CN101895559B - Method for passing through network and firewall for agency - Google Patents
Method for passing through network and firewall for agency Download PDFInfo
- Publication number
- CN101895559B CN101895559B CN 201010249039 CN201010249039A CN101895559B CN 101895559 B CN101895559 B CN 101895559B CN 201010249039 CN201010249039 CN 201010249039 CN 201010249039 A CN201010249039 A CN 201010249039A CN 101895559 B CN101895559 B CN 101895559B
- Authority
- CN
- China
- Prior art keywords
- host
- protocol
- agent
- agreement
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The embodiment of the invention discloses a method for passing through a network and a firewall for an agency, which comprises the following steps: receiving a packet of a server end or a client end; determining a transport protocol applied by the packet according to the packet; according to the transport protocol applied by the packet, determining the type of the realization method for passing through the network and the firewall to which the applied transport protocol belongs; calling an agency program set for the transport protocol type to which the applied transport protocol belongs so as to realize the fact that the communication data pass through the network and firewall, wherein the set agency programs respectively correspond to each type of transport protocols after the transport protocols are classified based on different realization methods thereof, and realize that the communication data pass through the network and firewall for each type of corresponding transport protocols thereof. The invention enables each type of transport protocols to respectively use the same agency program to realize the network and firewall pass-through of the communication data so as to realize pass-through of the various protocols.
Description
Technical field
The present invention relates to field of network communication, more particularly, relate to a kind of method of acting on behalf of passing through network and fire compartment wall.
Background technology
Present network can separate by some technological means such as fire compartment walls internal network for safety and managerial reason with internal network and outer net.Like this, although brought Safety and Manage convenient,, when also having caused some resource in the visiting from outside internal network simultaneously, inconvenient or can not directly access.So just need passing through network, to facilitate the resource in the visiting from outside internal network.
At present, in the system of client/server (C/S) pattern, the method for its passing through network has its shortcoming, and is specific as follows:
Be for different agreements, at server end, corresponding Agent be installed respectively, such as (socket, p, http etc.).The problem of this method is, owing to using various protocols on the client in the C/S system that is everlasting, thereby need to the Agent of variety of protocol be installed at server end, caused the maintenance of C/S system and configuration complicated, increased the unsteadiness of system.
Summary of the invention
In view of this, the embodiment of the present invention provides a kind of passing through network and firewall method acted on behalf of, to realize that maintenance and configuration are simple, to support multi-protocols and stable passing through network and fire compartment wall.
To achieve these goals, the embodiment of the present invention provides following technical scheme:
A kind of passing through network and firewall method acted on behalf of comprises step:
The packet of reception server end or client;
Determine the applied host-host protocol of this packet by described packet;
Host-host protocol applied according to this packet determined network that the host-host protocol of described application belongs to and the implementation method kind of Firewall Traversing, described host-host protocol is classified according to the difference of acting on behalf of implementation method, and the described host-host protocol of same class uses same Agent;
Call the Agent that host-host protocol kind that the host-host protocol for described application belongs to sets, realize communication data passing through network and fire compartment wall; The Agent of described setting is after acting on behalf of difference classification of implementation method according to host-host protocol according to it, respectively the Agent corresponding with each class host-host protocol; Described Agent is realized communication data passing through network and fire compartment wall for a class host-host protocol corresponding with it.
Preferably, in embodiments of the present invention, described control port is based on http protocol.
Preferably, in embodiments of the present invention, described host-host protocol is classified according to its difference of acting on behalf of implementation method comprises:
To connect and not be classified as a class with the agreement of source IP address information based on TCP.
Preferably, in embodiments of the present invention, describedly connect and do not comprise with the agreement of source IP address information based on TCP:
Not with Transmission Control Protocol, TELNET agreement and the ldap protocol of IP address information.
Preferably, in embodiments of the present invention, connect and not with the agreement of source IP address information, the Agent concrete methods of realizing that it uses is based on TCP for described:
On the path node that agreement is passed through, described Agent is monitored its port that need to pass through, and is connected to the corresponding ports of purpose computer;
When needs pass through data that described port carries out communication when arriving, described data are sent to the corresponding ports of purpose computer.
Preferably, in embodiments of the present invention, described host-host protocol is classified according to its difference of acting on behalf of implementation method comprises:
To connect and be classified as a class with the agreement of source IP address information based on TCP.
Preferably, in embodiments of the present invention, describedly connect and comprise with the agreement of source IP address information based on TCP: http protocol, IIOP agreement and File Transfer Protocol.
Preferably, in embodiments of the present invention, also comprise:
To the connection monitoring that connects based on TCP described in client;
When described when being connected in setting-up time not with server generation exchanges data, should connection with server or/and the client disconnection.
Preferably, in embodiments of the present invention, also comprise:
Described Agent is embodied as point-to-point passing through with Transmission Control Protocol, TELNET agreement and ldap protocol;
Described Agent is embodied as point-to-area passing through with http protocol and File Transfer Protocol.
Preferably, in embodiments of the present invention, described Agent divides multistage deployment.
In embodiments of the present invention, the host-host protocol that first will need is classified according to its difference of acting on behalf of implementation method, then, makes each class host-host protocol use respectively same Agent to realize communication data passing through network and fire compartment wall; Increase by control port at last or delete described Agent and allow the agreement acted on behalf of.By said method, can support passing through of various protocols, in addition, in the embodiment of the present invention, can also can add easily or delete by control port allowing the host-host protocol acted on behalf of, thereby conveniently realize the management of host-host protocol.
Description of drawings
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, the below will do to introduce simply to the accompanying drawing of required use in embodiment or description of the Prior Art, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is the flow chart of steps of method described in the embodiment of the present invention;
Fig. 2 is the schematic network structure that IIOP agreement described in the embodiment of the present invention realizes;
Fig. 3 is the flow chart of steps of method described in further embodiment of this invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is clearly and completely described, obviously, described embodiment is only the present invention's part embodiment, rather than whole embodiment.Based on the embodiment in the present invention, those of ordinary skills belong to the scope of protection of the invention not making the every other embodiment that obtains under the creative work prerequisite.
The invention discloses a kind of passing through network and firewall method acted on behalf of, to realize that maintenance and configuration are simple, to support multi-protocols and stable passing through network and fire compartment wall.
The packet of S11, reception server end or client;
Because most network has used implicit IP address, and, security consideration for network, most network also is provided with wall with flues, so, when client and server is in respectively in different networks, need to use acting server, described acting server by the Agent that is provided with to realize communication data the passing through between heterogeneous networks between client and server.
In embodiments of the present invention, client is sent to the packet of server end and the packet that server is sent to client, at first will be received by described acting server.
S12, determine the applied host-host protocol of this packet by described packet;
In actual applications, client need to be by multiple different agreement and server communication, to realize the application to different services in server.Because the packet that uses differing transmission protocols has different Frames, so can determine the applied host-host protocol of this packet by analyzing packet.
S13, host-host protocol applied according to this packet are determined network that the host-host protocol of described application belongs to and the implementation method kind of Firewall Traversing;
Be provided with separately Agent for fear of each agreement that uses that is applied to for the client and server communication, simplify Agent configuration and and safeguard, in the embodiment of the present invention, the agreement that uses is acted on behalf of the difference classification of implementation method according to it.Concrete, can be, will connect and not be classified as a class with the agreement of IP address information based on TCP, in the agreement of this class, can comprise Transmission Control Protocol, TELNET agreement and ldap protocol etc.
In addition, in the embodiment of the present invention, can also connect and be classified as a class with the agreement of IP address information based on TCP.In the agreement of this class, can comprise: http protocol, IIOP agreement are or/and File Transfer Protocol etc.
S14, call the Agent that host-host protocol kind that the host-host protocol for described application belongs to sets, realize communication data passing through network and fire compartment wall; The Agent of described setting is after acting on behalf of difference classification of implementation method according to host-host protocol according to it, respectively the Agent corresponding with each class host-host protocol; Described Agent is realized communication data passing through network and fire compartment wall for a class host-host protocol corresponding with it.
In previous step, connect owing to connecting based on TCP and all not being based on TCP with this quasi-protocol of IP address information, and, in these agreements, do not carry the client-side informations such as IP address.So the agreement of this class can be used same Agent, to realize communication data the passing through between heterogeneous networks between client and server.The concrete methods of realizing of this type of Agent that agreement is used can for: monitor its port that need to pass through on the path node that agreement is passed through, and be connected to the corresponding ports of server (purpose computer); When needs pass through data that described port carries out communication when arriving, described data are sent to the corresponding ports of server (purpose computer).
With above-mentioned record in like manner, in previous step, connect and also can use same Agent with this quasi-protocol of IP address information based on TCP.Realize in the crossing process of http protocol at Agent, all with the address information (as the IP address) of access purpose resource place computer, so Agent can be realized communication data information passing through from the source computer to the object-computer due to the characteristics of http protocol in the packet of the request of sending each time.Concrete, can be that after Agent was received the communication data packets of client (being source computer), according to the information of http protocol, then the server (being object-computer) in the access destination network segment, returned to client with result.
Realize in the crossing process of File Transfer Protocol at Agent, similar with the process of http protocol, just, according to the definition of File Transfer Protocol, each File Transfer Protocol need to have FPDP to be connected TCP with control port to connect, so Agent realizes that passing through of File Transfer Protocol is slightly more complex.
realize in the crossing process of IIOP agreement at Agent, Agent is after receiving the communication data packets of client, can be the IP address of Agent place acting server with the source IP address information change in described communication data packets, then, communication data packets after change source IP address information is sent to object-computer, at this moment, object-computer can think that described communication data packets sent by acting server, thereby the result data bag can be returned to acting server, after acting server receives the result data bag, source IP address information wherein can be changeed back the source IP address of client, and be sent to client.Like this, Agent is transparent for client.
For example, as shown in Figure 2, a network segment is the local area network (LAN) of 192.168.3.x, is the client 1 of 192.168.3.112 comprising the IP address is arranged; The acting server 2 that described client is 10.224.10.20 by the IP address uses IIOP agreement and IP address to be server 3 communications of 10.224.10.30.Its detailed process is:
The IP address is the packet of the use IIOP agreement that sends of the client 1 of 192.168.3.112; Before the acting server 2 that is 10.224.10.20 in the IP address received, the source IP address information in described packet was 192.168.3.112.
The address is after the acting server 2 of 10.224.10.20 receives described packet, and the Agent in described acting server 2 changes to 10.224.10.20 with source IP address information wherein by 192.168.3.112; Then, the communication data packets after change source IP address information being sent to the IP address is the server 3 of 10.224.10.30.
At this moment, described server 3 can think that source IP address information is that the 10.224.10.20 communication data packets is to be sent by acting server 2, thereby the result data bag can be returned to acting server 2; At this moment, the source IP address information in packet is 10.224.10.20.
Agent in described acting server 2 is changeed back the source IP address information in packet 192.168.3.112 and is sent to client 1 by 10.224.10.20.
In said process, client 1 is not also known the change procedure of its source IP address, does not know the existence of acting server 2 yet, that is to say, acting server 2 is transparent for client 1.
In another embodiment of the present invention, can also increase or delete described Agent by control port and allow the agreement acted on behalf of.
In embodiments of the present invention, described Agent also provides a control port, and is concrete, in embodiments of the present invention, can be based on the control port of http protocol.By control port, can the described Agent of additions and deletions allow the agreement of acting on behalf of.Thereby, after knowing the protocol type that client need to be used, only need the open necessary port of fire compartment wall of local area network (LAN) can realize passing through of required agency agreement.
In embodiments of the present invention, the host-host protocol that first will need is classified according to its difference of acting on behalf of implementation method, then, makes each class host-host protocol use respectively same Agent to realize communication data passing through network and fire compartment wall; Increase by control port at last or delete described Agent and allow the agreement acted on behalf of.By said method, can support passing through of various protocols, and, can add easily or delete allowing the host-host protocol acted on behalf of by control port, thereby conveniently realize the management of host-host protocol.
In another embodiment of the present invention, as shown in Figure 3, can also be to include following steps:
The packet of S21, reception server end or client;
S22, determine the applied host-host protocol of this packet by described packet;
S23, host-host protocol applied according to this packet are determined network that the host-host protocol of described application belongs to and the implementation method kind of Firewall Traversing;
S24, call the Agent that host-host protocol kind that the host-host protocol for described application belongs to sets, realize communication data passing through network and fire compartment wall; The Agent of described setting is after acting on behalf of difference classification of implementation method according to host-host protocol according to it, respectively the Agent corresponding with each class host-host protocol; Described Agent is realized communication data passing through network and fire compartment wall for a class host-host protocol corresponding with it.
S25, increase or delete described Agent by control port and allow the agreement acted on behalf of;
S26, the connection monitoring to connecting based on TCP described in client; When described when being connected in setting-up time not with server generation exchanges data, should connection with server or/and the client disconnection.
In embodiments of the present invention, step S21 to S24 respectively with a upper embodiment in corresponding step similar, here just repeat no more.
The embodiment of the present invention, S26 in steps also, that is, and to the connection monitoring that connects based on TCP described in client; When described when being connected in setting-up time not with server generation exchanges data, should connection with server or/and the client disconnection.
The embodiment of the present invention is by monitoring being connected between client and server, and disconnects timely the connection of long-term immobilization, makes the resource of server do not taken by the connection of long-term immobilization, thereby effectively reduced the pressure of server.
In embodiments of the present invention, described Agent can also be embodied as point-to-point passing through with Transmission Control Protocol, TELNET agreement and ldap protocol, and http protocol and File Transfer Protocol are embodied as point-to-area passing through.
In embodiments of the present invention, described Agent also can divide multistage deployment.Concrete:
When needs penetrate a plurality of networks and carry out data communication, such as, be that to arrive at last the IP address be the computer of 192.168.3.1 for computer that computer that the computer of 192.168.0.1 is 192.168.1.1 through the IP address is 192.168.2.1 through the IP address again if data need secondary IP address.The concrete mode of described multistage deployment is:
At first, Agent is deployed on the machine that to access; Start Agent and add various required agreements of passing through and port by control port, wherein, oneself also can pass through the proxy management agreement by Agent.The various required agreements of passing through of described interpolation and port can be specifically:
At first, to add the ADMIN agreement as example, setting ADMIN agreement use port is 2300.Concrete deployment way is: add the ADMIN agreement on 192.168.0.1, port 2300 to 192.168.1.1:2300; Add the ADMIN agreement on 192.168.1.1, port 2300 to 192.168.2.1:2300; Add the ADMIN agreement on 192.168.2.1, port 2300 to 192.168.3.1:2300.Like this, just can directly access from 2300 ports of 192.168.0.1 the ADMIN agreement of 192.168.3.1.Thereby realized penetrating a plurality of networks and carried out data communication.
Then, then to add tunnel protocol as example, setting the port that tunnel protocol uses is 2400.Concrete deployment way is: add tunnel protocol on 192.168.0.1, port 2400 to 192.168.1.1:2400; Add tunnel protocol on 192.168.1.1, port 2400 to 192.168.2.1:2400; Add tunnel protocol on 192.168.2.1, port 2400 to 192.168.3.1:2400.
In embodiments of the present invention, by adding tunnel protocol, can simplify the complex configurations in multistage passing through.Such as, can use tunnel protocol, add the p agreement on 192.168.0.1, thereby make port 2121 can be directly connected to 192.168.3.1:21.In like manner, can also use tunnel protocol, add http protocol on 192.168.0.1, thereby make port 8080 can be directly connected to 192.168.3.1:80.In like manner, can also use tunnel protocol, add the IIOP agreement on 192.168.0.1, thereby make port 2809 can be directly connected to 192.168.3.1:2809.
In this specification, each embodiment adopts the mode of going forward one by one to describe, and what each embodiment stressed is and the difference of other embodiment that between each embodiment, identical similar part is mutually referring to getting final product.
To the above-mentioned explanation of the disclosed embodiments, make this area professional and technical personnel can realize or use the present invention.Multiple modification to these embodiment will be apparent concerning those skilled in the art, and General Principle as defined herein can be in the situation that do not break away from the spirit or scope of the present invention, realization in other embodiments.Therefore, the present invention will can not be restricted to these embodiment shown in this article, but will meet the widest scope consistent with principle disclosed herein and features of novelty.
Claims (10)
1. act on behalf of passing through network and firewall method for one kind, it is characterized in that,
The packet of reception server end or client;
Determine the applied host-host protocol of this packet by described packet;
Host-host protocol applied according to this packet determined network that the host-host protocol of described application belongs to and the implementation method kind of Firewall Traversing, described host-host protocol is classified according to the difference of acting on behalf of implementation method, and the described host-host protocol of same class uses same Agent;
Call the Agent that host-host protocol kind that the host-host protocol for described application belongs to sets, realize communication data passing through network and fire compartment wall; The Agent of described setting is after acting on behalf of difference classification of implementation method according to host-host protocol according to it, respectively the Agent corresponding with each class host-host protocol; Described Agent is realized communication data passing through network and fire compartment wall for a class host-host protocol corresponding with it.
2. method according to claim 1, is characterized in that, also comprises, increases or delete described Agent by control port to allow the agreement acted on behalf of.
3. method according to claim 2, is characterized in that, described control port is based on http protocol.
4. method according to claim 3, is characterized in that, described host-host protocol comprised according to its difference classification of acting on behalf of implementation method:
To connect and not be classified as a class with the agreement of source IP address information based on TCP;
To connect and be classified as a class with the agreement of source IP address information based on TCP.
5. state according to claim 4 method, it is characterized in that, describedly connect and do not comprise with the agreement of source IP address information based on TCP:
Not with Transmission Control Protocol, TELNET agreement and the ldap protocol of IP address information.
6. state according to claim 5 method, it is characterized in that, connect and not with the agreement of source IP address information, the Agent concrete methods of realizing that it uses is based on TCP for described:
On the path node that agreement is passed through, described Agent is monitored its port that need to pass through, and is connected to the corresponding ports of purpose computer;
When needs pass through data that described port carries out communication when arriving, described data are sent to the corresponding ports of purpose computer.
7. method according to claim 4, is characterized in that, describedly connects and comprise with the agreement of source IP address information based on TCP: http protocol, IIOP agreement and File Transfer Protocol.
8. arbitrary described method according to claim 3 to 7, is characterized in that, also comprises:
To the connection monitoring that connects based on TCP described in client;
When described when being connected in setting-up time not with server generation exchanges data, should connection with server or/and the client disconnection.
9. method according to claim 1, is characterized in that, also comprises:
Described Agent is embodied as point-to-point passing through with Transmission Control Protocol, TELNET agreement and ldap protocol;
Described Agent is embodied as point-to-area passing through with http protocol and File Transfer Protocol.
10. method according to claim 1, is characterized in that, described Agent divides multistage deployment.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010249039 CN101895559B (en) | 2010-08-09 | 2010-08-09 | Method for passing through network and firewall for agency |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010249039 CN101895559B (en) | 2010-08-09 | 2010-08-09 | Method for passing through network and firewall for agency |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101895559A CN101895559A (en) | 2010-11-24 |
| CN101895559B true CN101895559B (en) | 2013-06-12 |
Family
ID=43104625
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 201010249039 Expired - Fee Related CN101895559B (en) | 2010-08-09 | 2010-08-09 | Method for passing through network and firewall for agency |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101895559B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102970291B (en) * | 2012-11-19 | 2016-01-06 | 北京思特奇信息技术股份有限公司 | A kind of pass through monolateral fire compartment wall set up TCP connect method and device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030865A (en) * | 2006-02-28 | 2007-09-05 | 西门子通信技术（北京）有限公司 | Network address conversion and/or firewall spanning platform, system and method |
| CN101374141A (en) * | 2007-08-23 | 2009-02-25 | 浙江省电信有限公司 | TCP NAT crossing method base on PCP protocol |
| CN101437036A (en) * | 2008-12-22 | 2009-05-20 | 北京中企开源信息技术有限公司 | Document transmission method and system capable of supporting NAT/firewall traversing |
-
2010
- 2010-08-09 CN CN 201010249039 patent/CN101895559B/en not_active Expired - Fee Related
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101030865A (en) * | 2006-02-28 | 2007-09-05 | 西门子通信技术（北京）有限公司 | Network address conversion and/or firewall spanning platform, system and method |
| CN101374141A (en) * | 2007-08-23 | 2009-02-25 | 浙江省电信有限公司 | TCP NAT crossing method base on PCP protocol |
| CN101437036A (en) * | 2008-12-22 | 2009-05-20 | 北京中企开源信息技术有限公司 | Document transmission method and system capable of supporting NAT/firewall traversing |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101895559A (en) | 2010-11-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107852604B (en) | System for providing Global Virtual Network (GVN) | |
| CN113950816A (en) | System and method for providing multi-cloud micro-service gateway using sidecar agency | |
| US8295277B2 (en) | Analyzing a network with a cache advance proxy | |
| US20060200547A1 (en) | Methods, devices, systems and computer program products for providing secure communications between managed devices in firewall protected areas and networks segregated therefrom | |
| CN107210933B (en) | Mechanism for providing hardware resource information to attached equipment | |
| EP3289728B1 (en) | Distribution of internal routes for virtual networking | |
| US9825815B2 (en) | System and method for aggregating and estimating the bandwidth of multiple network interfaces | |
| US20220368563A1 (en) | Method for implementing gre tunnel, access point and gateway | |
| JP5679343B2 (en) | Cloud system, gateway device, communication control method, and communication control program | |
| US11601358B2 (en) | Cross datacenter communication using a mesh gateway | |
| US11805011B2 (en) | Bulk discovery of devices behind a network address translation device | |
| CN111262715B (en) | Virtual intranet acceleration method and system and computer equipment | |
| US20210044678A1 (en) | Optimized quic fallback on access networks and endpoints | |
| Mohammadnia et al. | IoT-NETZ: Practical spoofing attack mitigation approach in SDWN network | |
| EP3583751B1 (en) | Method for an improved deployment and use of network nodes of a switching fabric of a data center or within a central office point of delivery of a broadband access network of a telecommunications network | |
| US20200322418A1 (en) | Secure remote computer network | |
| CN105052106A (en) | Methods and systems for receiving and transmitting internet protocol (ip) data packets | |
| WO2022151420A1 (en) | Method, apparatus, and system for transmitting data packet | |
| US20230336377A1 (en) | Packet forwarding method and apparatus, and network system | |
| CN101895559B (en) | Method for passing through network and firewall for agency | |
| CN110381007B (en) | TCP acceleration method and device | |
| CN114979139B (en) | Management system and method for heterogeneous virtual gateway in edge computing scene | |
| US20230029882A1 (en) | Exit interface selection based on intermediate paths | |
| CN105429844A (en) | Network system, internal network equipment and access method of internal network equipment | |
| US20090052446A1 (en) | Communications Interface |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20130612 Termination date: 20170809 |