Overview
Virtual Private Network (VPN) establishes secure, reliable, and cost-effective encrypted connections between your on-premises network or data center and a virtual network on the cloud.
-
VPN supports only non-cross-border connections.
-- A VPN gateway provides an Internet egress for a Virtual Private Cloud (VPC) to connect to a customer gateway in your on-premises data center.
- A VPN connection connects a VPN gateway to a customer gateway through encrypted tunnels, enabling communication between a VPC and your on-premises data center. This helps quickly establish a secure hybrid cloud environment.
Figure 1 shows the VPN networking.
- +
Creating a VPN
+Overview
By default, ECSs in a VPC cannot communicate with devices in your on-premises data center or private network. To enable communication between them, you can use a VPN by creating it in your VPC and updating security group rules.
Components
- VPN gateway: a virtual gateway of VPN on the cloud. It establishes secure private connections with a customer gateway in your on-premises network or data center.
- Customer gateway: a resource that provides information to the cloud about your customer gateway device. It can be a physical device or software application in your on-premises data center.
- VPN connection: a secure channel between a VPN gateway and a customer gateway. VPN connections use the Internet Key Exchange (IKE) and IPsec protocols to encrypt the transmitted data.
IPsec VPN Topology
In Figure 1, the VPC has subnets 192.168.1.0/24 and 192.168.2.0/24. Your on-premises data center has subnets 192.168.3.0/24 and 192.168.4.0/24. You can use VPN to enable subnets in the VPC to communicate with those in your data center.
+ +
Site-to-site VPN is supported to enable communication between VPC subnets and on-premises data center subnets. Before establishing an IPsec VPN, ensure that the on-premises data center where the VPN is to be established meets the following conditions:
+- On-premises devices that support the standard IPsec protocol are available.
- The on-premises devices have fixed public IP addresses, which can be statically configured or translated by NAT.
- The on-premises subnets do not conflict with VPC subnets, and devices in the on-premises subnets can communicate with the on-premises devices.
If the preceding conditions are met, ensure that the IKE policies and IPsec policies at both ends are consistent and the subnets at both ends are matched pairs when configuring IPsec VPN.
+After the configuration is complete, VPN negotiation needs to be triggered by private network data flows.
+Scenarios
You need a VPN that sets up a secure, isolated communications tunnel between your on-premises data center and cloud services.
+Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click
in the upper left corner, and choose . - In the navigation pane on the left, choose Virtual Private Network.
If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.
+ - On the Virtual Private Network page, click Create VPN.
If Enterprise Edition VPN is available for the selected region, click Create VPN on the Classic page.
+ - Configure required parameters and click Create Now.
Table 1, Table 2, and Table 3 describe the parameters.
+ ++ +
+Table 1 Basic parameters Parameter
+Description
+Example Value
+Region
+Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across regions. For low network latency and fast resource access, select the region nearest to your target users.
+eu-de
+Name
+The VPN name
+VPN-001
+VPC
+The VPC name
+VPC-001
+Local Subnet
+VPC subnets that will access your on-premises network through a VPN.
+192.168.1.0/24,
+192.168.2.0/24
+Remote Gateway
+The public IP address of the gateway in your data center or on the private network. This IP address is used for communicating with your VPC.
+N/A
+Remote Subnet
+The subnets of your on-premises network that will access a VPC through a VPN. The remote and local subnets cannot overlap with each other. The remote subnets cannot overlap with CIDR blocks involved in existing VPC peering connections created for the VPC.
+192.168.3.0/24,
+192.168.4.0/24
+PSK
+Private key shared by two ends of a VPN connection for negotiation. PSKs configured at both ends of the VPN connection must be the same.
+The PSK can contain 6 to 128 characters.
+Test@123
+Confirm PSK
+Enter the PSK again.
+Test@123
+Advanced Settings
++ +Custom
+Advanced Settings > Tags
+Configure Tags in Advanced Settings.
+-
++ +
+Table 2 IKE policy Parameter
+Description
+Example Value
+Authentication Algorithm
+Hash algorithm used for authentication. The following algorithms are supported:
+- MD5(Insecure. Not recommended.)
- SHA1(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
The default value is SHA2-256.
+SHA2-256
+Encryption Algorithm
+Encryption algorithm. The following algorithms are supported:
+- AES-128
- AES-192
- AES-256
- 3DES(Insecure. Not recommended.)
The default value is AES-128.
+AES-128
+DH Algorithm
+Diffie-Hellman key exchange algorithm. The following algorithms are supported:
+- DH group 1(Insecure. Not recommended.)
- DH group 2(Insecure. Not recommended.)
- DH group 5(Insecure. Not recommended.)
- DH group 14
- Group 15
- Group 16
- Group 19
- Group 20
- Group 21
The default value is Group 14.
+Group 14
+Version
+Version of the IKE protocol. The value can be one of the following:
+- v1 (For security reasons, IKEv1 is not recommended. If your devices support IKEv2, select IKEv2.)
- v2
The default value is v2.
+v2
+Lifetime (s)
+Lifetime of an SA, in seconds
+An SA will be renegotiated when its lifetime expires.
+The default value is 86400.
+86400
+Negotiation Mode
+The value is Main. This parameter is available only when Version is set to v1.
+The default value is Main.
+Main
++
+Table 3 IPsec policy Parameter
+Description
+Example Value
+Authentication Algorithm
+Hash algorithm used for authentication. The following algorithms are supported:
+- SHA1(Insecure. Not recommended.)
- MD5(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
The default value is SHA2-256.
+SHA2-256
+Encryption Algorithm
+Encryption algorithm. The following algorithms are supported:
+- AES-128
- AES-192
- AES-256
- 3DES(Insecure. Not recommended.)
The default value is AES-128.
+AES-128
+PFS
+Algorithm used by the Perfect forward secrecy (PFS) function.
+PFS supports the following algorithms:
+- Disable
- DH group 1(Insecure. Not recommended.)
- DH group 2(Insecure. Not recommended.)
- DH group 5(Insecure. Not recommended.)
- DH group 14
- DH group 15
- DH group 16
- DH group 19
- DH group 20
- DH group 21
The default value is DH group 14.
+DH group 14
+Transfer Protocol
+Security protocol used in IPsec to transmit and encapsulate user data. The following protocols are supported:
+- AH
- AH-ESP
- ESP
The default value is ESP.
+ESP
+Lifetime (s)
+Lifetime of an SA, in seconds
+An SA will be renegotiated when its lifetime expires.
+The default value is 3600.
+3600
++ An IKE policy specifies the encryption and authentication algorithms to be used in the negotiation phase of an IPsec tunnel. An IPsec policy specifies the protocol, encryption algorithm, and authentication algorithm to be used in the data transmission phase of an IPsec tunnel. The IKE and IPsec policies must be the same at both ends of a VPN connection. Otherwise, the VPN connection cannot be set up.
+ - Submit your application. +
- You need to configure an IPsec VPN tunnel on the router or firewall in your on-premises data center.
- For a list of protocols supported by VPN connections, see Reference Standards and Protocols.
- Most devices that meet IPsec VPN standards and protocol requirements can be used as VPN devices. For example, a Fortinet FortiGate firewall can be used as a VPN device. For details, see Configuring VPN When Fortinet FortiGate Firewall Is Used.
Other devices that meet the requirements outlined in the reference protocols described in section Reference Standards and Protocols can also be deployed. However, some devices may not be supported because of the inconsistent protocol implementation methods of these devices. If connections cannot be set up, rectify the fault by referring to What Do I Do If a VPN Connection Fails to Be Established? or contact technical support.
+
-
-
- What Is VPN?
+ - What Is VPN?
- Product Advantages
@@ -18,9 +18,9 @@
- Differences between Enterprise Edition VPN and Classic VPN
- - Security
+ - Security
- - Permissions Management
+ - IAM-based Permissions Management
- Basic Concepts
diff --git a/docs/vpn/umn/vpn_01_0002.html b/docs/vpn/umn/vpn_01_0002.html
index ede6de738..6e53b6614 100644
--- a/docs/vpn/umn/vpn_01_0002.html
+++ b/docs/vpn/umn/vpn_01_0002.html
@@ -1,21 +1,21 @@
-
+
- High security
- Data is encrypted using IKE/IPsec, ensuring high data security.
- A VPN gateway is exclusive to a tenant, isolating tenants from each other.
- High availability
- A VPN gateway provides two IP addresses to establish dual independent VPN connections with a customer gateway. If one VPN connection fails, traffic can be quickly switched to the other VPN connection.
- Active-active gateways are deployed in different availability zones (AZs) to ensure AZ-level high availability.
- Active/Standby mode: In normal cases, a VPN gateway communicates with a customer gateway through the active connection. If the active connection fails, traffic is automatically switched to the standby VPN connection. After the fault is rectified, traffic is switched back to the active VPN connection.
- Cost-effectiveness
- IPsec connections over the Internet provide a cost-effective alternative to Direct Connect.
- A VPN gateway can be bound to elastic IP addresses (EIPs) that share bandwidth, reducing bandwidth costs.
- The bandwidth can be adjusted when an EIP instance is created.
Enterprise Edition VPN has the following advantages:
+- High security
- Data is encrypted using IKE/IPsec or SSL, ensuring high data security.
- A VPN gateway is exclusive to a tenant, isolating tenants from each other.
- High availability
- A VPN gateway provides two IP addresses to establish dual independent VPN connections with a customer gateway. If one VPN connection fails, traffic can be quickly switched to the other VPN connection.
- Active-active gateways are deployed in different availability zones (AZs) to ensure AZ-level high availability.
- Active/Standby mode: In normal cases, a VPN gateway communicates with a customer gateway through the active connection. If the active connection fails, traffic is automatically switched to the standby VPN connection. After the fault is rectified, traffic is switched back to the active VPN connection.
- High availability (HA) mode: S2C VPN supports active/standby and active-active modes.
- Cost-effectiveness
- IPsec connections over the Internet provide a cost-effective alternative to Direct Connect.
- A VPN gateway can be bound to elastic IP addresses (EIPs) that share bandwidth, reducing bandwidth costs.
- The bandwidth can be adjusted when an EIP instance is created.
- Easy to use
- A VPN gateway supports multiple connection modes, including policy-based, static routing, and BGP routing, to meet different access requirements of customer gateways.
- A VPN gateway on the cloud can function as a VPN hub, enabling on-premises branch sites to access each other.
- A VPN connection can be created in a few simple steps on the VPN device in an on-premises data center and on the VPN console, and is ready to use immediately after being created.
- VPN can be used together with the enterprise router service, allowing enterprises to build more flexible cloud-based networks.
- Private VPN gateways are supported to encrypt traffic transmitted over Direct Connect connections, improving data transmission security.
- Easy to use
- A VPN gateway supports multiple connection modes, including policy-based, static routing, and BGP routing, to meet different access requirements of customer gateways.
- A VPN gateway on the cloud can function as a VPN hub, enabling on-premises branch sites to access each other.
- A VPN connection can be created in a few simple steps on the VPN device in an on-premises data center and on the VPN console, and is ready to use immediately after being created.
- VPN can be used together with the enterprise router service, allowing enterprises to build more flexible cloud-based networks.
- Private VPN gateways are supported to encrypt traffic transmitted over Direct Connect connections, improving data transmission security.
- In S2C VPN, you can flexibly enable or disable branch interconnection to implement interconnection or isolation between customer gateways, respectively.
Classic VPN has the following advantages:
-- High security
Dedicated devices are used to encrypt data through IKE and IPsec protocols, offering carrier-class reliability and ensuring stable VPN connections from perspectives of hardware, software, and links.
+Classic VPN has the following advantages:
+- High security
Dedicated devices are used to encrypt data through IKE and IPsec protocols, offering carrier-class reliability and ensuring stable VPN connections from perspectives of hardware, software, and links.
- Seamless scaling
You can connect your on-premises data center to your VPC to quickly extend services at the local data center to the cloud, forming a hybrid cloud.
+- Seamless scaling
You can connect your on-premises data center to your VPC to quickly extend services at the local data center to the cloud, forming a hybrid cloud.
- Cost-effectiveness
IPsec connections over the Internet provide a cost-effective alternative to Direct Connect.
+- Cost-effectiveness
IPsec connections over the Internet provide a cost-effective alternative to Direct Connect.
- Easy to use
A VPN connection can be created in a few simple steps on the VPN device in an on-premises data center and on the VPN console, and is ready to use immediately after being created.
+- Easy to use
A VPN connection can be created in a few simple steps on the VPN device in an on-premises data center and on the VPN console, and is ready to use immediately after being created.
- Easy to use
- Cost-effectiveness
- Seamless scaling
- High security
diff --git a/docs/vpn/umn/vpn_01_0005.html b/docs/vpn/umn/vpn_01_0005.html index 3a41dc896..3264e1285 100644 --- a/docs/vpn/umn/vpn_01_0005.html +++ b/docs/vpn/umn/vpn_01_0005.html @@ -23,6 +23,7 @@-VPN connection groups per VPN gateway
100
+- VPN gateway of the Basic specification: 10
- VPN gateway of other specifications: 100
Enterprise Edition VPN
@@ -37,6 +38,7 @@Number of BGP routes that a VPN gateway can receive from a customer gateway through a connection
100
+- VPN gateway of the Basic specification: 100
- VPN gateway of the Professional 1 specification: 200
- VPN gateway of the Professional 2 specification: 300
- In multi-subnet scenarios, you are advised to use VPN connections in routing mode. For a VPN connection in policy-based or policy template mode, a VPN gateway creates a communications tunnel for each pair of the local and customer subnets by default. If there are multiple local or customer subnets for a VPN connection in policy-based or policy template mode, multiple communications tunnels are created.
Each IP address of a VPN gateway supports a maximum of 100 communications tunnels for connecting to customer gateways.
-- In routing mode, each VPN connection occupies only one communications tunnel of the corresponding VPN gateway IP address.
- In policy-based or policy template mode, each VPN connection occupies M x N communications tunnels of the corresponding VPN gateway IP address. M indicates the number of local subnets, and N indicates the number of customer subnets.
If the number of communications tunnels occupied by all VPN connections in different modes established by a single gateway IP address has reached 100, excess VPN connections will fail to be created.
+- In multi-subnet scenarios, you are advised to use VPN connections in routing mode. For a VPN connection in policy-based or policy template mode, a VPN gateway creates a communications tunnel for each pair of the local and customer subnets by default. If there are multiple local or customer subnets for a VPN connection in policy-based or policy template mode, multiple communications tunnels are created.
For a VPN gateway of the Basic, Professional 1 or Professional 2 specification, a single IP address can be used to establish a maximum of 300 communications tunnels with customer gateways..
+- In routing mode, each VPN connection occupies only one communications tunnel of the corresponding VPN gateway IP address.
- In policy-based or policy template mode, each VPN connection occupies M x N communications tunnels of the corresponding VPN gateway IP address. M indicates the number of local subnets, and N indicates the number of customer subnets.
For a VPN gateway of the Basic, Professional 1 or Professional 2 specification, a maximum of 300 source and destination subnet pairs are supported for each IP address used to establish connections with customer gateways.
+
If the number of communications tunnels occupied by all VPN connections in different modes established by a single gateway IP address exceeds 100, excess VPN connections will fail to be created.
+If the number of communications tunnels occupied by VPN connections in different modes established by a single IP address of a VPN gateway of the Professional 1 or Professional 2 specification exceeds 300, excess VPN connections will fail to be created.
- When creating a VPN connection in policy-based mode and adding multiple policy rules, ensure that the source and destination CIDR blocks in different policy rules do not overlap. Otherwise, data flows may be incorrectly matched or IPsec tunnels may flap.
Product Advantages
-Enterprise Edition VPN has the following advantages:
-Reference Standards and Protocols
-The following standards and protocols are associated with VPN:
-- RFC 2403: The Use of HMAC-MD5-96 within ESP and AH
- RFC 2404: The Use of HMAC-SHA-1-96 within ESP and AH
- RFC 2409: The Internet Key Exchange (IKE)
- RFC 2451: The ESP CBC-Mode Cipher Algorithms
- RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
- RFC 3566: The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec
- RFC 3602: The AES-CBC Cipher Algorithm and Its Use with IPsec
- RFC 3664: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
- RFC 4109: Algorithms for Internet Key Exchange version 1 (IKEv1)
- RFC 4434: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4868: Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 4302: IP Authentication Header
- RFC 4303: IP Encapsulating Security Payload (ESP)
- RFC 4305: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4306: Internet Key Exchange (IKEv2)Protocol
- RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)
- RFC 4308: Cryptographic Suites for IPsec
- RFC 5282: Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol
- RFC 6989: Additional Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7321: Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 8247: Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 3947: Negotiation of NAT-Traversal in the IKE
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
- RFC 4271: A Border Gateway Protocol 4 (BGP-4)
The following standards and protocols are associated with VPN:
+- RFC 2403: The Use of HMAC-MD5-96 within ESP and AH
- RFC 2404: The Use of HMAC-SHA-1-96 within ESP and AH
- RFC 2409: The Internet Key Exchange (IKE)
- RFC 2451: The ESP CBC-Mode Cipher Algorithms
- RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
- RFC 3566: The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec
- RFC 3602: The AES-CBC Cipher Algorithm and Its Use with IPsec
- RFC 3664: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
- RFC 4109: Algorithms for Internet Key Exchange version 1 (IKEv1)
- RFC 4434: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4868: Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 4302: IP Authentication Header
- RFC 4303: IP Encapsulating Security Payload (ESP)
- RFC 4305: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4306: Internet Key Exchange (IKEv2)Protocol
- RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)
- RFC 4308: Cryptographic Suites for IPsec
- RFC 5282: Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol
- RFC 6989: Additional Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7321: Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 8247: Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 3947: Negotiation of NAT-Traversal in the IKE
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
- RFC 4271: A Border Gateway Protocol 4 (BGP-4)
Permissions Management
-If you need to assign different permissions to personnel in your enterprise to access your VPN resources created on the cloud service platform, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your resources.
-With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific cloud resources. For example, some software developers in your enterprise need to use VPN resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using VPN resources.
-If your account does not need individual IAM users for permissions management, skip this section, which has no impact on using functions of VPN.
-IAM is a free service. You only pay for the resources in your account.
-For more information about IAM, see IAM Service Overview.
-VPN Permissions
New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.
-VPN is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects in the specified regions, the users only have permissions for VPN in the selected projects. If you set Scope to All resources, users have permissions for VPN in all region-specific projects. When accessing VPN, the users need to switch to the authorized region.
-You can grant permissions by using roles or policies.
-- Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. Some roles depend other roles to take effect. When you assign such roles to users, remember to assign the roles they depend on. However, roles are not an ideal choice for fine-grained authorization and secure access control.
- Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, administrators can grant IAM users only permissions to manage VPN resources of a certain type.
System Role/Policy Name +IAM-based Permissions Management+If you need to assign different permissions to personnel in your enterprise to access your VPN resources created on the cloud service platform, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your resources. +With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific cloud resources. For example, some software developers in your enterprise need to use VPN resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using VPN resources. +If your account does not need individual IAM users for permissions management, skip this section, which has no impact on using functions of VPN. +IAM is a free service. You only pay for the resources in your account. +For more information about IAM, see IAM Service Overview. +VPN PermissionsNew IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned. +VPN is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects in the specified regions, the users only have permissions for VPN in the selected projects. If you set Scope to All resources, users have permissions for VPN in all region-specific projects. When accessing VPN, the users need to switch to the authorized region. +You can grant permissions by using roles or policies. +
Table 1 lists all system-defined permissions for VPN.
+
-
Table 2 lists the common operations supported by system-defined permissions for VPN. +Table 2 lists the common operations supported by system-defined permissions for S2C VPN. -
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
