topic Re: HA Lite Configuration A/P not working... in General Topics https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26604#M19418 <HTML><HEAD></HEAD><BODY><P>I run HA-Lite and I utilize the mgmt interface for the ha1 primary control link. No need to utilize a dp port.</P><P></P><P>high-availability {</P><P>&nbsp; group {</P><P>&nbsp;&nbsp;&nbsp; 1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; description ha-lite;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; peer-ip 172.16.20.254;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; configuration-synchronization {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled yes;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mode {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; active-passive;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; election-option {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device-priority 125;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-backup no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemptive no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; promotion-hold-time 2000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hello-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; flap-max 3;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemption-hold-time 1;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-fail-hold-up-time 0;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; additional-master-hold-up-time 500;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp; }</P><P>&nbsp; enabled yes;</P><P>&nbsp; interface {</P><P>&nbsp;&nbsp;&nbsp; ha1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; port management;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encryption {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-hold-time 3000;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; ha1-backup;</P><P>&nbsp; }</P><P>}</P><P>[edit]</P><P>admin@oliver(active)#</P><P></P><P></P><P>high-availability {</P><P>&nbsp; group {</P><P>&nbsp;&nbsp;&nbsp; 1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; description ha-lite;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; peer-ip 172.16.20.245;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; configuration-synchronization {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled yes;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mode {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; active-passive;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; election-option {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device-priority 100;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-backup no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemptive no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; promotion-hold-time 2000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hello-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; flap-max 3;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemption-hold-time 1;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-fail-hold-up-time 0;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; additional-master-hold-up-time 500;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp; }</P><P>&nbsp; enabled yes;</P><P>&nbsp; interface {</P><P>&nbsp;&nbsp;&nbsp; ha1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; port management;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encryption {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-hold-time 3000;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; ha1-backup;</P><P>&nbsp; }</P><P>}</P><P>[edit]</P><P>admin@renato(passive)#</P></BODY></HTML> Thu, 01 Nov 2012 15:42:12 GMT gswcowboy 2012-11-01T15:42:12Z HA Lite Configuration A/P not working... https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26603#M19417 <HTML><HEAD></HEAD><BODY><P>Hi All,</P><P></P><P>Trying to configure a pair of PA-200's as an active-passive cluster using "HA lite".&nbsp; Right now both devices are showing active, so it seems the nodes do not see each other as cluster members.&nbsp; I have defined one HA link on both firewalls, ethernet1/2...they are connected together via a cross-over cable and both interfaces are showing UP..&nbsp; I realize that state synchronization is not possible with one HA link, but just looking for config sync.&nbsp; When I do a "show high-availability state" from CLI, I get:</P><P></P><P>Peer Information:</P><P>&nbsp;&nbsp;&nbsp; Connection status: <STRONG>down</STRONG></P><P>&nbsp;&nbsp;&nbsp; Connection down reason: <STRONG>Never able to connect to peer</STRONG></P><P><STRONG><BR /></STRONG>I have tried to suspend the device with the worse priority...and then make it functional again (hoping it goes into passive state)..but it only goes right back to active.&nbsp; Note I am running 4.1.8 code here.</P><P></P><P>I have also found a doc that indicates the MGT port is used for HA1 with an HA-lite configuration.&nbsp; Is that true?&nbsp; If so, does that mean I don't need the cross-over on ethernet1/2?&nbsp; Note when I ping the peer HA1 IP address (from either firewall) I simply get back an ICMP "Destination host unreachable" ....&nbsp; I am sure this is a problem!</P><P></P><P>Below are my configs for this...perhaps I have something missing?&nbsp; Grateful if anyone with this knowledge and experience on HA lite would take a look for me....thanks in advance.</P><P></P><P><SPAN style="text-decoration: underline;"><STRONG>Node 1:</STRONG></SPAN></P><P></P><P>set deviceconfig high-availability group 1 mode active-passive passive-link-state auto</P><P>set deviceconfig high-availability group 1 mode active-passive monitor-fail-hold-down-time 1</P><P>set deviceconfig high-availability group 1 configuration-synchronization enabled yes</P><P>set deviceconfig high-availability group 1 peer-ip 192.168.201.2</P><P>set deviceconfig high-availability group 1 election-option device-priority 95</P><P>set deviceconfig high-availability group 1 election-option heartbeat-backup yes</P><P>set deviceconfig high-availability group 1 election-option preemptive no</P><P>set deviceconfig high-availability group 1 election-option promotion-hold-time 2000</P><P>set deviceconfig high-availability group 1 election-option hello-interval 8000</P><P>set deviceconfig high-availability group 1 election-option heartbeat-interval 1000</P><P>set deviceconfig high-availability group 1 election-option flap-max 3</P><P>set deviceconfig high-availability group 1 election-option preemption-hold-time 1</P><P>set deviceconfig high-availability group 1 election-option monitor-fail-hold-up-time 0</P><P>set deviceconfig high-availability group 1 election-option additional-master-hold-up-time 500</P><P>set deviceconfig high-availability interface ha1 encryption enabled no</P><P>set deviceconfig high-availability interface ha1 monitor-hold-time 3000</P><P>set deviceconfig high-availability interface ha1 ip-address 192.168.201.1</P><P>set deviceconfig high-availability interface ha1 netmask 255.255.255.0</P><P>set deviceconfig high-availability interface ha1 port ethernet1/2</P><P>set deviceconfig high-availability interface ha1-backup </P><P>set deviceconfig high-availability enabled yes</P><P></P><P><SPAN style="text-decoration: underline;"><STRONG>Node 2:</STRONG></SPAN></P><P></P><P>set deviceconfig high-availability group 1 peer-ip 192.168.201.1</P><P>set deviceconfig high-availability group 1 configuration-synchronization enabled yes</P><P>set deviceconfig high-availability group 1 mode active-passive passive-link-state auto</P><P>set deviceconfig high-availability group 1 mode active-passive monitor-fail-hold-down-time 1</P><P>set deviceconfig high-availability group 1 election-option device-priority 100</P><P>set deviceconfig high-availability group 1 election-option heartbeat-backup yes</P><P>set deviceconfig high-availability group 1 election-option preemptive no</P><P>set deviceconfig high-availability group 1 election-option promotion-hold-time 2000</P><P>set deviceconfig high-availability group 1 election-option hello-interval 8000</P><P>set deviceconfig high-availability group 1 election-option heartbeat-interval 1000</P><P>set deviceconfig high-availability group 1 election-option flap-max 3</P><P>set deviceconfig high-availability group 1 election-option preemption-hold-time 1</P><P>set deviceconfig high-availability group 1 election-option monitor-fail-hold-up-time 0</P><P>set deviceconfig high-availability group 1 election-option additional-master-hold-up-time 500</P><P>set deviceconfig high-availability enabled yes</P><P>set deviceconfig high-availability interface ha1 encryption enabled no</P><P>set deviceconfig high-availability interface ha1 monitor-hold-time 3000</P><P>set deviceconfig high-availability interface ha1 ip-address 192.168.201.2</P><P>set deviceconfig high-availability interface ha1 netmask 255.255.255.0</P><P>set deviceconfig high-availability interface ha1 port ethernet1/2</P><P>set deviceconfig high-availability interface ha1-backup </P><P>--</P><P></P><P>Thanks and regards,</P><P></P><P>- Dave</P></BODY></HTML> Thu, 01 Nov 2012 15:13:50 GMT https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26603#M19417 DJFirewallSupport 2012-11-01T15:13:50Z Re: HA Lite Configuration A/P not working... https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26604#M19418 <HTML><HEAD></HEAD><BODY><P>I run HA-Lite and I utilize the mgmt interface for the ha1 primary control link. No need to utilize a dp port.</P><P></P><P>high-availability {</P><P>&nbsp; group {</P><P>&nbsp;&nbsp;&nbsp; 1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; description ha-lite;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; peer-ip 172.16.20.254;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; configuration-synchronization {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled yes;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mode {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; active-passive;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; election-option {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device-priority 125;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-backup no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemptive no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; promotion-hold-time 2000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hello-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; flap-max 3;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemption-hold-time 1;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-fail-hold-up-time 0;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; additional-master-hold-up-time 500;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp; }</P><P>&nbsp; enabled yes;</P><P>&nbsp; interface {</P><P>&nbsp;&nbsp;&nbsp; ha1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; port management;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encryption {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-hold-time 3000;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; ha1-backup;</P><P>&nbsp; }</P><P>}</P><P>[edit]</P><P>admin@oliver(active)#</P><P></P><P></P><P>high-availability {</P><P>&nbsp; group {</P><P>&nbsp;&nbsp;&nbsp; 1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; description ha-lite;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; peer-ip 172.16.20.245;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; configuration-synchronization {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled yes;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mode {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; active-passive;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; election-option {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device-priority 100;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-backup no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemptive no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; promotion-hold-time 2000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; hello-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; heartbeat-interval 8000;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; flap-max 3;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; preemption-hold-time 1;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-fail-hold-up-time 0;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; additional-master-hold-up-time 500;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp; }</P><P>&nbsp; enabled yes;</P><P>&nbsp; interface {</P><P>&nbsp;&nbsp;&nbsp; ha1 {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; port management;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; encryption {</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled no;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; monitor-hold-time 3000;</P><P>&nbsp;&nbsp;&nbsp; }</P><P>&nbsp;&nbsp;&nbsp; ha1-backup;</P><P>&nbsp; }</P><P>}</P><P>[edit]</P><P>admin@renato(passive)#</P></BODY></HTML> Thu, 01 Nov 2012 15:42:12 GMT https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26604#M19418 gswcowboy 2012-11-01T15:42:12Z Re: HA Lite Configuration A/P not working... https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26605#M19419 <HTML><HEAD></HEAD><BODY><P>Thanks Renato, that is helpful.&nbsp; I have tried your configuration and it is working.</P><P></P><P>But are you saying that I <EM>can't</EM> utilize a dataplane interface for HA1 on the PA-200?&nbsp; Or just that I don't have to?&nbsp; Obviously it's nice to save the physical dataplane interfaces if I can as PA-200 only has 4 of them...But on the other hand, it would also be nice to have an HA1 primary and HA1 backup like I do for full HA configurations...for purposes of HA control link resiliency.&nbsp; Note the comment by "npare" to this document seems to indicate that you can use a dataplane interface for HA1 primary: <A __default_attr="2926" __jive_macro_name="document" class="jive_macro jive_macro_document" href="https://live.paloaltonetworks.com/"></A></P><P></P><P>But if I can only use the management interface for HA1, what happens when mgt interface of primary goes down....obviously a failover should happen there.&nbsp; But how will upstream/downstream gateways learn the MAC address of the new node?</P><P></P><P>Thanks for clarifying,</P><P></P><P>- Dave</P></BODY></HTML> Thu, 01 Nov 2012 20:58:08 GMT https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26605#M19419 DJFirewallSupport 2012-11-01T20:58:08Z Re: HA Lite Configuration A/P not working... https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26606#M19420 <HTML><HEAD></HEAD><BODY><P>Hi Dave,</P><P></P><P>I'd have to set that up utilizing the DP ports. Only reason I'm using the mgmt interface is I lack the available ports do so. Manual failover works like a charm but I suspect a non-manual failover will have no problems either. I just haven't seen it in my setup to date.</P><P></P><P><SPAN style="color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: 12px; background-color: #ffffff;">In A/P HA,&nbsp; the IPs are assigned to the L3 interfaces. These IPs will be replicated across both HA units.&nbsp; The IPs will carry virtual MACs.&nbsp; In the event of a failover, the passive unit will take over the IPs and issue gratutious ARP when it becomes active.</SPAN></P><P><SPAN style="color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: 12px; background-color: #ffffff;"><BR /></SPAN></P><P><SPAN style="color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: 12px; background-color: #ffffff;">On the L3 interfaces, the MAC address listed via the 'show interface all' command will have the following format:</SPAN></P><P><SPAN style="color: #000000; font-family: Arial, Helvetica, sans-serif; font-size: 12px; background-color: #ffffff;"><BR /></SPAN></P><P>virtual MAC is 00-1B-17:00: xx: yy where</P><P></P><P>00-1B-17: vendor ID (palo alto networks)</P><P>00: fixed</P><P>xx: HA group ID</P><P>yy: interface ID</P></BODY></HTML> Thu, 01 Nov 2012 22:17:02 GMT https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26606#M19420 gswcowboy 2012-11-01T22:17:02Z Re: HA Lite Configuration A/P not working... https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26607#M19421 <HTML><HEAD></HEAD><BODY><P>Thanks for the info - I will be having someone at the local site swap the crossover cable on the dataplane interface I configured for HA to see if it's the cable....&nbsp; and if not working I will just use the mgt interface per your config.</P><P></P><P>Thanks,</P><P></P><P>- Dave</P></BODY></HTML> Fri, 02 Nov 2012 13:56:55 GMT https://live.paloaltonetworks.com/t5/general-topics/ha-lite-configuration-a-p-not-working/m-p/26607#M19421 DJFirewallSupport 2012-11-02T13:56:55Z