Use of proxy distribution table in ACS v4.0

HI All,
We are running with Cisco ACS v4.0 AAA server, Here I need the use of Proxy distribution table.
Why is this required and what is the functionality of it.
Regards
Suresh

Use ACS as Proxy in a distributed enviornment.
Using proxy, ACS automatically forwards an authentication requests from AAA clients to AAA servers. After the request has been successfully authenticated, the authorization privileges that you configured for the user on the remote AAA server are passed back to the original ACS, where the AAA client applies the user profile information for that session.
Fallback on Failed Connection
You can configure the order in which ACS checks remote AAA servers if a failure of the network connection to the primary AAA server occurs. If an authentication request cannot be sent to the first listed server, because of a network failure for example, the next listed server is checked. This checking continues, in order, down the list, until the AAA servers handles the authentication request. (Failed connections are detected by failure of the nominated server to respond within a specified time period. That is, the request is timed out.) If ACS cannot connect to any server in the list, authentication fails.
Stripping
Stripping allows ACS to remove, or strip, the matched character string from the username. When you enable stripping, ACS examines each authentication request for matching information.
Regards,
Jatin Katyal
- Do rate helpful posts -

Similar Messages

ACS Proxy Distribution Table - Logs ?

Hello,
I have setup a proxy distribution table in my Cisco ACS v4.2 (patch 6).
I have two type of users: Suppliers (external) and TI user (internal). They connect to our Internal Network by a VPN SSL connection (AEP Netilla box).
This box have 2 realms. One for suppliers, another for TI users.
The aim is that:
* For the suppliers connect trought the Netilla box which forwards the authentication (RADIUS Authentication) to the ACS which forwards the request to an RSA server.
* For TI User, they connect trought the Netilla Box which forwards the request (RADIUS Authentication) to the ACS which check the Active Directory.
=> It's working perfectly.
The problem is that I have no logs from the ACS box about the suppliers which are forwarded to the RSA server. If possible, I want to know which users try to connect, if they are permit (or not) and eventually how many times they are connected.
The problem is the Netilla box doesn't have Radius Accouting.
I was hoping that the ACS logs these kinds of connections. (It's working for users, TI users, authenticated by the Active Directory).
Is-it possible that the ACS forwards only the request without taking attention of what it is forwared (except remove the Character String).
Is there another way to do what I'm talking about ?
See my VISIO attachement.
Thanks in advance for your attention,

I really hate draggin up old posts, but I have the same exact question. In my scenario, I am proxying requests for eduroam (basically any user name that ends in .uk, .com, .ca or any other country suffix) off to our national server(s). I would like to know if/when these requests get proxied over. smahbub's suggestion only directs where to find the settings for loggin. I have these enabled, but cannot seem to locate any setting that applies to the proxy distribution table. If anyone has any idea, it would be greatly appreciated.
Thanks,

ACS error, AAA Server is a referenced in the Proxy Distribution Table

When installing the ACS appliance (4.1) I have an issue where during the setup it prompts for a static address, Gateway, and DNS. This fine and network connectivity is tested during this time and success.
The issue seems to be fine but that when logging in to the GUI under Network Configuration>AAA servers.
AAA server AAA server IP address AAA server type
self 10.10.10.1 CiscoSecure ACS
ciscoacs 169.254.25.58 CiscoSecure ACS
Under Network Configuration>Proxy Distribution Table
Character String AAA Servers Strip Account
Default ciscoacs no Local
The 2 questions I have how to stop the 169.x.x.x address or why this is being put into the configuration, and how to delete as the following error is obsvered when trying.
ACS error when trying to delete..
âCan not Delete AAA Server, AAA Server is a referenced in the Proxy Distribution Tableâ
Many Thanks MJ

Go to,
Network configuration > Proxy Distribution Table > (Default).
swap the entry in this section under tables AAA Server and Forward to > Submit + Restart.
Then try to delete 169.x.x.x entry.
Regards,
Prem

Adding AAA servers to ACS to use Proxy RADIUS distribution Table

Hello,
I've added two non ACS radius servers (Radiator) to the AAA servers on Network Config, in order to use them on a proxy distribution table.
I had problems authenticating users through those servers and I did a sniffer trace on the outside interface of the ACS.
What I saw is that ACS sends packets to the AAA server configured as RADIUS on port 1645, not 1812, the expected standard, and port to which the others servers are listening to. How can I change this behaviour?
Thanks
Gustavo

ACS by default will listen on both ports 1645 and 1812, the two "standard" Radius ports. However, when talking to a proxy server it will only send them on 1645, by default. To change this you have to go into the registry and change it as follows:
Under [HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\CiscoAAAv3.x\Hosts\\RADIUS] (where is the server you want to send the 1812 reuests to, and note that you may have to add the RADIUS key if it isn't there already), you can add the following:
"authPort"=dword:0000066e <<---- 1645
"acctPort"=dword:0000066d <<---- 1646
"timeout"=dword:00000001
"single connection"=dword:00000000
"strip users"=dword:00000000
You don't need all of them, you can just change the authPort to 1812 (714 in hex) and acctPort to 1813 (0x715) and you should be good to go. Make sure you reboot the server after making the registry changes. Keys are case-sensitive too so make sure you type them in EXACTLY as I've shown above.

ACS v2.6 with Distribution Table

All,
I recently inherited the duties of an ACS 2.6 Server. I have built 2 other ACS boxes in the past (more recent versions), but I am perplexed by the configuration and the way ACS was configured. I looked at some logs, and realized that none of the information was being replicated to the secondary ACS machine for the past few years. I found this out when I tried to log into a router that had specified the secondary ACS first in the config, and I wasn't allowed to login, since my account ID was not on the secondary box. For the most part, all information in the 2 machines are the same, with the exception of my newly created user account. I figured I would set the replication up properly, and force replication, but nothign happened. The logs state that replication was completed successfully, but the 2 Cisco Databases are not the same. I then went into "Network Configuration", and there was a Distribution Table Entry, with only the primary ACS name present. Anyhow, I changed that to include both the primary and secondary ACS names, and upon doing this, I was able to get authenticated to the router, but this is because the secondary server is proxying my request to the primary box, at which point I can be verified in the database. Now, my main questions are, how can I replicate my information over to the secondary box (does this mean altering the Distribution Table entries again)? My network doesn't have 10 ACS servers where I would need to proxy user information, like it is now, but I have always set it up as a primary and a secondary, and am a little confused on how to handle this. Any help wuold be appreciated!
Thanks,
Matt

Hello,
Replication can be tricky, especially on the older versions of ACS. I just now verified that on all verions of ACS through 3.1 (including 2.6 and starting even before 2.4), replication can only take place between two ACS servers of the EXACT same rev, patches and all. I hope that is not your problem; for example per Cisco TAC to replicate between 2.4 and 2.6, you have to start out by replicating between two boxes at 2.4 and then upgrade one to 2.6. And as I recall, even when you try to replicate between two different versions, the logs can state that it was successful when it really wasn't. Believe me, replicating between two revs will not work, no matter how creative you get.
If both servers are the same rev of ACS, then verify the settings on both boxes at the System Configuration --> CiscoSecure Database Replication page. You may have already done this, and if so let me know...
Primary server:
Replication Components - the appropriate items should be checked for "send"
Partners - the secondary server should be listed under "Replication"
Secondary server:
Replication Components - the appropriate items should be checked for "receive"
Note: be careful if you plan to receive the Distribution Table, can result in circular proxying
Partners - the primary server should be listed under "Replication"
Inbound Replication - primary server or "any known" should be selected.
Let me know how that works out. Good luck!

No tables listed when using a proxy connection in SQL Developer

Hello, I'm trying to use a connection in SQL developer that uses the proxy connection to connect to another users tables. In the SQL worksheet area I can access the other users tables with no problems. And using SELECT COUNT(*) FROM USER_TABLES i get the count of the number to tables. But on the tables view on the left hand side of SQL developer no tables are listed. So the question is why do I not see any tables under the tables view? Is this a bug or is it working by design? Thanks

To access other user's objects, use the Other Users node...
K.

Sites keep asking for username and password and say "restricted". I've tried numerous fixes and am not using a proxy.

Hi,
I wonder if someone could help me please.
I have an issue that extends across my browsers – Firefox and Internet Explorer (Firefox is default) and both are the latest version possible. My machine is fully patched (Win7 Pro x64 SP2).
The issue is as shown below:
'The site xxxx is requesting a user name and password. The site says: "restricted"’
The happens for some (not all) sites and I have to click “cancel” twice to remove the dialogue box, and then the site appears and works normally for a little while. The box will come up again if I attempt to click any links within the same site. It’s incredibly annoying and has been frustrating me for the past month. Here’s what I have tried so far, but hasn’t resolved the issue: 
 
• Clearing Firefox cache/history manually (set to never remember anything) 
• Tried checking/unchecking private browsing 
• Made sure “accept 3rd party cookies” is enabled 
• Tried all checkboxes for “no proxy”, “use system proxy” and “auto detect system proxy” etc 
• Disabled all add-ons/extensions within Firefox and retried 
• Performed the option to “Reset Firefox” to its default state from within “Troubleshooting” 
• Completely uninstalled and re-installed Firefox (latest version) 
• Went to the URL "about:config" and searched for the key "network.websocket.enabled" and switched it to "false". 
• Went to the URL "about:config" and searched for the key "network.proxy.share_proxy_settings" and switched it to "false". 
• Went to the URL "about:config" and searched for the key "network.automatic-ntlm-auth.allow-proxies" and switched it to "false". 
• Run a full AV scan in safe mode (with latest definition files) using Avira Antivirus, Spybot Search & Destroy, MalwareBytes, Super Antispyware and performed full optimisations via Registry Mechanic, Tune-up Utilities 2013 and CC Cleaner (with CC Extender installed). No threats found. 
None of the above has helped. The problem is only recent so I’m not entirely sure what’s changed.
Does anyone have any ideas or suggestions? I seem to have exhausted my ability to diagnose the fault via the god of Google 
Regards
Malachor

It is always best to avoid using such external cleaners as you can never be sure if they aren't corrupting files and it is usually not worth the trouble to repair damage if that is the case. A lot of the SQLite database files use a complicated table setup that can easily get corrupted.

Outbound interface using ABAP Proxy

Hi Guys,
I am trying to create an interface between a Z table and XI using ABAP Proxy. I suggested file based interface, but client is insisting using ABAP proxy. Z table is in IS-Retail side.
I will appreciate is somebody can share a program to do this.
Any advise/guidance is appreciated.
Thanks,

Hi There
From your subject line i can see that you want to develop an outbound proxy which means you want to send data to XI from your SAP custom table. That means you need to extract all the information from your Z-table and send it to XI via proxy.
If my understanding is correct then what you need to do is :
1.Ask your XI team team to generate a message interface for you of type 'outbound' and include the structure in the way they want you to send data to them.
2.Once the message interface is created by them , you can generate the same in transaction SPROXY . Search for your interface namespace and then right click
on it and say 'CREATE' . Give the appropriate package and prefix to it.Generate the proxy, save and activate
3. Now you can create a report and then according to the structure generated by XI , you can popluate your internal table to be passed back.
4. Call the method of the proxy in your report and send the data to XI.
I can give you an example of how to do this:
suppose you have built up an internal table by extracting data from your Z-table .Lets say it is tbl_output.
In your report you need to trigger the proxy method as follows:
Note: i am assuming i am triggering an asynchronous proxy method from my report:
DATA:lo_senddata TYPE REF TO CL_DATA_OUT,
 lo_system_fault TYPE REF TO cx_ai_system_fault,
 lo_root TYPE REF TO cx_root.
ls_output-output_file-data[] = tbl_data[].
CREATE OBJECT lo_senddata
TRY.
* call the asynchronous method of the proxy and send the data
 CALL METHOD lo_senddata->execute_asynchronous
 EXPORTING
 output = ls_output.
* get the system exceptions and display the error text
 CATCH cx_ai_system_fault INTO lo_system_fault.
 WRITE:/ 'System Error:'(E01),
 lo_system_fault->errortext.
 RETURN.
* get the root exception and display the textid value
 CATCH cx_root INTO lo_root.
 WRITE:/ 'System Error:'(E01),
 lo_root->textid.
 RETURN.
 ENDTRY.
COMMIT WORK.
Note: 1. CL_DATA_OUT is the message interface class.
 2. ls_output is the output structure to be sent back to XI and data
 is an internal table with the same structure as tbl_data.
 3. It is very imp to catch exceptions as i have shown u above.
Please let me know if you are a little clear or you need some more clarifications on this.
cheers
shivika

Is is possible to join Invoice Distribution tables to GL or SLA ?

Hi,
We want to get the Sub Ledger (AP) Distribution Information and GL Details in one query. Is it possible to join GL/SLA Tables to AP Distribution Tables without using XLA_DISTRIBUTION_LINKS Table?.
Thanks,
Sunny

Hi Vamsi,
We are trying to populate all these following fields into one staging table.
AP_INVOICE_DISTRIBUTIONS_ALL.EXEPENDITURE_TYPE
AP_INVOICES_ALL.INVOICE_NUM
AP_INVOICE_DISTRIBUTIONS_ALL.PROJECT_ID
AP_INVOICE_DISTRIBUTIONS_ALL.TASK_ID
JE_HEADER_ID
ACCOUNTED_DR
ACCOUNTED_CR
GL_SL_LINK_ID
CODE_COMBINATION_ID.
Requirement is that SUM(ACCOUNTED_DR) and SUM(ACCOUNTED_CR) in the staging table for any particular JE_HEADER_ID should match with the JE HEADER AMOUNT.
This is an GL Outbound Interface and we are picking the posted journals for AP Subledger and Sending the Subledger Information along with the GL Information.
Can you please help me with this?
THanks,
Sunny

To Use Cursor or TYPE table Index by PLS_integer

Hi All,
Let's see if I have table with no. of records 19,26,20,000.
If I want to loop through all the records which will be a optimized way To Use Cursor or TYPE table Index by PLS_integer.
Please guide.
Thanks.

What is it you want to do to/with the rows you're looping through?
Ideally you want to avoid looping, as that's row by row (aka slow by slow) processing and it's expensive time-wise.
If you're doing DML (insert/update/delete) then you're best off doing it in one sql statement, rather than looping.

How do I get firefox to keep my option of not using a proxy in settings

Every time I change the proxy from auto-detect to use system proxy it does not stay once firefox is closed

If you do not keep changes after a restart or otherwise have problems with preferences, see:
*http://kb.mozillazine.org/Preferences_not_saved

I am using a work laptop and have the same problem. When I try to change the "configure proxy", they only available option is "use this proxy server for all protocols". Could it be that my system administrator blocked me from changing it since they don'

I am using a work laptop and have the same problem. When I try to change the "configure proxy", they only available option is "use this proxy server for all protocols". Could it be that my system administrator blocked me from changing it since they don't want us to use Firefox.
== User Agent ==
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.4; FNGP_SYS)

Start Firefox in [[Safe Mode]] to check if one of your add-ons is causing your problem (switch to the DEFAULT theme: Tools > Add-ons > Themes).
See [[Troubleshooting extensions and themes]] and [[Troubleshooting plugins]]
If it does work in Safe-mode then disable all your extensions and then try to find which is causing it by enabling one at a time until the problem reappears.
You can use "Disable all add-ons" on the ''Safe mode'' start window.
You have to close and restart Firefox after each change via "File > Exit" (on Mac: "Firefox > Quit")

To save time, could I get away with just using ProRes Proxy?

Might be a dumb question. But please play along with me...
I've been battling with FCP-X since it first came out. Beach balls, crashes, failed auto saves, you name it. Sluggishness is my middle name. But I think it might be because I'm trying to force too much quality through my older, less powerful machines and my little firewire 400 hard drive. All three of my Mac are 3-4 years old, all are from the old "Core 2 Duo" era (not quad core processors), and are all maxed out at 4GB of RAM. While I've read that many people are having performance problems with FCP-X even on brand spankin' new suped-up Mac Pros with lots more horsepower than I'm running, I've long thought that my machines and their lack of power by today's standards may be at the heart of my sluggishness problem, especially given that most of the material I work with is shot in 1080 HD. (I've never actually tested it in FCP-X, but I'm assuming that things would speed along more like I've been used to in the past if I would just do everything in Standard Definition 480, but that ain't gonna happen.)
Like many, I shoot most everything in 1080 HD (usually 24p, sometimes 30), unless I'm occasionally shooting 720 HD at 60i for later slowing down to slo-mo.
Here's my question: Most everything I edit is for web delivery, and 99 percent of it is for my own use (not clients). Mostly podcast-like stuff, although occasionally I'll create something for my business website. Most of what I do is talking head type stuff, not a lot of motion (except for the 720/60i slo-mo stuff, which usually has some motion, which is why I shoot it at 60i for slowing down). Most of what I shoot is green screen talking heads, intended to be keyed in front of some innocuous background like some of the generators in FCP-X. I want it to look good. Even great. But given the limitations of power on my machines, I also don't want to invest an eternity in rendering and processing time. The work I'm doing with video just isn't that important. It's mostly for grins.
Until last night, I had been working exclusively in ProRes422 (aka "Optimized"). But last night I shot some footage and imported it into FCP-X, encoding it ONLY in ProRes Proxy. And frankly, I couldn't discern any difference. It looked every bit as good as the 422 stuff I'd shot before. There was absolutely no difference to my naked eye. That said, the footage I shot last night to test this out was not shot in front of the green screen (I'll test that out today or tonight), so maybe the Proxy footage won't key as well. (I've been stunned at how good the keyer is in FCP-X, but up to this point I've only been keying ProRes422 footage, not Proxy.) But really, based on just eyeballing the footage, I couldn't tell the difference between the Proxy footage and all the other footage I'd shot previously that had been imported and converted to "Optimized" ProRes422.
I'm not looking to deliver anything for broadcast television (if I were, I'd for sure use 422). I'm not doing any feature film type stuff. My video work consists mainly of stuff just for me, for my own personal amusement (and for the amusement of anyone who might watch it on the web). It's intended for YouTube, Vimeo, or occasionally (in smaller dimensions than 1920x1080) for deployment on my company website. Mostly, it's just me doing podcast-type stuff. Occasionally I'll shoot and edit something for church, or for friends. I like to think the production values of my stuff tend to be higher than, say, the footage Aunt Delores shot at Uncle Ralph's birthday party (okay, A LOT higher than that!). But my stuff isn't going to air on "Good Morning Flatbush" either (unless, on the off chance it should happen to go viral).
So let me make my question as clear as possible: Could I not get away with just using ProRes Proxy throughout my entire work flow, end to end, never switching over to ProRes 422 even when exporting? Honestly, it has taken hours just to render the keyed green screen footage on a 15 minute video, and just the other night, it took the better part of 4 hours (after it was already rendered) to export a 15 minute ProRes422 sequence to YouTube (and then the darn thing timed out, essentially wasting all my time). I'd rather just stay in Proxy the whole way through if doing so would streamline my workflow without compromising too much quality in the "look" of the video. Based on my very limited use of Proxy (just testing it out last night for the first time), I couldn't tell the difference. Maybe for web deployment, Proxy is all I really need.
Have any of you just stayed in Proxy the whole way through, never switching to 422 even when exporting? Might this be an acceptable work flow for some of us, especially those of us on older, less powerful machines? Is this a viable solution? Do any of you work this way? What's your level of satisfaction?
Thoughts?

A lot of what I'm shooting is being shot on a Canon XA-10. Some (and certainly all of the 720 footage, but some of the 1080) is shot on a 7D. And still more is shot on either an iPhone 4S, or even on a Flip Ultra (720p, 30fps).
Most is shot on the XA-10.
What I'm trying to avoid is the excessive render times (doesn't the ProRes 422 footage have to render as well?), and the ridiculously long times it takes to export. Would all that not be reduced significantly by sticking to Proxy the whole way? And what would the trade-off be? I mean, I honestly can't see any discernible difference. Maybe I will when I try to pull a decent key. (Haven't gotten that far yet in my Proxy experimentation.)
Of course, editing in Proxy and outputting using 422 requires that FCP-X encode to BOTH when importing, right? Doesn't that add yet another bit of time to the overall process?
I'm trying to streamline, and to reduce the overall amount of time I'm spending doing this stuff.

How to use non-default Alias Table in Analyzer report

Hi,I defined many alias tables in Essbase. I would like to use a different alias table other than the "default" in Analyzer 6.5 report. In the on-line help, it said I can modify in "database connection properties" when first defining a new report to use a specific alias table. It tells me to do the following: Click the "New" toolbar button. Select a Display Type or Layout, and click OK. Right-click a database connection name in the "Select Database Connections" dialog box, and select Modify from the right-click menu.So I did this, but as I did the last-right click, there is no "Modify" option available. Only has "Add New..", "Database Connection Properties.." However, if I defined a new personal database connection using the login user, I can select to use other alias table. But this will go to personal database connection properties.Is it possible to specifically tell Analyzer to use other alias the global level in database connection? What I use to do is to have certain reports to use the default alias, and another to use another alias table. These reports should be able to share across all users.Sam

In deed it is fix in the GA.Another way to set the alias table is to do it in the Admin client. If you add a connexion to a user there is a new 6.5 button "set alias" that allow you to set the default alias table for this specific user. But, it does not exit on a user group level.

Use of client dependent tables

Hi Gurus,
I have read many threads on difference between client dependent and independent data/objects etc.
But, someone tell me please, wheat exactly the 'Use or Advantage' of client dependent tables/data.
Thanks in advance.
V

HI,
The use of client dependent tables is that if data in one table of a particular client is updated then that data wont be seen in any other clent it provides a security to the data we retrict users with their authorizations in differen clients
When you log on to an SAP System, you log on to a particular client of this system. Any activities you carry out in the system are always carried out in one client. When you plan your SAP system landscape, you must consider which clients you need for which activities.
By assigning activities to be performed in a client, you give each client a particular role. This section describes the most important client roles.
Since you need to adapt the SAP software for your own business needs, each SAP system landscape requires a client where Customizing settings, and possibly ABAP Workbench developments, can be made. This client is known as the Customizing and development client, or Customizing client for short. The abbreviation CUST is used for this client.
Before you can use the Customizing settings and Workbench developments productively, you need to test them extensively for errors. Any faulty settings can seriously disrupt productive operations, and at worst, lead to the loss of productive data. The integrated nature of the various SAP applications means that there are many dependencies between the different Customizing settings. Even an experienced Customizing developer may not discover these dependencies immediately. The correctness of the settings can only be guaranteed with extensive testing. The client where these tests are made is the Quality Assurance Client, QTST for short.
A separate client is required for productive use of the SAP System. So that this client can be used without disruption, it is essential that no Customizing settings or Workbench developments are made here, and also that no tests are carried out. This client is known as the Production Client, PROD for short.
These three clients, CUST, QTST and PROD, are the central clients that exist in every system landscape. Standard system landscapes have precisely one client for each of these client roles.
We recommend that you make all your Customizing settings in a single Customizing client, and then use the CTS to transport them to the other clients.
We also recommend that you do not make any Customizing settings or Workbench developments in the quality assurance or production clients. You can make sure of this by making appropriate client settings.
In addition to the central clients, you can also set up other clients for other tasks. However, you must remember that each extra client takes up additional system resources (main memory and database space). They also need to be administrated. For example, you need to set up and administrate access authorization for the users, and also distribute any changes to other clients with the CTS. You must weigh up the advantages and disadvantages of setting up other clients.
Examples of other client roles are:
Development test client (TEST): Developers can use this client to test their Customizing settings and Workbench developments, before they release their change requests. In this client the developers can create test application data for realistic tests. If they discover errors, they can remove them in the Customizing client. A development test client is always set up in the same SAP System as the Customizing client. This means that any changes that are made to cross-client data in the Customizing client are also immediately visible in the development test client. Changes to client-specific data are copied from the Customizing client to the development test client using a special client copy function. The client copy function uses the unreleased change requests from the Customizing client to do this. The development test client is set so that you cannot make changes to Customizing data and Repository objects.
Prototype or sandbox client (SAND): You can use this client to test any client-specific Customizing settings if you are not sure whether you want to use them in this form. Any settings that you want to keep are then entered in the Customizing client. To prevent conflicts between the prototype client settings and real settings in the Customizing client, you cannot make changes to cross-client Customizing data and Repository objects in the prototype client. The CTS does not record changes made to client-specific Customizing data, and does not transport them from the prototype client. You can make sure of this by making appropriate client settings.
Training client (TRNG): To prepare end users for new functions that are to be transported into the production client, you can set up a training client. The users can use the new functions in this client with specially created application data. This client is set so that you cannot make changes to Customizing data and Repository objects.'''
plzz reward if this information is usefull to u plaa dont forget to reward

Use of proxy distribution table in ACS v4.0

Similar Messages

Maybe you are looking for