Welcome to SteelConnect 2.14.2

The following is an overview of the changes in this release.

New Features in 2.14.1

Multiple SNMP receivers.

SteelConnect CX can now configure up to three SNMP receivers.

Improved NetFlow export performance on SDI-2030 gateways.

Improved the performance of SDI-2030 gateways when exporting NetFlow data under heavy traffic conditions.

New Features in 2.14.0

Support for Zscaler Active-Active tunnels

Added the ability to configure a set of Active-Active Zscaler tunnels, essentially doubling their Zscaler bandwidth. This feature is only supported on WRT-based gateways: SDI-vGW, SDI-130, SDI-330, and SDI-1030.

Improved performance for SDI-2030

The overall throughput and performance of SDI-2030 appliances is improved in the SteelConnect 2.14.0 release. Please contact your account team if you require more details.

Improved Zscaler/Cloudi-Fi integration

SCM automatically updates its Zscaler and Cloudi-Fi ZEN data centers list every 24 hours. When a specific location gets decommissioned, SCM initiates a refresh of the gateways that used it. No SCM UI changes or code changes in the appliances are required.

WAN Uplink failover on a single box: improved path-selection time to an alternate link

Allows configuring a more aggressive check interval for the uplinks. In case of network unreachability via the uplink, this feature enables a quicker failover to another uplink on the same box.

Minor Improvements and Bugfixes

2.14.2

• SCON-38232 -

  Symptom: The Zscaler resource name is displayed incorrectly.

  Condition: This issue occurs when the Zscaler resource name is exceeding the 127 character limit.

• SCON-38212 -

  Symptom: Upgraded the log4j version used in SteelConnect CX to 2.17.1.

  Condition: This is a security fix added in the 2.14.2 release to address the log4j vulnerability CVE-2021-44228.

• SCON-38201 -

  Symptom: The firewall selection on SCM's Zscaler API is customized starting with the 2.14.2 release.

  Condition: This is an improvement in the 2.14.2 release.

• SCON-38198 -

  Symptom: Traffic routing from the Regional Hub to the Spoke is blocked.

  Condition: This issue occurs when the Regional Hub and Alternate Hub are connected through both MPLS and internet uplinks, and the Regional Hub and Spoke are connected through only the internet uplink.

• SCON-38188 -

  Symptom: Zscaler tunnels go offline.

  Condition: This issue occurs when the corresponding uplink's AutoVPN priority is set to "Don't Use AutoVPN".

• SCON-38174 -

  Symptom: Tunnels go down on the SDI-1030, which disrupts traffic.

  Condition: This issue occurs if encrypting/decrypting of a packet fails.

• SCON-38168 -

  Symptom: The uptime for uplinks does not have a value in SCM.

  Condition: This issue occurs when the state of a tunnel remains unchanged for several days.

• SCON-38163 -

  Symptom: An uplink cannot be deleted in 2.14.1 release.

  Condition: This issue occurs when the uplink is the last one in the WAN.

• SCON-38161 -

  Symptom: The overlay routes from the backup appliance are not present in the primary appliance and vice versa.

  Condition: This issue is seen with SDI-2030 asymmetric HA configuration.

• SCON-38158 -

  Symptom: Latency and slowness occurs.

  Condition: This issue occurs when traffic is running with 48K DNS cache entries.

• SCON-38155 -

  Symptom: An appliance which was deleted from the organization is still appearing in the Licensing tab of SCM.

  Condition: The issue occurs after deleting the appliance from the organization.

• SCON-38152 -

  Symptom: Traffic is blocked and the appliance might reboot.

  Condition: This issue can occur when DMA stalls on the network interface and triggers a Netdev watchdog timeout.

• SCON-38151 -

  Symptom: A permanent DNS alias does not work in 2.14.1 release.

  Condition: This issue occurs in 2.14.1 release.

• SCON-38137 -

  Symptom: The tunnels go down.

  Condition: The curl request fails for the reflector service due to missing OVS flow rules for br1.

• SCON-38135 -

  Symptom: NX appliances lose connectivity or have high latency.

  Condition: This issue occurs when packets with TTL=1 are dropped with "Skip TTL" messages.

• SCON-38130 -

  Symptom: The SCM UI freezes when a user navigates to the Registered Devices page.

  Condition: This issue occurs intermittently.

• SCON-38126 -

  Symptom: Tunnels are declared down and blocking all the traffic.

  Condition: This issue can occur when tunnel ICMP probes to a tunnel endpoint fail or time out.

• SCON-38118 -

  Symptom: Tunnels between SDI-2030 and SDI-1030 flap every 4 hours.

  Condition: This issue is seen during high traffic in the rekeying intervals.

• SCON-38113 -

  Symptom: BGP sessions are flapping due to SCM service being restarted. Recovery is automatic.

  Condition: The system is up for ~1 week and runs out of memory.

• SCON-38106 -

  Symptom: After power outage, all traffic is blocked or dropped.

  Condition: This issue can occur during an ipset restore, where the given ipset or member ipset does not exist, causing incomplete ipsets and iptables.

• SCON-38092 -

  Symptom: Traffic reaches the LAN interface of the appliance but does not go out of the WAN interface, and the traffic is blocked.

  Condition: This issue occurs on bidirectional UDP traffic flow with the same source and destination port over an AutoVPN tunnel.

• SCON-38089 -

  Symptom: The conntrackd daemon process is continuously leaking memory, and the system may become unresponsive.

  Condition: This issue occurs when conntrackd process is using more than 50 MB of memory.

• SCON-38074 -

  Symptom: A memory leak in rum_manager causes network disruption at least once a day.

  Condition: This issue occurs when a /16 network on the LAN zone is also running a scanner service on Riverbed VPN tunnels.

• SCON-38009 -

  Symptom: Deployment of virtual SteelHead instance in Azure fails.

  Condition: The deployment fails for SteelHead in Azure through SCM because it uses an unmanaged disk.

• SCON-37975 -

  Symptom: The SDI gateway changes the configuration to "None."

  Condition: This issue occurs when adding an SNMP receiver with an empty community string.

• SCON-37966 -

  Symptom: Power supply information is missing in the statistics sent to the SCM.

  Condition: This issue occurs when the appliance keeps probing for PSU information and the I2c bus hangs up.

• SCON-37936 -

  Symptom: The SCM uplink status changes from online to unknown for all uplinks.

  Condition: This issue occurs when there are many flows and not all uplinks are updated within 180 seconds. With this fix, we have increased the timeout from 180 seconds to 480 seconds.

• SCON-37010 -

  Symptom: Zscaler tunnels at a few sites went down.

  Condition: This issue occurred after upgrading SCM to 2.13.1.

2.14.1

• SCON-38021 -

  Symptom: PMTU does not work for third-party zones.

  Condition: Traffic from third-party zones has the DF flag set and MTU > tunnel.

• SCON-37840 -

  Symptom: On SteelHead SD 2.0 appliances, tunnel or uplink flaps occur under high CPS load.

  Condition: The high CPS traffic causes the Deep Packet Inspection library to use more memory than allocated, resulting in the data plane restarting.

• SCON-37657 -

  Symptom: On SDI gateways, HA failover can take 5 minutes or longer in very rare circumstances.

  Condition: The issue can occur during failover in a SDI gateway's HA setup with uplinks on which DNS resolution does not work. The condition is rarely met, but when it is present, the issue occurs at every failover.

• SCON-37532 -

  Symptom: A flow gets stuck to a suboptimal path (MPLS/RouteVPN/Underlay).

  Condition: In a rare case, a long running flow gets pinned to a tunnel/path and doesn't honor path selection rules.

• SCON-37529 -

  Symptom: On SDI gateways, system logging can stop. If the condition persists, the appliance will disconnect from SCM and eventually become unresponsive.

  Condition: This issue occurs when there is logging at a high rate.

• SCON-37502 -

  Symptom: The system time is shown incorrectly on the SteelConnect SDI-1030 gateway.

  Condition: This issue occurs on SDI-1030 gateways located in Sao Paulo, Campo Grande, and Cuiaba time zones.

• SCON-37498 -

  Symptom: Users cannot download files or browse the internet in HA setup because the backup node repeatedly resets the connections.

  Condition: Version 2.14.0 changes for improved performance on the SteelConnect SDI-2030 gateway introduced a bug on all SteelHead SD platforms where the gateway might send packets on wrong tunnels, reset TCP connections, or send packets meant to be tunneled as naked. This issue is specific to HA deployments

• SCON-37486 -

  Symptom: Appliances in an organization go offline and become unusable.

  Condition: This issue occurs when creating a custom application with more than 10,000 hostnames and adding it to a firewall rule to block traffic.

• SCON-37463 -

  Symptom: Possible reduced performance occurs when more than 20 tunnels undergo rekey simultaneously.

  Condition: When tunnels are rekeyed, the data plane has to be paused to update the keys. This patch makes the rekey process gradual, thus reducing impact on data plane performance.

• SCON-37426 -

  Symptom: One of the Zscaler tunnels is down on the 770-SD appliance as port 4500 packets are getting dropped on SVM after segfault in service_core.

  Condition: This issue occurs when packets with missing source or destination metadata are tested for local site ID by accessing the source/destination metadata without prior NULL check causing seg fault.

• SCON-37388 -

  Symptom: The appliance reboots.

  Condition: This issue occurs when packets larger than 1490 bytes are sent through the tunnel on top of an LTE uplink.

• SCON-37371 -

  Symptom: The backup gateway in an HA pair is randomly shown as being offline in SCM.

  Condition: The backup appliance reports the wrong state to SCM.

• SCON-37350 -

  Symptom: Increased latency and potential tunnel flaps on the SDI-2030 gateways.

  Condition: NetFlow exporting is enabled under heavy traffic.

• SCON-37317 -

  Symptom: GRE tunnel traffic stops flowing.

  Condition: This issue occurs when the uplink is reconfigured or is down for a long time.

   

• SCON-37206 -

  Symptom: On SDI gateways, flows are sometimes not being routed according to traffic path rules based on application classification.

  Condition: This issue occurs when traffic path rules based on application classification are configured on SDI gateways and network latency is high.

• SCON-37202 -

  Symptom: A traffic rule using a device, device group, or zone without selecting the respective device, device group, or zone is ignored.

  Condition: This is a persistent, known issue. 

• SCON-37148 -

  Symptom: Erroneous Zscaler tunnel offline/online messages occur in the Event Log while the tunnel has traffic in both directions.

  Condition: This problem is seen with 570-SD appliances associated with sluggish response for affected uplinks. High-load conditions may increase the likelihood of this issue being seen.

• SCON-37101 -

  Symptom: The secondary IP address on a WAN interface is used for outbound traffic source IP.

  Condition: This issue occurs when configuring multiple custom static WAN IPs for Inbound NAT Rules. Any subsequent change in L3 configuration parameters might trigger the issue.
   

• SCON-37016 -

  Symptom: The SDI-2030 (NX) gateway incorrectly sends the DSCP hex value, not the TOS hex value, for a flow towards the flow collector.

  Condition: This issue occurs consistently.

• SCON-36979 -

  Symptom: The primary ZEN goes down.

  Condition: The issue occurs after interchanging the primary and secondary ZENs.

• SCON-36448 -

  Symptom: Some sites lose data center connectivity.

  Condition: This issue occurs after upgrading SCM to 2.12.3.

• SCON-36316 -

  Symptom: The Tunnel Status and Path Quality tabs show blank Throughput statistics and Path Quality statistics.

  Condition: SDI gateways send negative throughput statistics when 32-bit counters overflow.

• SCON-35857 -

  Symptom: CPU utilization reported in SCM remains at 100% regardless of actual CPU utilization.

  Condition: This issue occurs in the following appliances with an uptime of at least 248 days:

  • SDI-130
  • SDI-330
  • S12/24/48
  • AP3/5/5r
• SCON-30423 -

  Symptom: Latency spikes are observed every 60 seconds.

  Condition: The garbage collection logic runs every 60 seconds. On an appliance with a large number of flows, this process ends up causing a latency spike in the data plane.

• SCON-29836 -

  Symptom: During power up or reboot, an SDI-130 or SDI-330 gateway can occasionally reboot multiple times in quick succession.

  Condition: SDI-130 and SDI-330 gateways can sometimes fail to detect the on-board switch during boot. When this occurs, the gateway will reboot immediately and attempt to reconnect to the on-board switch during the next boot.

• SCON-29319 -

  Symptom: Traffic towards non-management LAN-side networks is routed to the wrong zone if it matches a remote overlay network.

  Condition: This issue occurs when a LAN-side network overlaps with a remote overlay network.

2.14.0

• SCON-37299 -

  Symptom:  When SCM organization migration is triggered, the order of CVM flow rule creation and deletion is incorrect.

  Condition: This issue occurs when both SCMs are running with the same IP address or shared host organization.

• SCON-37183 -

  Symptom: The SteelConnect SDI gateway can block outbound traffic from the LAN-side OSPF networks.

  Condition: When the configuration update takes more than 1 minute, the LAN-side OSPF networks might not be properly updated.

• SCON-37051 -

  Symptom: AS-path prepending only applies to the CONNECTED routes.

  Condition: This issue occurs after upgrading to release 2.13.1. 

• SCON-37050 -

  Symptom: With "Manage all sites: Off" in the Role assignments, only a single record is displayed on the DHCP Lease page instead of a full client list.

  Condition: This issue occurs when a user without "Manage all sites" rights tries to view the DHCP Lease client list.

• SCON-36516 -

  Symptom: The remote syslog server stops receiving syslog messages from the SDI gateway.

  Condition: Infrequent log messages can cause TCP session closure by upstream stateful firewalls.

• SCON-36474 -

  Symptom: Names in the Organizations menu do not display in alphabetical order.

  Condition: This issue occurs after upgrading to version 2.12.3.

• SCON-36297 -

  Symptom: Occasionally, a tunnel can be reported down, then back up again, with no change in the underlying network connectivity.

  Condition: The issue occurs during the rekey of a tunnel that is traversing a port-NAT. When the new key is installed, the destination port is reset to its default value. It only reverts to the NAT value when a packet arrives from the remote end. Therefore, outbound packets will be lost until a remote packet arrives, which may trigger a loss of connectivity.

  With the fix, the destination port is not reset during a rekey, so there is no disruption to outbound traffic.

• SCON-36046 -

  Symptom: A network outage occurs at all sites after upgrading to version 2.12.2.

  Condition: This issue occurs after creating a custom application with a registered device configured with an invalid MAC address (00:00:00:00:00:00).

• SCON-34016 -

  Symptom: Health check reports temperature offset from a maximum limit rather than an absolute temperature.

  Condition: This issue is observed in SDI-2030, SDI-3070, and SDI-5030 gateways. 

• SCON-34002 - Symptom: Every zone gets a VLAN tag assigned. If this field is left empty, the system will pick a free VLAN ID from the unused VLAN ID pool.
  
  Condition: When a new zone is configured on SteelConnect Manager, the auto-assigned VLAN ID was unique across the organization. This issue has been fixed. The system will now pick a free VLAN ID from the site's unused VLAN ID pool and hence the auto-assigned VLAN ID is unique only within the site scope and not across the entire organization.
• SCON-33099 -

  Symptom: The Zscaler tunnel is reported as online even though the tunnel is actually offline.

  Condition: ICMP monitoring of Zscaler is enabled, and HTTP monitoring of Zscaler is disabled. The ZEN is reachable via ICMP, but the tunnel cannot be established. This issue can occur due to a credentials mismatch. To work around this issue, enable HTTP-based monitoring of Zscaler tunnels. Zscaler does not support detecting higher-level failures via ICMP only.

• SCON-32716 -

  Symptom: The tunnel probe traffic is missing from NetFlow data.

  Condition: This issue occurs when NetFlow is active.

• SCON-31564 -

  Symptom: The SCM UI shows the wrong management IP address for the SDI-S48 switch.

  Condition: This issue occurs when a default value is initialized inside the statistics of the appliance and never updated, which is then shown in the UI.

• SCON-30974 -

  Symptom: Classic VPN routing can fail for subnets that are also learned via BGP or OSPF on the underlay.

  Condition: If a route that matches a Classic VPN route is learned via BGP or OSPF, and that learned route is subsequently retracted, traffic does not revert to the Classic VPN as expected.

• SCON-30578 -

  Symptom: SCM connectivity is disrupted.

  Condition: This issue occurs when traffic on one SteelHead SD appliance or SDI-2030 gateway has to transit another SteelHead SD appliance or SDI-2030 gateway and NAT is disabled on the outgoing uplink of the appliance it is transiting.

• SCON-30518 -

  Symptom: On SteelHead SD 2.0 appliances and SDI-2030 gateways, Multicast HSRP (224.0.0.2) received on the WAN results in TTL expired on AUX.

  Condition: These appliances do not support HSRP, so receiving HSRP packets results in unnecessary ICMP TTL expired packets. Rather than create unnecessary packets for an unsupported protocols, the code has been changed to drop HSRP packets.

• SCON-30365 -

  Symptom: Routes are missing following upgrades or configuration changes.

  Condition: This issue occurs when zones or uplinks have been added or removed, or the management zone has been reassigned.

• SCON-29992 -

  Symptom: In an SDI-5030 cluster, the default internet uplink is not hidden in Network Design -> Uplinks.

  Condition: This issue occurs on a site with SteelConnect SDI-5030 gateways and additional appliances.

• SCON-29980 -

  Symptom: The following kernel warning message can occur in the SDI-130 and SDI-330 system logs: "WARNING: at drivers/net/phy/b53/b53_spi.c:120."

  Condition: This message is caused by the kernel attempting to read a nonexistent register in the on-board switch. There is no negative impact.

• SCON-29675 -

  Symptom: Unable to connect to an internal VPN server.

  Condition: This issue occurs when configuring NAT using a custom WAN IP. 

• SCON-27748 -

  Symptom: Some tunnels may not be displayed in the SCM dashboard tunnel details, even though the Health Check > Overlay Health page shows that the same tunnels are up and traffic is seen flowing over the tunnels.

  Condition: This issue occurs when viewing tunnel details between sites from the dashboard.

• SCON-27145 -

  Symptom: In the Health Check > Summary report, individual zones may show "need attention," but the Zone Health report shows the zones as healthy with green check marks.

  Condition: When gateway assignments within zones are deleted, the DHCP status is not reported to SCM. This results in the Zone Health report displaying a "need attention" state for these zones. The overall summary still shows healthy because the last reported zones health was healthy.

• SCON-27088 -

  Symptom: SteelConnect devices may forward traffic to incorrect VLANs or have a forwarding loop between the other virtual router.

  Condition: This issue occurs when employing zone HA on a segment that also has other VRRP device groups. The VRRP ID used by the SteelConnect devices is in conflict with the VRRP ID being used by the external devices.

• SCON-20965 -

  Symptom: SDI gateways reply to internet NTP requests.

  Condition: On SDI gateways, the NTP server is always on.

• SCON-19789 -

  Symptom: After HA failover, Zscaler tunnels cannot be reestablished until a new configuration is received from SCM.

  Condition: Zscaler is enabled, a pair of gateways in an HA configuration is used, and a failover has occurred.

Known Issues

• SCON-38239 - A missing route from LPM causes broken communication.

Detailed Description:

Symptom: Traffic cannot be forwarded from one site to another.

Condition: A missing route from LPM causes broken communication.

Suggested Workaround: None

• SCON-38216 - Low download speed occurs on the DSL uplink on the SDI-330 gateway.

Detailed Description:

Symptom: The SDI-330 experiences a very low download speed.

Condition: This issue occurs when a DSL uplink is used instead of a DHCP uplink.

Suggested Workaround: Use another type of uplink.

• SCON-38190 - The SDI-2030 HA gateway experiences high latency and slowness.

Detailed Description:

Symptom: The SDI-2030 HA gateway experiences high latency and slowness.

Condition: This issue occurs when the SDI-2030 HA gateway generates a large number of ICMP responses with the Link-Local IP address.

Suggested Workaround: Configure FW to honor fragmentation needed request.

• SCON-38128 - SDI appliances in HA get stuck in recovery mode and do not recover until factory reset.

Detailed Description:

Symptom: SDI appliances in HA get stuck in recovery mode.

Condition: This issue occurs when an interface associated to the internet uplink goes down.

Suggested Workaround: Factory reset the appliance.

• SCON-38111 - The SDI-2030 cluster goes offline when SCM traffic is backhauled to another SDI-2030 gateway.

Detailed Description:

Symptom: SCM connectivity is disrupted.

Condition: This issue occurs when traffic on one SteelHead SD appliance or SDI-2030 gateway needs to transit to another SteelHead SD appliance or SDI-2030 gateway.

Suggested Workaround: None.

• SCON-38032 - Tunnel probes are missing, causing the tunnel to go down.

Detailed Description:

Symptom: A tunnel may go offline.

Condition: This can occur if the routing path is wrong or the next hop is unreachable or the wrong keys are installed for the tunnel.

Suggested Workaround: None

• SCON-37987 - The zone subnet is not advertised to other gateways.

Detailed Description:

Symptom: The zone subnet is not advertised to other gateways.

Condition: This issue occurs in release 2.12.0.

Suggested Workaround: None

• SCON-37364 - The SDI-2030 gateway HA master node is sending traffic via overlay tunnel on the backup node's "DOWN" uplink causing traffic to get blackholed.

Detailed Description:

Symptom: The SDI-2030 gateway HA master node is sending traffic via overlay tunnel on the backup node's "DOWN" uplink causing traffic to get blackholed.

Condition: Uplink on the backup node is down but tunnels over that uplink is UP on the master node.

Suggested Workaround: None

• SCON-37305 - The SDI-5030 gateway experiences reduced or faulty performance in version 2.14.x.

Detailed Description:

Symptom: SDI-5030 gateway performance may be reduced compared to 2.13.x levels, and overlay tunnels may not come up after upgrade, requiring Riverbed assistance to reset the routing service on the SteelConnect Manager (SCM).

Condition: This issue occurs after upgrading the SDI-5030 gateway to version 2.14.x.

Suggested Workaround: Customers with SDI-5030 gateways in their realm should not upgrade to SteelConnect CX version 2.14.x without Support and Engineering review.

• SCON-36764 - Custom applications cannot match the flows against outbound and/or traffic path rules.

Detailed Description:

Symptom: Traffic/flows fail to match the outbound and/or traffic path rules of type custom app. 

Condition: This issue occurs in custom applications that are created with type "IPs/Ports" and have both hostnames and IPs in them.

Suggested Workaround: Create a separate custom application for hostnames and a separate custom application for IPs.

• SCON-36500 - SteelHead SD fails to optimize the TCP connections.

Detailed Description:

Symptom: Optimization is not working on SteelHead SD.

Condition: The inner channel is not established as ARP resolution for in-path gateway fails.

Suggested Workaround: Manually add the SteelHead in-path IP address in the ARP table of the RVM on both the primary and HA SteelConnect appliances.

• SCON-35373 - The TeamViewer application is not identified when used with some hostnames.

Detailed Description:

Symptom: The TeamViewer application is not identified when used with some hostnames like IT-MIL-ANX-R016.teamviewer.com.

Condition: Hostnames like IT-MIL-ANX-R016.teamviewer.com are used to access TeamViewer, but they are not currently present in the application identifier under the TeamViewer application. Therefore, traffic remains unknown and is blocked.

Suggested Workaround: Create a custom application with a URL such as IT-MIL-ANX-R016.teamviewer.com. After defining the custom application, you can use it in a rule.

• SCON-34506 - SCM traffic timeline statistics are inconsistent with the Top Talkers report on the SteelHead.

Detailed Description:

Symptom: SCM traffic timeline statistics are inconsistent with the Top Talkers report on the SteelHead.

Condition: This issue occurs when SCM is not able to process incoming flows in a timely manner. As a result, some flows are missing from the traffic timeline.

Suggested Workaround: None

• SCON-33902 - During HA failover, route flaps occur on the LAN router.

Detailed Description:

Symptom: During HA failover, routes on the LAN router momentarily flap and then recover.

Condition: This issue occurs in a SteelConnect HA appliance configuration where a backup node is configured with a lower router ID and the LAN routers are configured with the next-hop pointing to the backup node. If HA failover is triggered, the backup becomes the master. The routes in the LAN router flap momentarily even though there is no failure in the next-hop backup node.

Suggested Workaround: None

• SCON-16920 - SteelConnect Access Point 3 and Access Point 5 can occasionally lose link connectivity when directly connected to an SDI-1030 gateway.

Detailed Description:

Symptom: SteelConnect Access Point 3 and Access Point 5 can occasionally lose link connectivity when directly connected to an SDI-1030 gateway.

Condition: Access Point 3 and Access Point 5 directly cabled to an SDI-1030 gateway can occasionally lose link connectivity.

Suggested Workaround: Connect the AP-3 and/or AP-5 to the SDI-1030 Gateway via a switch.

To view the release notes for previous versions, please visit SteelConnect support and select the version of interest.

If you have questions regarding this update, please contact Riverbed Support for assistance.