend publish -s http://localhost:1234 -d ./ Appv1.p5m
    This posts the package on the IPS repository instance at port 1234 on the server. However, we would like to post multiple versions of the package on the server at the same URL. Why the same URL? So that our customers and end-users need only point to a single URL to pull down our software rather than having to add a new URL to the publisher list each time we have an update. We want at least 5 of the previous software versions to be available on the server. Posting each version of the application or driver on a different IPS instance on a different port will require customers to add multiple URLs to their publisher list and they also will not be able to initiate remote scans for updates.
    Has anybody been able to do this? Is any documentation forthcoming?
    Edited by: user13489824 on Jun 25, 2012 10:17 AM

    dhduvall: Thanks for your response. Yes, one would think that as long as the version numbers are different, you should be able to accumulate multiple versions of a package in a repository. It looks like Oracle has done it in their S11 repository unfortunately, as far as I know, they have not shared the steps on how to do this. I would like to publish two versions of the same package. I.E. two different manifests with two different fmri.pkg version strings and two different binaries.
    If I publish one package after another like this:
    pkgsend publish -s http://localhost:1234 Appv1.p5m
    pkgsend publish -s http://localhost:1234 Appv2.p5m
    Then only the second package shows up in the repository, as if it over-wrote the first one.
    Running pkgsend with two manifest, like this:
    pkgsend publish -s http://localhost:1234 Appv1.p5m Appv2.p5m
    Will cause pkgsend to combine the packages and manifests as if they were a single package... not what I am trying to do.
    Both approaches are complete without errors but neither achieves what I am trying to do.
    alan.pae: Thank you. Unfortunately, the link didn't really help. I've read Oracle's white papers and IPS developer guide so I'm familiar with the topics covered.
    Lex: Yes, I know. I specified the versions in the pkg.fmri value string.

  • How do I stop Firefox from redirecting me to another site based on my IPS address?

    I work in California. Our corporate offices are in Oklahoma and my desktop computer is set up with an IPS address in OK. When I try to go to the CA website for AAA, Firefox redirects me to the OK website for AAA. How do I stop from being redirected to OK sites when trying to open CA sites?

    hello eajames, sites can show you content and redirect you based on your IP address which will reveal your approximate location - there is not much a browser can do against this...
    http://www.yougetsignal.com/tools/network-location/

  • How can I use Apple Caching Service on a Network with Multiple Public IPs?

    Hello!
    I help manage a network of ~4000 clients for a small liberal arts college in Michigan. I'm looking into the possibility of implimenting Apple Caching Server for our network.
    We have one 400mbit pipe out to the internet, and all of our clients are given public-facing IPs to the internet. A caching server would be great, especially on update days. All wireless clients are on the same subnet, which is where I'd like the server to be serving the cached copies.
    I have installed Mavericks on a fresh machine, downloaded OS X Server 3.0.3, and attempted to start the caching service. This is what I get.
    Unable to start service.
    Caching cannot be run on a public network. Consult documentation.
    How can I get this up and running?

    The way the Caching server works is that the server will be accessing the Internet and when doing so traffic will be coming from it via a particular public IP address. Usually this will not be the address of the server itelf but your router as for most networks NAT is used. In this by far more common scenario the client Macs (and likely iOS devices) will be going through the same router and hence show up via the same public IP address.
    If the client request is the same as the address registered via the Caching server then Apple redirect the request via the Caching server.
    The setup would look something like this -
               Internet
                    |
                Router (with NAT)
                    |
      (LAN)     +------Caching Server-----Client devices
    With this setup because everything is using the same public IP address Apple can reasonably assume everything is on the same network and trigger a redirection to your Caching server.
    If you try a setup like the following with the Caching server having its own public IP it will not work because the Caching server and client devices will have different public IP addresses
               Internet
                   |
               Router (no NAT)-------------------+
                   |                                      |
                Firewall (with NAT)       Caching Server
                   |                                      |
                   |                                      |
    (LAN)     +-----Client devices-----------+-----------
    Your configuration as described is more like the following
               Internet
                   |
               Router (no NAT)
                   |
    (LAN)     +------Caching Server-----Client devices
    With yours not having NAT each device has its own public IP address including the Caching server and Apple cannot redirect traffic as it thinks they are on different networks.

  • SRP547W, How to use multiple WAN IPs for port forwarding?

    Hi folks,
    We've run into some difficulty trying to take advantage of multiple WAN IPs in conjunction with the SRP547, and I'm hoping someone here can help out or at least tell us that we're going to need to buy a different router...
    What we're trying to acheive is the ability to port forward from our distinct public IPs to different internal servers. Looking at the options under Port Forwarding it looks like we can only configure forwards at the "WAN interface" level, but our problem is that we can't work out how to set up separate interfaces for each of our Public IPs...
    Our ISP provides us with a fully managed NTU/router with a single "Internet" ethernet port, which we can use by statically configuring IPs on our end. For this configuration this port has been directly patched to the WAN ethernet port on the SRP547W.
    We have been allocated a 255.255.255.248 (/29) subnet, giving us 5 usable IPs after the ISP's gateway address is taken into account, like so:
    a.b.c.208     Network Address (/29 subnet)
    a.b.c.209     ISP Gateway
    a.b.c.210     IP1
    a.b.c.211     IP2
    a.b.c.212     IP3
    a.b.c.213     IP4
    a.b.c.214     IP5
    a.b.c.215     Broadcast Address
    On the SRP we've set up the default "Ethernet WAN2" sub-interface with the following details for IP1
    VLAN ID:               4088 (Uneditable)
    Connection Type:       Static IP
    Internet IP Address:   a.b.c.210
    Subnet Mask:           255.255.255.248
    Default Gateway:       a.b.c.209
    The next step (I would have thought) would be to add a second sub-interface, using similar info for IP2
    VLAN ID:               4000 (Chosen arbitrarily)
    Connection Type:       Static IP
    Internet IP Address:   a.b.c.211
    Subnet Mask:           255.255.255.248
    Default Gateway:       a.b.c.209
    When we try to do so however we get:
    Fail!
    Conflict with Ether_WAN2 interface address type
    I should mention at this point that we're running on firmware version 1.02.01 (023).
    Any suggestions on how we can proceed?
    Is there a CLI or other method of configuration that might work if the web interface won't?
    Thanks,
    Tim.

    OK, I've seen reference to this solution before but not much in the way of details. Perhaps you can spell out how this ought to work, as the Software DMZ doesn't behave as I'd expected it to.
    As before, on the SRP we've set up the default "Ethernet WAN2" sub-interface with the details for IP1 with a /29 subnet.
    VLAN ID:               4088 (Uneditable)
    Connection Type:       Static IP
    Internet IP Address:   a.b.c.210
    Subnet Mask:           255.255.255.248
    Default Gateway:       a.b.c.209
    We'd now like to expose a server function on IP2, let's say LAN details for this server are:
    VLAN:                  3000
    VLAN IP Range:         192.168.1.1/24
    Server IP:             192.168.1.10
    Server Port:           80
    So first we turn on Software DMZ:
    Status:                Enabled
    Public IP:             a.b.c.211
    Private IP:            192.168.1.10
    WAN Interface:         Ether_WAN2
    My understanding, based on what you've said, is that this should expose the whole server to external access via IP2. Unfortunately, it doesn't seem to work this way - we don't seem to have any access at all. Perhaps there's a default deny rule on the firewall?
    Just to be sure, I tried creating a rule to allow HTTP traffic to the server in the Advanced Firewall page.
    In Interface (WAN):    All
    Out Interface (LAN):   VLAN.3000
    Source IP:             0.0.0.0
    Source Subnet:         0.0.0.0
    Destination IP:        192.168.1.10
    Destination Subnet:    255.255.255.255
    Protocol:              TCP
    Source Port:           Any
    Destination Port:      Single:80
    Action:                Permit
    Schedule:              Everyday
    Times:                 24 Hours
    Still no dice. What am I missing?
    Cheers,
    Tim.

  • How do I use Cisco MARS to monitor two ASA (active/stby) with IPS modules?

    Hi
    The two ASA with IPS modules are in active/standby mode. When I try to add both the two IP (active/standby) into the MARS, the MARS will complain duplicated hostnames.
    How to setup MARS to monitor ASA with IPS with active standby topology?
    Thanks!

    Hi,
    The fundamental problem with this scenario is that you have non-failover capable modules in a failover chassis - think of the ASA failover pair as one device and the IPS modules as two completely separate devices.
    Then, as already mentioned, add only the primary ASA. (The secondary will never be passing traffic in standby mode so it's not actually needed in MARS) Then, with the first IPS module you can add it as a module of the ASA or as a standalone device (MARS doesn't care). With the second IPS module the only option is to add it as a separate device anyway.
    In a failover scenario the ASA's swap IP's but the IPS's don't so whereas you'll only ever get messages from the active ASA you'll get messages from both IPS IP's depending on which one happens to be in the active ASA at the time.
    Don't forget that you have to manually replicate all IPS configuration every time you make a change.
    HTH
    Andrew.

  • IPS Signature Updates with no Internet Access

    Hi all,
    I've got a bit of an interesting dilemma that I'm hoping that someone could help with. I have two distinct networks: A "regular" network, along with a "secure" network. I've not been involved in the setup/configuration, but I've been handed some work to do now that has me puzzled.
    The two networks are separated with a pair of ASA devices with IPS modules installed. User access to the secure side works by using Cisco VPN client, terminating on the ASA's, and once connected applications are delivered via Citrix. Management of the ASA's involves connecting via management VPN to the "external" ASA interface, connecting to a management server via Citrix and from there, management via MARS, ASDM & IME.
    My issue is that I have been asked to configure auto-updates for the IPS modules. However, there is no internet access from the secure network. Servers on the secure side can request files, etc, from the regular side but there is no direct access can be initiated from the regular side back to the secure network. There are no ASA devices that are contactable/manageable from the regular side.
    I've read that it's possible to somehow download updates from cisco.com via FTP or similar, but I fail to see how I can automate the process. What I originally thought to do was to install another copy of IME on the regular network, set up a dummy device and there on configure auto-updates, but unfortunately the IPS needs to be contactable for that to work.
    Can anybody think of a solution that could make this work for me?

    Hi Jennifer,
    Thanks for that, but the instructions in that document appear to be related to updating a sensor from an FTP server where the updates have already been copied to it.
    I have searched and searched, but I'm unable to locate the relevant location to download the signatures direct via FTP/SCP. I have attempted to locate them on ftp.cisco.com, but with no luck.
    Regards,
    James

  • Use one IPS port to create tunnel to two remote MDS switches?

    is it possible to use one gigabit port on MDS IPS 14+2 linecard to create FCIP tunnels between two other remote MDS switches?
    each tunnel will  allow a different VSAN. this is kindda crude but gotta do it, if it can be done

    yes it can be done, make 1 FCIP profile defining the Ip address of the GE interface.  Then create 2 different FCIP interfaces ( tunnels )  each one will use the same profile, but have different peers.

Maybe you are looking for

  • Document Restrictions

    I created a document using Live Cycle Designer ES 8.2 and when I save it to a pdf form there are certain restrictions that I can't figure out. Changing The Document: Not Allowed Document Assembly: Not Allowed I am opening the pdf using Acrobat Pro 9

  • Unable to get XML payload with new JDBC interface

    Hello - I have hit a wall in trying to use the new JDBC dequeue interface. I can get an Oracle connection and get a message with the following code: OracleConnection connection = (OracleConnection) getConnection(); AQDequeueOptions deqopt = new AQDeq

  • TDS on provisions

    If TDS has been deducted at the time of making provision in the year end but actual invoice receipt after payment of TDS in the next year , how the system will take care of TDS on differential amount (e.g Audit fees), and what will happened if TDS ha

  • Firefox v3.6.8 will NOT remember passwords. I've doubled check the settings but it will not remember the passwords

    New HP laptop, O/S XP-Pro, my previous computer with XP-Pro had no problem remembering passwords but this v of Firefox will not remember the PW's

  • Problem importing idoc to XI integration repository

    I have deleoped a custom IDOC and released in SAP/R3. Next I have imported it to XI using transaction IDX2 without problems. However, when I try to import the metadata to the integration repository, I can't find it in the list of available IDOcs. I h