Jump to:navigation, search
Wiki

HTTP Proxy

From Securepoint Wiki




























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden

























































| 3= }}


| 3= }}























Configuration of the HTTP proxy

Last adaptation to the version: 14.1.1 (11.2025)

New:
  • FastDiff aktualisiert die Viruspattern in Echtzeit
  • SigQA Übermittelt neue aber unbekannte Signaturen an unser AV-Labor
notempty
This article refers to a Beta version

12.7.2 12.6.2 12.5 12.4 12.2 11.8 11.7

Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 Applications HTTP Proxy

Introduction

The proxy serves as an intermediary between the internet and the network to be protected.
The clients send their request to the proxy and the proxy passes it on to the corresponding servers.
The actual address of the client remains hidden from the server.
In this way, it is possible to check the data traffic for viruses and unwanted content.

notempty
New as of v14.1.1
If necessary, additional configuration profiles can be added alongside the standard profile.

Globales Profil

notempty
Das globale Profil gilt für alle Schnittstellen und den transparenten Proxy. Die meisten Einstellungen werden durch zusätzlich angelegte Profile überschrieben.

General




























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden




























Caption Value Description Edit global configuration profile UTMuser@firewall.name.fqdnApplicationsHTTP-Proxy Area General
Proxy Port: 8080 Specifies on which port the proxy is to be addressed
Outgoing Address:     The Outgoing Address is used for two scenarios:
  1. If the proxy is to be bound to an interface
  2. If a web server in the VPN network is to be reached via the proxy.
In this example, the proxy is bound to the faster DSL line:
  • Initial situation:
    • LAN1: ppp0 with DSL 2000
    • LAN2: Internal network (Internal interface with the IP 192.168.175.1)
    • LAN3: ppp1 with DSL 16000
  • The IP of the Internal interface (here: LAN2) must be entered in the field for the outgoing address
  • Save settings
  • Under Network Network Settings  Area Routing a new route is created:
    • Source: IP of the internal interface
    • Router: ppp1
    • Target: 0.0.0.0/0
  • Saving the route
Now the proxy is bound to the 2nd internet connection.
Connection to a web server in the VPN network:
  • The IP of the internal interface must be entered in the field for the outgoing address.
  • Save the settings.
  • Connections initiated by the firewall do not require extra rules
    • Forward requests to system-wide parent proxy: No If another proxy is used before the HTTP proxy, this function must be activated.
    The configuration takes place under

    Network Appliance-Settings  Area System-wide proxy -->

    Logging (Syslog lokal): Off Writes a general Syslog for the HTTP proxy (Open: Log  Area Log
    Logging (Statistics):
    Only available if no anonymization for the HTTP proxy
    Settings at Authentication Privacy
    has been activated    		 On Writes a statistical Log call: Log  Area HTTP proxy statistics
    Authentication method: The proxy offers various possibilities for authentication. The possibilities are:
    None The HTTP proxy processes all requests without authentication
    Basic With basic authentication, the users are queried against the stored users under Authentication User  Area User on the firewall
    NTLM / Kerberos Here the firewall must be made known to the server.
    This can be set up in the web interface under Authentication AD / LDAP Authentication
    Radius Here the firewall must be made known to the server.
    This can be set up in the web interface under Authentication Radius-Authentication
    Allow access only from local sources: Yes
    default    		 Access to the HTTP proxy is now only possible from internal sources. These are:
    • local networks
    • routed networks ( Network Network configuration  Area Routing)
    • VPN networks
    Allow access to local destinations: Yes
    default    		 All internal networks can also be reached via the HTTP proxy (the packetfilter has already been passed through to reach the HTTP proxy).
    Disabling it prevents this and access to other internal networks must be explicitly allowed via the port filter without an HTTP proxy.
    Forward Microsoft connection-oriented authentication: No If it is enabled, login or authentication to websites is possible. For some websites this is not possible otherwise.
    With this option, NTLM, Negotiate and Kerberos authentications are forwarded
    notempty
    If SSL-Interception is active, this parameter must be enabled for HTTPS-based authentications, otherwise no authentication/login is possible on these websites.
    Authentication exceptions
    Aktiviert Off
    default    		 Authentication exceptions are disabled by default.

    If enabled: URLs listed here are accessed without prior authentication.
    The default URLs are pages that are used for Securepoint Antivirus Pro.
    Further information can be found in the article HTTP proxy authentication exceptions

    Section authentication exceptions
    Ausnahmen (URL): \.ttt-point\.de Wenn man die Authentifizierungsausnahmen aktiviert, dann kann man hier eigene Ausnahmen festlegen

    Virusscan

    General

    Der Virenscanner im HTTP-Proxy kann Datenverkehr auf Viren prüfen.

    notempty
    New as of v14.1.0
     Dabei werden mit FastDiff die Viruspattern in Echtzeit aktualisiert.
    Die Funktion lässt sich per CLI deaktivieren oder aktivieren.
    Per Default ist die Funktion aktiviert.
    FastDiff Deaktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 0 }
    FastDiff Aktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 1 }
    FastDiff Status abfragen:extc value get { application ikarus variable ENABLE_FASTDIFF }
    application|variable |value
    -----------+---------------+-----
    ikarus |ENABLE_FASTDIFF|1

    notempty
    New as of v14.1.0
     Zusätzlich werden mit der Funktion SigQA neue aber unbekannte Signaturen an unser AV-Labor übermittelt.
    Die Funktion lässt sich per CLI deaktivieren oder aktivieren.
    Per Default ist die Funktion aktiviert.
    SigQA Deaktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 0 }
    SigQA Aktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 1 }
    SigQA Status abfragen:extc value get { application ikarus variable ENABLE_SIGQA }
    application|variable |value
    -----------+------------+-----
    ikarus |ENABLE_SIGQA|1

    Virusscan: On The virus scanner is activated and the associated service is running
    (default setting)     		Datei:UTM v14.1.1 Anwendungen HTTP Proxy Virenscanner-en.png
    Area Virusscan
    On The virus scanner service is deactivated.
    The HTTP proxy is not working correctly.
    The service can be started via the menu Applications Application status Virusscan
    On The virus scanner service is deactivated.
    The HTTP proxy is not working correctly.notempty
    On devices with less than 3GB RAM, the service for the virus scanner cannot start.
    Please change to current hardware or allocate more RAM!
  • Once this configuration is running in an environment with enough RAM, the service will be resumed.
    • Off The virus scanner is deactivated.
    Maximum scan size limit: 2 Megabytes Sets the size of the files to be scanned by the virus scanner
    Trickle Time: 5 seconds Interval at which data is transferred from the proxy to the browser so that the browser does not stop loading during the virus check
    Allowlist ICY-Protokoll: Off A web radio protocol that can be excluded from testing
    Cache Updates notempty
    New as of v12.7.2
    		 Off When activated On, the virus database updates are distributed to the connected clients with Securepoint Antivirus Pro after the initial download.

    In this way, traffic is reduced and the updates are rolled out smoothly.

    Mime type blocklist application/x-shockwave-flash
    Example    		 Mime types listed here are blocked in any case.
    The button opens a dialogue in which a mime type can be selected from a dop-down menu or an individual type can be entered.
  • This function is only active if the Virusscanner is enabled!

    • The MIME-Type detection is performed after the first few bytes of the file. Normally, this detection is accurate, and the blocklist is applied accordingly. Additionally, there is a rescan mechanism in place, which re-evaluates the MIME-Type specifically for Microsoft-Compound Storage Formate files. This rescan occurs once the full file is available or when the loaded portion of the file reaches the Virusscanner sizelimit.
    Thereforce, the detection may not always be 100% perfect but represents an optimal compromise between efficiency and accuracy


    Allowlist
    Aktiviert Die Allowlist für MIME-Types und Webseiten ist standardmäßig aktiviert
    Mime-Type Allowlist application/pkcs10
    Example    		 Mime types listed here are not scanned.
    Standard defaults:
    • audio/*
    • image/*
    • video/*

    Websites Allowlist

    »^[^:]*://download\.windowsupdate\.com/
    »^[^:]*://database\.clamav\.net/
    »^[^:]*://[^\.]*\.geo\.kaspersky\.com/
    »^[^:]*://officecdn\.microsoft\.com/
    »^[^:]*://[^\.]*\.ikarus\.at/
    »^[^:]*://[^\.]*\.mailsecurity\.at/
    »^[^:]*://officecdn\.microsoft\.com\.edgesuite\.net/

    		Here it is possible to create your own filters based on Regular Expressions (Regex).
    notempty
    Viruses from these pages are not detected!

    Some update servers that cause problems when using a virus scanner are already preconfigured.
    Hint: Further exceptions are necessary so that iTunes can communicate correctly with the internet.

    Bandwidth

    Bandwidth limiting policy: None Default
    Area Bandwidth
    Limit total bandwidth In this case, the proxy only uses the specified maximum bandwidth and leaves the rest of the bandwidth untouched by your internet connection.
    (This bandwidth is shared by all hosts connected to the proxy.)
    Per host bandwidth Bandwidth for each host.
    The limited bandwidth for hosts cannot exceed the global bandwidth.
    Global bandwidth: 2.000.000 kbit/s Default value, if activated
    Per host bandwidth: 64.000 kbit/s Default value, if activated

    App Blocking

    The general app blocking with fixed ports has been removed.
    Individual apps, or the ports they use, can be blocked flexibly via the packet filter.

    SSL-Interception

    With the SSL interception feature, it is possible to recognise malicious code in SSL-encrypted data streams at the gateway. It interrupts the encrypted connections and makes the data packets visible to virus scanners and other filters. Data transmission to the client is then encrypted again. To do this, however, it is necessary to create a CA under Authentication Certificates and select this in the CA certificate field.

    Caption Value Description Globales Konfigurationsprofil bearbeiten UTMuser@firewall.name.fqdnApplicationsHTTP-Proxy SSL Interception tab
    Enabled Off The SSL-Interception is turned off
    Only webfilter based When enabled, only connections blocked by the web filter are intercepted.
    This avoids the problem that there are sites that do not tolerate an interruption of the encryption (e.g. banking software) without having to define an exception for it.
    Always Activates the SSL interception
    Validate SNI:
    		 Yes When activated, any SNI in the ClientHello of the TLS handshake is checked. The host name contained is resolved and the addresses in the result are compared with the target address of the intercepted request. If they do not match, the connection is closed.
     Without Server Name Indication validation, clients can manipulate SNI arbitrarily to bypass the web filter.
     This setting should only be considered as a last resort when it seems impossible to standardize the DNS settings between the HTTP proxy and the UTM clients.
     If the client and UTM use different DNS servers, this can lead to false positives.
    Allow non identified protocols: Yes If this switch is deactivated, unrecognized protocols are blocked.
    CA-Certificate: CA-SSL-Interception Here, a CA must be selected that can re-encrypt the connection after decryption (and scanning).
    The public key of the CA must be installed on all client computers that are to use SSL Interception. Download can be done here directly with Download public key.
    Download public key The public key should be installed on the clients that are going to use SSL interception to avoid certificate errors.
    Peer verification:
    not for Only webfilter based
    		 On This should definitely be enabled!
    With this, the HTTP proxy checks whether the certificate of the called page is trustworthy. Since the browser only sees the local certificate, a check by the browser is no longer possible.

    Exceptions for SSL-Interception

    Exceptions for SSL-Interception

    not for Only webfilter based
    Enabled Off It is possible to define exceptions in the format of Regular Expressions. However, since only https can arrive here, it is not filtered for protocols, unlike the virus scanner.
    New exceptions can be added directly in the input field.
    So an exception for www.securepoint.de would be: .*\.securepoint\.de"
  • Regex exceptions do not apply to transparent mode!
    • Compare exceptions with the SNI:
    Only available if salidate SNI is active.    		 Off Applies Server Name Indication validation only to activated  Exceptions of SSL-Interception .
    Ausnahmen: .*\.ttt-point\.de
    Vordefiniert im Globalen Konfigurationsprofil:
    .*\.ikarus\.at.*\.mailsecurity\.at .*91\.212\.136\..*    		 Ausnahmen bestimmen, hier für ttt-point.de

    Peer verification exceptions

    Peer verification exceptions

    only if peer verification is active
    Enabled Off Here exceptions for certificate verification in regex format can be added.


    Transparent Mode

     Transparent Mode  On Due to the transparent mode, the proxy is not visible to the clients, the client sees its internet connection (HTTP) as if no proxy was connected in front of it. Nevertheless, the entire HTTP stream goes through the proxy, which means that no settings have to be made on the client. However, there are the same possibilities to analyze / block / filter / manipulate the data stream as if a fixed proxy were used.
    Each network object or group of network objects that are to use the transparent proxy must be stored here.
    Area Transparent Mode
    Add Transparent Rule
    Protocol: HTTP
    or
    HTTPS    		 Protocol that is used Add Transparent Rule UTMuser@firewall.name.fqdnApplicationsHTTP-ProxyGlobales Konfigurationsprofil bearbeiten Adding a Transparent Rule
    Type: INCLUDE The transparent mode is applied
    EXCLUDE Transparent mode is not applied
    Source: internal-network Source network object created under Firewall Packetfilter  Area Network objects
    Destination: internet Destination network object

    Konfigurationsprofil hinzufügen

    notempty
    New as of v14.1.1

    General




























    In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
    Diese Seite wird auf folgenden Seiten eingebunden




























    Caption Value Description Konfigurationsprofil hinzufügen UTMuser@firewall.name.fqdnApplicationsHTTP-Proxy Der Bereich Allgemein in einem weiteren Konfigurationsprofil
    Name: Konfigurationsprofil 2 Angabe des Namens für das Konfigurationsprofil
    Interface LAN1 Dieses Konfigurationsprofil einer Schnittstelle zuweisen wie z. B. LAN1
    Outgoing Address:     The Outgoing Address is used for two scenarios:
    1. If the proxy is to be bound to an interface
    2. If a web server in the VPN network is to be reached via the proxy.
    In this example, the proxy is bound to the faster DSL line:
    • Initial situation:
      • LAN1: ppp0 with DSL 2000
      • LAN2: Internal network (Internal interface with the IP 192.168.175.1)
      • LAN3: ppp1 with DSL 16000
    • The IP of the Internal interface (here: LAN2) must be entered in the field for the outgoing address
    • Save settings
    • Under Network Network Settings  Area Routing a new route is created:
      • Source: IP of the internal interface
      • Router: ppp1
      • Target: 0.0.0.0/0
    • Saving the route
    Now the proxy is bound to the 2nd internet connection.
    Connection to a web server in the VPN network:
    • The IP of the internal interface must be entered in the field for the outgoing address.
    • Save the settings.
  • Connections initiated by the firewall do not require extra rules
    • Forward requests to system-wide parent proxy :
    Wird im globalen Konfigurationsprofil festgelegt    		 No
    Logging (Syslog lokal): Off Writes a general Syslog for the HTTP proxy (Open: Log  Area Log
    Logging (Statistics):
    Only available if no anonymization for the HTTP proxy
    Settings at Authentication Privacy
    has been activated    		 On Writes a statistical Log call: Log  Area HTTP proxy statistics
    Authentication method: The proxy offers various possibilities for authentication. The possibilities are:
    None The HTTP proxy processes all requests without authentication
    Basic With basic authentication, the users are queried against the stored users under Authentication User  Area User on the firewall
    NTLM / Kerberos Here the firewall must be made known to the server.
    This can be set up in the web interface under Authentication AD / LDAP Authentication
    Radius Here the firewall must be made known to the server.
    This can be set up in the web interface under Authentication Radius-Authentication
    Allow access only from local sources: Yes
    default    		 Access to the HTTP proxy is now only possible from internal sources. These are:
    • local networks
    • routed networks ( Network Network configuration  Area Routing)
    • VPN networks
    Allow access to local destinations: Yes
    default    		 All internal networks can also be reached via the HTTP proxy (the packetfilter has already been passed through to reach the HTTP proxy).
    Disabling it prevents this and access to other internal networks must be explicitly allowed via the port filter without an HTTP proxy.
    Forward Microsoft connection-oriented authentication: No If it is enabled, login or authentication to websites is possible. For some websites this is not possible otherwise.
    With this option, NTLM, Negotiate and Kerberos authentications are forwarded
    notempty
    If SSL-Interception is active, this parameter must be enabled for HTTPS-based authentications, otherwise no authentication/login is possible on these websites.
    Authentication exceptions
    Enabled Off
    default    		 Authentication exceptions are disabled by default.

    If enabled: URLs listed here are accessed without prior authentication.
    The default URLs are pages that are used for Securepoint Antivirus Pro.
    Further information can be found in the article HTTP proxy authentication exceptions

    Section authentication exceptions
    Ausnahmen (URL): \.ttt-point\.de Wenn man die Authentifizierungsausnahmen aktiviert, dann kann man hier eigene Ausnahmen festlegen

    Virusscan

    General

    Der Virenscanner im HTTP-Proxy kann Datenverkehr auf Viren prüfen.

    notempty
    New as of v14.1.0
     Dabei werden mit FastDiff die Viruspattern in Echtzeit aktualisiert.
    Die Funktion lässt sich per CLI deaktivieren oder aktivieren.
    Per Default ist die Funktion aktiviert.
    FastDiff Deaktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 0 }
    FastDiff Aktivieren: extc value set { application ikarus variable ENABLE_FASTDIFF value 1 }
    FastDiff Status abfragen:extc value get { application ikarus variable ENABLE_FASTDIFF }
    application|variable |value
    -----------+---------------+-----
    ikarus |ENABLE_FASTDIFF|1

    notempty
    New as of v14.1.0
     Zusätzlich werden mit der Funktion SigQA neue aber unbekannte Signaturen an unser AV-Labor übermittelt.
    Die Funktion lässt sich per CLI deaktivieren oder aktivieren.
    Per Default ist die Funktion aktiviert.
    SigQA Deaktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 0 }
    SigQA Aktivieren: extc value set { application ikarus variable ENABLE_SIGQA value 1 }
    SigQA Status abfragen:extc value get { application ikarus variable ENABLE_SIGQA }
    application|variable |value
    -----------+------------+-----
    ikarus |ENABLE_SIGQA|1

    Virusscan: Off The virus scanner is deactivated, but the associated service is running
    (default setting)
    On The virus scanner is activated and the associated service is running
    On The virus scanner service is deactivated.
    The HTTP proxy is not working correctly.
    The service can be started via the menu Applications Application status Virusscan
    On The virus scanner service is deactivated.
    The HTTP proxy is not working correctly.notempty
    On devices with less than 3GB RAM, the service for the virus scanner cannot start.
    Please change to current hardware or allocate more RAM!
  • Once this configuration is running in an environment with enough RAM, the service will be resumed.
    • Off The virus scanner is deactivated.
    Maximum scan size limit:
    Wird im globalen Konfigurationsprofil festgelegt    		 2 Megabytes
    Trickle Time:
    Wird im globalen Konfigurationsprofil festgelegt    		 5 seconds
    Allowlist ICY-Protokoll: Off A web radio protocol that can be excluded from testing
    Allowlist
    Enabled Die Allowlist für MIME-Types und Webseiten ist standardmäßig aktiviert
    Mime-Type Allowlist
    Wird im globalen Konfigurationsprofil festgelegt    		 application/pkcs10
    Example

    Websites Allowlist

    »^[^:]*://download\.windowsupdate\.com/
    »^[^:]*://database\.clamav\.net/
    »^[^:]*://[^\.]*\.geo\.kaspersky\.com/
    »^[^:]*://officecdn\.microsoft\.com/
    »^[^:]*://[^\.]*\.ikarus\.at/
    »^[^:]*://[^\.]*\.mailsecurity\.at/
    »^[^:]*://officecdn\.microsoft\.com\.edgesuite\.net/

    		Here it is possible to create your own filters based on Regular Expressions (Regex).
    notempty
    Viruses from these pages are not detected!

    Some update servers that cause problems when using a virus scanner are already preconfigured.
    Hint: Further exceptions are necessary so that iTunes can communicate correctly with the internet.
    Cache Updates notempty
    New as of v12.7.2

    Wird im globalen Konfigurationsprofil festgelegt    		 Off

    Bandwidth

    Bandwidth limiting policy: None Default
    Area Bandwidth
    Limit total bandwidth In this case, the proxy only uses the specified maximum bandwidth and leaves the rest of the bandwidth untouched by your internet connection.
    (This bandwidth is shared by all hosts connected to the proxy.)
    Per host bandwidth Bandwidth for each host.
    The limited bandwidth for hosts cannot exceed the global bandwidth.
    Global bandwidth: 2.000.000 kbit/s Default value, if activated
    Per host bandwidth: 64.000 kbit/s Default value, if activated

    App Blocking

    The general app blocking with fixed ports has been removed.
    Individual apps, or the ports they use, can be blocked flexibly via the packet filter.

    SSL-Interception

    With the SSL interception feature, it is possible to recognise malicious code in SSL-encrypted data streams at the gateway. It interrupts the encrypted connections and makes the data packets visible to virus scanners and other filters. Data transmission to the client is then encrypted again. To do this, however, it is necessary to create a CA under Authentication Certificates and select this in the CA certificate field.

    Caption Value Description Konfigurationsprofil hinzufügen UTMuser@firewall.name.fqdnApplicationsHTTP-Proxy SSL Interception tab
    Enabled Off The SSL-Interception is turned off
    Only webfilter based When enabled, only connections blocked by the web filter are intercepted.
    This avoids the problem that there are sites that do not tolerate an interruption of the encryption (e.g. banking software) without having to define an exception for it.
    Always Activates the SSL interception
    Validate SNI:
    Wird im globalen Konfigurationsprofil festgelegt    		 Yes When activated, any SNI in the ClientHello of the TLS handshake is checked. The host name contained is resolved and the addresses in the result are compared with the target address of the intercepted request. If they do not match, the connection is closed.
     Without Server Name Indication validation, clients can manipulate SNI arbitrarily to bypass the web filter.
     This setting should only be considered as a last resort when it seems impossible to standardize the DNS settings between the HTTP proxy and the UTM clients.
     If the client and UTM use different DNS servers, this can lead to false positives.
    Allow non identified protocols: Yes If this switch is deactivated, unrecognized protocols are blocked.
    CA-Certificate: CA-SSL-Interception Here, a CA must be selected that can re-encrypt the connection after decryption (and scanning).
    The public key of the CA must be installed on all client computers that are to use SSL Interception. Download can be done here directly with Download public key.
    Download public key The public key should be installed on the clients that are going to use SSL interception to avoid certificate errors.
    Peer verification:
    not for Only webfilter based
    Wird im globalen Konfigurationsprofil festgelegt    		 On This should definitely be enabled!
    With this, the HTTP proxy checks whether the certificate of the called page is trustworthy. Since the browser only sees the local certificate, a check by the browser is no longer possible.

    Exceptions for SSL-Interception

    Exceptions for SSL-Interception

    not for Only webfilter based
    Enabled Off It is possible to define exceptions in the format of Regular Expressions. However, since only https can arrive here, it is not filtered for protocols, unlike the virus scanner.
    New exceptions can be added directly in the input field.
    So an exception for www.securepoint.de would be: .*\.securepoint\.de"
  • Regex exceptions do not apply to transparent mode!
    • Compare exceptions with the SNI:
    Only available if salidate SNI is active.    		 Off Applies Server Name Indication validation only to activated  Exceptions of SSL-Interception .
    Ausnahmen: .*\.ttt-point\.de
    Vordefiniert im Globalen Konfigurationsprofil:
    .*\.ikarus\.at.*\.mailsecurity\.at .*91\.212\.136\..*    		 Ausnahmen bestimmen, hier für ttt-point.de

    Peer verification exceptions

    Peer verification exceptions

    only if peer verification is active
    Enabled Off Here exceptions for certificate verification in regex format can be added.


    Captive Portal

    The Captive Portal is configured since v12.1 in its own menu under Applications Captive Portal . There is a separate Wiki-article for this.

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/APP/HTTP_Proxy&oldid=99528"