From 5d5122121b04a4a0e5efecdd62ab53b95ccaec1a Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Fri, 26 Nov 2021 15:58:05 +0400 Subject: [PATCH 01/10] Create l3vpn-hub-and-spoke.rst --- docs/configexamples/l3vpn-hub-and-spoke.rst | 75 +++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 docs/configexamples/l3vpn-hub-and-spoke.rst diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst new file mode 100644 index 00000000..13bf8a79 --- /dev/null +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -0,0 +1,75 @@ + +############################################## +L3VPN for Hub-and-Spoke connectivity with VyOS +############################################## + +IP/MPLS technology is widely used by various service providers and large +enterprises in order to achieve better network scalability, manageability +and flexibility. It also provides the possibility to deliver different +services for the customers in a seamless manner. +Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered +through OSI layer 3 networking technologies. Often the border gateway +protocol (BGP) is used to send and receive VPN-related data that is +responsible for the control plane. L3VPN utilizes virtual routing and +forwarding (VRF) techniques to receive and deliver user data as well as +separate data planes of the end-users. It is built using a combination of +IP- and MPLS-based information. Generally, L3VPNs are used to send data +on back-end VPN infrastructures, such as for VPN connections between data +centres, HQs and branches. + +An L3VPN consists of multiple access links, multiple VPN routing and +forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. +An L3VPN can be configured to connect two or more customer sites. +In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have +unique Route Distinguishers (RDs). In order to use the hub site as a +transit point for connectivity in such an environment, the spoke sites +export their routes to the hub. Spokes can talk to hubs, but never have +direct paths to other spokes. All traffic between spokes is controlled +and delivered over the hub site. + + +To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple +requirements in order to properly implement the solution. +We'll use the following nodes in our LAB environment: + +* 2 x Route reflectors (VyOS-RRx) +* 4 x Provider routers (VyOS-Px) +* 3 x Provider Edge (VyOs-PEx) +* 3 x Customer Edge (VyOS-CEx) + +The following software was used in the creation of this document: + +* Operating system: VyOS +* Version: 1.4-rolling-202110310317 +* Image name: vyos-1.4-rolling-202110310317-amd64.iso + +**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) +– The configurations below are specifically for VyOS 1.4.x. + + + +***************** +How does it work? +***************** + +As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic +between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE +and the VyOS-CE1-HUB is the central customer office device that is responsible +for controlling access between all spokes and announcing its network prefixes +(100.100.100.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +own Route-Distinguisher(RD) and route-target import/export lists. +Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to +the nodes across network where PEs Spokes import the route-target 60535:1030 +(this is export route-target of vrf BLUE_HUB) and export its own route-target +60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the +Customer edge nodes can only learn the network prefixes of the HUB site +[100.100.100.100/32]. For this example VyOS-CE1 has network prefixes +[80.80.80.80/32] / VyOS-CE2 has network prefixes [90.90.90.90/32]. +Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network +routes exchange and minimize iBGP peerings between devices. + +L3VPN configuration parameters table: + + + + From 3ef79632b5fca1e8c1363c68d839e93af05d49e1 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Fri, 26 Nov 2021 16:12:40 +0400 Subject: [PATCH 02/10] Update l3vpn-hub-and-spoke.rst --- docs/configexamples/l3vpn-hub-and-spoke.rst | 22 +++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 13bf8a79..935f3d82 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -70,6 +70,28 @@ routes exchange and minimize iBGP peerings between devices. L3VPN configuration parameters table: ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ + From 8686fda24839acb92dd3c24cb7b7a8c325b08859 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Fri, 26 Nov 2021 16:15:33 +0400 Subject: [PATCH 03/10] Update l3vpn-hub-and-spoke.rst --- docs/configexamples/l3vpn-hub-and-spoke.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 935f3d82..66ad32fe 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -93,5 +93,12 @@ L3VPN configuration parameters table: +---------------------------------------+---------------------+ +******** +Topology +******** +.. image:: /_static/images/Wan_load_balancing1.png + :width: 80% + :align: center + :alt: Network Topology Diagram From e87ed44e3b6a678a23b1eb5b425463b8d65e2ed7 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Fri, 26 Nov 2021 17:31:13 +0400 Subject: [PATCH 04/10] Update l3vpn-hub-and-spoke.rst --- docs/configexamples/l3vpn-hub-and-spoke.rst | 683 +++++++++++++++++++- 1 file changed, 655 insertions(+), 28 deletions(-) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 66ad32fe..3a616873 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -46,6 +46,18 @@ The following software was used in the creation of this document: **NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) – The configurations below are specifically for VyOS 1.4.x. +General information can be found in the :ref:`l3vpn-vrfs` chapter. + + + +******** +Topology +******** +.. image:: /_static/images/L3VPN_hub_spoke.png + :width: 80% + :align: center + :alt: Network Topology Diagram + ***************** @@ -70,35 +82,650 @@ routes exchange and minimize iBGP peerings between devices. L3VPN configuration parameters table: -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ ++----------+-------+------------+-----------------+-------------+-------------+ +| Node | Role | VRF | RD | RT import | RT export | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | +| | | | | 65035:1030 | | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ -******** -Topology -******** -.. image:: /_static/images/Wan_load_balancing1.png - :width: 80% - :align: center - :alt: Network Topology Diagram + +************* +Configuration +************* + +Step-1: Configuring IGP and enabling MPLS LDP +===================================== + +At the first step we need to configure the IP/MPLS backbone network using OSPF as +IGP protocol and LDP as label-switching protocol for the base connectivity between +**P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** (eflector) nodes: + +- VyOS-P1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '3.3.3.3/32' + set interfaces ethernet eth0 address '172.16.30.1/24' + set interfaces ethernet eth1 address '172.16.40.1/24' + set interfaces ethernet eth2 address '172.16.90.1/24' + set interfaces ethernet eth3 address '172.16.10.1/24' + set interfaces ethernet eth5 address '172.16.100.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth5' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '3.3.3.3' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '3.3.3.3' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '3.3.3.3 + + +- VyOS-P2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '4.4.4.4/32' + set interfaces ethernet eth0 address '172.16.30.2/24' + set interfaces ethernet eth1 address '172.16.20.1/24' + set interfaces ethernet eth2 address '172.16.120.1/24' + set interfaces ethernet eth3 address '172.16.60.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '4.4.4.4' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '4.4.4.4' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '4.4.4.4' + +- VyOS-P3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '5.5.5.5/32' + set interfaces ethernet eth0 address '172.16.110.1/24' + set interfaces ethernet eth1 address '172.16.40.2/24' + set interfaces ethernet eth2 address '172.16.50.1/24' + set interfaces ethernet eth3 address '172.16.70.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '5.5.5.5' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '5.5.5.5' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '5.5.5.5' + +- VyOS-P4: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '6.6.6.6/32' + set interfaces ethernet eth0 address '172.16.80.2/24' + set interfaces ethernet eth1 address '172.16.130.1/24' + set interfaces ethernet eth2 address '172.16.50.2/24' + set interfaces ethernet eth3 address '172.16.60.2/24' + set interfaces ethernet eth5 address '172.16.140.1/24' + + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth5' + set protocols mpls ldp discovery transport-ipv4-address '6.6.6.6' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '6.6.6.6' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '6.6.6.6' + +- VyOS-PE1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '7.7.7.7/32' + set interfaces ethernet eth0 address '172.16.90.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '7.7.7.7' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '7.7.7.7' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '7.7.7.7' + +- VyOS-PE2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '8.8.8.8/32' + set interfaces ethernet eth0 address '172.16.110.2/24' + set interfaces ethernet eth1 address '172.16.100.2/24' + set interfaces ethernet eth2 address '172.16.80.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '8.8.8.8' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp router-id '8.8.8.8' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '8.8.8.8' + +- VyOS-PE3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.10.10.10/32' + set interfaces ethernet eth0 address '172.16.140.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.10.10.10' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.10.10.10' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.10.10.10' + +- VyOS-RR1: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth1 address '172.16.20.2/24' + set interfaces ethernet eth2 address '172.16.10.2/24' + set interfaces dummy dum10 address '1.1.1.1/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls ldp discovery transport-ipv4-address '1.1.1.1' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp router-id '1.1.1.1' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '1.1.1.1' + +- VyOS-RR2: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth0 address '172.16.80.1/24' + set interfaces ethernet eth1 address '172.16.70.2/24' + set interfaces dummy dum10 address '2.2.2.2/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '2.2.2.2' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '2.2.2.2' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '2.2.2.2' + + + +Step-2: Configuring iBGP for L3VPN control-plane +================================================ + +At this step we are going to enable iBGP protocol on MPLS nodes and +Route Reflectors (two routers for redundancy) that will deliver IPv4 +VPN (L3VPN) routes between them: + +- VyOS-RR1: + +.. code-block:: none + + set protocols bgp local-as '65001' + set protocols bgp neighbor 7.7.7.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 7.7.7.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 8.8.8.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 8.8.8.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 9.9.9.9 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 9.9.9.9 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.10.10.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.10.10.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '1.1.1.1' + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '1.1.1.1' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-RR2: + +.. code-block:: none + + set protocols bgp local-as '65001' + set protocols bgp neighbor 7.7.7.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 7.7.7.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 8.8.8.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 8.8.8.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 9.9.9.9 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 9.9.9.9 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.10.10.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.10.10.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '1.1.1.1' + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '2.2.2.2' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE1: + +.. code-block:: none + + set protocols bgp local-as '65001' + set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '7.7.7.7' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE2: + +.. code-block:: none + + set protocols bgp local-as '65001' + set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '8.8.8.8' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE3: + +.. code-block:: none + + set protocols bgp local-as '65001' + set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.10.10.10' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + + + +Step-3: Configuring L3VPN VRFs on PE nodes +========================================== + +This section provides configuration steps for setting up VRFs on our +PE nodes including CE facing interfaces, BGP, rd and route-target +import/export based on the pre-defined parameters. + +- VyOS-PE1: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp local-as '65001' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.50.50.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + +- VyOS-PE2: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_HUB table '400' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' + set vrf name BLUE_HUB protocols bgp local-as '65001' + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.80.80.1/24' + set interfaces ethernet eth3 vrf 'BLUE_HUB' + +- VyOS-PE3: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp local-as '65001' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.60.60.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + + + +Step-4: Configuring CE nodes +============================ + +Dynamic routing used between CE and PE nodes and eBGP peering +established for the route exchanging between them. All routes +received by PEs are then exported to L3VPN and delivered from +Spoke sites to Hub and vise-versa based on previously +configured L3VPN parameters. + +- VyOS-CE1-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '80.80.80.80/32' + set interfaces ethernet eth0 address '10.50.50.2/24' + + # BGP for peering with PE + set protocols bgp 65035 address-family ipv4-unicast network 80.80.80.80/32 + set protocols bgp 65035 neighbor 10.50.50.1 ebgp-multihop '2' + set protocols bgp 65035 neighbor 10.50.50.1 remote-as '65001' + set protocols bgp 65035 neighbor 10.50.50.1 update-source 'eth0' + set protocols bgp 65035 parameters default no-ipv4-unicast + set protocols bgp 65035 parameters log-neighbor-changes + set protocols bgp 65035 parameters router-id '10.50.50.2' + +- VyOS-CE1-HUB: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '100.100.100.100/32' + set interfaces ethernet eth0 address '10.80.80.2/24' + + # BGP for peering with PE + set protocols bgp 65035 address-family ipv4-unicast network 100.100.100.100/32 + set protocols bgp 65035 address-family ipv4-unicast redistribute connected + set protocols bgp 65035 neighbor 10.80.80.1 ebgp-multihop '2' + set protocols bgp 65035 neighbor 10.80.80.1 remote-as '65001' + set protocols bgp 65035 neighbor 10.80.80.1 update-source 'eth0' + set protocols bgp 65035 parameters default no-ipv4-unicast + set protocols bgp 65035 parameters log-neighbor-changes + set protocols bgp 65035 parameters router-id '10.80.80.2' + +- VyOS-CE2-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '90.90.90.90/32' + set interfaces ethernet eth0 address '10.60.60.2/24' + + # BGP for peering with PE + set protocols bgp 65035 address-family ipv4-unicast network 90.90.90.90/32 + set protocols bgp 65035 neighbor 10.60.60.1 ebgp-multihop '2' + set protocols bgp 65035 neighbor 10.60.60.1 remote-as '65001' + set protocols bgp 65035 neighbor 10.60.60.1 update-source 'eth0' + set protocols bgp 65035 parameters default no-ipv4-unicast + set protocols bgp 65035 parameters log-neighbor-changes + set protocols bgp 65035 parameters router-id '10.60.60.2' + + + +Step-5: Verification +==================== + +This section describes verification commands for MPLS/BGP/LDP +protocols and L3VPN related routes as well as diagnosis and +reachability checks between CE nodes. + +Let’s check IPv4 routing and MPLS information on provider nodes +(same procedure for all P nodes): + +- “show ip ospf neighbor” for checking ospf relationship + +.. code-block:: none + + vyos@VyOS-P1:~$ show ip ospf neighbor + + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 4.4.4.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 5.5.5.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 7.7.7.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 1.1.1.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 8.8.8.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + +- “show mpls ldp neighbor “ for checking ldp neighbors + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp neighbor + AF ID State Remote Address Uptime + ipv4 1.1.1.1 OPERATIONAL 1.1.1.1 07w5d06h + ipv4 4.4.4.4 OPERATIONAL 4.4.4.4 09w3d00h + ipv4 5.5.5.5 OPERATIONAL 5.5.5.5 09w2d23h + ipv4 7.7.7.7 OPERATIONAL 7.7.7.7 03w0d01h + ipv4 8.8.8.8 OPERATIONAL 8.8.8.8 01w3d02h + +- “show mpls ldp binding” for checking mpls label assignment + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp discovery + AF Destination Nexthop Local Label Remote Label In Use + ipv4 1.1.1.1/32 1.1.1.1 23 imp-null yes + ipv4 1.1.1.1/32 4.4.4.4 23 20 no + ipv4 1.1.1.1/32 5.5.5.5 23 17 no + ipv4 1.1.1.1/32 7.7.7.7 23 16 no + ipv4 1.1.1.1/32 8.8.8.8 23 16 no + ipv4 2.2.2.2/32 1.1.1.1 20 16 no + ipv4 2.2.2.2/32 4.4.4.4 20 22 no + ipv4 2.2.2.2/32 5.5.5.5 20 24 yes + ipv4 2.2.2.2/32 7.7.7.7 20 17 no + ipv4 2.2.2.2/32 8.8.8.8 20 17 no + ipv4 3.3.3.3/32 1.1.1.1 imp-null 17 no + ipv4 3.3.3.3/32 4.4.4.4 imp-null 16 no + ipv4 3.3.3.3/32 5.5.5.5 imp-null 18 no + ipv4 3.3.3.3/32 7.7.7.7 imp-null 18 no + ipv4 3.3.3.3/32 8.8.8.8 imp-null 18 no + ipv4 4.4.4.4/32 1.1.1.1 16 18 no + ipv4 4.4.4.4/32 4.4.4.4 16 imp-null yes + ipv4 4.4.4.4/32 5.5.5.5 16 19 no + ipv4 4.4.4.4/32 7.7.7.7 16 19 no + ipv4 4.4.4.4/32 8.8.8.8 16 19 no + ipv4 5.5.5.5/32 1.1.1.1 21 19 no + ipv4 5.5.5.5/32 4.4.4.4 21 17 no + ipv4 5.5.5.5/32 5.5.5.5 21 imp-null yes + ipv4 5.5.5.5/32 7.7.7.7 21 20 no + ipv4 5.5.5.5/32 8.8.8.8 21 20 no + ipv4 6.6.6.6/32 1.1.1.1 17 20 no + ipv4 6.6.6.6/32 4.4.4.4 17 23 yes + ipv4 6.6.6.6/32 5.5.5.5 17 21 yes + ipv4 6.6.6.6/32 7.7.7.7 17 21 no + ipv4 6.6.6.6/32 8.8.8.8 17 21 no + ipv4 7.7.7.7/32 1.1.1.1 22 21 no + ipv4 7.7.7.7/32 4.4.4.4 22 18 no + ipv4 7.7.7.7/32 5.5.5.5 22 20 no + ipv4 7.7.7.7/32 7.7.7.7 22 imp-null yes + ipv4 7.7.7.7/32 8.8.8.8 22 22 no + ipv4 8.8.8.8/32 1.1.1.1 24 22 no + ipv4 8.8.8.8/32 4.4.4.4 24 19 no + ipv4 8.8.8.8/32 5.5.5.5 24 16 no + ipv4 8.8.8.8/32 7.7.7.7 24 22 no + ipv4 8.8.8.8/32 8.8.8.8 24 imp-null yes + ipv4 9.9.9.9/32 1.1.1.1 18 23 no + ipv4 9.9.9.9/32 4.4.4.4 18 21 yes + ipv4 9.9.9.9/32 5.5.5.5 18 22 no + ipv4 9.9.9.9/32 7.7.7.7 18 23 no + ipv4 9.9.9.9/32 8.8.8.8 18 23 no + ipv4 10.10.10.10/32 1.1.1.1 19 24 no + ipv4 10.10.10.10/32 4.4.4.4 19 24 yes + ipv4 10.10.10.10/32 5.5.5.5 19 23 yes + ipv4 10.10.10.10/32 7.7.7.7 19 24 no + ipv4 10.10.10.10/32 8.8.8.8 19 24 no + +Now we’re checking iBGP status and routes from route-reflector +nodes to other devices: + +- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary + BGP router identifier 1.1.1.1, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 4, using 85 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 7.7.7.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 8.8.8.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 9.9.9.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.10.10.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + + Total number of neighbors 4 + +- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn + BGP table version is 2, local router ID is 1.1.1.1, vrf id 0 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + Route Distinguisher: 10.50.50.1:1011 + *>i10.50.50.0/24 7.7.7.7 0 100 0 i + UN=7.7.7.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 7.7.7.7 0 100 0 65035 i + UN=7.7.7.7 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.60.60.1:1011 + *>i10.60.60.0/24 10.10.10.10 0 100 0 i + UN=10.10.10.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.10.10.10 0 100 0 65035 i + UN=10.10.10.10 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.80.80.1:1011 + *>i10.80.80.0/24 8.8.8.8 0 100 0 i + UN=8.8.8.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i100.100.100.100/32 + 8.8.8.8 0 100 0 65035 i + UN=8.8.8.8 EC{65035:1030} label=80 type=bgp, subtype=0 + Route Distinguisher: 172.16.80.1:2011 + *>i10.110.110.0/24 8.8.8.8 0 100 0 65050 i + UN=8.8.8.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 8.8.8.8 0 100 0 i + UN=8.8.8.8 EC{65050:2011} label=81 type=bgp, subtype=0 + Route Distinguisher: 172.16.100.1:2011 + *>i10.210.210.0/24 9.9.9.9 0 100 0 65050 i + UN=9.9.9.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 9.9.9.9 0 100 0 i + UN=9.9.9.9 EC{65050:2011} label=80 type=bgp, subtype=0 + +- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected + for specific VPNv4 destination + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn 100.100.100.100/32 + BGP routing table entry for 10.80.80.1:1011:100.100.100.100/32 + not allocated + Paths: (1 available, best #1) + Advertised to non peer-group peers: + 7.7.7.7 8.8.8.8 9.9.9.9 10.10.10.10 + 65035, (Received from a RR-client) + 8.8.8.8 from 8.8.8.8 (8.8.8.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 + +Also we can verify how PE devices receives VPNv4 networks from the RRs +and installing them to the specific customer VRFs: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors against + route-reflector devices: + +.. code-block:: none + From 85b65077685fe60cc1f54cbcd23dcaae437ae342 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Sat, 27 Nov 2021 17:32:56 +0400 Subject: [PATCH 05/10] Update l3vpn-hub-and-spoke.rst --- docs/configexamples/l3vpn-hub-and-spoke.rst | 399 ++++++++++++++++++++ 1 file changed, 399 insertions(+) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 3a616873..a2520ea4 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -729,3 +729,402 @@ and installing them to the specific customer VRFs: .. code-block:: none + vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary + BGP router identifier 7.7.7.7, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 1.1.1.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 2.2.2.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + +- “show bgp vrf all” for checking all the prefix learning on BGP + within VRFs: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_SPOKE: + BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + * 10.50.50.0/24 0.0.0.0 0 32768 ? + *> 0.0.0.0 0 32768 i + *> 10.80.80.0/24 8.8.8.8@0< 0 100 0 i + * 8.8.8.8@0< 0 100 0 i + *> 80.80.80.80/32 10.50.50.2 0 0 65035 i + *> 100.100.100.100/32 + 8.8.8.8@0< 0 100 0 65035 ? + * 8.8.8.8@0< 0 100 0 65035 ? + +- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor + information between PE and CE: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary + + + IPv4 Unicast Summary: + BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 + BGP table version 8 + RIB entries 7, using 1344 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + + Total number of neighbors 1 + +- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. + Using this command we are also able to check the transport and + customer label (inner/outer) for Hub network prefix (100.100.100.100/32): + +.. code-block:: none + + vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE + + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + VRF BLUE_SPOKE: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h + C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h + B> 10.80.80.0/24 [200/0] via 8.8.8.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + B>* 80.80.80.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m + B> 100.100.100.100/32 [200/0] via 8.8.8.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the + specific VPNv4 destination including extended community and + remotelabel information. This procedure is the same on all Spoke nodes: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp ipv4 vpn 100.100.100.100/32 + BGP routing table entry for 10.80.80.1:1011:100.100.100.100/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 8.8.8.8 from 1.1.1.1 (8.8.8.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 8.8.8.8, Cluster list: 1.1.1.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 + 65035 + 8.8.8.8 from 2.2.2.2 (8.8.8.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 8.8.8.8, Cluster list: 1.1.1.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 + +Now, let’s check routing information on out Hub PE: +- “show bgp ipv4 vpn summary” for checking iBGP neighbors again + VyOS-RR1/RR2 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary + BGP router identifier 8.8.8.8, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 1.1.1.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 2.2.2.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + + Total number of neighbors + +- “show bgp vrf all” for checking all the prefixes learning on BGP + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_HUB: + BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + *> 10.50.50.0/24 7.7.7.7@0< 0 100 0 i + * 7.7.7.7@0< 0 100 0 i + *> 10.60.60.0/24 10.10.10.10@0< 0 100 0 i + * 10.10.10.10@0< 0 100 0 i + * 10.80.80.0/24 10.80.80.2 0 0 65035 ? + * 0.0.0.0 0 32768 i + *> 0.0.0.0 0 32768 ? + *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i + *> 10.210.210.0/24 9.9.9.9@0< 0 100 0 65050 i + * 9.9.9.9@0< 0 100 0 65050 i + *> 80.80.80.80/32 7.7.7.7@0< 0 100 0 65035 i + * 7.7.7.7@0< 0 100 0 65035 i + *> 90.90.90.90/32 10.10.10.10@0< 0 100 0 65035 i + * 10.10.10.10@0< 0 100 0 65035 i + *> 100.100.100.100/32 + 10.80.80.2 0 0 65035 ? + *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i + *> 172.16.100.0/24 9.9.9.9@0< 0 100 0 i + * 9.9.9.9@0< 0 100 0 i + +- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor + CE Hub device + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary + + IPv4 Unicast Summary: + BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 + BGP table version 50 + RIB entries 19, using 3648 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 + +- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. + With this command we are able to check the transport and + customer label (inner/outer) for network spokes prefixes + 80.80.80.80/32 - 90.90.90.90/32 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + VRF BLUE_HUB: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h + B> 10.50.50.0/24 [200/0] via 7.7.7.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.60.60.0/24 [200/0] via 10.10.10.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h + B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 10.210.210.0/24 [200/0] via 9.9.9.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + B> 80.80.80.80/32 [200/0] via 7.7.7.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 90.90.90.90/32 [200/0] via 10.10.10.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + B>* 100.100.100.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h + B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 172.16.100.0/24 [200/0] via 9.9.9.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, + extended community and remote label of specific destination + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 80.80.80.80/32 + BGP routing table entry for 10.50.50.1:1011:80.80.80.80/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 7.7.7.7 from 1.1.1.1 (7.7.7.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 7.7.7.7, Cluster list: 1.1.1.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 7.7.7.7 from 2.2.2.2 (7.7.7.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 7.7.7.7, Cluster list: 1.1.1.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 90.90.90.90/32 + BGP routing table entry for 10.60.60.1:1011:90.90.90.90/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.10.10.10 from 1.1.1.1 (10.10.10.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.10.10.10, Cluster list: 1.1.1.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.10.10.10 from 2.2.2.2 (10.10.10.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.10.10.10, Cluster list: 1.1.1.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 + +Finally, let’s check the reachability between CEs: + +- VyOS-CE1-SPOKE -----> VyOS-CE-HUB + + +.. code-block:: none + + # check rib + vyos@VyOS-CE1-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m + C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h + B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + C>* 80.80.80.80/32 is directly connected, dum20, 09w0d00h + B>* 100.100.100.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + + # check icmp + vyos@VyOS-CE1-SPOKE:~$ ping 100.100.100.100 interface 80.80.80.80 + PING 100.100.100.100 (100.100.100.100) from 80.80.80.80 : 56(84) bytes of data. + 64 bytes from 100.100.100.100: icmp_seq=1 ttl=62 time=6.52 ms + 64 bytes from 100.100.100.100: icmp_seq=2 ttl=62 time=4.13 ms + 64 bytes from 100.100.100.100: icmp_seq=3 ttl=62 time=4.04 ms + 64 bytes from 100.100.100.100: icmp_seq=4 ttl=62 time=4.03 ms + ^C + --- 100.100.100.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 8ms + rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms + + # check network path + vyos@VyOS-CE1-SPOKE:~$ traceroute 100.100.100.100 + traceroute to 100.100.100.100 (100.100.100.100), 30 hops max, 60 byte packets + 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms + 2 * * * + 3 100.100.100.100 (100.100.100.100) 9.225 ms 9.159 ms 9.121 m + +- VyOS-CE-HUB -------> VyOS-CE1-SPOKE +- VyOS-CE-HUB -------> VyOS-CE2-SPOKE + +.. code-block:: none + + # check rib + vyos@VyOS-CE-HUB:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h + B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + B>* 80.80.80.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 90.90.90.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 100.100.100.100/32 is directly connected, dum20, 01w6d07h + B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + + # check icmp + vyos@VyOS-CE-HUB:~$ ping 80.80.80.80 interface 100.100.100.100 c 4 + PING 80.80.80.80 (80.80.80.80) from 100.100.100.100 : 56(84) bytes of data. + 64 bytes from 80.80.80.80: icmp_seq=1 ttl=62 time=3.31 ms + 64 bytes from 80.80.80.80: icmp_seq=2 ttl=62 time=4.23 ms + 64 bytes from 80.80.80.80: icmp_seq=3 ttl=62 time=3.89 ms + 64 bytes from 80.80.80.80: icmp_seq=4 ttl=62 time=3.22 ms + + --- 80.80.80.80 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms + + vyos@VyOS-CE-HUB:~$ ping 90.90.90.90 interface 100.100.100.100 c 4 + PING 90.90.90.90 (90.90.90.90) from 100.100.100.100 : 56(84) bytes of data. + 64 bytes from 90.90.90.90: icmp_seq=1 ttl=62 time=7.46 ms + 64 bytes from 90.90.90.90: icmp_seq=2 ttl=62 time=4.43 ms + 64 bytes from 90.90.90.90: icmp_seq=3 ttl=62 time=4.60 ms + ^C + --- 90.90.90.90 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 6ms + rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms + + # check network path + vyos@VyOS-CE-HUB:~$ traceroute 80.80.80.80 + traceroute to 80.80.80.80 (80.80.80.80), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms + 2 * * * + 3 80.80.80.80 (80.80.80.80) 8.125 ms 8.019 ms 7.781 ms + + vyos@VyOS-CE-HUB:~$ traceroute 90.90.90.90 + traceroute to 90.90.90.90 (90.90.90.90), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms + 2 * * * + 3 * * * + 4 90.90.90.90 (90.90.90.90) 9.358 ms 9.325 ms 9.292 ms + +- VyOS-CE2-SPOKE -------> VyOS-CE-HUB + +.. code-block:: none + + # check rib + vyos@rt-ce2-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h + C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h + B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + C>* 90.90.90.90/32 is directly connected, dum20, 02w6d00h + B>* 100.100.100.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + + # check icmp + vyos@rt-ce2-SPOKE:~$ ping 100.100.100.100 interface 90.90.90.90 c 4 + PING 100.100.100.100 (100.100.100.100) from 90.90.90.90 : 56(84) bytes of data. + 64 bytes from 100.100.100.100: icmp_seq=1 ttl=62 time=4.97 ms + 64 bytes from 100.100.100.100: icmp_seq=2 ttl=62 time=4.45 ms + 64 bytes from 100.100.100.100: icmp_seq=3 ttl=62 time=4.20 ms + 64 bytes from 100.100.100.100: icmp_seq=4 ttl=62 time=4.29 ms + + --- 100.100.100.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms + + # check network path + vyos@rt-ce2-SPOKE:~$ traceroute 100.100.100.100 + traceroute to 100.100.100.100 (100.100.100.100), 30 hops max, 60 byte packets + 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms + 2 * * * + 3 * * * + 4 100.100.100.100 (100.100.100.100) 7.504 ms 7.480 ms 7.488 ms + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. From 57df76bb532fdee2f0fbffc050b6d902c2233159 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Sat, 27 Nov 2021 17:34:28 +0400 Subject: [PATCH 06/10] Update index.rst --- docs/configexamples/index.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst index b1f34801..a1154e1b 100644 --- a/docs/configexamples/index.rst +++ b/docs/configexamples/index.rst @@ -18,6 +18,7 @@ This chapter contains various configuration examples: ha wan-load-balancing pppoe-ipv6-basic + l3vpn-hub-and-spoke.rst Configuration Blueprints (autotest) @@ -45,4 +46,4 @@ The process will do the following steps: :maxdepth: 1 autotest/L3VPN_EVPN/L3VPN_EVPN - autotest/Wireguard/Wireguard \ No newline at end of file + autotest/Wireguard/Wireguard From bff0668fd74a14c9ca1b324eb917f0fd24cd68c9 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Sat, 27 Nov 2021 17:34:45 +0400 Subject: [PATCH 07/10] Update index.rst --- docs/configexamples/index.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst index a1154e1b..3a3c2849 100644 --- a/docs/configexamples/index.rst +++ b/docs/configexamples/index.rst @@ -18,7 +18,7 @@ This chapter contains various configuration examples: ha wan-load-balancing pppoe-ipv6-basic - l3vpn-hub-and-spoke.rst + l3vpn-hub-and-spoke Configuration Blueprints (autotest) From 3081fa9b884e20af701cbe76ad328b17d0b329cc Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Wed, 1 Dec 2021 13:01:12 +0400 Subject: [PATCH 08/10] L3VPN hub and spoke topo --- docs/_static/images/L3VPN_hub_and_spoke.png | Bin 0 -> 134458 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 docs/_static/images/L3VPN_hub_and_spoke.png diff --git a/docs/_static/images/L3VPN_hub_and_spoke.png b/docs/_static/images/L3VPN_hub_and_spoke.png new file mode 100644 index 0000000000000000000000000000000000000000..d442cc1a87ef0f23ad38954a85260becf5b10cbe GIT binary patch literal 134458 zcmcG$bySpV7dAeGF!a#f2q;J?($d`$(kUP*(%q$WBNBp2cS@IpG}6-2E#2_l<9R*r zyS{Jz{`|4lIVd>KJkP#&T>IMBp0_GW(pczZ=nx15OIAkWIRt{-27w?(LQ%j^9%OjY zfNyB_GTM$12#zuQKZHEtTuTUq1|lmVs_vGyGw151Zq|(Qo0y{ z;M73*l~iv*7%QELC_CHJCj>}{@3d5YBL47vtA6hRZNhNuyufFs&<CfN)&h>bxao;nDhVK8*uj~()VgLEsFfaQ)$)^^-w%s5u z@t?2A0NNBH!v)H}w_rtp*;aLaxd+4LzE{E8VP2V4R762asvQ;;B`qO=Nk?xABP9&) z=^>Gj=%RT>i<^_Cr>?2lZdZGCS@rhM`=oIqkN$$c!-};_1LghuUu2YrB-#^Sl2j=6 z46p=^Bw(bsA*Z)N#cR-{)Tk;V`DB!2rJWQ6F;VDy`&dXqaN%F7YHcuu@X~#3+*tPM zU6+>@+chlAOESsqv&B|STq=Th4cdEtq#s--Q7~4u=qd%FA6&EYp;egD%t;yf z(hgQACMKn=3Go=(N#5SFe{AGrZ3@lloOBHh>mh!rEoEo-EKco5)?<>`{JxS(u8NA- zSThl+B!tcPa+|SnNpIzoKdI{J{o3yPa}U|NLtI9{Q} zTBcPbqo5#auKBd$SStBP-A%2d*;a&ITMELaHVVU+&&$8QFl!Y*H8kY0!E%3#M*>Aoufyh=-xBX z7y4`_h~@1AnW5pfnDk}lPtWV@G@54lNREiYHX~$|zKck_EGlJB|8wki`u{pkO$FCu z6BE3cwA8E+4LLuvo>(Q~(3Jx zoVLNroGEGUwqgE4xy8?Pwmh?Ys#988bL2Q5N@TWhVw-!pgP&J7ahXf7@m zg3mc-`Af-oUZjqPdg7&xh${sed8$#)4u@6&oc9R|(K-%4J|@8>q#R;@H^z*Jh)5IE z%Cq1#x@eoLoQX|~90cR_Jhds_ez5IUNc2eOqkJ;kRGp(mQ&j%s_PDLQy!>{xqJ{=x zj#BzNDj|=>@@^{e{rM(bJiGvK+s^5p`%T1R(8i0k52;uDP8+Zw*w>>$0poJ5;TGRJ zozmSwfqjWuySXywZOvqFy=E_MeGBmNYO3wrOrHQ4B74*E^QMw=$#5c=*y8c#XzKQ} zvsp**XP%aeNDr#Q7o`)kYmq$jelWz^1)qk#!*}n{BS;^2ZJ*p7MEib=q7<;g>KM!r z3b)8`@3L+fc>fqRF)`8EfCu>E1?Jx^E`{ z5sj56Bp|X**sd?}*HXmcOm7P^?H;0g@PIHlSn>sTM5N4{YFaHD8`dD0RqI%hcBM`S zg({_$grsC0W?Nxio?n}h$cLx4V~~Q9EMF|Fwx6}HacGe#Y|pz?DjyPE*O`rorEraC}wH2#JZ; z@wBvyHN8%!Ew;87ywB46d=h^b`QF{KWqq2n>ptC`*&gqRfydOlzcE#4R;?485gQzy zoE;mRFK%Ff5CPIwg<}lJ2(yid)uG9rQyN<8*_x_v(B8e1=k6_68hFZ$pxyk_v)B2J;>?bCs*1iS#6-sh) z@7CUs;{|-Lh?uc!7%+uWtKk2-hm4%pm(aSC?mB-^-||SeMg;0FP3^6&pA%%X-*jeB zyq<+woyKK`?w1NHaz9#2otztnVfvB1vi({0eS5pK<(5APwlPy%T5q$^?7ihqA>=V; zc2noLUeH04KI6I8|K9nO2FXvm(ma3r!JU%X%a>!M6A#v>v&2I^^x>g1XaBF?L;}Cb zHpR1Fl|x5If2S8B$dBXN&(18?tX9hQI_t%ox6jQC3f7$0RTR*^rFE2D2hcfxed!~L z%O)*B&&0GasVLc^@&Z3VLtXu&SznS>SXL0X>%4pJdrPUm-)o2%tg_@P~>S*#Z#hIoR}mXKlhy5;66c=DaszE>am zyma=Ae~bqi-Ca($SnZB$Xlv(Fu`n@pZ@Zi=__pv9zmS!ETYnpZMLy=d>(apg*`Ys$ zGj-jxc4pj#T)>4Dve=u*;ym909P6X?WXU;*&@Jy>P@|p1|1B3P8X6j5VG$hw4v<9f z4R0zAlPU~buqX$puOT>Mb)ch%t1c1*5GE&NeIBdpXLc^Yt1d8fMej-w>DML6!Au+@ zSK#%f1y$o8Q#`=`C476n41rWmM+odU;)_8E2npSb*teijEd%rOnIxiCQY{B!H}<`f%Tb$;yZ-h;jWY`AkR4N%uCJf%ONhz1 ze@ZQf0x6wk|M%|lWsBI!Z;JuxW5{rmZS9w%G(X!V%kZD2L5wo3HK7_1WG_%IOi@gvQN7d;(?akV1=`Rjw}fuI`Axsd-_ULM~qWkg1@ z`Z;s+Hu`n*1!EBGe5v4pR zW4g-|>X)Mgen+7MYSVGEjh!^z_o| z1-ZF3=DNYvmYk!aOuM5*q5k=5xf9#=dtVJVdAe5F&0Q8mxfXXt zQ-ie625jCDt*9vNE_rXzFznlE9D7ViAR~W& zf3|L~jjT{X53b#XmWAyT=bb5BF=&6fz@%9nUI6#&c?x)T(g8Ww>HX0*aGKEiNKbI; zpt_KO2-zv`9y5DE9^iex6bciAXN)bb^$deS(GLy825xO%BHP>B1t(+`6^osrxjdYl zoK~gm7OShP=jY4OO}9d`Z@MW{IE)d+z3J$(a{yFM>ayF7iGcyfTwf1W{Unu7ZF6&d zt>;r75fR~Zp|UzVW8D^T54@9Zt({h*8|UrKzHb9&_f(^M<>dkrDz;O8KmcO$5x|XY z?ZFr$CHexA8?(!|Oc{QxeN*+$ETA?_mS)!9ewK{~ zryp<+<0F82r%-I{F5nMit@fbkZUwc1!<{fd!D4H<(W8U3g-i_eLjUe8f<#M14=?{6W7j& zd&*~l`^XJ9r!#McgwDRIgM#yWX5p5Iq3SrF8!M zUG|_;4mAMI4j+J4lC1Jev1TFJMw+1ebNy%biz47D%m>Jvr>DwIX@gWcDAx_2B%ZkL z&7!p)uxz&aBaM_A3a1R1b0ZfH5eEXW-nOt{C{)@7ZHuDd1NT70rU(7F7U<&T)p+SY zJ2Zr&Sx6`{P&)Sh{d+6u>6n^w{*^B9qaYXww^f2XlrcyplxmDHpa~$*jfrCN>zkVc z0KwX9o_@;9gMx4&;WR;pbQ6bx?1M?c3ljm^cKn6mQhsiR*i4PBP&14(L`R1>*Weloepm0j9kSdVUASK1bK`NmF@kh^ zdrQJ$7N-$z=A%W+Y?~jVGhtUg|+Fbh|uL;&QA0b~}DB-VX3OZAnSFV4X zm)Il23rI{(o-BNkeB_Cv((?A;?yBXET+9ty+-Z`8mSizy)(~wMnE%&d>W`Vr%)4tQ zzf|gZc=7ez$$jP+P*?Z}xxs!Zz{3_abRc>fn_jax+S$(3V2KQPmnh?G+s)PI3#Yn| zf|`^-U7f(!hK_*|8y~M`?Pp#&JvMJ6292gI1a)DIfdhH;N6Mr0q@)}lj^~Ipt(>9J z1LkTCgP>A4=Pmmqp@M)Wf8Cf>A`F_k z9kmEt3}8Zll<0vq#$zfy&-U0Rvu3+N&sVTy1srSZh)G0I{ka4GU`BKacIyv{4(d@W z4_~v*2msLx+S$(*3z6^LyU)zbDk*CG06p=cL&26=lrzOPOI8Zr=hYP=K*^Mza`X+b zh#2_b9%4|4KbT`0Q2rVhAfIfiqHfnV>`Z*nk^kfyxt!Nr(HJr}1G2!M4%ZDN|AUM5 zOwUKF3td%JPn-qJ-fKc@j5|=EOZ+y&A3}nR7QBwI_?@?cK=yI>)+Y`4`tmzo@~RyB zVbUXA#5}a%G+#HhC+1MbKCavSyIUMF-i*DkAnc=IMR|EW)^%zg4JV7VJ953Oys&|)Z~nrc)Cxl*SXiiW1j z^6+7=+0A8;QFk=;i)avgubthsv`B(r@S-IqEHh z7-A6Y)m%OIM3HtN0N_RgsocYxP9RVHv@S)+dtbN)YL?2(5r8DYtbNSv?5-CxDq>|5 z#kvjGLd>EoWyT%w%C(fMmaC+}q_8*NB;c|)`*wI(1vIB!_dkCzO!~a?B&~r&U+C@y z(eqI!nLZ90dKPkRxqbFeM|y_A+)FP+-_rLNU^l#b*Q=twllRM{a`L$W`@@H7ft>eY zj>p(6Vs>`44h|T`{okc)IEOgbwOrURr}+Tk#NS?iEw(~TB%aG-ay5t)HbE$g99%GN z@|#icdfG*h(~cdbxXEvB#A9lgg2$c3S_V2%puqy*Iq1=JCRJ~5sQ4T{cXJiP6gD4? z)xI_yaC{{LeQMTA0DOoisj}r}_x09QWL%HILoz6-9gd zz-%fV;%7I2oXDq5c`gTi3c8}wtc}ICKx3}=dLC&P7Z=8t$D7sjYF3xeN4efSpu?7Z zKpORZe=bDWocu_yz4SW3q`LcsaV&lRL$;@%zJ7~{i*rawNcdExo{!GH>Q?-@isJtL zsNDqnqOv^9d%;oj#=R=CUtXlNrC@-DhQA4oRC`)x$O&^?LAI}bt=MyHyZq-4v?=DT z!BKQwkjdUjOT154fVeDkzLB42AvpY;Yx3Ow#MObr)jp7qOCGHX=}ec@aCBUBXMB-Q zw#pC}7b~l@7%JH2KRZVGh$1fb^;AaVn5Qbyga;3lwGSdie7g=!PLnwVtwUFy(+d_eNE#x@+h0^}KEF)^_*=LEE);5<@vG&k%}r*(>e2i*>K^samO z%L1WBgT@ppkBv(_p+sb0u3}YMP5RjUD@DhvCk0veAOBQ z1(1C#)^E_nYD@U2c=2Nlc*D+o(+qu(TFvUkbXKoBQGz>n>TO5A|k$h zk7oj1>r^`y%4-9?PYPmsX%BrK7{OJMpbeG;n zrDMz&9$KMMzbYprJiO6zv+a5Q(jz^cXU(&C!MV4U)X@>s{tbaVp2(&+k?7qYx!22C zdi_??o)e@L@^0QLN}#oE6}&KTmpt;8ToQbpa(Jted4r*P6(5(*7iy&QrC<1D$oE!F zp9lu?6AeVkZ)yy($BaLda(}J1^?RwqV6uUVmIUIoH+zvP&T&76Ky0yQ#;))zo@g6C z03qtkc6~_4_q>A|MnMq)IMtcu*WEW$wl0UY^X&FrYUw3yqWU==hZ*O0Of2_ZO%~ zMn<-ri*%~x(ur-3)&{g{Y)C;14-!@xJmWobba2=@aTQTi1|t@LGDNIWOL9=PT$BdV z^y;F}b}-Q8RJ61nuar;mT|1!H_OJDNXuPlc@c^?h53OU&z&NU|BaLau71`K*nA|F$ z?DGod&XoINL5Wa99-=PW=I_-c=3^au%xIswQF;<vBfr;sqZ=;h=MOyYGJJ0@bcC$|MW`Cz3R93bt*z-a zX#?|wo6Q4vw)@n==Ewj@^VY`d9H(m2VcEFI6&eaESI?P+#ghS>Xi)hH8B09}>q zBdS|t^S=8Mz$O>VOaO8*Gz&FA@=#Iaqc#&;1X-%#+G7r65e5bZh&@(YZ*T9I-#!>e zXf?PL_pRKvwY8N^+W!S@IP^%Z*tPTN5;^4raosAElilMh!t=&HN^wk(T z(Rgm+g3*$ORPrz(**dwd5#8J|QH?}%6EB1?nHMLTRl_srfhZ^xs7+vKIUkg_!4ekn z&bsQ9xwL|os}S~q?d4M6BULw#pQ5u*-QuNrPp6Uv4%%lwkq~;2F5&X8BzoXrhuJ;R zP6D+I#9r<488+e_!2;lP&P^mm@nfkciy?X~ECl3!q#i4un5Z&F~ee%Kv zj8yY*LH&1V(rK!wzymP=rhLE23dUZTo99gCvT)xsuOvMuRd1 zxPSoOntdT9C6(^j#4IN#2cx7cR{Dw|g4G7P&M+{U*>K{I-YwE(iHnPidH-H}pO)@j zLIOdlFFPS2p^TiI)$iLp%L*M^Uhg%$=c5%yy{Z|#8}}iF8E1u6WAf*#+`lWnCMN&s z_fHy)xAct1JLu;EIY3&~)}H3|xGw6uV=O^!VEy#D9Z}qv@3hn0baBh^>s@>?RohfL zb?6e$r}l#d{8QuhQ>|~LR+%qi{|pg*aQ~TdX6c4ILZzG@z0~d+F|~+|i+dXoV6sw( zpf&Kj`^OIl>GRe5=LLCXdKz`1rsm1UaZ$8!RxnMKfX1!w7iyyw_8Y%t6Ovz?*KZm< zENM-Oo>)dEHv8z<00$QDN?#W6H#vGf2j1~;`?C0 z7tj6qiu51sJKv{=K!<;B$11-ZD6d;0sOq;e46k1I#?_j1w6uQR7V z_n<%a80Ai`Xkk6;?Ul;WLHYbS2TXHcNpv%O%x*tJ(6VKHD&P|}&}Cta>*g|nd%d}> z|7z(z#npoB6(>I{-V&~d#O6B{Js)q+Y7o63eglCA{28gkEh1%X%!!9T8WR%}5ybL9 zG5Z&O94>Wc1Zz6N+TlCH6%{?e=*H*=I9ojC02dn?cou*vZFdCi^0~WkX{=i0?XnB+ zN|NXQyqa`zIre8{Z>RBhgfPM$3efwL7qrhBNQAr1myZTw&#%5V8LW}dM07XL2Isa2 zgt0%B{`JZP+ve2J044*_h{Q2Q$A4z^xHpH>J6yemHp~xejpn8?k5gO;YOx%!x>D~2 zXRi)(oMSBntXojGMd$ud(X>1{$^T>aIfZ{m+ao(J0uGLj`XS6~YirpB1qBnfFSTza zu`O*LvY8PWU7wOTrFcN@xXn@b(B^kWJa?i^T};j|<)^4EB;=GHyz4D&WdvmqOw(Y0 zXa9CpJ3BTqaX}!<74|X6wuAA4)m#qXM?nFZj^u691r-O8e8}S0GH4-pis;>5_G3pI z?PM714m-|sdet&f34Fqod6L*_1tbpt*emtnzZZXUA32@@4UA_|7RdtOx!2J5h8xhT z(V)CSL_)DC!EDtxf?Al0KYh?*-KVm!Yzp>?y*;UqKVpt7l5G?x3z#L@Xs1T>!|(O- zh7tH%QW5#5t9lTmSnqcN$psj1U>N^LfUqH@CRPTL_9p<Nk(#`0bX0(B6ameeo zPlkIE$)uqiSL-ZZa`)lhHuvto#{t;M$B*$#8xPR|^N<^2gwLcD#2~vdUPxT;x{oaz z2gVu0S>mYJp*Gp*0~%WP%xJs06s=7iHH%TS##9K};j|xyeJ?C`BEL($sk=u=M81<| z9|4bayJvr0Ztm3}t(K~4EdP@qe8>VG$IMYwLhk@}ZZ|3aC?1LpnAGx8<@BxmUaRiC zS4bhnEn(PdIEy%jJIB!OR4jDK#j3#bp%PvS(&Zmo#tbzI0Cu^CK!({Mww9Sk%1|AeRaf8Ptt&K3c%V`eW!bAQWxWfW|L#+0`M5l*&xw(Wkz*_7Gr*Z#BRxrrbz< zscR?cNg7MBMQt=j9^c6}}gyi}raJ@z4Y!&)4ey3mn--a`a!RP_|)eSihK8 z(<5}-uDz~OX`ByUjxVa}#+6w$H?^T6zeMiG+t(nA$ror0;VOBXp}V(nE)& zT0dH16-0?!7;Vf(hA9q(befCDhlRc*t*}A0(THI=^e^g&p(hfXzj|6$PG5Ftym*C5 z%kBk9aim`1^J%paHquo5Ub!DEc=e(+;EIO5j#}#$Qg+!w6N-X(HSbTsNz9RP?_oGZ zmyl-0+j|@yK3IR1M7SdZGyu&Br^$5)unc8)j3K$5SK2>u#OTridFcgF=C^inS>Du? zz^XMuD6fmKjpR3KiZF-UYJ8ZzYnFHuD@$1`QQmjm(veeHwe(1m*CT z-{;~O93R9YJB)ry1Xg$0)ClTf;)#fc>@r0(aPz!_fA3F%8${K)l{Ep?CF?9biP{!O zYHpqvq&v}lE~MF7ItFjC#dDTrikc@xtb2aPx>eq_7;_-SF)WR;w;X7#FXLv4#W8@= zvz)vTz?_|_1SD2}2v5)tpowg$VmzU!tLYNR|Ym}qTli#mcU2(3K+ zrfoVpTgg?TqGyRA&EZPFhD=?T{bOf_ZDOoBCRmvX?gY#!`Mm|zuqvNB^p#njA=vz^ zqkfx%$FQDY(&|aQm^e8vlEy|2o+5szS!AOGY3lSyb)$EOmoOb!Hm+>_oUifZ6yoG@ zY3c0yT1h8z@gi&T%*2e;p^j>523u=^;(XJfXFb5LLZQcn#R{th(#>#M-sc~T0};N5 z$Twne7QK?*+Snpua42B3>8mkG-x_C#Bz%1@>;kte;Q=}C8d9G!Qr^rM1lc%_t?=@5yFEJKJ&^*Z#>3qm`XS=YXT~s0^TjX8 zhW-q)T6I2^WL}i~#Avc{W3Zj3&21RRtDh%LVG$>-r=kAC0)FTD)g_D{M*Yw4#Vj)+ z9^lhOcvxsI}89x_l|Pq zoSMwdAKa?MB;mgWXN(sxftBSCfW_i120O3K3ORkJtteV3_HhFqI0l?-UXcNmRr1M# zMi%eKAurzdj1{4vD+9B=%O?n1my7g{$FTECys z8m2)~l*DQ@$L_vP$o0I*5^;mAge7u22D+=IVcU2hXgM*Jaeln*hC6)y?f=+si6Y>B zsvHc^EN8+LL7WQ_p$xKN1HB!Ki^{(h*4e(=-ygMx61`8w0;XO2@OESN3roGzZcd2N z{*Zl;(HBA@b?sfY_(PsleODx1E1P|xG-t({X*Y>HcYRpOiPl>@606qtvULr z9E&&pP%?hZ_nn%~zSINrVRw{In${j9ig)~;-JwsZV8Omxjs*Dh;}5Hbn(!%i)G`f` z30ntbeZ?4?!T>LuCuP6cj4s5RpZ$^eTKt7wxT?#%WU)b@66a-Un7-IA73Xl+#DkSn>(_%wF3kw;#u!GO`(!RQ;QX?; z|LRXc@}kiEfHf4A7P|Q%ipK*|!$XI(8>%2}Y+2XGDgTfaJl>*F0Ges7zqj%`6w)#Hll|!(X4&#k49}&gQmX!)RGb+N6Q0&6 zrPeIjVV8y9uD9PVJJO6{NaKa%;y2{hv~6!s-TSZxDy>6~vU3BY`{Ho@u+{VbaW7gV zE#E~%a0pRNv73=Zew{Cqe+7?(bC_>Vcnlz!SN1X2PN^7`v|m<|x>>fpdE$uvja4)9 zqQ+(6o_j8&<|)$YEoG0us(0rseoU!8SN=QsW{r){XoH5!WBthloFeJy_nn@ z*{HookcRa#rD?l+KhDGqZat0Kgkr?^ETB>#4i&Nf8;5S7IbNsL9e%Tc+5giEQP!Ps zII$NCyZP9R>p4b2*@Ze{ePl}L-G?eXLJczfah{2b7okRnN(eTVDDK^v2;N^mp(Z&( zUJxMcc%Yx>-!HooUHl!-?YuD*qwEx{N3mY)?^mVYdW`Bn9gQHnIFG$^rQ(DY=yzGd@9}FZYV784baAw(I@}D&OI6d_l1o8A<|EDluUgH^FySPxJCA8 z_hSyzj$3j(KZFw6l%MoAGdD5x(jtSxNa}>@rLRzXY4Iyts}>qrkn!V4XhGf0n=;OknL!u$h2djuPz){GX!PwU&iljh%@M4lNjNU?s(2UCc8msCP%)*h&L?Dj$ zRzv8wuQ7*&P?1N-~e4 zu`zvY!>M8j@};4X{NBflR)@uQ$EE7@8I;%+KnSWEJM z-KP3?HQIeU?R^>rO0v2-(lS{Hd0IdjH=@=fzr;s=X0D>xmTt=I13I@Hu!i=@NARdw ziTD>d&;{$c+~XZDzHMqtFpkv)uRKB2V)Cm-Jj5CB(-`n4d_?Q(>-s6gh?f94!LTFf z8oXR0^54dXjxLcE=^hg;^#%D#`T!YK5FbuBP_S{sU+$kc;J@mMxUhi4Ct+Q2>*iLcIzIf9MV8nj(6 zL=xRdQr>8KE=JsE{P(=!Og++pFvL8*R5uhJB~SmY0J!75n%D#xD0t0?*tH`RbZBR} zk|9qWKTsF(l@$cjL$7W#JVFdxP-+A*^fEA3q(p0GyyocO2GRMi`~P4>I+gqQka+kG z`9hDq$Md=>lc?@XUH2%Rb%^9V0&4@td9%iD2bHfE1@Ad+OfzxbLzEpN`&)KkkIQ>T z|3<7GrQ~W-*R-lTaKo&9Zo*TsfBKq2pOw-B{ zFBN8NrYDDKI;Rg?(-8UYm{)cNM7Ahsj0IPwI7L=u7Jt|;{<2?e=UDue+uF(5y82yY z_Ib}{17unIqdIEOX_pZE_Or?V>lgJGwoOHWQ1s4@Oj~Ie)!dGo_f$@AX`+*o7i<65JX2?Cb^6sf!SoZUK10{%u)-#|!tS{L&+ zQbl9$Ygt#5o}gUz7yMu?-le9T$GuC<8J%t3O&NMpd)J*ZRB}OKkYPD7+dPo>g1gq& z{F-rKx8Y{}RrxYxpg<0&)jcQXUf;BoCbCUyc={JuUfn>qt;IK8Ev{hbqJWWukkgz z(bHz5#F>%GM=^*a2meww+z;qnBXt3Ta5y6)BP*Nl=*t+7cJJOjwyVkQ6QJ*`wo@}O zh?<(x`qtT*RZx(FnmT7EZDK;lX4ni=c$m?p#Wk`i`)?zXbJn%@U@B4WW`!Nh50 zecjXMg_c$rAiViY;qe68UEqC9)jp)OQybRLLanjey2fz>6iuKL7DVD@&nig*9(2MY zHj+hARLrWEB%IJS_xK`XD4EFA`&`q%%{#s!p{BZrOYkl?mrBGvabUX~3{Mzj0~lmU zfLIx9fmjQbMnAiR4hbG%+C1%U{xLdAD~ku%tu5ypFvbv%V{qF2NeKTf*z~XmGWwnh z_>hkr0Rh2nIg$qspMU(&tHDA?hjUgL-ly828Gv69!r`zYBNMk$p||Y(eooPAO zF96=4I5dhKV@@#cj_qtHUa@xCWRYZLcUQVOojP-tmXu$2)AyKVYb1)$dA1K6r>DND zK=ZkNFZbP};|$fDI`2};F8-gKg;6d~438Gt!xz4cjYQRfmu9HyNeeI<`E0+qT%SUc&UWB#$5%Zi{A1wYadW@g|YkO1f*(a@~N2kOI5s_ty=z3Y8wEtKI1 zWt7E3L_#Vz>mw@N2D%aQI0jlFAxg+^uxLRK$WNf_?0jM9eGeidFW&(a!eIFdQ#S55 z*!L(9XY)MWc?(2H?Jv1R;}|IT93+~|T}4Gj-A=||AVA)}eG8fxRaI3IJ_iP%T0?<+ zbvvMAkQICRlA*n$1Fp~vF#;hvMgXVZ=XGY-e{NlK^_!Gy@zj$9;OZMzu$rC+s0iL1 zDD>k92OiV00O*Bj{v;24;|jN(@?gZhqu|52VPut-{L;D2IR|7|23`k}(Mus~7VMS934L5sx_J80R z+I9z=CU`c`1~Rj;xuCUyVJfO@+{e+)v5%3o@QTTe0Mh)|S|V`{qVREoa9Wa)6M7`A z<|77v>~w$eH}xo}hSeHH<(NXx41<)3ZBKtL7u3LtfGxpn=uqnp>?MRS$O4H;FleK~ z!XS{U*9%mDlspzPvi!1wlZ>Zm{Fv^B>d(uK`WfBmw1GMLAk<|Hyn;hy{G1 zD`3~c3ajdrLLmG%Qa2!0hMe{S%JFmEiYlLZvCn&WLQqhB1LVI)ao7&6IysSWA-Q*& zQFWgX1q{4bySnQ-@el%M36?5GDlL?qFThep5Ljd)i(@bbKLayDsw=W*Uc7+UUN2V$ zU7_79Z?c)3GF;>$cyl}o6pIi@o=_W@w}9wF!J*nIXaD03E2jTz+3o4OwD$N+oNm_{ zo~vJxK^r+P=MHrISm{f6uR33@(J|6X-|UN0<4E7R&Ih*bKs}$`9Fl(nzYsNq29kb_ zN!f(@=M1(U%^8YJ+TE$wdb{tOo$uvl3Po*G1bBlDqG6zW&alpW<_+?JW{F-t8<_E_ zuM?o z`yL=Q1C&&nkf-Kc)c@-z3Dy_1h3xY(VRlv+H58)B%4-E#<5$#J&pYyyubSW43R7#` zdA3!IgOgWAMJec83oZH<8(!|_Y6Nro;!>nV90L5X@CqXp|6NI@+v#tx<+w4Hj}K;? zh0n~&+3M=*z>3^&5`zb_ar~mqbdMfkfyo6F2S-{{Gs&YrC4~g|HV%tsk;wDsaowC; zj~@dSNWrZu7-WDyX94Fv*>w@X!^1P;Akmvp3(>^`j(!3ClkY&H?lj?EHGxWvotxVU z`hkRE#DQdCLg8q!%kMyDc`u4eQ#iA6aRh&-+UIqf5sJa}3wD{f&nO0HA!2anp7U(X zWAl7{$q!f<7yUu+--~VFF~L?#folvLLptHZw?Lb!H7N|Dr9)l6sTnFAUL@-ig?Bo@ z{UUM*3@_Xm5douQ$bQn*SK9b4+0dO(*mio8kK!=AoFfJ3pAFT-%TAV}(AE|_JpKBH zd$&mgz!TucVgL|6s|$iOywj=|JW1XG2=C;$3UK5}MVDxvQRyAS%2Kpk+~k4JsG{IU zv69B+ti-Vn+i|Ec{c(A_-x%t=lfSP%J!9eoQ2 zp?||w4}>e(!UTS-8^2ppAFQk21mg!rp7sSbpvam^2vv<=pDp1^|X^FtR*5~ z97Gc!R(@eJfyKuNo?I2b{SUC=L^dtgQmg|>mAm=Jp&W>1$}9TELpsVYr8W>W!=lY?zg2!(qwPq+F_cjGlBjv@eQf}) z=~d3xi)!(Q>g#|b(0LuqHZ4|7HCAv)lZNhQgwHZ6aVbLvMKa6#U{9C`_7x2$Kav5{ z-!PVl6*l2Y?OYb;_e@cOVPIoum14r<&)%a*amxK1U_ennG1>QW2Lp*I??Lea?0dd%t7#`rP?-KcWL`v+2g`T*PV z+c%!WT(1BpT#q^A%TGNg)o-iPbba!i6-_uwF1%V+4?d(-g_D(UUKj5Y+djLi=mRxy z4~~txcu8IdK+z=&mvmKLl^mXI>OBV2XS@FHqs&3+?yScn>mSVATz@LNnYI^ryl8n_ zc(9*uJ?z+TQbjFDX_~w*k{FD$3CO%`#yw+^QHGomAGHn^SOsTZU*i; z>WdpJ$DS~>-;+q8lijg@_3s$tZCC(e?I3DNNv7r@$sgx-&({WhWQ2oO7{edDQOS$%QoM5Yf;mD6n5n517MyBry$yI?Az zkt|bbYbFfE+ya@G4W;cwQH1Na% znwl;k%pAKRBp@*AO?a>|*TB;iK^h3OvB}Ht6&R0qrsLbF0BnLQK>os}1dx$cmr3dl zxFl4V5pyXe>Q>h!%q~>Hz9zDj~_9lq4`LuS%lH?aZwqL*b6;H)HUu!Jcmpu>}zq9BSdtj?fqnC9KLwVCe@Ps|K>25F~&9xxA_w&_acwuY~aoq!J-kWeJ~r@2@==d7YU zB1P=B{rx{RaB{DMdJx{o<;x0pm{eX}I+c)v61A}39PP3@v;5)CD_7Gzwv!%N{!yNU zj?X=D4mX@O^TD+I=4P)82k>-0*KQCIuyPJ8A|n%4uk`#m9)M?|z)66tfg73pv3W%O zAXu3|phX7weB0X&Y-_>9z8V>luvtY7r}Hkq`~yM%KT7-LTJ;wukckeCs{&(IKU__RfOE^4 zLj}i8^ym)vb;}VIzq5x9R&7Y+C50?w_qCB_Fc8!fxMQ?|zJ=4{_!TlL>T;|!l|M|3 zGGt?Y9qeg>Hq~k_*AuF#rx%f%;Q`jMb{1OT3P)b|!_U&2CmzW+K;H(IrobL<7Fdl0 z3tv*8D}gLt?cZfK9bt!W_1^vNBr?sOW+0E>VV`!6x2gD^!~ZeQ(rV|C?da3#mue`g z-{w7&8POk3Nk*CxNDvSTxJa_nOyQCfA>)$puY&~-{@yU+h~AGr3+wKgL2m}__s#}| z9-np8tt%}B6B~R4dR6!eJHTYoAWXm-S!&Lk-;1K#+g_l1x;`FN240%91*9Msl;edj zEP&8%BC~YBDITT(Ll$LT2O{ZE+iC`6e93Y_7TOe=YfkjU?2B`mC!gM~E%ONdMj&au zO7G$_x%IGqwYo|zv#gvtT;+~&%9KX`9dqvLIM=dr%_fphEL^jg?+st_w=oKxDl5hF zklhJbk!0b-x#D{>@8VI?;3peTk_ZKscbeXxMf?)u&;_4E005_F5yEJs;iI|P*>{3x zKfcIMz!VzlbEYCo<5N@Rz`|IbLDQuoz&Zq*x)Kt|sW}H-0xM z{durCAJ6Bw#$n!1Qt+Zw2`sYkI;=oba|qGK!18LRMW#1MB9GzSWcYOyaMj1g?a13h zcmZeuG|)3Nynsz(-A7;tLzQ(%4$26vjeh;O zSxa%WVWZm!S-?2BPZTV&VX(EpsE}gRgjrt2YS=vMQAZ~tDvAJ3hl!OHvvOMR<-sM` z0DWF*uBepxEHcOP+c&+;ruDToDG+q;g?(=oAGg5;#oGawG~mRb0rm^vJ5|ki987_r z^ROt$D8Sy6fZ*Xgc{AC-tL#F{(xwKr914Et3=hht={JHGC80*2i0xM5_k31}1ygtk z{o*E(b%ClhHAl6<#TEimNl1<**c{T$bOfK7ux(RHE?!1HiQEwD=LhjP+w+c}Y%j6i znXc^qS!>;Rxdq<|0-s*d4jRs)XjBxG!_%49@#*Q{#w7!ar6S3Ie)!wkz=x41kz-@( zknR2&pz6}jggYC!_00eK)>S+X(b0<$v@#cOPWP1F#~Z5j;Lr!2pAC~Tx>iodoixyHTF!bWunz?tBW-rVJ?6+NC z9}U6Dbk!Ai(BZ(DE5Pd{0yYZlmkvLP1gc7)l^UFR-J+zx+O1=Lntx&{T(qhrl)Y15vQ(goM(;vY9G4EOa|4ANYt1WKq~2J_GV-M~x0% zz}svssvG-PB-OL&q+~nR(KvXbU-!Yb+zPu;$8ZE=j_otM{k^G3miO9Ewl|gIsqm+q zI5wk@IEExY4K0nI4lA~?Fn;~(-9 zzDFk~j}AR1sX)YBDpn4en3{se18TL|Hw*VfVaQ8VbpPX5dBCq!JRAv8C{r zCn#!M{|{Sl0T$KTy$_4hsf09$ARyfx0s<;6C`fmA4c#RzNH<7HcXzjh)G!R)9YYN9 z-+12he&;*y@48gD=5qF4&x(89Ydvc}8?+}c^%=X(Wh6JU2nB1wz0@G0RTv2aqQCHM)Y4+JeRFpx~pd6+~9A_L41^1B@AR&-3wRhfkC`+p1t9#O-0 zCmgaUOUPiYiUb4*fImm;I4duiUKmMn%~!A?!PGXrh}BlY@3D9Y)ZEpN#w<}z=)E01 z-PI##fVVV=A($n7VTxP`JIp?JVbyfkkjIQL?C&h$BO*Kra7RrTX@D)#04oEoy%POY z76)t|C`mYbYp9AZIsO@~12M~RG~eh{^CH(&3J)V&ey&Lnho-7F{S9Zb%TEh>I_2S4 zyboUnfK%h27LEhJ^z8kIp%wNzT>v<5^I5^bH@U{Y76RA#B*?Vkax#)I^#C`10JQ&E zQ+$AKHhsJ_;4c9h4(!4xK%n}CeN97q4LcZ>5c8NIU}#JP90WT}rVa%9bIYftRR6Yy zP=(0^@SiBQ%M zq$soQmKwq}h>afnnjTafDX2g&(*vv-t&$~9>;1rRmU(awUwtA`!^_1*$g_uKEH6um zvk6-ky`q}EHH+AUzMbS+gc~PA;4ecjCd_tE_m9P1qOOOQ^sy){@3^U$eQ|{yL_S(u zBT&q#TA%2Dwu~F_M~}L|85a*BCX+p3Dzd>>A~XiRHN5buyehA19=Ati4$7z!nRaYv zUo_?S<4HGu_+cy|e<~HGCv@>y!`z!UtX6xj`gCAD_DJA-Qs}ODL%u#p%TaP6`moBqk@IVwJrYnV| zS*dL?R)+_uywR$P@AjV+jfc~Ep~ZYD`pfP}fBEtm)@kATf$V;3*S=S!yXf3JbsBnH z(eZ(5Y)Mqhi5+kHo%@sdtF>%15+L2}?T%boq)`^C<&s1R!xezfCo*ptxa7LBR;X`& zZ?{d|m~e8*R>1L+S-GjXP6Co5Vf4lgtoz7hWXOzg5 z>b%?Luii=7z|c>&Hys=XGLu}|jyH?f3mXz+K;}CHY1&|QBx4EaU4ahCehQz106h=Q z!_MQWO*dm@CVkQPR0`f{lraI9Il8PWTRoc;2bKiHvIsu#k5I8ou|Rkx6+%WEY z*k4JnY72cT60vG=Fx{jElxF)!X&lxgdPA?GA>soAtmPn3z{d$eL($~%?i7j7-%?n` z9x~YrR3pCtUANiKGUDZerw>jds3X62cnDfbQYF=(oZ*U4xb7u%EzL8#$x$lXrAkbg zySCvC(j7s51=v~+nJo9?Z#vV3%}0O~g&+4{?;6GPUN5xG&$nP_yOe!@a5SQ7uIGTG z*?7jsvT}wV2ztC^LfFW$?x?)~3zIPZHW(zSjAz>hD`yb|*7ek!#dslZaf@1F`clx1~f@>N+Td)g>U&8iPpk#*Fn zCj@SrruWSLJ;Zako;$d3Nk6-C_vM!%xj#_q9`WCWSN+}^dN6YCPwr5mQZtgcBH^A` z?~*Qzpu+;i?Puv;+n#{M;~5a$cO66lyM1nfT3jUiE+b zbdYQ{l^#IT#+;c!%xn}NVhx2%V!0_>oaJ9vj{iZn02IQ%(G*mAS|(En_4@R!54i63 z(p&R;x)5IVh#%=gA9mZgDV^g5M42l`aV-E(d@}Q!i`e$e?GYP8Ankuiv{E78 z(VhCf>OUCm!uIV?R(X%=Y%|3b5l=k|ZlTO}X=8YZyv*>y4Ylb+UBB^(ck;UY;^`CkS6 zl~&)Q(uV50s)(~Ki_vh>Wq4z%`5JSvyY+|xhAV$E=ZbWb69{%y+t zBt{A@fC;)*cj*JdnQ7qeLC8BI>2nK&JMH=RHe+l57Ip#pPhqc@f7xp9+^~0v)6PD4 z(E)>MV;}x8^w=T_2n3;V*ROyDAAqOxHtdnc02>G8RF(~>sLHJMkw4hKNA*x_BBgsc3 zN5+?83^?P(YmF$a&JNR+WBHCfdD)u(xC;IM&u&0DVB1zMMEf;#pHQjd_T{MdC}5fZ zcxnzIN5O*Ev$%QImmj9T|E03&e_H(Eo1*2%N0JYrME*QB_1i;M!$I9FHB>G!U;|LP z(Vq~|{$KLa{X^a;FFvkt^@CANELcq+%GVd)lYa@vbEn=-8KDhq53mYrU{0_KGm_b}>ka4wf3oeY-{&s`BYGPAd65ZmwC$7H1G%bNcx7DL z2UzKUj26@Y9(sTQd-s&~kB0y!Ej+L#y>X;}c!qZ7cm45R)15}Q3A0XISVluDeXru@EeVl%@|tv{Uz;tO6{=4;0}`f!%*QsuKjNX z3sf4N5UJNaGZOi$0$#_=UB!vr7{%a*C>qZCdZ#?SoL*jGlijTGb=$Sj@86yK zoKjni3a#P4(deAOWdhE{v(COno2yfc{xuc(CBC1mcq+l=~v`|xy&LW46}h!yH$ zomN}q=GiWv!D=V&uG)lG2%ndD-R(|5Y~#L(%@?;m&sh)c``daN=Q?Y6pwg}r*hZ%H zbk%J!5)}f=s%UZoOVet#u8IuL<7-+r&0L2|0h$M0n)B%Nx16)vRbLvcIA1GH%vQdB zEmwED(xP#Gv3`IBy78Ki_t+)bd-r#7cK16Vcf zG~1!6bwAe>XbsotoY|?ppRRsWcWWV>5rni!L4z9_Oynnka^p+pZC}0uUsqK~ z&{?25k1Re3wiRgcdF}ArmNqB)J?F-QFEZf@twjc4zE@ zy~uTTPQ1Q4F`0?puv+F?!!x>OwrcNHp**04U~Q#*CvaWrPA<5$H9y4~E>;2Z(iFtL zSE}gz9C0}=2mxt82ul15=x7NExdKI^BdA*c!r&Vf(83nj` zqL5Tu0_zQV2Z7m~nK>z^eC=}>T5IwFGKFX8Ke4N% zWx{m%+qEweQmE(v7an=)H&Xh(;r?+af^)WO^XCP zHFI{=5sr~4m7|bs%fUQD;zur&@}X|=mYoQ5x>n2myav(W39<$y#+)mnG$Bq9`S3b? z=~W~6Xmw&8q|*0!vNv9>F9s&DDTm?+2F;P>gYPCY+XW9K?mZI#Hy~?Oe^69l<9;w1 z8}t}{3_Ug8t-a^>h_HsYj&B~;<5(GA?$+8o!~bf`rBv9ZkKAJnom#Y7T?8)i-aw{J zm=L%MuVa!m{O~#Jg8`zS7(-w>cOuGlo_$V05P`tXZ|gk4NnWq4C3d%48_UK`Krwgh z6|(n<^o5a6V7ZIO?#rhQlaAmfs}Po~$l&w7_%8^&H2|vs0Pepm6`(dI`6a9=HP)3F zDqnSOdf;FY!B`vgj>Y?>CnDCfAyK3}*%v-kJ=)kwhRAILoPd5(8)Fo1wq*c_GgYET z_U~{jH0+NA3JCi68qqTTFknIBPV8DB&02Twx5w6VbOLB&i4I05T5kYyAtDK67VDqW zk+B{^9?WvmzQu@&B5}-8&+JE~q@oDi`X4amFN9dh|bft5j2(2u}N=^_Kzx~~Z z3aZ(0jBO%JWFDzLcDrj!AfoJ4CD?&ZsXN$J1DycOnyn9)tS=U|xws2ifgH^n#XOJ^ z=D&!P9F#2s$gNWcf(r+9P1*FJwE%ZrWQOm_=4qqYj2hyrPaml_4mK{%Y~J4`;}y>B z2_(8qChGzv5rBb*)06Y1&|lxCCC?M~g!~NL6`E}FFKr+0`)NVkmM!@by2I&w7)8HW z_@|HiJ>(yLUG=cIp}X;f!quIggKqp?%W`Ga6Fv`?5fZ~!Ny~=n=}r}J4OgML;bTLG zZ+*RqJSR$r1I|!+rM(Ky2=g=vAiuS$C+j{eD-Eds0D|=OpP2(-94>WaBnc79C^pT{ zZ6>hl??Uo9(aoktqHOYutKiO|E8Innm;lh4@@U-CqGqe5KQvtsv)=w)paE^cbmpR` zOpI+l2ZE84f;-iawxh6%(F`xBn7@4M+YH&3BC14C|MMN^v#fjTFVUJzIwIqq!~kjQ z+J+O8WEeciwhu7Gf6J!vnQE56K>+AC7IK~tHhC`-9;W#lRGG5dBSbX8s}9a?RGsity7Qy4RDDWcY*U zC!2LKm$V33fhME%7>t5zN0dAvnh1G+tQ-yt(SMKqb!hpw(l>zo)C3LAJFVR20A0%$ zsIUIYKFJk!&sd$TL$aVmO&MnZ$JSOBXFJy3X}!Wt9uM#jL!0RjdvL1wxWhFs9@Tb*l4`(JmMLA^#`PmS*2zW+f}MyAI0fA~1#ecd$^w(65|c@37i7SU`q-o)S5$^2<3{R=K0T7-vzI;_G# z0i`tH#4hZd`}akUH2S?#=iN_4$F2gT>1>6#FKTU&?SQ@kDsDK0~y&%5TB>lXSkdkB7 z!Bj{WSqdtdI->F_NJI4QgtU!FD-5R$Nwdr%(Q zu>ZPxb+JVG-eaQ+)~l74 zMvuvA!ki}{hU)(z#(0QT^Y5WFcD)XxlL0EKS^s^FMGYeRHwVUaBB_lfLb5H9i@+vD ztYOexSQi@+CIFoaO&2c*!p}FoB!VWJjTlLq?_19+_&fAylCm@o?>ufH7rcQFn=zT% zo5uhE9d`f~8&Ifd{TC=MI>$UYu6izLAiev>K2T#R1+|XuV+7e#(lJYKn~h6Xb}%${ z+iMl|C?kB+1<${?B(LcZJKP}Z$R>jeXtm6G3ciI4T6uc?6|cH{FGs@3^A7cMzC1aw)f&~In+fD_UM=joVo8~p;a`AWFp>SOQ8(}^f#^Fs{7+;nLB&;hte;lB|$K%9J%?_g;zWB)ik%htnaDiOWl8_8h)V{>t% z#B+3pA6UgV1U01?mRm^QZuJaorW#Aj2T}EOI#YS|CRW)#`;TK6uoKXe>3qHMAxTAJ zD{uEEI%svjnxbnWvuslP{E(9kJ+NEd6)Nlvp61K$_orNA271LQQDC!ulyDWyq*d`F z_LdH;_KOqEnRad!fSomoz~0ukSC;9H3O-frGTtkc71PCHL2Bu%J@S&BBj`EeYe@ar zEXvG+m_k~aO2a9Oojexr862vGS3E3Hen}?Pr`gMTO*9EQSh^@-{L*0j65I(d=dFH% zLUS%=zlknx9tYv7Qw_G%~QldldWcqZ3D1;4Q02I1&#Uw;{%BN1CF zHTAflWHQ1~&h;_(00MU_GGZ%cUX)VG zwfG*>yLqH-6Gd0xsR6XU5eMJ<)>cXU(Rg%1mB?mxz~rQqjXwciSIGrG=HmAn)>0~pp&Zj$g$Q}7z~SXN;) zY&Sl02i(tkCUzQy(vhu2rX`Qu&nfk_4vXGT8q*}{S@+umq|6fqr)~e~u&5=R9KaHT ziNr>CR>tYE7Xrn2Xs5|B9P3W@H|Y`)MW}ZKim~RIc`e9QyV+j%s2jXNNOF2&cvH<% zY!{xW_HX6jg0er6y|D4a-SMmLPg66rQ>Zb(6`rm-e!Qc7-WOs)eFJhF2ZVp}2>pNe zvGmPu7wBTeVyDZ!jHM^?+aAS|D^}e_qFbOe2`>-x^nXD3T% zZ);2zwoYp|1libW)yM|#jrrWD`~zfWGL+TfqnaIko_XI}6^{8a!^V0Ud6JgMhe9;2 znF%*qC8mFDzCQEBq!mUu-RY>L)CJq}vEj)VzfFT;C9Et>P`%@ST-e8yN9HSoLUr|s zX5Ys^=7lkb<(5DCExK_F_T8t~N1owluf3_w4y5Z@@hMvQ#sS^_ z1vMJS=%VGQ(GXhU$AV&+f-0~sSTXTRVQQ8^Gx<#6C9PxcZ{E=ZZrsBNTtDFjH_CT< zBeV)J{?H$`Zb*r@Wai55d^PACqi^(%4{_o$o@|^(yN+^T6I`VFX%1bgEX>BHnWstS zRVpiOI(Lq;v+XhyX?#61yVun*b$^@<1Gh+JtHnII(C!%c9TvSGY$LeDFo2hEYC2)? zSabxUy>sW%tqnBH1R{gIrKgAUUngo}5nSRAs^HXWVbyYuio=ZhIVHp>ewII_H#4S- z-^73ZMvP_6SUnP2{g$tmY`Rh6mqvk|LX2n@$@V1lg+Mj6vh#udny+KiAzg*bzrF9h z*I~x!btd-O%^i{XXC#%kT2oid1S+&h6jb3f{B6Sqhs; zyM8(BO$bwvTGvD<574{%Qm{s(c7-zQxY%ueqY?}?{1F?9u=sCoI*c21jQ6wyq z1=RQtEd9Cg>g3n?UttSKQCY_PnV(z31genZ+;i6|HZ5s}%W$g9C06EFSi_pj35~hL zpzAj-dTsypmgrf+NI(n9Tx%=g7l#ZfxiWMI^Nz;*j&a3) z`3lYSV)QVIs-M4bEjN>Fh&^)f*Gx3h4RQv@DsC!DUl7K{`^@taJogSc@s8|7`_w?B z5^S_rG56g3=fN zoYb!{mC@EbY-F|yVfx~2gcm+7iQ=X+A>2!898b|pA&2(UvhI;LQ5{{!0bB?FoUESJ zA6e_xY|@+KtJxKZ%qwkx-teOfK0q$7oRkK{jzTUijrYI4q`JXF-}wA?q$FtmNO)%o zy?0Qrse)6lqi^Yg z2FX{ULa-RaYg~H2wX8e)-<6hduq;^WgQ-=b4nnObQbR(R@Q#W$Nh&l%01wl|e_0ka zRoibKf|DowHCYK`)RO*IPcspxi7qQh7+s7~!d~-uY>2Z9TY>1F>&jPwbKE8wVnMq| zE=oos#SAhDLWalRc{-ph98%3j&oZ?pRbuDE(yO=d-bml;HX;U0jEmM!!BQ*3p}j0W z^ms*qTA-7gY1G<68)-j^mN}bZ805oj^#ZP60he1hX%8GJn4IaOaB@R4AJa{|Vlv;+ zS?aF*$Q13pkA$Ijk2!U;!`4!2RI6r(zt(Q;O>~cmgy2o9KjPBVhVr(81}?3&vD!LW zFf)$Ad;fI9N}xR^O&WDh$xQ-8-eYl0n+!`1h%F+#*C-FuvwIbecg!yfrW|TmA7xYU zk5;$!U|@iYZ$}PIJz;|qH#2nJ71m*QWHayjJe!;Oi4I5hDC+tFQp)Egv{F`kR4A=P z3eUbte<4~fz%Jv}15(I_0KTvFhw6WL`*&SbusN*@n({+0-;jF;aoUxM=D>R~NWkNT znnEgWC^7qsXqro^r-#TxKQ3g}rZcpQORw6HdQ%r;tGcE^M7a#kZYdCMMqWjmlRuyER8{}lHc5TJaSV3L z+Tee)b!uzQj{lrd`OTds$Vw9V;aSBWWDK~YSsUTrkrVR~7)q+P)H4u$+*RSZ=V z%ednig1Sp;E&P3%+8r0GJ32wOm}Q2BW~gIar)Ix^0b18E-HX#?I%ek0}n`YFS z54u+yau+v&jsyhaz5zEPi3m^YJ_xAyi6E&a8y7?`9E5kKOJrsiZ;PXN zxA}d?dYKtdtp;_pk!n;Vdd>rHR;H<#PzoON;XaN{r(r!ZYih%JTT#4UMfYUHw6nwL z899$u^ZF@^mFXKj+gECO%OPJaC9zBK-~d3HXG=8jLW;xm8CxVBXc zQA&K0Bu!<7!vNPD09iLZ%T=5!w7nvtIh58~aDZSmQLX=CzBk8wqs_BNhH!_yhB)1v ze{Q;)Cb!G}x|+->{yFv7LOio{TGsExFkoV*67JPP`QRA>H5Y~wH(z3gZF!U{+`trh z!`l6e2JwB(H;-+dOZ!Uw>4=0T@PM*^o*bUo@FJjVbK)I`ze9_gOJqj(O)ewQbhQi# z1+=S7?R@HW@ztnR&UHB|E1oaY*~22q$c+)*f$Eg+hh$D=jJ5aP!22cvSodtW@VM=E zrV*q=<68!X`%SwJwap->vo~c(w(uT#n*48hDxfPRS|Xsl=Wx(c^pByB{RsQ1^v{8iF#Q!w77eu>806ChXApQ{C8rsR%8f5OQ7F9iH>_3eDV( zKt=O@W#+n`AZb%q4kuBGlp8Lmwq^L~R+}{53#U*z)TRiX2^5;FOn5{2%H%}nK#AGj zlxGjsNf3EuY7uV}d$F!1=tB$k;*{NacSQ?M1d7yqqR)O0fCcoX_~W$S#1PMecKmX3 zsCB$)Cna zngU#gJTUWtwmU{;jNa;t#ATP$SfIR^#;=qruFL!NkKh-~#a2iTJ`L3Ky~k#lqX zRHK`AfoIl)>QZogyr=70qzIacU?qA>rqK3?jGTOXzKE5RFhH@)%X4TwT2-Q)h7&O< zUj1Hl0FyLZzfh+QA>$ryA+I$6jB2|p(d@ zhGgw))|-kVgDB)@_kIqHOrVIGSF3#HS`LX?&tQ#EZPa+&;N&ap!BaGV7_ls{!8B)| z3{*rXeDMHRBdVy89@T^k1D$%DrYEqJD`gy+r_-iVvfsRiFv@(i;5Egr(5r7F!LffdFD)2YNR@_3i9)*#7c|Os$AugQ=XHQ*l*@a!rmAleks?d0U z05;AClm2bYQ+3q5c(bP;5eV*rjHD8oiKX=*bZi>_1Y@1GQF=mWmzNgFkXN+|$yq_1OJ};W1?- zL~ThN?*?(%L}fG%+AVXkr=h07Jn$~tBL!qR#jW{3D^tMa@1YUo3+&CAJ&`q)15 z{Ja!+cOH^zZUr#h^7BCEQaNheuc-j8Q z*E0QpAkvs?+^s`zchz;7TXBftjVaRX(X$^1Od_a5a+3QyA<4^+zKxtG=#{@Z6*502 zWGm({SK^!{d<1`7b_c@Uqd=)^1Y3x)kZGf?T4d6GdgZ<20Du$czZ%&E`P_&arCITU znelw>D?0^=ECt~?iqQ_|-Acav2$7eW&fX|sjds|^^Ez%RD+~05oG?*CPWg^egr{>o zxFL|ox%l{NSsbytV~A7Tgo>>MO0ht7<#m!CpbN|a7EE?T`HB_U5SzZz99(g+r+sg1 zI$OXlA?3PwmI?`0n5dA!k%~B9J^MX09WO=RRoFsj)jYA^nlV&0IStkCZMVw&zJ9B$ zR?yGNL{pX-y>KILe}d6J%J_n@&gXlv2Xc4fb{kao-ZSY8obVpnlH>?YlIrU>^wM^S zKa5XXJC&3+6XA`F%G=Kw?WSLZ%?*l5S+Dho6}jfA@GK5T zJUXH2r+f3Wcsq~6C?xi;2;#h+qF0syWHf&%k<$F)g2zAsZ)#e~)=cIYA%P#w87DX* zZRxD!kk5qNeHf^IfD<)k3MwS~(whkUup&k_l%Yls0iw5QSG|YVE}hl~i7$a8PZXq3 z0tJ=ntPRO6NXJ;sW9~roc-hI+1N#s~iqMsbwHevm6={lNq;hmCNMY$leJBQ*HwHuu zbM)mWDfT49y;+(H-=&o;C%f+k`r8VU5Z8~-{4;< zXT&`%PJR9FR2mkftEwQCV6JQL^Qo-E*EgE%D@R6ai&MLGaHkNPj?d}%)BUjIO-p`+ z^Rn>d8@k>1TP>)-RIA_za@8_@an`DHlZ42Fht@q!Qim?vua?6%xGY9?FJGn5aFX$7 zM0V&dg_X5t0VDNXmQ(%nwQ~2bx%QgI58!hYwZK$yjq3A~=Hcq2;mihU0lB^(AvL&C6afzlE+(nW?HyK5zZFOF{H>EC+5gTGSn`_vwU_efY2n{E%EIXWZB+?m6XiI$}7*OV6fC1j_Ui zqgf~hOR2O`dUe3@h2h?SbW-f{ir4IJl=>0-VBO2hPmN}K4WvNXn#e?glPK0@?Zq@p z=H16BUq{~1ZsMOmnF&U`KBzamh*djY{!QZd#Ux&^eXvfcuUBF^sR(#Ubi7kLi)FyR zXco`3Z$ypF5xGh?5Z@S~I31NSRFx>h#TZR}yTQ62vd~YJ3WJqM-LhzfqfW{q8wIL> zBYjVDcjw8^zBZpzzJGW;0N%3EeQ zhNUGE`|Z-2cs+i^An+#K9JTcyV)jC0I==J#xba>{llMq>pA=V%vL2_?+dp7WwYJWr=9fT zT~^5l@_~Syns^$vmos#1-=j46pcP3GBD=`zuF)l-GyF(@JQtf^ zN{bY>iQeZ?tLI)7&GROdtQV1apUbqGXAK0sw`&7Unxsx-6R?EVTZ8BXBo$j$(JA)J z!x>7mR2xTEc<(&JMw@m$now@j)V_X4`dNSs&M(be)mk@Cb%R zo?aYvd>7_QekL)=k7CMw_#%TvpfiE0@5=bgOVMJXo-vCUwo=h3@P=Wdr9!T>3W?{1 zF$XJ75hCoxP5^5FdW0>z$1{op#;t~_Mt z1Lj)Z;~uirz$;x56tlh;g6kWb^nnb+{>`#exoT6eZv}H@IlZFTu|Em;(_bMn>P!PO znek1hloT@$Rq^A$s$yX7EdOE00*+k=e_yY5H~hsp?CD-Fn`I#~6$#VNa1P-pbXW41 zBoZnLd~67jtU(SMROe4M`O%0?%2K=r?Kk^=Kx`d}_fpWoL1Jo*iB~-46HvvwDD_lD zastJcS-f8s8}eQUrPlY-Evm{FJF?}o-57vFJ@((gt1#jP2s)Nh#mylvVe91%sr(N^ z12!Vl@t@op29dvtT`^KqcgkNdb-G>6HKxHsncg0V*r5Ttc6B$mR?Ssr2j9eE#|yd0 z;)YSW#*}Pk%~Fx+jt<(Xn}3U@d&9!k;}+d7-OK2;w<;nw8?7pX6cs?)eaZ(GuGy33 z=8oz;tJaJK({}uy1OtvkEa>CFtXbJIY}mb(Nv}VRzY6$C9{&+yh2*`1-!Yjsb8I>D zPJ630PF)yuVt;6=z1x(*3-3FI`E(H>Q+8R6zV0-LQ6u$E@24i5^SZ$WcB{Yg$M$A9 zY}3$~*b4j}4rH9uK3p7q*$c`o2K34%*DwW;<5Po_w)4Y6BZ`K!M|EsRu$KR3UB z!&gVbq3}kYg8?dA;j8*uDex*f1z{sB+8z~~)sH((cbbtNy2F-*&TxdLvXnuC$k_Kk zZN<}sPt&5$YJ{n@vODy#HU!(N(Vr@!(SG*xVPLy@HiaK1>xD?GDv2bd&p&YHiMXyr z+^h1q44vK^Mdc0m5aFc7PO8shQIam@xwe&-jhV)<5&%z;k&%4-{CaFeM=3(5c|%l9 z=LZTg#I09j-T(z*g4RPwJW4_qd~fcP8~@#o{gYP0iCQ0l z&~|HlvKF;#MW3_w4ndEFC+v8`$7PY!<-34{{DiIxE@hN#-gY8m_1SRs{NRvfO^s^2 zFpJN=3|PM{R%pp`BPAJOB>Q*uD0~y z%X27kMtf~y&UA)VUotGMv7DO4cdIM^9Y@z)fCCU&&soAUfpVD3^r*FFA4ClZ#yER$ z`003=i?w+k$O=|O&+X5fBy73W%zQ>fC5DOkNPQcLkP46Ej|6sc*M5ju3#=Kb4a)`Z z4aJu;?jvf32ma8qHT5Y z*)lAj0SY-P9t$7OI34xrYF>nL2>$#$rgf7G{%r0%*B*Od;ZkhC_eoQtP;rnuTbm16 zO`_bhFBX_`VA5!d0~#ntM7-a&sPk>Nw?-3myoa{WJa&_TNv=zny9{bA;~gRZIQ_!M zjt7gRCYx@+&_k57S}%YDu7jRfV_Ip%=O4%DwfCzMc&{m!(tM?D$x`3kX60YmcDp{1 zBZnwQz|!DbVf!+G)8Y4SF5!}d0qws1KIV-jB+mTOMW1D7p_IaRvO^|A%cmX!rUFg^ z*S}2ME46C3Z+7ZlYaZBc8jO))8Eccf)2h}N8H`0FH-mLGLFv|ltdpLqB*HnRzXS!+ zMBF*H>R4kD;3Jr!Bl<_ad-|+0H*SL@B93*#Cjzlb?{;f5KF-V~0kaLOn!wAlK?nK3 z)1Q353%kDaW0WLlw%vE20IuMMLo_^3?*1^mC(ruAW!;U8JgpdB>#j@WB;W?VZ(&&c z1oUaMp$970d$O%o@Po$g_7>H_HIBKPBZgej_yoT8$5>u7OCS`rBQo>xrl%**0=&^J z?!xAeNEs%O2)5BlwUl-v$~R0@F1>Y?ED}#e%zMEFKKY7X1d6Sn6umw%duuZG95Yd= zU48u5ZsQIypC=i=-Yd;`$5nMKO>y)JMV+T$2vTn9%I4fAF8W!hzGE@8<-O&U3i;0skYN_ zwFFF`ZBTD~Ibbl&-$w&Kdp8=|cQ`+r6B;gjoxpSV%mzejypG)=G|nBqd0m?Q(C2_~ z_LJ00Q}PFP=(d}z;6E=>3+~X>Rk}=0G4}JkI$fd@O>34jL?4bGDA`WJO}`Wu>VA^8&OefOAHo zGkKAVLUIZ6ZUgP$xO=S`l41X|L#NYAX#~Hi%@ujZZ2!gZ2unwI(~M130*PPE*htoU zZD+uAn}vIV(|Tcd@6IVtVf@Djih@|llnMi`v-awcn zVMc3W$3V3ZI`+uaL|0vn)+j&om&u{!a zp4o@rGbyZXa+_?|Z@+{%Yvw^0WrKPLIrYCt0DCXeIfp$d zTM^=|L(pb_?+l&Emi(VhrF@YuXQ}l`IbqP2+t_gp&Ey|`4DI2eY$Xh`uOYc;uUvUD zd8m7t*EuOqwIFxX6t98ux$@NIL`%!!^#CRcYvNTqBw>SEe%4boL7FsTcDT*0)@1mj zGBDUB#6~syWaX%yiS`iEQOG^&?XkzMMd@D80~;=ORP9S2s#?^yTYD@;(chf2f6H)m zeeI7jmIsW!Z}A!;#+r=fe@b!QQ{W4hkp_|QntcFWlqtrxCi zTkZF(&u|S5BrMvJ|9;r-ldV1*^rO?#nu`TevQ^n8J-(gv%O2eq>1>*-)G6Vw4odY;&>N6~gu$cOG}--_eKK8z6ioZk?&(iDjt5kWR&dZiMy{3Ki@ENU6Z)%R?gxtQPAtd;5mduV| zn^<3;b<@#MAo1nU$?8)nqfSFliajG$Ha(~nUxo`}*&YKT{^`Bvta7Tu+4JgDaoe3i zf9Lz&g~HrecUqJf>i&(wQOxPQk);FKR`eB_K0Wb7^dzuw;E4eQESb~>2?%VYJ` z4zw#{CRFA1c`~)im7F*$U$Sg&;knGxtnULnXG=jR6iE2LI~bdAS@J0ib~@aN8g@}; zJ#-$gIwiaa7l~>^N$Wm*PT9*!XuMQ}1V0Ki5fDjfLJ>WmjZj!{UY1BuY38+X54KU8 za8?9=)nS?q7DXiM;HApXtYN^QMY}48xFH!#SnKy@!EHsZP)qYO+E*7ihxzX{?VkAO zr4X(Sft&5b6ztUAlJqjkeQYhe_{p#7tr;O$20`^_55m$=wrdi%tBOw<+qJ#5tFa$g zJLt-Pfsf9ve@4XCYr7=NGr0C|Ahck&xhu#MZX!Ibr@ zfY)W`Gi~evEh9B|BGR46lf&>xY1d-z(>g;7oyG)Igk-jKgEjd9c~}& zCntL4In4|frrF}}F5S)CWeQYYb1q(VN2q{T3arnElQF5)5e6MR`(+;*upVRKl5kvF zC-W@a17ai@_im8iXIQz^#c|17DdTQ2g*i+`>M{>1OfKmEgX#c7#rjeZ{bRmv-?3rw zu=ji}xQ?%kWPVidolxq`I>O%6I?B^A^gz%C-XgRQhDrakr!(wRV(b-J6%bR^5=KM` z+M&yWrCqcQh=@@ftZL z&Qqp3bH;F3Wx78O$$i%7~&c;vSyt{l;!Nk$J-z3=@a!ZL{ zLJ@G7lb|nl`C1meDJ*M(5Yh;7&SGWjZ+qHU6-(v#-FZh|6WyQ68T^P7icyYLx`%LR zFc$xkXs&Zby_m@*;BrCMFg12%M@gpt!t>6#&3)PvQGSG&#>v7vut`JK);vQLcZ^(G z?SPz#+2dHg*2Zx`Z>uq2c_Bht>v?;rNNGoi4;I^n%+9z8Ukk=;H3cKLoT|j!bAiV4zeNLE*A0NjCcx)99bhLGjEgv!}tX$j$AD?&LUOGC@ zYoOFzq}Hw)%%ok;rE=YP+-cvKk0abzA5-0!ZL{BauD`$GJj1-h`-TRYB}=rSZ;xKX z4PS62f4IRg^~JLD2HJ*+s=l2VRsgmbD%1(t$o>rp9uBjW71Olgy?tu2N&o$55d!`6tp=Q24_2OCP+^A-9IKk^OiV<9lzrP;SOO8xwcWE&ei_Q zz#a}3?6T?+N_t~UPd^20omcR|ZiyDaS0>FL;E>5l!FWW$J;vZ3W@}VD?9vp^s+g zbt+C9b1Ca19@~;GKB>E-wzcpM4XPhgqP#%T?zw%8Gwl&JoX8#$q5dS{NGLo;q|4Tf zduy+-l}fU_b#*PgDa~EZjyWEGsG@m`Kl`Lif99&D-ckQC1?3In&LmV?!p)m&kJu-O z3!z@?w*7U2Bn*BG8ly!h*LzeSfYV+AMnN2!;qzZklWwYmpy z^3~K;&PQ>gpP-xTF1J0qwq92AX1gePGJBluUVai9c(*{rH0U-8hcBdH(U? zZ*I>P;%{dC)U^xDLu{&aauz*yU=`}y;~ZnVRV0==Z2d|F)d@Ool(|$eq`j+M;qzK` ze~(i!rT-scZyguq)`bm&)X*R`bfZYkNGPo!ppuHxF^GanBi#%s3?Qh0BBg>N z4bnL@(xP-Dp~TQN#J2~ZbDraQ-uHX|IKQJa&VAo&@3pRV?X|AG@5I-}=j*J2J7DCH zM|hkqB!BWP~(;_K0>q0|6}Pmyh!Ar zZFnW(NB<*8x4*`EHq&)l6xb*vLXZBIE@KSRU7lOw9jewv9>SIk9xGo8H+z@X^)5>% zi%rB2dnskKfHJ+U#FeXW6`biboGg+hwOXQp49Ol$SJWJB)fA&&7TjaKPM%NE&708s zR!Cj9c$j?wIYt)i+Z-@sL@{AhdQb1$}zq;)p%Izu=QH)9ZHP) zcY_z_!nAAIYKf9%jW52R;)rv;=s0By+lY>7Tv0aqIC5em@t*pMvL$5pE8&zIDVVZ+ zk;t+428`|eK6v&kAEss$l$B>M&L`OT2U$NoX>c8enGA_DJyLsKuyaTxEcCugaYx{k zAAJnrNtC%`9mxZ|5hvfb8jXk`#|_E9*!*FF*3Pz5zR}gocKs*b`)7~ zmXa$Y%iM2{_Od4?x{%dMGgLc}4406x2hk+EX))*K*oB_Y$7f{ADvvCTEqprj8nHiU z6ot^|)KfAxrf7j~QBvr5EX8i{U=Q*v_JTf8n2QXB^{_gat);79AinIjN>NIkJh_~g z1sLBIBS)s}P3PFeCxo&+`Hk!S6Kx98bo$X$E#m|fF}uf6N8$EtHI*QUMcyjULuE$I-zF=v}NR;bB57)1myM%p)<~4c|2(T^a@!u>w z?!LB5Zv@XnYzvR=_mF>ZZU~$W70_1}YLKf!5Rm$@wH9<=;pI*j{ z=RU5VD{`J2=Q7^3zbjuPnjq!f{jybz%Z(}oJ3Syqg)ujX1j`8cxlQRe+6oP*#$7mI z!>EyM0zix{Dk>lXq@KNo&k2$xhfRxW)FVI9-r0k4hdg-3_=4vm<^u3_8s98vwkU(e zU3*%+IYu6tGDu%VbNH7UWcb(;q^l}&>M+c}Y>iDlVsST8;9rq>J#M)@Pxj!G@v*ZG z;gUk#%ao8SJdLUGY$5(klkzcqlEYcX-Hl*fV=tGxvQZVD`KE#*))M9;*0*6;v~c5J zVLmANs)&V=gT#}QzhWL#%jPEc^CJs$*XAdB0X*>PVlX zM=})AnR1{t7V;W;*Tz4aJX>};Mw>GEI}WbI`{ILjkQv!2KOZ=-YzK>%7Jnwu=_5qK z5A#`4S_JB9M?J9=eukYwkK4W_tOeHQTeksc?+~PkpfvW^d?>ONCPrvUp=9R^*ohqc ztXq0XfuVERx|2LC7OL@nd}bR3howtF=>p;0p@b8mb7OQ-F*bq{?)+>l}d+{xeBz)n5_f#?h^9Ynh`NCP@ZX0aQi*$}!1WNE^ z#hfclN1eRUTFicXUtw4~&C-@Q{W|&E78{-}t-4^q{!!#8VoQp9%9gNnn&*vDQr;`? zpHYIJnp?~G2p^JvqBXc3=1HOs$W_gf(!@gIHy?JldF3DU$Y(1b95?qnz{(=z!QBEw zD0$<4;abg>y*(NHWYKkEA!@mX3Y+LfW=p8TAZM+#_NY(vWCodm_LD%H zFU)h6n=xiV+b;~)x^0g-budpJK&3{h!E_p+l8DRLBPPZ0RU{MnG=uZ9h+I%zurKF6 zH`}a?S6fKjhoZuw8}=BS)~fc{{1PsJujoe(RAI~tj8AsvHc$MXpR%Emu)lD3zw#5U zhEr%fzOYHZvE1PO5hImgqjf?(a#0D@54Xd&MA9$0h%RTiMp^r)T(yOBC>7o+9<*UL zP#)cqrP#PU1nr$iyEXUgwPv6YUu7P$Qrj@1Q35KB9*>2IyA%jd7a6J&3z6=t^SMQHQY=Nq4}obQL`C)=I5X*Q1ofd?CCz9K4&CG{zy zxBk?v)q&0tQ3Kv;ZZ8eBOr($h=#%T8KC>I#pQ#LEmApk;8lV5jRU==mAfSN-M5C#y? z@IbXPM8$D2%0&t_-{F)g^Jl_>YkJ{QK|}RW@}99~oiY{RaFo8}HsO?-9{#B}PQjl& z;J;Ils{(6*evS$&y{z0JuvU8S#`{sT@GW7kuaZGEpQ%DE;{~Z886^?P8g)Xw7e9xT z{%o_#XG)4DwB#8I8E9}mmJWBJFLNE_TqR>W2?DbR`KOaRO2}=sK{PF+=!c)_^={klBU@GgTl`hicmml#NXRUQCa z368D?rCZw*ZT3BXNvqM*z@iij0Z_Kq;R|l8L&)1caQDbiip@4g<<+jST>his!k!Sd zFN0Ag^eA+{X?n)HNF0Wll%E{|OMzdd*J(4!&Ci?XJ4h3vNT(~0D8P`H%!QA@qfE-r zfLMi2m#`^;K6PtUSaj%6efVw#?S!LWkd@vq}pxn%LECWZ+x+z zLqDXxgrM^vN5P>eqZ~P``d~{I93^OG&16I%@HO-p)?<~bJ!tP%ydb%M@Cu<>TEe!m zJqXg+k()kY_A~u^X-QC{j?B&4#(dHPrtdT4JuU#c0b3l)8vLXRW49FFo0GHI+y}#k zO3u9O(d~!C8ATb6yq-f|m`?+Op+jvxw=~aLGvHxbU@~W^S=jkFPPsUL9o*3_ zDiF}3QhS?QN$}90Hl>%mQ+9{F!Gv(b30AAn83k-+{Hz05@LB>i&{H>$yx^-4k!|_}gwG%eMSsQOboK2LWkB@L)ts@wcs)sjbrc zi9D|zWSX#Jv8Ui5gLj$~8C75#u3-AkBhl`W2qvDen$L^_9rnu0l^i@_Tn}YKT>OSZ zbRpNMuF~8cVUQmEy{>fZ_(nnykHKI?c>!^1w^k6qg}KbPT6ML8$VW@ei22ITZmIbWj|f_z zp_jX{P89ohzYt7SkkDH~%Oq5tN)shWMcX4LIWs4tl&?66gmzH|L@v{tl%{~p+-QZB z#In$%uWxkSjWVyyWON+$EB(G;r0GmZNA}VhB`GiZ?W!APwH^$4m_!k@{r0e>^|8fj0s$aHnPK*g6OoEj^P81glfJ*S9>{B%i8eND zW4Tfo$fgr33JkrNcD~9Olw-n<*NA$VC76kMj}UZg%8^dYQRK+3nWZic)@64h)mh~0 zN5wzPiU&WtM!|~~Y@p9V1MTk-E<-T!b!_zL$`%z*XCE0g+InIKLC<$R={EPG)9oV* z_HL_$rC^ed=y_{`raXUq+9(8zqQs~-5P}ZwuDo-6H-^Y%7l@#8hiQXadg>FKr$tt8{sb_o>P5nxwy2VA3H`|)43h7r!U^9n-CbgUCYFZ{-xbOP zl>{5U!{=s$K2%AG>JKPinI`WXH~&~JmFmxTM*Y{+YiAaX^G%D*(`#Lx#66ArGzPax z+AG0pyU|pp_VCQixo4UObMeaWMOxM>@E>Ck>TdbJbKPHS41)zW20g0$@P31u3#31@ zYo0NPv+2KebrSz&JVuTs)_#9N&A@G*F0-ZnE!Z#m^|Kys>ish>xy`2y+wvV1mwUCdytdzXEK<*K0u!95Caq%oS^~wVLE`=xJ1i=V$%qY%M9HWu}A~ANCAp zQz_2Zv^j1rYfZ+rO1WoHvgDzYs($})vQ*sgmsTq~>5*lMVt8O5L^!MItxWn~T7X8> z5PKI#nftcAtHvi<+tt9gjMlmPQlffd*9eQs1iiMJ^Y4B-GuEQn~&^3PtT*k98YW zw@H^2BDRND$49#Op;soyn2T=k86?mZz*UyuHHnG5PP`WuLjL|zGkku1GDi1wCy--+qK$R0e7SINV zUP`UI(~>#2Wv65+ed;k$|EHr2`8on5WDbgYhtz9a>fzUT zpv&Ir#<#i(vHELkN4xM_2^rI3?bSpsZu0P|;GBnb34Grwl@kkb) z^A+Y(yiEvB*3GRd_V48n(}m)bg?RQ+Wsy9 zsI(tu+I^YB7ixIxv}lsIF_}HU9|#XcD=)u@Nv<|Pk@IIH3OF^4eW0ft$)EFnOON&nOEF|vJQr&bU`f{UVRFV-E>~K1Q`)4bH%=gquYKYI4sjtR zzh~?gp-mq4*IBlkiO7g1bG#+OD_{Hr-pth>X{6<`O_l4_EtQYlOgm7}F{X;Pd3a=8 zoJaQY0>LLv3H@WpNBu*m1s1bFZ!eJtXs3preE)_55@aIQ1CaEF3itAbTt*wzH>Z^oiSq1w3=_boJ=GhdA0ZJS3TnV zpHx~16t~OWoDF!)_bM(I$jlM24m4)GYDGVA&dPsSSzO?11eH=xPHp33P~!lLSj;Tf zjX1tZjXw(mJMTnoIA!!cY@7CMxj&A1*eYw@Ruhn z0b?ao_iAs+IW%5UtlUqn4{WcWMGmGMlbLK2IPx0@1UuB5T!$&rk zWa&_#cpVQ;ur#ZF9I&u|+v7pMb8YmZ&o8)w;{<--HR8d3ZBNb^89`+1`}xJ^=URJL z2B*A!!7-NHRoZ`AnCW=%+WOY-yvM;n_YYu}Q9Y?AIy0whuWan_Zt&4HBn zd5|meZj3y!5cg~r*rYZ58V{`stVr3-oiICV!DF%= zBT|{{M+Phag_n>D`IEQ(fIr-R^2R%z?aWh(Ox6ugaHyB>pYc>6gM#F@pjSF>)vXX* z+0mUcx}P*@YNE+pj%^K4QwvmUt(TXhlDkZ{x^~_%_9!4oH*mz7{lqQz0zsMU`6)5H z?mSzpC$$(pDKRBYjzyGHeKDS+)Lp++MLA57F4JgVj z8#-f9*;-9#>}|WgUzsJ&{*ty++>aU|(FzW7V*HCHyBd^Bk?cO0#Jh;^Xz}J?E{1vsAFEPN>N^#TU;d7` z-h#jp+f~n=L^#%kH`p6kbxo?_t|B2-C&@rkkkC-har>a#8F*cN$B>xQMXL>9fq1IM zV&!$G4@G9oc@e8}=w=)DmnWjn3BW_Y+w!z4ZZ+FAlMKu0$S8NNdpkVauk<{9Hl+!R z)!wlMYZJEC6+v9V2y}I)V)p^Gx!j3B@MTF$slc8SMj(7umdd#(jG4ZPV9$VRS`GcF z8M*JDW7l^p=+ahLTS1r3yoIj`oG}+ePrLk6dVA7LER|r+^U8z5h6sUtWVY|8@*REa zhaN~N$KFL-h>6c(x1)6DXScA4zC$L~3 z7;hRc5(7t>^{M}^{TcZSGlLKJFb(|GoXZ;z#ts}MmO1d2=>wi8Y^-aJ!p*+p2?|WT zJ(%5LaY`DsWHlk>%~z(WYEd5b)cinS)za9uL}MEygb>ROi8el)Q$15DhZGrmhM%r{ z9+a3o{7>3bL{wnMN21{6oziW+lTNZeH0|coGEbbd$5>I0HYvGAjCAXMA z*-i#e962wrs9*)M%24D@Zd~rlHo&;i#&97|u z2mJ6SXg?t?TlEiI28U&y{33GXW(z-{Fj;02;Yl>TF8SH?9{m0-IVzLN?SaByj%aoY zL;4thnd|F;_r;G_pj4*Tg7eLoz-1TsZSj1!FUha;3nli?YgnmW{Q)J84B#13xAFXs zHOHSvy@&vWn0u{;Xs5i{U9Zmi9f+Xh4&Wviiu31FX#9I7mRlh$8M_2-J`^S{L}o8a zj#uth(q5;>lO;Jrz2goHvcXGWBDa5qXA;NZD9?VrgYZkYV6`vXc?VxX0ey24lN-cL zC*EB1bdH7QrQrxKj>$$V3$}<=eb?c*=C|0p&}tatP~;NBRj%0SV$YvzU6^F+ z07+1-{XhEC@-{>OFF^qBwjz(^e{XJ z)kfRkiK^m95?y(VUmju1eqcZU%N!}BafS)Yiuext3gDQT!9xw$=+sRRlFyv7K6j1&I1oXEkdL1fGMKA?=8xC*a zJkYx}AZRu)hpV{+J%Y5+Y0BSNn%e2XW7<$Czso5^kocHT+{lAoru(ba)upCp9+PS> zwS5O;YuOloCL(V@&nPRo>BjKS>LN2A{=0-Wuof9&*S*9g@7oz6r zpW0TNVNq{(*f&lXn3Y|*=n&*}9x3=OrVaw~T7JzAy6$5^ymZB zpD|@1M4NNVmI+Vr%v6rNqdxJS@rUw`uC!y>ENQbY@o$#p;Q6Ny>niIhmI- zqg}@6EM#PFI!*6K=))w%!=m#4Z{fo;i8AMI!mJ?q&rtwH5Sv?S)dP7}cd7kD(mg~^hv5!-d z+}utTRz?VX5HR#ojQ+JeP1&!7POTikh%F_vNOAPMm=WrtbUn23$Ir8b#5cIlKE?gZ z%m-J_(_i3CjP)jT89NI~fo-+?Dg~?JY2{RtH+!ytNr+L8=Drei<}b86B74jQs@gGA zx;V2GEbXhCkEOtAJM+r_RH96_2wY3^>j@a(9a@45-^E*|!4pgkR6imq(B^D=5g>#j z%;P6;kH*s`3yip(_KD)7U+%w=<&t$odfOyS z+jNfE3Pem;!z6qSQ$qEzQaTj8y!#b3bx+9Jnn^gFw2DZAvcLzaNW`u6rw9~||G%A~ zOLstk-1p;d1cJT4Zi*<=t_xXVe)jX5$sd^vS7|C#XLjSh@2S`0Pn0c~{!Wt3zzGik z^Z%y^BZq2zsj;u%L+Sx!$BSZgxcts-0X!*6ys}kGuHz3^4z24CQiIeFiOQSu(fodt zwtM{L!TEu%b$De5LR`Pd9lvU$Lyiee_SB~C9RwP03YJTzmax{!oJDv4Fb9QObZmB^ z2@5H?x{!&eHx-Dk0yf*Ajt4z2PaCN0m!H3r3)0Xw=cLQjcn4A4xS&$7vt7GJQOVKQ z>l)ke#7>6l$IF?{?_rmHx39L=Y~VRD8x|N95c9MmG&E$Q>djmPhLBHU5c5^|_XgK4 zkp+ON^P<-^3j+_9L(#kIwcri0pUMQ0N50KBaCt2C-?pdQTzU&ONwG&FexBjVpTzCWikS6~#qN|%_5oVwC zT8|ZTqK&fI>YnblGrET@-=rMpwU`-q&u3QKummUb<5E^WC3-P8$#Zhp0X+5)u|w-r zh!gt(vqJpc0No0HP&y*>KX}<%!oUu&C#F1<_uGUdYoL3+>|ftjiP*J(8+jYTnyTbXZof463=ePzv0n^@$X@&mgrw01-U01 zU9{+d$`HoOuRojTG^GD8vQ5@Fn5(8aa*kbr6*bDM^M*2hq+G(;Sh0B+VN8h2kLU5E zDDZ$3Nc6a0lpF!{dQ(#utWhuGg<9=dZxf{}(|i>*!EE5gyG_f00WYA;0?SM zP+8@in3_Wb!amIYN~<*eV9GZT3-pto$e+>Oi4u0ir5ITxXG(2AR4)70)^?$NBn5G( zDonf#r$5qo#f@%Wa(_v?e8-+NPd=xiB<${&RNvJ16wt1iIbYdP=Yvw)#2(|2uN$Qa ziWgf7c;r~zFD#*<%G1f`x)l624MlcR+Jbe?2fNo_oSWU>y})1{lw8|`b&I=i?sWVr z3@1$7Tt|u?#Z*&q>BC_UOuZ_ZWg#U;TKbP{)WJ{L_ucqugYK>Q|1p`)fg|;Ei zyh>rHCG$Znr-W#v&*t9t#T}bBCXz(DjrI*@Mx*zZffS9)&6EWA=#bOS7h}xjRRw>_ z%qMTT!H2lYAEt|y)hO~&?WF=M5Bi&a`9u)HkDe!VSGca!q;a}2SFS6n-p*Z$uKfkd z#5ICQ=?o_2Nl6MI!vsELR|t(C2!eO`Qb8@tj}4*)#ra@x@z&T)PZ&(%j3os}iW$w* zYp{z_w?cVsl-l1m~ya&^hEEXB&@g~;5&l#$B`rF zYKqwxJK2{w$wu65x5mz~Gjsyl&B>p<_-r-rrr?(?mO$J-e8LC1KaFv(z}*$T_S(1U z*21d9e4i_{orSaU2Befh%DuhA5qg~uRGdPsdWPS;rUIg*#b3WH=7pK&W_bzDA}Sxs zV@9vnCjZkjOMn_`;A%zzsb3QoZLjSJ#6^=szBnbIn43FSXhxQBiWIa63n-x9^-wfc?d!8k9M zTfEXD4MmV=mA5 z?W$P};(>F0y(Go#r8iT)vH@Q461H~Rwq$|(T!tu`1RzcD)arH zVSws{bd(jq`6#uk_PaKtYnV{gV6tdo8@f zXMN4AIh3*^wyX>K{ZVS^ld|iQ9Xyvv>-l#`&MGW^D{8A8%6EDaCHhsr3w^lOpUhHa zcb!4Q_o4+%jN#x(sr$_!&n(z>`?ohX0U-nTrgIuEZ|7rrd-FMeO<;AH(W}1O*2k@C zr9vtN@t`}%b8pZR^Hd{8dm<3WZFmg&CDC#5XDg^$!^K9@9?4|}lJ z8_(r?ZDGWVeE+E`XH+RDWxwDX`07?dp`2D|O%l7Kb?c-~-3NcHd!)~bZNYp8&uE?T zkIkXF8Iw+foCp(=-L*GXO!em`yY1%9%1@dx_C@FQPi@U35F)NO#X>#w z!Y_`1+z=RBNZO*62viOL_>_izm4Ih#80jj~<2BG_JFx!-U1WteeCssX-{)~pUFjo< z!ZqL-xB(e7nRZ=Pbj4p!DxIG1f325K>Q*(w0M_rzfwdglBEq?d2X;Y=uB?C-!~8br zmld7Nn13bl7_5(fxa=ZYW>~NNVg(5xGd-3T)W7X_#JhH-;vD|9bzz`ZIYSakcTA|u zV}I|)n3k>f#Ir6gkApzB!ZXlj4*Kwu;1-wE)&t52;tgk-pDCG#rQ=`X>4#xv$>5Nhb8t3wZ zv@@W83}&J>5I-~u8UlRqiw!cl)+M7K^wm{xHJqxxLEgl`KyCr8SD_i{v<56Jfr;Bm zpb!HpoX>ps<7Z^TV?GtiNt{jSNSW2jm{~Akq0^?-P=1dq{q>3dCEuACgHOjymmEOf z+dO~v0vg_!bZ(|09$o&q8Om?$;`pGLMqetzQTi4+5h-z7bXimTP~r8bhQW&;x7T7i z>pvGHRXc=bdK*ZP+N@*%J)iCs0@n!?7({WffQTl5XuoD8#9Fygh2D- zA=6(q&i4Y|^P?8wZ0wWEg+g_f1~RU)7)xGRD^TJf^W-P4e41WjD}#|eTrn~s7f+>3 zWGO1?AQkW3?psVTJ_b0oh-W2iE1<6@DRu$EDl-2!6X9Lu~Q`R%)cNzkiJIFBz zFn27^Bc#3Gy5VsFWoEZaQ_W*4kTp@vinP3~sK$xeS5UZ@@T#697bXmg`y(i}{~YUp z9*kcf8XCDIOTIiZ%K{oaCVv(lP~Yx|9e14(I>*1MK(*2J*=V1D;*1;j1>QQKvfKIu z(Ys9&!<*6jnjzw)U~82yUUJns6l8mt#69XW5sy75TS~WT4DbQ9JEgU}L!W!?z@hPB z^)o3|M|@e29!rOCDez*G-wd;)#!?olLviV`;xs*u{MAT>W8_KorwAe=<3G7_#V(ggRZ#}#b5!1Ls@es1B`Cbxe?ttRT|0e#S`nG8U5QcY{WT z@M;GfimP*F%|UT;L!4a8$sPZY+-7ewj|!?|5Y*=s253F1{i^Y^lqUpbLNax78zawI zaui)?-4txNT_DJ%Kvow<0PMvIOhTZ+(=ekMRw)tS=`chMc)5?5-Uc9WNlQuk(cy6$ z|Hn3?p{BJh&?p!QG+I=>U6DOB^n4(=$};~l*Qawz)&V9EY}yv7XKpFSO^;I%g054d zjBOwg14#vzp%ZB|J`%MA_eyaL%#=u}uU=5>4(5TBxWGKtU7Hsyl``};d(c25!v`DTzfV^RdKzEciTq=v$UEyx8{nQ$3jHA5HIu~zpd~quK zG#%A22pWR)9VLz6lhY zOeU0|D-ZNj5+_FJy9gzbhe=VPrq@em3SagBJ#~S@jpBtRYV$OdAy8*E#vVuHGx6yA z)nr1fs%8Y2k=gX4R+5y;@rqy)4|sjR9d&&)(;2sHO)bQZ;7H~uGD5ni7Av|RJxpu~ zgD};e{)$y!T2qf0wah|*Q!cXrZifl3DZ_~tW0$mq+g82tbKd=<8F)JihzWg{rN9O> zZfAOaILzfYn5TcSwvYWw3-F(wj%GMebA`KT zT1aE=L@uyIk?XZ&qx}-VXqD{phr4ufl_ug<(MUt-8eCM*UOR}V`DrZWU8AGUbZ@f| z=6>@Q;pal2-n-K`vou5)e?eilA+n1DtfX3W^%`vl+$c752&G2ToWUr5W=3mR3jjUm zyY=)h`Gdm9kbx`j9Y_m@&qJe4@mmav2O~vVf}S>gu><7$h}A>SW*f5 zyy&9>y9ZTXkqnCa(wX~a3%+dk2Z12A#;qtDG=p)w$UGMGHWgA*gmEN7g>mrSM7ww5 zYab54P#=D;>(**=;B(6Lvwghb>5+2b-Cl;pKU;M1nb&^n>l#kQqjqQLoxV7)-U#nf zy*k>)2*fjs)XCZ5N|6leXLEhYxW7t<#HVW(50aNqrrF8SyQNDOII07|Ej5bNLJrOb zZC%*2KJ(8b}NM?32vC$G|2Yye%wx0c#Z|MNBm}LS!?&jJUF$r69CnG9A9Vj z;;Lf5?;oAyuP-20)1`IIXPX5|G*u5hqVj)6ESU}G`Q(`>wOx}bAkPhnMB z(voyb`OVf=B^wJ^0~4^B^$yi2gEj)Vy>0y1E#Zu<%e~9nb|PVS{Ei2C5?8)hNA#3! z7-pO23nGUJC-mM>4wMsqb7=`}DIUM@GQa;~K`8L2o!cse;wd!5>80F>I_k^~UPsPt zy+-uZ-_UIgJ^P@kI`_K=J7vCg=2%5u_5$UNTHL;i)UF#r=2v?-Y_wxft<$6x4(Q(b zCH~L()pLkJR0i>{C`>l+zFU90Zq&uW^myr#8Lu!6nA{;@oKDvzhrfXId`M}#dxUt7 z(huklCz>ED&Ops8Su+%$TI%0Rd}ib!SZbMz_r(3PpQvjO2#epip9T7F@OL{m_(^HJ zGL`fA=;6|%rAx+CSqDA>XO-Vu<0l1hBILL=Xo<(g=|}fRLe@j>@j_fRaPX2o1o7G_ zemToh^g|Sbu~TDb+&J^*N+oBM}b2;$>qI8@!e#kIpc`n6Z|Zt~&I=aJilz+^GG z{=)KvvF5^arxnr;AeVg$8E8EvZ2#%i=1#DnKckirE6JnNgHY5)SRdh|;?^8rb(Vx{ zX1WSiK-YNCSd(TcO+-BD+340xheP`5N)oS9dm7+?K#u(-vZF4~w2d4ZMIDm2O|fX8 z6$tPXTJ)KMnAaz1*u@kEQUHbOUc=W-m&l$6t8Ye@mne5c0yPnW;L}pi715wrzuv;v zWWHEwpzAZ+FQ5L1N8vn44Sp6X?EMkiI5rDoE6y1%N1Y2^Kb~-Fnnr*Bh#5@Xb$T{F zTlp>@SCi3>LC6$JgC6PLOLyWk5sUTtxOu(N6~|*R`J4v|3f)HMky*;FrCyeVtVPQT z%cBMdL$r4K3PHyO`v@i4tz~(SNsgjfKc+iR^^YcJ0c`9J5AqrSC16u_F%DW;Q-dJq z=lwNmG;y6{!()Xhm`Z`d`-eXz7KM`r{%j8f&kF9ntAZ!)-khLzt5OHBnByA(8^T-! zjZ{xg>S4HAo=0>7fx;B-HY0<)Ltqyx?j9c=v`%ST2h;%d%4gYMU zp_a3hxTbt5_)gr637`Kht1W$ZvOk7X)I#%n-r0=1q@ND%A@<92;4TIlv^m=UV^UwJ z-w{mWeJJp-!$*Ip8+}w^CvS~>mP^S&2X^NBa5bmn!`G)5d=D8Y``1dSEoHs~A2VB( zb^);44IA^Ph>3(x>vM9=%!o|V{c29zhoD;lCi<}MS$_mX4~W{u9wwBNy}Q)x(ou_d zmFAk*Z=P&}-N(X=<4HSS4tgjq^0)t@_7A<)k-Dxx73YstA~a4k4l(yw0d2>i@0mOk z)DjY)X#!l-kIpL;_>cI!s%hCWIe2~2*6rW3_SN~9r{WO*4G>@{CtEfe8+Ba(N>b7@ z)nIiEEQd{&m%yN_zMn|538+y%9dxkh!u+d<*p@OCBt~*CbN2x-Zih`$9!cpqLIpqv zQ)>PJZzuZH<>u-ddq8s+9m8Xg3Q+gIVF(<@$9pN^gq*3z1owMkNlB!q*~fbCD12L> zWvu2j*dqGB-TAsg&4Fxa#j3Rj;OCpms}KSI{j>d`Jl8)>jm6BiK9Ro&c|tWJV_&*RGAF?MqYok_a+6EsPb5B z1X#?hi}DUNL;`tTB9PZz?3CFL-wk?ND}WOs2n!;&<^T0m!{Z#ZT34D9U2z1D{XZL@ zsUeml%yZVqHKaeLb*sQGaHF5p4m%wDR{=1@yNIe~XdyHx+F%{10&HqLW00LrzBwm0LAW567LY$$ko?#mA2l>`ZnII`l;jm%IOXT&Ljr#ZTiY3I9SP6 z{jqJmn^w#5dNqFdUd&(*g2H3#KLnhzR%UJxQuX_167p`V#)H z0OS_tq}*88(Tf|inw|+LT41FLw^xnY)jxdI2``G2D`{3Ao1ED#Qq)anA@DK6hDrJ z6LD9-!O%v67@XgZlZ`6HbC%r|`yv~cR)*}(nHE%#oN5!mDEWf_{=gm|eVLw~#+Ce& z77$7kcK@sa9I&puryllV2EGJz>5Vf;mI-Q>HqO%_$+)4!0VdREV-B=seRfZ|$bTyg zKdKzZzJ`4~UKGc9r&(8gN^4y;BbSG^QQ6^~M?Zv7$AsjaYXm`2KGSOJj1n0_{&#W$ z;$Y+dxzyTR0QH)w4nJUh-uZv5wAV9fHN>RUnCl-t(&~9}3fDlN_V3XiXn7vC9`%91 z>EqwO>he499hl04 zZt#JdAJh7f9jla7b3&it`ip#$>e(XAxO{PqHmB#*gZ{B=xJ=Ty(};~$>xVDfd#hnO z-XZPif1?MOs0GYNj`r7KzE3oJ3~T~q~j#5qe@7VDiPB+6DMVpTUQuWB$RbbhQeIuef<2V z*qGzRg$a6uCwG^&{c2pSQp6{vd*tLcedgbY-@Y?$OplDEEP21(zbJbt%$xnaXVvOM z&*Dxt$q+<;KK=CeBN8tCx6H_EcD{&{%-`!;l zLEKlaUau5sLCLn(P<=g|V@B3owxCW_BK@FAn)veCAfEVLLBIhwi*|SJz(UUIis?eE zNNeTONo)nS9>(|JlzswaAqd#1VQ$a{~iZdN;I3l zG|^IO<>05Tp?tnk|B8+{cPB&i~52I*F`43bu$_ zk<~QjAD-|ud;HGE!v+<3A8TJseX|rJg-uJTT{g|te3X4|y{lSo{p7$bXtVlGJB!S5 zwN8;Qmb7temBd%lrx2!JbR0N+euHag8SGL z6z8|aqrH8kcif6yP3w)Ar>XikOWijj6KoY_$LiXxqu#u|C@1MGn>cf+TGobTm-_I% zMFtIuudCzO+a4+SBGLJ&5={NsKgav-AkFfuxmNgd9nD(FdGYogbI}X&wv*i*W)6^@ zK<#JuvF-v?3AQKA4JI{`i{uo?@_uRevC;kUH%i@8ymR{`4Nkt97WtM9WBEtjlWNSh z%_|q>j(@SbB~H2CUXb$5M|-YH0(&*K!N_6O3AS7x?2=6xXYShy4bkGc;u^<<6hK zx4l^|U& zd(!9CB=y;4GPL*+^TUM)+T4lEH@TrVUMGyu*gD(d?;5pbCj32IM3@O~jqnniK#N8X z{i`&ZN@Jmve1@WNio%itC>GrgLwtB8VAOWc#!k`S6xjctxPO=)}}f zVIX)FZX)nivWXhyM2M49eHCUS56Sg9xcCys45>SR%Jx`bQ>PqW8ciqabn4W}(84`; zA7#8zlm=!%CFzkj&{ggbx^zv}wD-a841^YrT4q($nL0D=v7@mmrhF4x+==_YjR^AB zCeb}V&2aS0Tjc)cb#5F3<@@UbX*T*(drlK~X@b$i>(juUs?@)K z4gyT>G{Bw(E5QUkcBw3ymM18E)`?Dkl_U3>EK}$0%6s{8bDhmcwJLKg8Z!Q@x}p2dTQPxxFQ5er zj5seElgCe;Qhov3h{t9cdsIMEpn9%v8 zWav))Q>=VX(^+J@@F2#`Y)A9(C(euB|1}Y`85viW2CB2UAVC-J_e%q;A7@leFV`?# zaQoW^>5V2|@Wqk)3A%={=qGqWpcxYTk1O!b%*F)rs^NT^xY2X?X#{WmJcnvUrM+6f zqyO5|*GFAXe{%~!@c-co7Sl?ILl4}5Tm=JSqMt&jd!Bn&_FI~r4#cYV@0Vm%)jPEULbDGfxMZI&r;~bZ7QNFUW%Cvw(MZ46 zBhrrZZjh3IcW>dcYqfXS6e@wKz?K>3r(7-@vJ^P)X?fBMp`@#Q|0dL5if7IC8Ae!H9!9o*#ij$wu{7c(S0iYU3Wn!gK+-m zZQ2Sg>(w~daU+22`s@pgQw=r?=xxKJ008i&WQ(TLu00=t`Yubjsjz!xsMPlky`jLDHZb+;2b4U-Z-E}~viFMBxZmr!7a=@YPcY0-5s(J+w1piubhs|HP7-~C24Xi&% zJ+V0KTY}R1QK8`LuT4;JxuXVkD6JERB^BSS!^z8c+q&A8ZbkNxf%)Nuwdl>kM7Ad+ z5tCYA&)KxaxyL!_&X7#sS~07f;N5l?A8~(PsHF@y)TZxDp18h6!@AcI$AEIIvS>iq zCP)_kZ&GrcIyt6p`!a*e?umyp&ed{m=Mt5kn)i%7j#~f`U2E1C4W%>hnVcwTY)fXsc?MndNuc44807+H(wI?S1=puT_FEGk zpFP3xwMS}Fxq$zt{Fna&gnDSzg2Im%J|!}V)iW36mMRD|(wo4GyES*@_M0#Gzy{ex zvlpCB3IN{eQlVQoYeXknpp7xc(UB((n`4_Y+y>w6z!?wq{#9BKsm%zolf$&C?ngoW zVsq1@FGpSMmt=h2YC#0Nw_S())^ode*wuP^Nzuy(LN2RiN7bBW$F0WDYQNO(QpG)c zLN-5WkD!BwL=?!rqSxP1J=Z3lMA7Um!p*9K8b+vZ!TPB0JGAK zzfdu#Bo*_gS*oIDgcJU$fY|gQjy=*Eip{1U{>*Dy&)$8#RT1(1%r5o*{r-o7+(Xo? z)DgRyG1-^T+IFI|WxxkXRQE=jZ9BE{F7p?Df3BUr;?4QZKzWX4`6!=w8grLpS2c{< zRjD9h!b5lAc)`rCWWcVfdn^C)+w8B+``(8V>N!syw$ZNd+^P}<{kH_cNDfX?y`PYa z2{*_AlYxC`WdiA`z}PeXf0#(P)sG~H0QyEVxi?&|BRk*leC8-*&y_2kcD&u6+I{kqh>*TuF>>(57wfgFbV2@nW3k8i|lyYsfWepBOB6F zr3E~PHD*82N0v9w1A@kZIBXB#7*HT9vs=>W>3CB}(Up`tX0s zSCds>=YOT*8GH#o+?t{W)i`T3v`zP-@*%Rp+uho!GkEATx><6(2NKl_#-!}|N=`0h za<5Y|15Y^HzT@O^%+ed_*F`u9?kV#MTn zPkc6NGxB@EB51XIp2sSqz4wp~Cf!F#PEc3fG6hdG^3)T3(M>#l;Zbc{G*|Wdkdz@(;f0 zDeO@yIv>EE_ajbQx_#pB1)Z?8{2H%qV2rt>=w=cgN-aq zuCMHA?uUad`jq1?`wx(U_PPc`48nVU_y=$blZg~J$?eq zd~yr-HhVsNOL@7tWVSLE{Vx@;_ZF^xcfADYgTM8KIAw35YzRvd3E$Y=l>Xj z_ z%Fsan=rMl4*)Hen^_keF_SgYe=1!E<)2@2*PcHxv4a7hsp!grr06?j1^m;ek@+vsU zIpgoJ^O+Gjw+g-9=&JWNQ9yt-s%|;N**DK+oJ*I@-Tz}Mh`yJ1w5mdGt;y)^s*eDy zxw~-@%>Y4SLgqIA%_ggcK2f^6eDVG1@_GpVv08PG8XthjDAGSG9Td>uf_Zu|?{RAl z6DRkFz-KgjcO;({rnm_T{foaDfoAgufB&UETrLrjkx$jTcZs(@?*DKTe;n4qmp^9V z0Pn@N;K6Q_`I;u|_Btgc;@2;yR}<37e1M;H)(QY<>6cL*>L$nwpxGaunW5q#vvB6v z1oR@l*bhX3q(3~ti6qYenkbw7WE&p6FilaG#0s8KY9ezq256Hq6r&@FMOySpk;%hxp#EGON-(WbT0@M1M?T_S?yP zCjUE`fdm#!(DM806_SaG30ZU6_0>gJR~M3?prHHd9<6fvL-byf%gaj$L@ETUV>C<3 z+U9$f6x!zuv73GDSE!4Av(oC$Z zK{_Qe&dxl=B_)fSn;4MkYD;|ZbI;nivW0961%kiKgbE1<(q#Iri+%eAXHq-3A^bFR z3yXd;){*>{yL-#)&|5FdDGV}_X)u5|T!U*hIAB2@QongopH^5*ObD3y2jw)3%%xOv zb8~a>mJeDnF=`wfoMb**vWFrf`y2Tgox{TbYHI1~cFoVXb&Py(^Ycry4?&g?zc}9E zvYp|993_w2&7&Ilwe-rB&|;DCK=qqkCmL+$TYaD&&L39}H@+?|FXz5&YikoTdq9dT z;SatP6^rDFZPQE&9zMPcLrpk7qa;H-EjV>EV~T!|wKfnBq5uW4Ea}c2Bb|SM0ti5I zDH$W~JCCeK9BwB@R|fmMJcSvXd4wpDEb@l{M+FB4BJOkQ*XTqKCUF3K4%{>B#Byi6 z5MNJE4>T@=LEoXED6T4*oz;6JE2~-c!QTJ;WEWRfR@P>^9Km|B_;#Ip#LmS<7;4_o zA^6>pG1jo@)~=Hf66U%21%-rwo6f+8i?u2cD=I34=07NAh*JJ&atoEu3zW~3)YE$} z@TPFW3fwkCM5JNc^!)jAaPPsxhkEbFdt<2$;c#*_F=OvTEhj7x?PW1zC1Fv*|0_HI zHFGdd6Z+!URxdulvm=sw*o$9!~>L&awSo>)_}Z5E%(xQf1Q(rbNkD)BJE@td5me$%<0Qd30=W zut@oW?(SVg;Do`73`nL}e0+QYZa*pfBjlpFejNPN*VljZ`nCV|whd=*x&3^r)pu4l zHgH^wmX;RyWc;Z_XKyd6tE;OJahHwFRgh!mB=pqXkpP6P-N}qaedV-&MTe2K-tBBh zTZvx}DZiLaVJ7@%)xv=RBiHhT1qCG-;%qiB;Rr zQ~4j}t}ZPFg75&TG6!dvLnkNmL^#^A^xwzF(#6$U0k;tO`Pu3`a z?7?LSEScsp)Qpd-E2i)irtn_9DYI0KjEVv+a^RzJ@iX1w_+wS(Dhmmk{$3{# z2ynnVjNQG87$780H+xhK+X7QB9a{ zw{x}_Pt{8AjQaNag18>v1@}l&vj=I%@ORp|^{a}sB#{}9ZwD9NMjy9=<^SVez2(MT z-CZuYltRdv*YP^4s(2uZ>nP#k##+Vh%(sc5Vv_~EeM^v=n``v-gHm}#g+!S_3q;+! z3ck4+QC}}WiD2}-)^@#*T|I)oF)umW~doB zv7WHtf%s3m%}e*m*9i*?=aiSjAPyiOk$ta}pHCm}1qpRweVu7C*XN4gZWaOocO6SP zsUrFB?Kyx~#(5m9h7(Jd2^Au=_e2tdT=`z`CD}8vj##G}f6YEkZ@RXX&unumJS6{! zf|o!Pbm9qteIB301P1=vkT!{lY<&C|Ns>u8J=iPr%PKC$3J(weG%`~5^6UHe6z_%I zN@cjYxqJGao0-w@@eu)!!e)M&Ge*P4hAk&2Cq!I9|2aMoaOVehj54uF)I6d~=0wmc&y-M7Q&Z#eyS^kV*~ou~E=k=W{oLJG5g9ya z+WDLTJV?plDeblJjUiq2mBR`e{Z(`!cOdEup7sj0Hj8K z;1scUx$XcSv3BGBsfpqhs1R6gQlo^s1}lWUwh@8UV9nAdsqDo0t+5#_;RK1 zO@|Qul&3da-e>R21TaizSe~`Rt%GrN%ty5Kmv-b1*Zukg%@{?(&6S!9X{`!j)C|Qv zS=o~_62FH?Rq^umZK842kFa@5%jVRKdw!A}lCzY z3(G5zU_l_@v>2t)t9L*U@7bc@vq_G5^9D4)O2EqPeh7h7j7CL86&4*$SeFzRhlq=d zDn}0nyRLZhL-4#7&xz3p0RzUdJ{$e8Q%^SOA@v9;^-}bD07K_0!Ohw2lrL zz#1B525g@DOVW_`2tpQ``2KRUe!SE3bAUA#&yTj4fXNgYq(C6cRA(M*ayvD-v(?Pnh8$dwro}PDkcnBW6!}?xlZ$B`I8KXl{HbdcToyUY0@g!}k2{Oz?u+V15Z70fFx_{ke&JLdr?vt2lZ)nTztHyR7 zhsyC)g^*2|m*&!%^-;Z7YNVYzF0qG3TjNhnOLFGuai|AOVpbdcyEl7-B(waBidYa4 z5sgeuUkSck6=#SC!h)uzX2FD2T3^wGm4JYN(R8`7$wj(|mkC(e+gLr4E^>#MIMkrU zGYen>5`H_1fx*Eysi~M~XlNiUq0`Ak`2&DDJ3HHL{{k=xF5gS{YTNHbV6LU5rAu}A z5)u;AqqS@?*wi>)US6M5`Ee&FCqX6!!FzvyAKP=A8FegO^zlj+lRW%HpsAPMU+m_Knal3krztypydOQ-zfc{!f5&E z*Yyecr7mw+lLoomHso{HifEGt9q(NQ3}5kADU@&R$vJON-%&F^i>PCqyYHXYhp6~a zPB!|r*~@dOX+dwk`{KLx24wZ6la4JHpYDHJaT?PPRiRZw(Q8gng3ok=iu}6)&)eyO zztsi+yBNRw6Pvjhs^^z1^c$TE1q!jL9@fv~Y8>sY;!q0tbD_RdWT-X0r8V-GZf0im zV2V%RJ|Kxh{Ks-+BTv4~%m6HDZEgKFG0|jmys*B5WJbiQ%3)D*dU_iCIx#UZJtO1R zcrpNB;L3li7iMPb583bCLy6)l)^8#LC_6YmpK)nv={IVS0Qq-uVZpytzsY1Uk&TIs zEm%Ge(Nu9w@W<>dr`abMV8wuK5fBkA0m$Lt4+NYy0%IFpy7HtoN+of;^PkJB8tI|+e3i*dgrpoOxpf32hbaxgJn&a0=# zbfb44S%G78p=&I1ziaa4tRbVEPTY^?SDXwE<|S~?QQR)(UYE6*z9ast)?ht$S(z;V zSW3#pgTaSpAN_SbtU%~wAAx;VpTtbC&OMU+k&y(#$Gg9oK6zBxN-bYm+Q1-v*cRe& zysf?OFpEvjH!f88qtOKu9UUF`F95F~XYQSxpqXL;qv131vaqn+nh3z>CHmy_barJe zz(--o2qIp`0I~u0&~+CVH&^uhgWQE}?D*mk_;&)vZv&{PsGARe0(@f>l?AZ0R;>*w zczru#2c(!Pc==&L((U`&vz9WuR&y0X04;srFXZ)*~0?+&NGO-tSbo^XW6&lD=|$4zp(0 zmixnAX+t^Q}(3jx=$*r%UO*yWbUbu0j?@$SiIc8nRyK<&p z)R*gaVdq4v4r8{;&JV%5^o38;lTE$I<_a?EZ8jJ!#Rge_3#HTKPf^oU(Sou3{rmS; zbqMVs|G2b1E3{QrE1Fp9o&c~HLP-4CEXsI)sb|S2;Rf2&*a(h|ws@Tca(#Gtx*Lds z2`HPmIK)**m~LT=|B()sV@%sI?qz>GBZ4|bBO3_mUMF@1>da}8ipuXEpa9UkgsgY= z+Db)51q3!Z^Y1GwE7LXB#2{IKm{#(=DEec(j#S3f%nTU<0>aXjd>$SkLIopsm0GTb z!?&g1U(;!)2U+rdNZgrPYz{ZCRVIgGejadHt>6Hs>z^^X0*l|2~=5O*=v&Jzk?w#6>^QW2K zBgHn9^4(cdIHO9AqbZN+vNPlVC)^YL!}?qii@Zr*uE?>8ic*2Gf4_fPiEkOI2Q$ zIy5Rje5b8RwtYSzpxDe*ql1UlyY8g8dp&sq1B~e@$o;l~F3!%~ACywdUA8n1cfM;j z>%))%-#|t~n`&&CDG(~;J@lZYq;zSO_yt1xYg#EQAA{_`BS!noV9D^dsPOhQy}>gN zdyoqI256_Z&mwOlvFHjBPI_zDL~7mAYS$838Tzrgf#5A-&(*-`_%Qrl%~o%IfURUd z#VDcgXu-H^tnS7?B61P;oJx5(W2~MJKbjVqd-W*L)fTuG0Q5wEL8WQ-2f3lSIjShG zprD|z_^8AXMJt6Q_6fm0zwWR*>+@}G?iLj?Id?d=*H>3VfZIgIwz%z5Rc826*{i=B z_xAP%BoGj1$D3=PG_tkfw8$)}P>lnyk%eMe*w~~&P~~#n)*>JvFgp49!>D)(@eRB$ zHWUy{d3pKQadCkl(zlO{;6g_8Rj2`A$O1eeD=Q07eh^kIEiIQG0h2}nFad7C0bkL- z^ZdmNlZ`KVOib?H9Y=qBaekf}B-)LQjj-_W+bHfbe8%_@-}zDqMBDwtPdiMkT)Wo( z&j2L+TJdY+wdDyWu;>^ZpV9exPs;o2uC5sY2H4D}qgj~B-3(L0$T?p>Jgz(|@fKP> z@~Vm5V%Kk)6e>ju^t;`w=Ij|#>`A6@`#U_PL*ixd{XM}S<(N(6h-z9K;{<_Yo&a$C z3&D~LELC;u9kPZOKPS9N8K)BUE^t$=s;wpBaJB@go!fjEQgA9~v{O5sWAEX*JBK~n z5*cWo4({R0S5Cv*5^&v4KAi^k;y*p27V%VHLreo84e5!afa6M}|ID{JR(>$*m^;TpV4s5tPp#c)-Ub~8>EG9oatt{Z_MaO5 zN%$3i6Fv$CCgz*8G~4nWOU4>epL6k?v4zPJ-3bOoNWISmpQ@@V)jTmN`nZ#T9U#KM zW?FF9O({#u`*HE{E(|a>Qc}{TWi?U>m;*=wAlGO#aj>vp78VxrifY<^FJb|+1OPKq zj6-Ss^OskeAm2`(Zp%I`e6D;6WQZ8CptM(Ck^N=|)TUS#K1PPSVHmAdK=4&wIQgZ~ zTgqL-TyZj#Ff8I6eL%hjKr+z{szEMOW$+q=78gGQuy+`6{?vsOa)0G&a9m#c_s6Gx zUbKlZq_?d2lr|dw9Uw4T3h1|8AY=%CYi(2l!brGOpfJKI zg<2d5OPeJ%?o2omJK1&vAl-E~&y)M~Oc88#U}6tTbf9;()}&mv?fpv)TL%EjgF ziMr%F!e??!^iFgrB;Yexx&OPT3A+?f-DP`udW~OK(MxI){gc_l}Qc6cwY~ zGscgtOnM>+wd(BBhHYy^$`T6-m;n8mwA4+EqJbEqyayGi#mXgQrW;QzASP@X=2L>y z32Fv$xr;W!S1_Q!jFCuj=4f+_BbE>YIG{!GSDvNZQ8{p08>U>C&@B4lz0i&TWJQay zY#G~Ypt=I#ELqr%eX`6D7w9oLvayK2YY82%&`gguC$b?9KW7Cwdlxn~!U3rODQUkE zXi;FaXCqQ21G#{n_LjuDCdVNjfIme2At2ZeC`{k9Dk|1?B{#ur^;2{J2Cd=#O zCy?H66{OJ?FSq*o`b<#21O*0(-MN+uqYgxX{xd=40LZZK>xW#nCT{^Hz^cQ;r6x`d z-lUr!^C zD=!0xfcGgUAc#iR)x;T${jy!7~3?GTS^SUq?e|$o5`K!t_F1w8UQ8n9`w&^8{gr&% z<9BIk*u5kmUfkB_{QV*OqIs&?@JDeeDHtH;072!kT^Zj;@T#Re^8QP1=oxbELa2a9zZ1ft3LArK(RE#uz5Dxw6)&Kit~)a*pls#tVecIWMhr3^Gt#M6`&z-mQ(_V<4k&WdgSQ`(>ZB`gDc`&PXs znZg8{)&wf^Uvu1o^y@K~dPzyik5{brl9GY$>AnsQF_gj%hwD%GXT5eB&S&g7 zs^e4QsF@#UiY4nOB_iH(+-83WWA!BkBWwY9aE;FQezaD@w5?L1ZE zc7Ft+P=%2cUd(z=!j!r>JVq%tT&jn#I)3xv_aGPO*4b?|$K0xZpnNimHiPN;ptn1N ziJgVzYeS3#2w*)v#1s^)bL{c`AgSK}*)~&)CjNep8UB|l-6VM$u-!((s;Z)6p(4A% z+52kNqXVYopac+BuYTb|5VrZBo`k%LU?TuE+u_!3e~HB3S~CGCX+Lsxtz9<#^5x6x z)KuO4ooAwbVxR@!QX}WVw{PF-omK|m7nPO%=_1xYUf9{O0~K=X@UkWgG%;MAyO_Or zq0v+Z${+Xd-{%$W+xcGS2)LS6-P+n39T!(cFD{ZQK+ZKH98WvanoX*mHM0}?_-vZQ zW&I~W56z#x>q~F*vHN6GMD!!DV!kMomQ1wU!cfm&xd^Y&Giy-j;P5Lbk_vWKHhA(= zk9Y;Yy8kvTs_dFJcog^FNOoH^`P1;@1&~3?d(<*w002Q+3vt`kx(gDw?Q~gHwLPw0 zgUM+iv}$SdhxbEaPc)Df2K`po?ZwBT|2}GlT@!^4 z3An#@BMiFpaw`A>bf1BKCeYb50`?$iH~-t%urfG&TW4XrcYE%|0{IWZ3iITA$-wC& z1gb1_E9WhUAU&(Z&IG&__GljD^7v0Z5H!^PJ*;!vJipm-edS+u+m=hWJUzh*Y`8=^ zLizY}F61-p-$gdhf3^mkIqZK|O>my#R#pX2iGU6s5>l_F2fvSDIB4D#N%a-zc=BJ= z`=?#|a+|^-ptmOYzqOsCTs6jp&!nKXBhxu|s`zjboW=lccLu)byH1}$ZR+!s<-YW( zpmI+OP8>bFT_<1w(6B3R&=%euPgh4*RuJVT_yP@> zK5I9@ySVkWKP6-BqS3g{dy(}>YkAGwP@lkytYdfBmpdm?%b%b-5j@X1x_?rH=b)_` zYmUpcs|WSR(!D#?&wq-=6$)u6xQ%isnyTr{c+Es4(KLfkA^ zK)hzPj0wjR;U0^jb|T5x+qbc~WsmoM&Nf~H~69CC(!vaeu5`+{-oZVG+s=K=V6TvlHV8{menpTi%0 z4wGBH;`-lbS$H4~6as$fV9<<-)D5Vhm)z=-o#5@;1NJ@}fM|FQl~}uf)u&G5QHFD0 z`1Q67=|7>`L*!w}2r6HC-hP7(?bsEcom(&mS2vx{ouOAPhK?;Mz-ITgbk`k4Qw?idt~NTT$grrvR&ML57)KV*sHsh)A9 zBx)fyKfZ~&NEIvg(UUzcB$+bbd{8R((M7K>^hO*$6Qq|QV+g?mr|SOf=uit#ONWSE ze*yJeBZLioj{2bq&OThel&6;;;05CbZ3f&1K4kVs@rJuR%u3? z#>5$v5Lbu6>6$S`#aSveQ2A=(_6yZ9%|wCRwwm@@pli_2_V&x z;&;|kwa4W@Av@H(BwdY)=6aeOuWp8X5karilhS+S2ez8}75qFapx4F2v8TS3498d( z7s^u_t@EE_O+2q>^%l<7KrbB+S0E(n@(2+$<6ks{W@SN&zcFcG&WbI^C$M$=3c{kN zzQjo>*Jv*rL16Tfawox+P(u|TnSLyWj9iBnc#WRBQ*>q#=jGVGIzm(IORjaoS3dlq zbD|8%+7Lb>88!;Ew>Ymq$NF% z9MgRAe!@Mw+JMQ2UIB3~I%CpLFJm8wz}^3C+PzZ`PLBtG^8qPP2^gotl{SdvB8iVk zx3OT^b|7}>u`7P={iaqGP)^idyA}|n?XUApY6Km^Lns>)h9Q2AVAPe`{&C8Gd~YU} zq#*-p)`N7yOi;Pxzb*({6-6rk30<_aiQXlqbs-MI-j&cABl8Opq}#iE{_`S=KKe&+ z_%{JRCmne2(YY%jT*%fdDZNcS7=rjWepCZeADs-K2AHPF;PmS1(gT{^%>R^EI z{>UFDj9>4CC#h}xV;&j^$<08<@jx<9L_{I25v%2)77!)Xnj`Zdx2fOdj^lA<>2*;6 zqdP6_u20wJDjl>I3M{U5EU{duza~EMkx5*7)$r3HdClPDngJSE{_t-Mh^7}LeLV=A zmjqfP(|+^f8M4v5y})1-MI=A~@JgFqZrEKC7(W%$U|9%w`>5LA;TLx%XU%a83kT%qPXs&G z(7ipL%==|t`Iux-L4N;g5%EqPsN*2DmnEsgbId2n&%7=k5W)^H%a_pKmQ*aYjy(P{ zT|zQdi~|>Hdjmfginivi#EEQ^$+FJ^z0Sc#I`@%tV8x;r0JqU)_rHK;d+hH)5D@|H z;_-KiMlJK&1v#!_ee@ahko&a^5F~q_-;Qki1*|gzA#M#}rABY6Xpg~R`z181gr+;D zcqM7oiuQ)69Ik70CPs4!Qug=VH+Hb&Lj;^C#LBXXS&b)18)NM={0KLEOu8pRz)9kI z?b7;OI*xjyw`}bQ;hvEqV3g&zqvR4;56JDBBv4>i_tQ$__~!fgNsQTrv311JWTt(E z2tAW-C1)VI$1(G*Hixv3EaIxL#AM(=)B)X z>F-A{a1Q|fDsszKUUc(;zzOpIsy@!s@JkcIZEwGzmzmVyB;s;Tj}twT>jR@Y!l2X+ z|Hj<&;A%`e$kPmjEEPzSAL4)$f>L2=AgVaF@xd!(qpx1=*-12dTId8n&?2ZF{t|t1 zSiVa41R2|5_d(EWH~;4<5?WWpU2KW*@|-K%QUXKMQK0%qo_DpLN8-jxSrsQ=f5P|; z89=_xGm2NunnKY!Q5CZGyk}l{!*C(78b`R$X&VT&Ah*DEECw8v_y#`UbR4pofp=he zoPTTHAqeD6WJr|=TQ#41NW&BcW=Pr3#@uDt`v^oZaDFb>P4E%nFZDBU_&HX&wX5E5 zfsvXcu?F)6?Ij`2H(aI`TxbGOdCxoX&$#WA!~r6H2-!18Pj7sd{b(qz_=Ae2cyBO% zymB{^Vl_L5aDephdIiMEtv|uNu`ToVhVL`GrzLTF4CJs$Nhd*rcW7({6yL~D8m(0w^lnhQ^1NWEhsr)-dOV+ zQE3c8$ZuMok2TLbfeUlzem{XG{2b(PmEY~FYZ0?J^jb{KnK&_hPKlT|A4|C^x7+8- z_;I(dE!OoBOOFt6xEp?_OB0=BW?rgFB9!BGni`)#PuP{;#{%gAr8+UzD{~_AX&dm>%fZ~ri(rsS>#f|3PpT!3G3WZ6CW3VB9uvi%-*?~ zL{oen*+DdDfM%ZwmW_4VH+#-l#`dScOG2ESq=lx1c;`pSq=Kt^)S&7DX)Ae(>Q%Na z>PM;HoX7{(X3~-JswcF(5nW0&5e@Ce72%^C*MDKq$lubl;R z^>=Clht!L^N%V4+e4qyq`S%4EA1DJ$(ysYp{LYwxL_h&v^x(|@FbjHn-el&J{nnwu zC~=@qv)nmvvJ>=Jx*L8X{_++yXxmm$^wVs=Xvaa__P`c6y7#(~pz~FgxHkUP!23pI z$z$GyP1l7{2k6!flCcMQ`^|l5ks$%`0ID`CW8y+ixWt}TYmRb2Pj`m7(a~zjgq=$N zr;d+Dw9|MMn$5O9Iuy#uDq#Y@Dce58#xuwV9@B3E)4S?dT6!esT;WSy8z44})laNLOYN4VuQNQ+$gz$Smaj>_EK|?2CkYR}BU9?6^l!sj-chZ;jt}e1JbO zBBBx>Fu;+T_HV)vDPNJU7Q_Bt;h$PUpwsVh`n7=P?4#RqbpMHbzWi>&Ftu;NfdOgt zhI;&Xshi%ejW$=QTZ`p_qfc9ito0X%Qh63zhnuZe;AlU+k_1KvnZ!g(9(ISQ zUe?Vg*cXAcmPHZ0sszWfSK~GF_Zh*y0wcx3~y@&ps*J#(qnOcre?GBuF1? zdJ<7`T@5Cgj#7JtEpRF5;K}OX!R6p1{Mr$*^G9U+)oH}noS%JCpCV8mC?i>3(CX=6 zzfZ<7o`*qGZ%|nMs5+O-X;{4wCEK}Sh=%^KL&@k!GslYN;|ZCTxd3vNcH=`luG}yI z2SqHV$*V@nP*e8s8^anqe9#Hvd9uMW=eja-A&~Yu0?a*(95)hHZHX!5y3J%~zZ|i1 zYGFci;(L#L_cfdO0;eaJofw89OPgjOU+_k=W@539+D?lT7q9+WOC_xh+Oku_uvgwz zkUv9VizB>oEyuCt(M^48>+V?nu?J77Z9Q-|hue1B+&l$ZExLlnI=~EZW4*7)G(O+p zo(O%yXnQ!0sSEkIgDTsE?MxOHsP~@liazfD6ac!mreZ}q%kFsXKdt*&Ubo8{ zLQ?0Xuz2}xt$g?LwAN9g>9&XVw_QNX(f(qA^e1(Msa--z_M|Sa8O5}d0bH?0c%*?L z?Z&axehVHMRXAud>q9#}7TQhVXxl8o59D3(%6kg;lsbsr`r_gTpPRph`)}wiH&mgM z(2qaafOOPloKN{=<^u{aOzC<<8+a!hFw8!=9g-f$k41>LK5l)pM4yNSyeICx*_m%)DPYs0R3JL3m%A(82ri+R~fNpLGdT($GR;dd2&ZfQ@uSu|BY zW!!%(`s<#KCpc4mbW1wFW~VCM(SqQP|tl8LEwc_VJy+O z(z;8H#zGNBgN8Y4pT2fLPvzxS)wMG>ob*mxYSuSV%?7)m()wzy`G>@;B#GUp&GC_-H@on^sC^IN!uFq^08uR zl`NmFQ=Q}Zl@Rdkvx2i0iC%He?5H!xhYW8m8{xHX*)V7gtDCvDXThg}H!aNme)~98 z&P@?E%b!+5{8iw1ZUIG6!mUVL2jT=DD7^Oi&xLkn`3EQTU|crcOm^6e*x1;)&yfyn zDcdVq`FE5=rv>~rm`~nI&Qc<_;7ZWAepIKF8{#w?dg@%mbXBE#DqLr{ik0|$v2i$Z zY9!+9%=})=R>6~a9Y;OJpA;deAFg|bpP8P_FJ4i6EC%^2h^Z)xMQZN^k*jfrG{J=# zkdNZK^Ew296KqvD==;?^Qgd5bHlDkw5SiuB^AEyYtKQUeTWYD%4+}BVuxCcUW$HgC zZq6gb==d0-Z^GVfP6dxmFxHb*eYPFz%GW`%}vLRIRYZdc@9 zs3=7JVvZ#(x*UDE$S@~{oBQj7yh)aAE#CdIxp_IB>*1WZjD)w&v+^U?xg+wpsnO5W zZk8X`_ZXHu>#G^cV|CUh4GDSS)$o#}i4QMvab)4OUIRS+t>Lo}BX2hcblP0jD-Gng z=Kg^1JtsVy%!U>J+~+^TxybkJ@)CI~t=VtJc~`99-FEkM`CRiEg`#@cm8*DMHdmXKJe@$E%-oeKk_5RH!=*fqVxs1cLdLU8k?y z7N7LP-g_@|Q^!XTCaD%}Uu5j!u+s*;1+8W%1ixo#*LZzlUVeO$dg3|m;@SGO9c+kC zCM>jwrIjUR**^r0Qw_%FHi@j|KiQZtPk@enK2f-O_ZWDNV#${#v5b>>ifmdwbm z+VbG3nC^4I`~F!t@Tr%5f)-8FY}~=Z`#ofYF=2-Tb&h7y@%qag8AQwvDrbagqR&Q+ z=f+`smWYL#RT!>sb>aIsY!o6DIMy7qK{?qnf%I!xYuQ62E9K7?J9<^;xu5Vm2KY$g z>}EX8P9BlBzt|x$Zj)ZjAWUjM0RPpobo!ZjK6I(ig${*!D&yH{y>GQzogT1>6IIlR zXvZ%5TEl@J-2qKOS!8dgf;P4H+>*jOk}VHJ{WVWhb_H0B!(83>NBcUFPKRF+lp3t`Pg1+!tOklly z;2Ln&*dpL~M#Y}j+}(o_rZOaMwEQeew-Q^D&Kyg(hB_wvdFaF1{coo)T?EM9p*d1^ zdiEla5W3?}5_1#s>94otQUK@a2w<|G6)BA54;@IBe>QDAr_1Rx&<4Ut=Z2c@R=?2a z6$;*8!$rJb>Z+jV1{k{qB&7?bN!m|4fQn#2${d)Z-V_eRG{gv=z= zg@R;;lPd;Pj589jLvxBi$Z*%Ajyhx#DBaS$aJ+JEg3)#;ED{pxF2ZM4Rf*1jK4#~e zxHveIH6~1WYSZMgsFG=1i=odpWweq0HLU(DS8{DN@;=8MuM^VdnBL5jSr-^tlTqUh zN>A_}FGa9X5bU`OZ8BnnxAjw~hMR511zk++PP>=L=3UoFL6SGfN-yj?bJt73ek%Pq ztePst*);fV-FW8}ZKSuum1U`dYIws*1Z@l;7cjcU~$7nRkfM+&Gvv3#wD^;uI!2X*LAnRAtQSuheq2 zC!V8x%}*iJmMyq9=TXy3zB}?}_bWnKt#fCBKl-%S3x2&NY7+zzMiRDE_72r&}j>QrTO;mERfS+ z*`Jw^)x_V}14y%3`{*c9t76e@ZtH2%%*&v;~Z{QtU>DNTiTTXLE~Ni&&~&zq=$8SAt{cKseWsb zUCzdHz3%MOUuFAw7Ruo&<=n@dlASh=_slq{s4oadUbRW}j^TU~oyGG&OIdPxV%m&e z99tKM>b_MJQrASjurqw_UR8qrtFA`;XX3GY&5ECU#fn?5y{Y3@dx5(+L$8)+4T@Xc z>*S@%zOc5w4Rz%##i*jF@$C_ch0?qMVuL$0v~Thv_bV9pT0H>9vHe zFAIk$x4uedaZ9jE;r@Tzu1*Pas(EO@5HIRf;I?9&w zTVck8lyvux-h&EShgO*rE!ljMd@o}A>a|*}fXkOVeaa0B;$i%*8Dc@vPw!}XEixq1 z?-Os{kz97@b3u0Prj&RxzUo9h)zpb&YO0Prx#ytAq5MhWW~c%dmNwA57(D$M&y-P7 zQil(KhE=WaL>FgQQT($F@1AR0Y^~F<>AH4B+Hp@Y_h57Uh5+0c9RyF7bq6`-h=s_j z$Hc@#PjEO2$%-^?LaJW1EwoV8=;u$=8a=}EHf|!r&uQ8>pnm=&?H=6)p^%P+q|XM= zUqeMrH;vTee9i4w<1#tas&DkV%SKM}zy=u^5rJr0$bmMwDNHsF<@ zohR*F?_=9A5}!MYUXy*P3}_E4I@R5d5d9v{$?{8Z_d*^@TNAuE>|l{vwv1Tvk~ogb zE*qg&nX|p3Tp;L?q09-DNM=zHS{qUaSO_)gUJ~Ik2%M30$)MMoJ}>vxb8WrGgb>}0 zZ}n;ET`lPy5ozlU4*0tl+7rL$UG=7jE~{pm3Mp-8P$&V!Ck+7llxV$1$0YG*>{6QD z+~p<&h4xvtQ;tM-j|xg!D__1rF>)>93jZLkk-EuRBZ#cV@46~uhfT#tvAId6)#^#9 zl_=dl_BGkw8rKCIn*t+z0hIE!HAY8A{XcvlD*ey`8LR}ZvU1(#Fkt3wg$e@o+{qi5 zq*W?cdf(WPQ;p5?ONRXkeMT zCsbjNo6!@WXJr+lV=F1S+n=mRa;nvd=Lv{uxrhG*SJ}*Vm#^A8W1q4 z)aab|8e4xAE@+&4h{3!CYzq z{ZLYZ^!?tTTV9NBi^K2MqG-Sds^3$Kg44 zh{d3>0R2j0Lz>IFk5*c}>UKo~W0|qUdJC>--%nLkMW2yQiwj5AC{Mj@b8g&j$?7v0 z>#&+3j4WB4bF{1u1(d)VOgCi^$Mh z`_cpbTe1fY4nva^=YhCQc;+zeed3pa_~oaa`6U5bJjjs^p2Q$tHQo49;Kp|K>R*R7 zc-B3FYSc4Kk1o)>Spoxjt zhvb~F6dfHB9%quqllAZm(n{e+2J$7>FvTKS4zM&-U40$rm!bCRoHM=Xtbzfiy3nINUWdZO6Z!EsVA0(M4r~NPs3zLwOR+AB4=O4_v zZyU|2zxjC`c4im!ty|Lsx{ipBZg9gSmDpIJEh86eV0A1CdL+M9!76H_#+F~ zotQfsF+J(l75s>-g9F2YhzLO`I-DnBH?6~~e3dSZe2+yfGy2@ALSx?9D3yD09AwQG z@dN28l(tI-1kI)41HI2F=GY*tWqedk*9nR7n#nQOiJC(~ED+OOZo_%PrJT)qScpBy#! z*p>4XyCaLN5)}O>HB4fI-3WWQqn{n(6$lr-m)jcSB&(t{gl>5NMqKtXGAt1vGV!OE2b=1d@jwJf@TotZMzy4_zS6_6 z%1OY5|JJKP7;+S#{^+`z@HwJ~%p}-SkK6(K@9pVJd1Wo~V3J*d3zHe6U#!(x;KLK& z-Nzh8F`gMG#vZ=WBdx_Vd^tk6ZtA|q4)%Wj{Tm`By;>sC@c59%dM+XT-@7)CbW_4? z#wE_EpC@AfQWUAcma0O{g{>rf!q%aGxvapq;`Nvg?2ryDlw_<9W=BzUqf_mLtFx(b zdlYKXSehX8#Lw3;nZW@o8{UQuiBYGi6>ERW`5mv{tX@68{zYRyQ-d8bBFi9fN(1xJ zG`x5@@)jA|HoyB4LJpCh1##*>{#OW&Zm)K{;%=Un8e^6{dq3($k)k;4$G_kMmL|3@ zeIa=5oyfC#qVGGebkdT!i@7Cu9pgah6_OT=8$!En#+`4n^+G+n8D;32}(hWk4EBWh4LMhczd zN&LltWAXMOu2WkIVT|q1(M)YY$*8AiYu1G!nb;kF!xlcqGFj^3JQ@l2H^&R5%t)(; ze9?f+3~G8p_+4dRC9b?u*QhPnw)~ElF_Xu?dBSx?GkAZaJBu5vNU z9^W4sG>$eHIT7<(?XTf{QGeJ85-JcTJdHQV;NHJVe>A)k!QI{6)jgge$Fw^Jhmjkcp=7z1BP4-h$0TZEwr_$q;BDUSut_fkJi+<(v z2^H6ZjQl{cXzG^z3Cj5H6mqYKO3I8!R1-Jw>>IusnL-&V{PyElVknaC+ws|zIv^BR+;l*6`Ug8(FThnWK0F;b*LE;MkhH2cYo z77}CSmalqwXGowyluR0oDe#?VX{=ltqrQsXCVRC7AK)F%cS97g*yK#vxDK~sY4ye$ zoa9t*9X0o_K=9D*aI^2E`vPkis5!8jlPr8K&PC4g;MQR;rT*~}hkZU^c>v~V{!Fys z18Z1L&zO>1QuK;Ho_w+1MAU@QheengsPstDdvxYCyl%dCEJgk&WtW5KJ_eQI!Ov~% z*za@OTctz3Td7*Lx<>L8;rBkQ331(;wIaV*?wciVHE4f|eA z@$pa`Anr2?cTAnBdfhf#5!yEjtKSz>n^=txetz&R&m1}VV!IYY2$wx-&2gtNf#@C@ zutCYLHqBBKq5)yC8gZ{8CBuXWvY?_c z${P2YU`vUcytH>*X;X9pgmJG=a;H7%>(1fM*oS0sk22R<3upFl1=CrmjC3~qblwTS zsdk7h8wGIoj^>$?N5GBAzC3z$xYclq)kdmeryK4Ml|D7@ZhYSrB7i_&>xx3GJa16r8*X_lo>~Ewy zm8&?htJ5Dhxo?lK_dS@;)2OZq=2Gm& z0)xdt*JK&jL340hscRHv`abc&NKTMNC zZrG?()G8-!$h{t0q~TlBNIz*Coe%}`H$7);8xf|zU*HMqVy`s|rG!EF zvT&u9hCia`ckS)A6rsm#3Z5T1Tz}EB!^F)HQ`hSuc1wz0L;BGLpndoOY6V>3uCr9GtAZVeoLwe((9~ zZVxBGWD*0`IJm1KN&Yw5H>ylfO0=8)dUr|^X0s`OYO-czwahqIHYDHrm3t#!W_@>qq!~3 zCK~fWDatNmvmd;3M^@sGq6<05ZZWHeD}7+opj!iha(?EWV~1}aN6oP7bO+;@Z|8)0 zW$mQ~+Td*$ZW{d%^`{9Nxhi>P@=@@Gz=%3k^(VD(L(G3RH_9>sG<1w;*$dYXoh z1aP(<zgv$R?6Cu0%!Pk!e{i-v{V}>qCtPvA`0{`)AhSqy~dLzPf^yJLKHC|mSE5a@t>-M zG2F#xM(|$lGx=f=%tuS7nqaUW%px`(iF)CPgy31!LX8WWeGGOpOg*zVH86CLwXKUW zAv0^;)M*jl^7GeiEBG`=SP>k^sC(+bwLX<54!pf{AjOrGlEW7?D{h{SAkgr3Q(fMe zBIKKU-7N01I{>=~h!_Gre_!N|*oQrOhwzDs{dpJORv#R}@=X8&_z4(KUmN?WPzfV=V zvxS8OuY*4(iw&hzc2e&Wt7HF>8}IXHByCOME?K17jDa^t%eFCijRU@0Aq0~02Yf!z zCw{iRpW()~mhKo9!HyO#NaBos9H1erk&0_Tjuvjl)3M0~b%zKLg_&ag6MxCsb{D>I zuQ)7!fcf~b<0{I{IEeR#>BtSsnvVtkUR^uV6n&b`GYcNJ#9pNF-Q2TUV!_*@`M%LBTO|_3-W&dIx-KezVA5Z zmqlFyOxPbX6P8c{N%qdO1I;T*xoB0Hu zp7~$i1b7z%6g+O#;2!?c-Z7g`Id2DRgffY~eSPzqCLeI@&NL!quVqzB^{lVLl03De z@BE-%ShzzMt~4JQP)Bl^2l((($yuyjgyx(Y{B@wug4#bH4OyF~n*eS(R>n<^x zZH?Wfdk53h)3PouAs7@CqiPclbIrn&WeUnj6z`>J=<@B8)EkWP8ZNJt&ELl;UVL~< zk2^v@!d=^|uC<7LPt<;gmZ87TanZs*1EqwXUlV`_&^9MW3%saZyL&=?Ot(Af6tg3C zrKW9%5N@VcX{LFz^cxAM>%AE{d86oN_HP~>egAWj#0lB@(`Zt`QOIb8b1e(y4KPnWFVo)WYFdfO%!^Ze^LyL9rqeamKe5+j5jz}gOd)iQMexJ|;{Q)jsvK;ONR8wS6 zlTBcO#kEjso3dyL(5g6W+6C>jDhywp{KI!ZAXxlr`BoG~*}%W&w&~c~ zpFuQQFggA3Uzio1xq15d7Aeebl~NG$s{}+9_)%N>^`*B*WsQpEzcIv4v!C`|-Dqfi zCNq@ASmU%HU>ODb<{mUfNz4dlag7ePB>NUf>@LC}hf8h+R;{JZNA6oacAu5xgS=wJ z0kGgK@g~X!Y1i&@CS!Iy6bF76n02D-YHj^mNqE>HW1eyhv0^0GM`XZDLN89VbD%~t*fLU{D?+!?KH(ib_JfE1B$?w@mHtfsY+z%mdfMflYo;)=8Gp(H;;uu7zFls(5 zv9u?N!A1u!Fm%M)cyBcD&@^Gc2^oe~Z2g4R_5PI@og?_Y*O;tL6HL+xaktmPNrK| z>Vax@4QGB&c$Hf{AQbkWcCaF0ec&G=}$r^waWcL?V?z* z(Moj1PLCox0;Wyj9g>#oE3Bn8c{Kh0>QddG6L!hkcWF)@-qHS?#kA@g0(Fph z%LT|n^?!0G4P$&^!QQp3z+>b1lWp3gN_#}t@vJoR$z<4d!bzzuBn^-Wq(;NC%MKrU zNC_*zOI3)Gc|(g5RL3neUkEY8OxZFPSk)*F%0xd$2N*z3^e!59&B}2)`mT=iQncUk z=~}!C{IH#i_s86B)tyd2vj4p%hAeZr$~x&!Zt8M@MLE*o;-aEF2RXz>)%mEuCO7!( zCFeXYmRR55elJim50mg^Wk_(kOh*@z===i1ze#;`{qo<7MB)NZwbI?aMTefVM*qcQ z1Rh1HZyzRsgKGL+SsAm#O7=zH`^DFz1^qO2`g%0Mz1QS}@xDF2g`rx;uweTA%pR7i zXOIZkHG$+(t?Ho6@8=Qi;3YIdpoT?Cq{hEwQzut#Z0b|t#>5rTK{A)M?1A8j7!BB+bOL?r(RAOB#A993R$L?CSDt~my=r@Ehs)u1bn9}lE&Ca zA_kumV>%5Nzi`v#G+2A8&c$W3=`Jqg$CX+=ciUFCi4vGwDpF*%(A zqOODXBB(w0JgdahBI(Fz(HKuS(sl{o(`K%lQ5e@c5~&i8fKpMP*5#q+vgI5FES|Sd z%Cg~%IAfE6q_>`)qbg^e3d7zJs>TTZdrdyW;Z?!}DrkHV$}&R#%RWlHTD!cL-e;+g zX|11#tVJN2e7e2S6|K8n=PN3DYN|!fZ&MMDnLF1E9q&Vl-$VGIC%3d`MqU_^vuF?2 z)kfHtk$H@`U%$Ljl4qn=Xsq)o2KyRp&+oSWhNqi_OXKLP^h1HOc+YUh>x#-zGDGtw z`VWs0W=MH17W9%(BXh=RxVK6ho_mMs`G%`ID(kqgA2r{j@3d9Czz+lfu$RzpJ&jgd zHMP4R)&0QiT_Eq_EKr4zuZH9r2!He01U07QH#i`Qi$SK^5&yW^)5or9q{$CWHmqYL zUxe6qf&LX)$+%(&F;xAP;15y58YYj5hb8v&KL-S&An zRrhXgEgXppVZBLIep6cpgBc88^Yh`i^1_aPP6lwDy%q7L>-7p-SC{2-U4G>al~35U zB+J3|pMNr1s~d}&8Arc6MO0v!-^sNU828mzB_GZyw5{jxUir-JnMT5^PYU4Tl!$_t zi`^u*e|_6;O_?fQ{3aZ`Z`zU07-?K?VF{u~{-L~|q9oSGbx$qQz zKGgBIWM1@#OVO%WZ5u}ZA46Oe>vQM*xMz&+&W33r--nuy`bPOpaQR>@SkF^H$7mh! znZA+d}8TL8ggNA*Ud6jyJPmQN_ba5qi5TK@@u$h zd7y1nTTE+`DD)KV(pFyN&{`bt8VT2+$V{tBSZhLS)NROV`^(s)@<0b>-z@$5@R?r% zZL3SF%BAO`Z3flE0D-tupP6YW2`$aPXI(1%^uy^ZxNI4D_qU4V_m#@gx3YIUa}*Jg z20LDG75&{)kg#)&Gr5fNcyxT7h>7>;tt=3WxOF81i5bT+-+dR$%1;L&$FJ6mPpBF$ zn9zaB$fC2C0JI_#-X?yIxKq3^9SodzzMq_rr&X;u%+{^;G5XL4wQlYZ90=IQ5)S?p zBLw(^;B~0P;tZ;ewdU2b>d62=DAR>j5gR_3b7I(;s_A~~{HD*{L>CM1>CAv?BQvY& z>i<}x~ zB0apKf(5({o<$GSzB4uvZU`n+I68mCqK{mLS1LbCM3l-(zB=n;CQ;7F0$g1}A+@_3EY311pBi0b!P62_eREf$MRB zExZ|EO-~?l+!`OM6%kg={XhmCU&85LWb2f<_Pv(~0k!T!AI!(7DS1Y=?X}aP7bX82 zR`9_IB{tbPhfaAIV>6Vc_(jCV3*AuBuKScwVm2r;wcR z9}#AsX?>h7k#WT|LnO+$0x~a2D8E4^)_BFWqSIjs{ADj*Ya#6Q4CYB~G} zm4M~dg5_cOl#ka4Fo9d-t_ZcFMNLZ(cK;a6+mDBYojwMW>rnwC^ z<&6Bz$$JZ~%aDwGn*T3P1iZis1l`JW{nbLVgHg-gA2tA#U|wA*Z@2f(<*FSr{TDHo zcYgTO1!r-IqVUBeg}uHN^pJ>-i_L}JiQufiVf;xR&bE3wJk+p-gZn1B#X5xa?PV*J z?9yTF^`*Y5;8TY)UR=FrI&aPAw8}yPj@~_c_wF4yDo@>B3!LRAt*86B0riRI>%&?= zoA)a7x9e9v0n3wm_@Zx-Sj&?A-+&kqXR`WKOCgyr|A&04ypcF~r^z#=96DJ>d+p%Y zHtGiqYBSM@_+xmg>Ln?A2@aY)ywngf^SZHobhq#usCL$+ETiY+amTu6G@;*bS}|Lp z_s@H?#yZ=x0)x!b9-UKFeZ{7%FNv2e-^;Iz=lqmO{1rLb2j`AB@VCRXt+X$QlrJF; zorTDntrBmb^;q8J3cN;R9%K3-(H3qp=%P=#zh%_MM>tt-4Pm+vLu-t1CF?(rz2W`E zh=a~0`o8Y$aVxvw19ZzsRaGoDO0a501VF_IFi^I|oz;rRAxs**9j zP}Xa8S(^w*t_$Lh)}LAzP0N$eOc-?Xs8j+&t_1Hy)4&7nI$&Il%rj(x0ufVrIj^R; zHPCUoUY09}0#sO~h5pnbUHX1q%%*=kK@1k*+UsuE*O$GsakGuS#F~mcr(~h1KIK&O z4dTr874dsE%-b&?wtw#8WMrVau1+KTaC??=Mv(r~i8z4pb9zn$#9-P?^1V2e22tZY z%4049hbnGhT&Ce22d)SbzWM9XMEnX&kDb5BKqt^NaynZ3+KF0>YQX)*A@!L$hU_O5 zTgc4ykcjh+4yB*RD`!Ej;(x>tX^R>xRh++-BXC;Yku-(GfqY?uw8z>)Y19EITwfpE zLL<=D1fIE{S9i9-5y3z@M1bmF>hk;MXYPQ{`Iw8i`XE~+G4m@D?9F0p<$i!w=>!Ce zIJ=jD4%RW)W1$iqMLZ$oMlmA!J-72bD)>ahb{3Lpf-t8L-C04RXq4BFmtdbsVbmU0 zefUd@E(>~39QpOsi6p;|PM><>EVHzS9^tpCI`9i6$XHNsy^> zV72cygYIlz_!DLDS4(95Ibnj5QYltq^X@d4g*^u`m&7=h$D5!p zA9k!~!)iQWM8y9T_x){$bXdUs15FJQG$s8&x-KIr9$$F+|C@j^I4}y_wRqTyk^V?P zp1!}x*{lUetU#HG)y>mkx>nP&8J>CB_l z%v?!sS8<&OSKDO#Jl@qNHvt zS;7a>wu4wd(Umn{8>)^x@i6=x*$_D~=-ETtbbVx*-lzHI&lAJut1p*Xj~`oq5wR8p z_`PtB?lulw zU*&xtT@pYB^}6dk9@ZbAe${%OfBQjA$W`_-mIdpe&LrRnYtgErXTvD58OjKmWO$Ar z@)?O|!h`Y9vRQrmn3%u?7pR-l$Sxx9Z<(6)13B8dVHdG|m8Oj%cqMDWO){D2o%SQB zFMjoxkHWw$TK}gSCgy0f#!8Wz3T9c|$1HpC(tn)BR61arJ$=xZMqv{NpCZyJm0O1K zclm;eedgd&q~o0?&tJbBjT}G%7USV5cyC*@(X^CJK~8iUC587D;%j&o9Ep5p>_dU( z01B6vcdw3n6_K*3ujDeDUxl#$a`1^wW_jncoN;IQVGwCC+g@RJU@7V>QSHaI#;2r6 z)L4>$&K|eOhyMAU&FlZIwjvZesJcePZ?i=y^+!^Q9F-GYU#w|Dprz^YUFpy7@ukMbIzMr5%hBwUoNjnkR5^aQ0*k=J`M0tPq6&=Vz2f%tu5 zjZ{_Mri(0XfbqM68G*?8;yqToS)KIa|CLaXug)*fBhm)UlK=I&mz3Fvkm!pz zHfGTXK&$p4cd)#$}dY8*XZ^1vv=j)2Z;CIS(OE_)Imu7%K_xwg$v{Nm@o zsDepSen1OAO%$!e7t+9E|L2?hg7OG^^^^a-2^^&RUrz8X#kyy~S4O`;c^S1bVZw>= zRDOQsjb4K?$k7f9s8-Qew3okqFVG8xQ_xKyGo=gm7^zA!Ik@-70oAH+Qwb4;9vJ=S zTl8hze^`0)n#=M`Bq#gnKna@W5iH4>_lyL$11nmK-9X;NVpic$|7-1{`hHYnp99!S zkOIN~P;?i@r&4s{G&mw9UA~1GtU0R?@(d=ikT`nGb+*9p+aM_0j&Rmxw^ z+apiXY0i;wl^%X{-&qpAcO`zYftUaahyEkl=FqWW-6CSng5^$EZcdnCyU<@FK&FOH z=vpj38nfGBCa+l5m|_E}uo@uKKow6pTB>ILWxG89G3{F*3P#qdgKtM$};8zdwk$(BQ@# zI}8{#$Q?$5CGEEG8!KNLJ!8ufWpB!d*wv`;it))MIIA={-xkVJGx`Q z^oJ67|F7Ylm?N|Hu|(j}YJ_le$u~bVez>?mIjKnM(`3W6SweJ0l_K{MJ!+q8b+;~1 znw%?nnh7vqo1gB?&{iD5$(fZMf-WLpr z@t|1`rO558v4asj+lcY5`3?r%ELh{T_Jd#0K1Jv(x3aPM8HU}OF*p~hVn=HBZo9DZ zSes%}511(`Z<7!kP?pp6EH={Q#p70Tt?#4cgRhx`ctl~J01Mq%T#_pP(9;>np51O{ zMZ=9<<}O$s5Jt*h_~Q*lAd>v_pF~9lfS5{4FrexcM*CekWU~%lA8tK4y+IzC7ku9a zB!W;Wqo>Su_@S9YW3H{}o@3MPej)+xwY^_f2%D!Xg&*?yM3loZV4$0tHR@OlM)yBu zkz3$P&=YTG-QayN&};Wl(=gDB$%RK{+E{vjYT|lp;f-^x@`HCsBpx=*1ChS^4;2H5 z%iX;1nw;3}ob~4Rx=>Z0*jvrEj{Hh0vw>c&W~gd8Noj<5i&g%WA-7{JHyB16ruu8K zJ|Zt-?t-M>1JacB+g7&Z&@%*fbIie!!c(w`erQ`` z^d1lQk;AMn2ZYyd=`dqMj-r)`!^}bx-U8v*zmqDmB_YFHgye~ITCtw5eU#Y%|p9FtQpi;B;^=%#NtEwPfVQuhUWGR8tE#JiV2HplhB+paJ`z z_I$}3f>QKY2j+*JnEg{BxAFi008-ELNo%|SxMN{y`|mwBrGcaW{cEM#gUerIsEm?m zC&q0jMZ+IYb+G0yQ*}Qlbih%?iw#;mU*Lj9Y{fJx=p)Hn0-hjAIfx&#{d0dRkP@(> zw*pj`E%OgfA(d;`V;9JOxh=97o@-4CrLmNhUzGmWHV18+5fX5Bo|6Kuhc+NA26qot zASug+ccfMy%3f5~D|ZoE0p+hVs=K&F%@|PeYx1MGrlrL0q7+`+lPalw^QKKw4qLg1 zJFEAfhXOqC@%b7Nc)PP1>JeXmj4R?WL|y-+muX`Rmj#rQV7fjb2=ub`$iuE>eShwi z4@aBx%-vEzX{^9QJ)Jp!7LX%^*(sCs>;Ff=zsSEoVG4Y`1I!$iD2y$BY4Jsy6Dix^ z>IR;_ys3)ALrUgFQ z?if>^SB_^!tyG#XIK*09qF!?~K4}XY8N_p$Ha)P)k>uWLYWDn$3331Zzclyq+G(`; z*n7?n4dFMqP)*7s5$5&}?M{TGN22DBX$bdVPt0#yWg6~1pS8f`P-yo)5@?%+eu@}N?<=yVMgV(2n_roXWwNpa+*oh2Y$~Be{*Y7_3(q>ij){!TXenk!+PX4F;6vgvc2fu!6vikf|90PwpbiS#zBRY2I=$9t0 z-eGJ)Z4Kgy&Qu?jwRW?M4%=m=QmZ2JMumpdl(0baiB{L|SY?+$0}*M(*0AN(oK>&5 zo;q@@9zgH$Y;^PZS#28GyG&Wt`h&03miE4}0zhfBcQNOp%tQy#k4NAV5qMz%=U=m( z1<#>8#o31)UwQuH1Pnx)5JJ*k1a)niPrr5Gj5o^=LKRG*$}wvhflx0s;C!I!Tlp~U z)UUgYmwuSTIRBmG#4uy+yQWmL$J@{!G7ta0*s|)^n|!2qSbqE#P}hI2_$s{d+ZCKR zynNy2aq(*bfuR%9#KGEm|BMfAXexb}3{j}VyTi70IdUc|INXk$&Q?AiE~hOh&5&p; z5h%zuk!(CiZ*LPR==+9jP4<%Vf{vgXDbf{{A&VZ@0O|90M3oE#UpUfyAY!vHg5BK9 z#>VGMKd1XLadD5|fa{v8VdxFnci2{m`e~G!Lv}MgyJqi>=xs(!P;wKAfOO{}uZj$> z#txNLQ4=xW=t-J zj9~i_=&^?pa}k^*O_R?2LW+=;qCCJc#6_U(Lr#yU_fNu>|4R20 zB@xNV1o^q@`?J!7r58BeKYw@DX6+_8+Tb?`b?==Ixwu>V?mwHO!0rr9dt`uXrdvjf z22H~NOJG%Y(Y1;V&Nr12`%|M10rSgi3zPi1PGU&Pnq=FR{9zLB2IvRrzj62+W`#m^ zI8hld{M&j%7uju~89@qT-#tq#yg`QYspAH_a-x!dt_cZuNW5;0*L z8IqFF>x6QcgJ`@I#t(a309^{WNqy{(zR`wc{1pM80iwKsX}ir}>J-=xw{CBtC^(Eg z_Ulr8w&#HM8ake~bD97<3MK&b-G8eI1O#-*sD|A;Hj$U*V~O+R3i4uoo(F0 zOpHLr^{eyRoLNiy(FET~U(7$*G6ZOFkD+74MU+=kLre&@j3yvCm87nmxC6$1Q%QYh z=t32%eBn0jV>0vt#eH2{x9)&kgYPTW&tWCMv=3r#)A@V*4wEl%`S7C!O*)Qgu#ets ziMOMn{ZY=5pq#+}Gqc&=qWSW#)GS>qi54)XWJVHRLAZp^0P-LIe1s9f_7d6tqf64< zrN6p=Y48$NNudxlNV3Gg+G)UQ{j#vK_e7z)#~Wdag)H_XG_^(W_u_f^Aolw+!+$H; znkZGey&oiA(JtW}Wp~IF`q^Fzf7vU#qD@Evd;i(GhDV7#j9(o2&)J)mP9IZvPC|uN z7e`J?WQret=4ofiEKFC_X1J!$ek5eGahsga?2%3djO*Cz&uyV@b2lcffu~FS0j6?z zyAA4`ev{PD8!}Jc39rA*XJS0Y#le+%4@Q0CXdiB$QJW~v*=f^_yE+}CiT^W^T`=__ zF@l5vMqI}R$eDV}eS_-x;@1QD7I^*yU~4>G_CFIIAG0N4CciP*9Wh)Kt)6gy@^2SQ zKHw9sy9HT{%TEnucyh#d5h-W?R4!vDTa-(l1X>D=g*lFih3-W6-H?>RL$Yt~dAu_t3s0(-yANJm=`!KBW@D^u^toXmj?86eO537Ulq-D^r? zUTOV{8?8uAS;%OA@r+FGZEEE|EY-5PCU#5~52o!bm?})OaEOL;o2&=) zQa#M!_kqls#f_9QL5$`IW{R+PlDa>t`oYltC@v-V_#y9H zqeY&=@oGB-h#T*3TM8wo{T_QJRtKEo{nO{G_DdE~kv818YjIo`1pI1lmz-;SR#QUE zX!L79l~#!VY7c)R@&(K}wqzIk((_x-pWgXafRkbwf62eQhU`+HgEEarD4Z0+GWnZT zx*kmzXafg7d>f%F_6E9R_|RLNfLcmqsd%}`rJq@AS6D!0&~T?!k2W*FFrCa7Gvo}l z6oWwlGj0extLrZfSSHYZB=kL?mE<0%c)ngyNdJT?A@s4-qL+Izw9j=p(`(Cs?x+-< z`ijbn79O;z{%VJ#c^E}y1i_GerOvV#lBRWy=jBZ%kGp=2u7Iekl2 z?!;(e_78?HFZ>y?I)1S~%-N8$MH^@dH49JB z9%-Vkb+_-u{An{i$wu(>kn)*CZ8$_SbVsackfanwJ-WjAAGAZOzL&4V4g={tdHIzM8`xsO1j?o`;7)`Q!5jPR zu-|0~BX`Ngb_}tkgI(GJKa)ASBHxA`BD=fe%Hz?1$)=j<%>L+w`$9`(KB4`Pm;2pt z=uhT!;;+%wTW|iM1}+8HH>4bSPiEEYNQsJRlkk?&L3{7Rrr7mDB4sJN6pxt556u_G z5{v!mOy)=$UY+_1tzcN+vYJ`crp6jK!|BE@K=~=gi3_jFC1PJNeGvr>T1Ok zBB&^soWW?~q|)&u7GJ55Ah!rBp(}wgd zyI4$IA^h?*8lGqvKe+svW+Hyo+9h0XBSn+1%L`^2+hgP zgLXE0tY}9b{mgl@cWI~OCb7rx2Lj7#h|FWv)tfi9vyRAPRl@#!sv-O)UJMx{K0F1_ zL5(;}+rWd$QDy4jMWjxtG9f0ja@E;@f&!7!M=EE9xPI?S10Li!*^FlKk3Xm)66};N z>mC0~3lL6edW$EQ)-3)=L4N}4^UL*gqUD+MHFja1=kOkFzsnHl_>)BGO;nE?LeDZ`XAn#0$A-d8!Zcj@ ztQ1K$ePJd+{%I6{M~y_WwPJ?pBa7}ZQfZ^&AWbQH$e(^~R`pQ6KJoBS76x<9JIrpm zFU-uLq8yi1-|nM&(tVuefyPcUVs$ zbq*UT)-vmQ@z=Q$Gtb;5r2F*C`khE;mbEHJrXyJ)jIMm#_~~H$=|~@6_q7p z<4O0z3Q*P~dc`ENjs+CPv8qMCWDdmQeqhR%C*q{~P37l|gI8{*@^&m=aq z5XKf!!2GyafB% zN)utC{Lq{`&cT9Q9AC3Z&U*nHqu%tJ7h5|2zCE*kStCPCRRsq*xMyMGHnG{L&LB{6 zUv|OaYs|Ax8$L@OM1v*cC{lzs*04`ed8Q`03@nw)d=n`S^Af2Qm{ZNk>)7AB48ab{ zRBgU`*H3eO(TQT9O@6*}F65D2!!E!@>8?ZZ@f%43a~hK>M7hddZFlw~b6Ph!Z!YBo ziB%EYphJ_9?E_|_b0AA7damr}0mF^dj8IA!8pp$6#Zq-{F5h8qQNu;7YFQ1o^*qxN z)3lWMnfKZwq}yL;QH={Z%y z(A$*&X7Q1q$)7**cQE~oZHykt8{1)?*g6{nW`>3N`R)Xu=c_BeK-cA`uY7I;0KZpi<*T`>Mb&!AFuR( zkC1hGVH|M^%hsrlU{Tf)czWeMT)t5Nw%I`Jgz-DHSe21NMH4a(?UuL6Losy_+`m%Tmm;a}EYuPWto-V=LG!{PExorn|Rxmwr(4r23XY*X)T)v>Yl{Kv;6pA-Hl*APk#msfO2%SVb#+!_{33jD&NCJj!e zm&LkCFu9LHwzPf}d|9-7S;kWtNgHfSRz!o(=~J#5J=ClFv{aVkhNs|zSM#c08obo< z6nSD>4qK~vU+{Hc@P?2;+dD1@PMzkG{0H#=+L|8RuZ*q6

y!O(5s1_t~hW3WcLv zYgUla8ihAR@@JMDt5-Sk>`uTs+Q=2|=pK;%zl<}qP@nc^v8?L2=IK@N>yL0RtKeb? zrLJvwV-2xkHm1Vy(c0k?^;A>4Cut@KI%Gi(ZSD2012>_Kw}C}4*tc5_UpRu&J)&&t z`+Tv=X1tP;sEkjMJ`UJ}m$dG`LhRQ&FB!7@99$a4Xw{5g>o)`T8NZ4-^hDnW7Idsq$?Xl!N_vXBpm$kh~$eM8$vga z6yCBAK8unqEIf;Rf+PMUmPetNB0!k5Pc0EiuWH;iU7usXt=X2SOsakSjk$77y91Oi z)+nB0Vt=pe3eG$G2(jL4+P031)^AI2yb3W~wy@7}@cG=8_|ViH6+?%l^aaLmth_^8 zv}#Wiu6S1q3QkrGMXdI3f4Iv?et|Q#imbyQll7~9?e?1C!$I2$37d>fRZvJNDJiN} zHMI_$7(nfSF>2kfF=pnh-mlqDY=aeIj`J|Th1;lw44GcRiy}n6 zh|O?&c&R5LkYpQ2a3B`-HFmBFI?pH&Og$19M9lsy4}UFqO-fCJ50B``%9rJ~>Xyr0 z5=Zp~$4Ugo?dl;+nix(zwF?$lR42-mp<$bFuUP&2MQ!@0-}7G~Xa>85&+5I9xd0+qU_CQ`3dwXJB2&Xdx}(5q&lhQM4$4K(wc<*-ZQnPn|Qvd zCW@V>!X2|~GU%-SI}&rsPgUU8$i8fKKx;Tv(2XPZRoj46F@^cUC)XEhi9V;))o##u z??PT1qZdyj_MX{aH){T#ric*LRtj)*<8XgH*L+O1RL2BB+IVGJ!FP1~>{Dh#--dtU zMnLu?0>>0M?A?;kPl5JpBaCPF8qe2a`hLMQ_&IviwdqiAPM&K{4>0Y(jsLf3^eLm} z;+|9_x+qBfg#2WFk4X15T4>h%s4d6ZJh9EVws`Ef}f(Paf55AKY^EiA5Kg<21M8 z8bxrXJvYv|1K$xU8LLuA`qGN~jdjYG!)-*x(%^efo^pcSI)dkFJl#3cJtDbt2=^wg^DCVeHC}NXKLHw5fDAuLgcYIzoWb@94xDuHe8qWlK2o;0x ze6T!?xft7-ylJ6|+|%JhT$`jsoQ2y21d384B7W0>KRR$Y7TD5iLb`0AbV)lf#Ss*~ zGBTZv+zLPRsT&*-yRHuqXHjz6tXCrEydfG%k5-N?8)_)dkBBiGFltGTxX_HDdDqQ3 zfAu9YOg}b1WRCw8EY~E5{!dtYVd?89uhi~@`6 z=)ykQC}H)w-(Y{yhyhb+KR0rI3)zRgSI#mWbKX%4X}HcwXIFV*=N=?Kh>qO5mqe*i3yHqk>&b8A*0I zna*Rmh$mbz!foW7SHyza(u?;()R{PBsU26K#=FE6}1+z@Ptb2pU- zZqTGM{gK-QTaP+R8}_(Bkr>^V>wvVwE?0nCCr|&N{0`O_N#XA}Aq9B;Y`>y2Ctz6j zocfM3_s@D2)wB1q5<|`})Q*#L$mmKS12ZxQJyl!Ul)CAk*?;OH^YO2g2JKKDkp{lL zd7Xhi##k*o4F#D%g0g>S<4O6~SfKyVVRs-GC+o4hB`^Rz^U$>V&)@#2<> z;(?JYCJPYP8N3C+p3$gjleaCdJ&FPO^?+y{Mr(|0;Z}hPhq50T~6RrW@@%5JT?FXL?dU@;MzBb_O{=bz#mWQEHUY$mA zns;Eczb{hg!h;^ulUT>i!8JW-i+0Y!65Z8PVRpk85%FQQtdd**+|pES9wGmorq@KW@u<{}@WV~W;ls5T%ItfftZr{swZTYs%Ke3V_k&h% zavooC4R~;8UpC$YaA$GfqjD&X9{9LP%Gb7P0rTm-VUvydhjxCi##_(k*x;_EJLF|U_q}DmmdsYT9(59F_y4;jrBflS# z+(p%_7XF?*EV;cm@EkRd>glc@&U>EyQx$g&{jh4nQ7r9uugmQQ-p038J*B znJ!1x%L(srcXNg)Cf1Y+|J2|w8|`%IdL_;0`Z3iXT4e<~(WFe{C^WEul1bQ>u3(Xa zSL>{S^>Ir*Uf>ps%V64sq;+h4tmeZViHiEE$T3Hf8gE(AW3w)bR*jX+;Cv^D-wT|u z1vaH%u=YPU9S%P2ubUEm@*X-A)1RB(wVa#-zT<`6e*NwIK&8@D=oy4?i;QaaM?v%rROVI+f4lc3-9-S?Q}vQTO=$sHMIQo#(2DiN+5d>g3zkO}C)QJ0w#D&ZV^%Obbw8 z%-ZnPIQU#d8^=c9?~V<4fPTc>E7}$g@SCp3b{%))!i}c`QFl4FH3j0!?*erNlXoHt z;wBzMw6br@=Fg>iXX48!e2$dEJ`c0))suI~!+}u^=WU}8=c3|I7rH23(r&f6qD3)4 zoEmYyR;fF$+xwV_WX}-o$*~6gas*|1zm43Ny z{ik{6rH-B@xvGcE34ELPGOs+kapO*r!*}^uF7(jVULs%(E^saCe8yMJq8i>SLtkkJ zF8ut|S)Yg)@Lh3j)}=dp&AlQGNB^QN-w?E`7-;1>n#Kf-G(Z!y+g8CC7I7st5?B_B z`xXZBzA2hak2xNDN4^CEg+DqDK4$L)JjP41$d5V*g`5kM{x28Z^(DAh2ZKigUz5*J ziI6x+6Evy~dDmF?oi=VvzIV0MW=IqZLvp-uDUCtXoW!4qkoNYlAV;*p zQNhCi211H$i$;W`65wXM>J>IAfViTc)srssi7<`Pm>sMq8;Lm8r93*U;BJ~4j-dT@ z4}PQbfsK-5gLI6ZuJ7P@{4&_uG zhqL<^Fe9QN+nIxB_*!Fjx(V)X-`OqibbzQceOKV+4j#R{XXrOw=5W+aj;w;0w6h}? zRJn_<_w+1<*t5Vg3b0d-{toCTe*ZoaH`TzAsAB4Ff>UEOh`Mxo950gt4elF7bx16# zrx@tY+xhmL2LaD>-ivEy4Jb+2;o9h1#5nGS#7bSU15`a@e^{@=4El5&`V&ftCb$;DjLz}if%3I_~IZ3oeNeL zWYaJ7c$@I{hu*V@pC&;dFB0p>LQOh&M~!{)`>xt0`L`w~17aHVzbX{qRNSfc0}zd^ zC-!oHWIxG2` zBcoJz^EXGWd>;Kk9tntAQMQHS8JNiH_g}_uqbXRRGWMV2(q1`O>? zfQS}yBj)7f1dK!ggB;K&E$a~pIO4k=Wu|3AZ?3X4N!VH3r{w`4(0sasl#>))pQ)RV zWhVK~umN%L9!7|_V{a&gM0}J<`5f!fsN+4rOkBes8(!aZ$3or#yzec3P|6ausF#Ht zYRx)xzRRGGu2ur+OZpZY(`qg2D^HFqA}vjG-Qp=20nQBgb6yjbH&2|}!mDieRYW~o zG;dnP^D8X#Wq9FP%&%`*NhMefgs<6GpatyTlQ?0FieW)7!5aGQ>4Vs7nw#gT>X)gV zzXFHTP@7vGjtj&XyiJ2ryUT%FS27U=*W8x2GjpGZ^5oD^6%rWevsKKXOuZ_S99hwPdGea z91j<)ZFQA0S{ogZiZmKI)DNk|r<3#bB|ju3C%^S9ygo&h;Hk4SHW&`;W^7u%TXD%$?TCZj!wJdxPOSGwsRi6 zBKSsg&zpo5x)Pje8=Ji zOcSJ|(`YwwOQTq*puz->Q+auX#Y{PObQ=5q#Up-|ML@gkeqfUO>1%NGa>vG2NG=~7 z{a0sm0VCln)J6(opaq?*@{fe_&yf5AQ!@IwpLL2NQ{G77P9u^jx+xE-V&QNvVMYGL zsLXkg>U%z8F}v$qwIu}ncbXQojA34>rJMd{cOcbRw9%q zU5lznZQNu_JwG zv-%X}>8yIA3KUhqW16_>YkO547gvkNn(4)bU&@RVJ?qjqN%5sQ zhwACbmjdS23c_afT((Onc+^`x2V37u1WLb>ep`G>Vat1Cq2m(S^SUS{2)FC|2N^Dy zUQ=^JUV|IzEG!0L+0Farx83)HZHLL7$kUAc<0xRxWGzb7BW-HyMCfcJOpS+v%Y!6A#El%}m%7`Mc0>lxc`ST=b?`BLDX^ZvwQzbn$-!)b%$D zXx2V9#h7HrWV>nvDBpTlW&`Ubs&I0&-hgl+Ab%jJ_1O5gKyrcFLD!fdhVdnIL4;18y zxcuI*lnUVfXeKv?C_)6?R^bE+17nB+8Fc;MOiJgN+jIMZ4oCYmC-s)2OKI(zD@JG? z43Rjiew45MS$(sVB-+>w_+_r-QpWv!p@$Uu-(|?+S7cPinNC7ICd{YYjn`d)WW8{v zmfdOD2uK;h{lh~$2zpXHL5s$`_McBF>3vBlQe2YZW-^b>pB(mt`xO`m`mwT|K+w2!DG%mR3gv@Mh7Im* zo4j#{1;$>OyAnA%+#H<^m;FX?b-eRrJGzo2$vhy=qs83mNn6pNC{wH-qV6XWFBMrYpx|UD=kolh9FZU zNXV{>&5f;(x5t6a+}@AmJL4$i(qEe$72A30EFg%8Hg?HJD)_xNu1vzBM<)gZTKDa* znk}xxDn&`+@#W#1OHlGhJtY&v(j^V1cHxYjLMM^5ML4{)E==FMVlpK94u=RI0# zYuVMyRJZ2!*z%@TRTqdA)5kpP`^KtipO{zAC8?!n`4vtJ@oL%B_>7qvigFWz^2EaE z>4lZ=7+Z1c9#F7uACinY`lP4~`juL@$}Qh9w~LbVUIi>7+8F>~GTzfk%YB0e2yVnM zRS8OB%{t?*{x8Nm;+l~9G&rehr-cN2R<{yjus zR{o6GzcLH4%z$2f#P*>gQX-`KoCo)K41J;{CU2@(kL#=?e(U;;z#K>@G}P40OBFih zGkWBCfs)j}v3`?1{Yi_ChQ@;E9K%#WjM521tUI?RAeZXfskOgK3L(9)P2X{1UCJ_5 z%5vKaQAF1UsGX#*d8^PdUCI^z6Go%V_k=>z-X$2C(YQ--Pd-$L_4C-)OTP8=ck(3WP zIrcYHD;+j9hCqC}riy4HuA0kzm!X)C{AMu)Q4!33`kJd;SFvj7m^Q#0#qU42f>zOt zxu$-y~BB0p?3Rsi|ahVJV;}VUk zJPk&TrQG_uzK%kOQ5ZW3r8*7uN`PQyJ87QTaiWQ9ga04q+nf-heRNsfiVdK)BRW{d zjrkDrhJ)|KrV7_bFZJvH)dGyxn>Uqn-(uGf5kzWFnwuDFomWbygOUaBQ{nESB5Xz+ zR_-0y5`o=_2o?@j+Y6Zo_AVkFO0`vciezE#!qGl=u^9?JDE$VfRUe?&ZUBbV z0R7WojS9Wk6Iw_#NlPvV8oA!m60$NBd1Y{#<{NW((R4sr7sLQUa2nE56tK92Ab-3V zQuA|cG2U#68GD?F?VxLoCAGe(N*=EbW#C}qxLMt1=Ek4+oqQf z?4gE+I+&X&h9jXeV*IoAuu}>D_s+!WQV83-E-k&e3ZyTTasHI2{WA7;LqR|~)(vzCK#WvV6xv(;Rkz=AR z;bc?|Ms`BU0f0UZlU5)?Cze-627kEAd*(^~NS)a3`EcPeGnXsI&$svfHE z7px$FN*$iRWCZU^;;31|glduwEP;n|6((@tTZ{++mz1^D zg#4y3simP(;*US(?_f?}UR^QwYtA?Zc%wFjE5COy0=IJR9-OumVpT%!kOv3quRB6r z3Os=ai)U^52;-5;v85~mbWu&0yX3x=&!algdX+ZfiQcLO+TU=|uX&wF(acx?@)|bc zn(6<){Xh(eU`~u30oE5coLY4zRAL5w@jkUOawhnsc+2PuVv9}lyv9+>T6_t*uW5xb_1Np(2PsoLhD3UB z>7D)->ygA$`Ak|{Y~jC*g1bmd#SMtbC4xSjQl)IVvgE3&haEdW%9N!aYQqHNmsb(F zd7DS7hO!kJ9|Qz)L(~Rh6sxkR$lhnw6+yoxWxTQKXKToB4!%SH06nd%2A?b9*$VS* zm@En4PqOOf;3MV&D11cpcp7|@n*r?)5IU4Fg8O~cHVJS-3v}5_>klM?c}_tUbC979 zMZk|5^v2x|t$BAnYnWZ30ZYQW)$*TH{_a^vCs-ty$}>Hr>02Z#Vhmm7m>L@G-7ROaYdpaA;f zoBnJ>fbJeZYf>-q{^U8vPb~)uHm2cHt+XoHP7Vzy7^jhnzUpYx@a&wqWoxB6_{1eG zoZL>DdTb!Q!;lTtb*0*apM7tTz4T3V85}5h%D^V=&Wh9H*{OxCH>I6Ace6D)SXob< z?L_pl@&$M5w~IK(y=2r;^`~`qd_M}xK18)Nyb|cJ0APIb#M)9;8*Ctq?0bafqneTc z7tsd-6!%oG4a>)q&dL-VB~jmZUnSACbz`B@D;E%kKj_fRai_A5zE?I&VQ$nnIKjZ>W zbnNMG1EgADZvAghTDKl%7hP|aI**WMRj6{>d6~8^`?}L-}x~vL$9#uY~P`*zNDCN9A_Hmv3tTPzvvs9=RHiOmUvj4Oy#L z%)fM$*h9ImRnUF23jAk0^nBJwXD|CV^CyA8mzG|q zzn~YEOH*)At6d(L%Jq=^{d33E_Qxjbs23KyQ3StE=H|}LajyRe4i4KpT0mV{?Td*J z5(0T~>NNd>idslCt4*5zr3Zw|64l^)FW0d!N{gfXnU?eSZ82#TUx)Oxo{{cETh(U$ zoo}4^D7{kMUfsP%l#>C0i}Q3a^_(dp`?4Gp#`^gNwp^blVac=uUVSD%U<*8i?aJOE z%;+Oim3S^X-o@KnBD(5+TFC1X6|U$d$277W$23T?0!3(2o-+j4zvAlS*t(;rZ>@Lp z;R<=p2fErhqE_EvrW-U_-L{F#HC_pi)n19y)shUSBhD9^Y7oDab(lS-5vMkH&}C`+ z8sFSqy|mBA-`Pox<|lcTUCpLcn>)))9wc2!7>pBCJex!b!e|+-Pi3g3v)U4{r7@uGiiplumjpC6H4e4MDJ3kqQ^w`k|z zJ+5e6oU#vbfhTZXXur`KzV(=gl!;`(r%&B^L>SiT+$>&|;G@zE`-6gDKlK8%Hzk4H zc484Hk~uvDYaxI-I77+X2rZG)Mj~%|+T{{e#cf|O@6IXcgDI28j)a#)4stx zgQ5K6L)XtQ8(Spse*_~JJWZ{AUfH>LgjZW8asrEM*=_I+Zb42(?p2fuvizm*`LgX@ zqme*3?m3G**dWf#*>mfyjjf$Pw(OAe{uh4-^w>VO72dLJW8AUj;BWapu9sz9677pX%mPU{jbX zf7t5BCi4{**cw3CqSzrdHTpurk8rV2^ce*L-qCF?G(%e>!e+SBWbUcvX4$w~-_T=t z#U8%4=%nsL3OQh$)(77cW?osA1_Cu%fsRN}&x*LH(<}E3i}n+l2fM9yInMqwZKS97 zaF$lK{dViU6OAa+Vud1sRcTn4pnZ|(`{hqTfkDikkZC5BT$<@Y(Sv4 zn^@6KVd&}_E-+o(VnXd?i&;w<)6NgiAgr`WdUgJxtFJ1%?q8WwJ9(i(q6+V&`Zr2l zal+R9246d{`>yGX61XIi^5Lm!bY_$wd$|~lC z?yfWhnPHsZMYOaFS|7oGsW8|i{-lA{7SZ+KrbvlNW}zjp^%`MsvSvny^cpABI&x_L zC#k`(nN@j&dL&D5zK#i_-LG?BHqE-s_{!JBLKcQr(as-Y&(@gP?Xqjdg-;7RR@U&0 z=B=D1hZfnZ4Cg3VswT7(d4c)++xdw7yZ`6;D(>e27*S06uAW!~hm}$sD?*t~!IO8K zwhfe})A7uZnqPpMD*Jw}3OJ=gTW-eDRL;+;st(%jIKV3JN-ggYbV`YdgZmhf zQR+92p&107a8VNGkbjG1X?bNqcZPR2{08GM6}#NnH|*hWcr%BON=1I~*L9!Xff{+R}VmOf#6$r@((@`hHf?5q8fc4tf7 z8abshwR;Qo4158daK!H&A4`(b!5lQK1zb)KR~HX7o|J0G(+ajL2!CLGdwtSHR-^8I zSzBlEIZ;5=QC{2GOZmHiv|pIRvqQ>7@}^nc&M^V!P@$5p2?HPvY&VOfoFsqBjf_Nd z?mu4LiO#=5dvk`m z$!&awG=U`ta1)7=WN3gI;a|Gi8q0t~`UU(iAnZqoUF2wCsUWg~!|v$8zORk4OIN&vD5BqM_!a%ry~d2Xq==;sq^M5l!E&+Gr3EoMF_c1O#J1kfAW~Q) z#z3)D@ub@qZ{ibYnD=qXv~MY1wbE!UM=&jCjbk3HUq-Ud`(q^;JgfGPtMe?X?@yUs z@#rl4gO|C+RwD<0G$(#-jj3FTlJz`%-#ZAz&*Kvgib8-Qu7ag(}{#7l!c`SR;;@h;DOEwx90eYxD)^~FPu(D zaThql1hgk+*QvaPXYyI<5O&oNW`tF`c6RXJMIm)sAfNAh(%8W%R~J9l+H-8QmDGn< z2&9v-3X?K3i>q%(W*nWpZ7oMLsMn0&eJ``(;tGi}XS8Wl812a&xE{roCS16IWSqsP z@oIkq>DvJ}%rj9fi&%l)b%~%OBjHP~tN=wgS?hnKuI+$+`re$-w&LMuzL+Uf)jub8 zC`z1)326V2a=KZf5!{DZ^a<&s6J^P4<6z1&`d4Rn&5&%|ZaTFI2KDW3ZdppYt0f2p z_i{BkVW`bO#J-R{v=7W-njFLjifa_?+Qc9G9uCf1d;zXbi6JDeMSt#oos^p_vhpSb zE{zjYTJYNXI8QVHlvwlGWcggC8z7~SibPDY&6QJFfKKkdLkARbvI62#{RcIZ@sn@6 zDeM)1F`VS|R zK{JR+zOZIRuujM1CEy8ZAvA()_yh#7uy&Il&8Vy83}I6Pq3sFBZ@ooGTJ7J+v%f2k zKIe8R(=vQ?v0|K|K9Aqg4%(O%-11h;7v~`?mmIF}oANd$Otbq#mToz1sb0^ff`@Ng zsgT2PExKA&=~PlPHMs-bmk!PyHV;6_qU6J45OkN`E*w?FfC4C{vDarDZEfDb=Gzg- z2TRQ-C~Av2VjwSIX*WWTr&^&7 z^Jegj(ee9!bhg9Ieu)mPq0-4;82OKiYLg%FScboDtHG``EFy;3y4P(0hmGj3q~PG< zoZD`gpN!d581KW3ia7xbAC!vF<8-sKjP84*@i+efS7(c0MJ5l`I$psI3{qwwe_*E2 zKY3HPIKKXL%rITDFA%6}_CD%ZlK8kRuLy{!X>RqthW;p`AkG$zCv>-yQN%Dy$STuZmPWl^wFH!Mka9p4LFaDqh#o`3| z1V@ywRukjnYg^8giyhp(0#)n`3%kB#wk&DA1uZ>L5(;*y;Q57r^*jyF` z>6LELxSsUk=}I>13IV~>?=P!x9c$xYo9LSy^wIQhI=yWo`1SpoQnv014T~PF)nT+;R8NmtTatVx%?~%^1Vci}3)>=^+!vGY&sBFi@hli}!94nVRID=Qy zy<_}KvIgScxa6^mEJy}lrbij+qy)hMWl9h;Hm0l66jX$DQWD+L%5hQ*p^f+Z%rVfa zJNHgq9FsU2Zw~<>JxtIzJKyi5eVa*Nrne5o;?7Osq*Vdzb}AIJ>J1+KGjjgjeOHN( zcPwao4>M@ag(i4d+0Zt7%J_u&vqGk}u@FI{N&%b-waCz-#!Z)0%L6l%AZs z^i;^5^Wkco;Ir)ZN_)}b-S=)kADoCt82z_XsoG3-2Tuf7pAjm?Gy`Ot9dMUetwORnVrPXaWRDt^CqJG6e%sd%_7y+ zpNNo)CJ{^|h`7#e)H<)rxdj{rhqS$czzyIb5$J*Nd&E~|AGCJ|CZE|cpJ z+h6ZX1rIZ(V=~>5rz2TOyJEKS2}8_q{1V^;z<(}P5b^CaUD70{FN*W@N+XO7t}3o$?G{2A8-H~D)Jo@OBpd8P+~*K z%Qz=0^Jr-~tbvR>jO3Wb2Wrj-x=54s#76v>CB_H)98hw3Dd=>qtgI+PjPy*WJG~2t zm(3Oy!``Y65B1>ms1P7z3=w?$@pPNxWTv!iI!RJ(-|kC@wv($TeWd!d-%kpl)Wpu(LZVTV_%&^LO?KhocI1<$p2+83$SK4y!Y``+~uB?2Nk)f^AqF;SG zlUPP31b7n!1epdRK0^%=4K2+aD)?hpqK$=JKW@iOihVo5Zb0|+1In{!DOb3WdIrB^ zdS@GONdJ+F10h61rx-fPLUBCCKmSG{1n(V~M-%Y8tYpm6-0rFT@hIWg{`u33@3D~;38A-bMnwBnAXe6iF+B7n{05jvhzEK3S&dwMi8)N8*+#-O7jk$yja7j?F% z(AsM49+j)hWP>vuMO!E2bqzZYNax%1E zVo6e~o4o(8x!43iSt*Ki2E)Ki3u4~8_M|Z?C1VGcv9kEGE2}oSq1{A(zA&2+(}FGi zN9gX;_t=&RG*_g+6lbiwa0h!&>O|hyUXjk#3-X0JF`1s}z>R2LP;DdU%kxHR*Rj1^=9ipPCAT;FDL9cFSPZ_E9zNygFuX)qgt6hq@+clrWQh!0l5`{Z=qEiA?|3aOVsKVn@ z1R>({EqeVw+6_TKAMKEIibl2{!_oKMzqEST`ta3mj-7}w%=*D5RPd6_w>lFGj zM~j6D3+oEJ4Zme)Z=A5WyPt92D~R;UNqRmOYRgIgu)fTB80@|7<(Tj{MEc!OD=MN{%{)x!7f4f5mxFEB;kCprpfQ~sN>dK(!j0y0nJy}dA zCnpwbL;e@$_O8cK1&N89GP7V8KBQz$_GXKp32fT>*cHcI!m&DoY7i$66|gk-SNUTZ z96(0gTbHr|IUEL{2fc$agdn3}D)HC*^^F6nqqkr5v{*ZjS3)Jqzo|%SMiwtG5@xt6<0MM!FdjWOsX2n z)wj`n%>yUd4Oe&0+-FcdVyZ{@fLHGYHY~cq#ipjk#J*JUoyqhF92_L@wPFZ{-nYk; zQB3;!ak)*d^e3ydvgO*1H9C~E3}51?hZ~d|I~kK~(OK%fZdl8C6!s)CDaTmd5_HqQ z0)mX)C?GIt>9KVuRjdMJ<;X0|wBH}tqZzBN*&X&YndCE_HhhzRIsUz=W_+!Rr26H) zm|Gj(1AwvcI0j12zY6)e*Rp}j--I!tCoFA}K0x=N6&r|8@CX{Asq=nU#lerb`~e>I)+<3!uPj5)8Ra7?SA&mDXS`1~g(HA4tzy&Z>Bqyv@rp6)}00 z%AG~2?!zsb2I+d@NSuBUSh#T-I5ZGTh*dJux(b3zQX;1SN8{Tc{A6nX_)*leAU(Zn zNo$6dR#{Xu8Ni0k>%mM`^YR!E*(_poFPwH*N-Sb8h4zEDX%Dk(ROJGi zV4J)UU7XZssKpeEFokd5se<7+zSqHUG&E#%T>ki7uZ?rayl4>cIHG4jwdK33qyuQL z<-E**jI=vdJGNN49`B5_|D{L{1dyi|3D!XtK*y+cFWsJeL(Wr|4 z8llV%GkWif?73eTtkU1v_>35dN-9d2?{N*tZmMfnCi8M}?gL@KDG5Wmo=@L0($hJ` zzHb2a5!Z8r4T%dQ73|(Pws>L{V-yh*1aw$7l9`$LEIc0DC)31w_LsZ#hsB2%r-us> zD#foe?KEnL9WQ9UPf{rrK`z{RryJFSGPjeZpubgHzdZcPRmqj#n=K@L`&QxJdM>A*t0|CGs+OwBD52BU!?|wSk^%aPKSse3iCiw*9h-vzy2(=S za_A?ZFj%XG4u(YWTX4-YY#qZkOQwL)ng^Tf*=tE>F{XSdO^UZ{{7UFARDSn=_Qw%w z$=JT7kY#0od+pt@OHzRpCKw)!L9MHWWA=Cz{$xrn18!UgS9L}_NvoE@lNPvG#YJ#< zH-(Af3lQ{2qo1GdQ@XC{wBe{#VoX}3b4HTvJl}-}>hdt^VJJzwztKKDU3}s5 zMU0F4L`W~&`QUCiWHL)9DUB8^M zE||Oid>^Ux4X6g#=IgD*P@UWLX5!MgRd5tlioii|;4nNE(fp&^L(+&!w}a0ke+uRL zR@AE)_SV6|8G*!p82g*G<6SE{I4XG254G+N)yoE{EL#~G8ejV&z#G;p8f{gzwNz6A z20tENs8xcP8|-tqi19fiFqZQq`o{Y!v~%awyzfpo+^?j$l5DpZ-Cv$)v5EgSdDM7{ zL?9{ZeZPLo(`ms5{Afn|^DjJ~woBx-I2#{!3P1xOV1p|cVp`sBGOb z-77X|gfDq=K<%>Q0<=~AZOJ!@g}W2>+>vH|%La19$RpY3i|!<84vN+jieuB-v-{@f z)b@pFk?9ZQWc|ODjH4*Nd|^&A2xm^J&rdNgUnt-d5))JE4ru?>7txN6%DX@f{;a(A z{JhOX%Gw3X!WDMzquWWlX}{NI@_nqW^O|p5#+y{*m4?jq2Px_1i&2xuCkM{w?sG-q z&sUYg{d&FO<_k;2Mtq<1aUa-)9|QwoJ=P30*}Xj~P9k68oYbSnq?#*xOu8@xG^YEG#D#QKw?815zqr)RK7YAAkXDvCaJIjt z$uB5Tl4x};3I4Oat=dCLCOX?2&g97!g_9$m3Q&}0*(LR9Ev~96dwhIdv#N5*RIHNDfugaoa~QXB1AYtMbcgDElg zy0*5No0$%u&2&411*X|BJXY}vRd%Z+EoXi{9d=S<<5{XUB>ZnGHseIIDLgLH(SL^j zC`NN5V0`ymc;Tc%u7bO!ZPzE_al(xj@2NB{34uLEC}^cWPW0rD1s#x^v*9%m^O$fE z{Q_a{zo`%naaFFhL_57xTk|F=9cuXE@cNGd)0#zKY=J7jeP3d?1K;^{ZuP?cw9Ho@ zp9F;`2A;xlH7k?_D_m5WwYtk@rU6}Ql~CPI0-pdDP$F22SMG3*m9`22oj{S)d1BFTYU*w1y`RDDl+!gpvp z|vbT}P)iPDty~xpI;tsQLm=~(9s*;q{DCr-v*}V!w z-(E68&XljDzAvdU=dOhV5_;bcHbklvCe7KL5AOslIA@EGsC~Pgk5>8=;TlfuX(~Fi`WMTES)A>eZqant-+zqhwxZTL@>4Rbb-f~?Wa#R^ zhNXmRFT1+C9*uaN`+ZHeJ$HJrhAx?R0{+ekSB9{`j<-m~BqCu{l;lP`u?X>y1{s>v zDCq8^`Vm7mjLDRz!9SUPQJ<-IrK9I9Cc_8JpHJylLg{}iXmrdDP?D>nOQDZ^Oc|RC zOfl%YXYH09W%4QA`3Qwt`1SY4wPynpbyNp5V`slY$Dwrwx(z5kJkPDxMt!dfX zXq4qQvh7a=W5OdF)zV@vKT8j{$+UK}x?Andt8u~|)nH_6WD#Q7-ug=Nx5P`5xgdmg zbesq{Wg-%eAjWiccl-Y?hH9#_l^by5t!45>!ix?G6O-Z2R{bHKx7mI#*wv~|Oqy_@ zV=BarPA390_F5$H%b|S91>>~qFvOJ|4{6oQx7W|_0S-8=B~f%wH~3xJc5VjxLmn$j z4L!iiS0@y1ooopo&)F4uZ7~gS8BT^}s`Y(n*x7im2{ad?H;bviO!@;2(3%=#UOUUUGAXk&vL|aq&RG z#>UpsUFAyA5+J-fc(fwm^=p@=Sm{0DgfK{RAnt@nB|`pA8SGqxR#2?}&Sz z^B;!QHA)c}eLr4AVAbY!@nOrwbfufEq7Isc=LmKxua>JVEtu2`ItrhnE zouNF5FN87YIOx0Q)A~lq2UtmeU=eE7VYQt*S6Q2$2}v(Bz?7jK)b1q&osuP$Y|uwGXfCtIw#nB_&5ylrxreTy7Tt6R*%6yl&OB0`sgw|G~pm!YP zCzTbY4f8)F|%d+3JBWaQQ^k(m#q2wa8uWi&kFkAdtzR7 z#^^UEQk{WsB->&;9muwHlSz-G6YwOA1)m7_R41rA5o;N~(8H*hv)c3Q*Uo0rGMZx7 zSlkO?RcR?mi*w-eH2ri*t{9Zy{^=RsV^(E<5@7k3+2%dWlvLYzrCIHOpMFoUH+5>% zqv4y6;`zE%GZ%Y7p;oa5Sb71z8a%|FCw4F-gPyKLFBPi%G zE#Y&ENcx6JSxqq;fhgn7P;`EmODzid*FwW+4N1pP24vqVmqtYd*9<&sZv`hVCtLHs>wh#n+~+>E)Xvx@g(+Z;16F! za0DePJgBxm310-;v9%ZWYOFwN$7MuZ|0vOEiMv(oCyA4^1k^A@jIX{I{Zl-K_!r1y z^`3tD`K17cJp0e|VreQ|Vd=U6w&{s?bZ>>Ix{`3F&UwP+Ac zp%_*$`!4t;S)=~Q5BI(-WZdM*xZ;nO9WS4EXJ7UEcL5^7SlmmgAUm$Ff0ley)piO+ zWHs7?<=0`h7yQr&_iwgXErO&Hf$RnF-!cy28^@Y5?#9K$UQ@POy=*N%RYccQtJ_#f zerPvd6D?^dGwMt5+Vha^mjnKy;ckO_1$wks@Jv1E6N(LRw064VC>FL01Pq~Go{Itj z@5FZ0m~rOIS-wU|T~Z3*tL$CQ4RnS9C5|Rt0@&i`9+~9JdgLbC=TsUhQfwNFt0c*I zMPl$iTHn7XOx68aSGDxr9r1{RkkR{M)YFO6JRM#YUtja4PCw|Suf0NvxEq~QyWmOE z-j5KBz%3?f%M+vmbTPr5+T31B%@P7rr$|bcSDLjYjY@!1lToaSn1Z)pxaa+mJ? zw{aUU_3Qr+QC}TaYjuU5tUMCKpiHd!a%>$+DPIo(zVZL}?CRFZhNc%AJ}gTI)}4`hC9fHF zeBa7`mR{WyEw{=dyPJGShq2OMe$#fuUwR66S$r=ns6Ja}y3yBBWTDv8<-3w{Ezs`5 z-zUq)^w+*c(kHdP=>w-WMP1lNHz=K}? zN(I%SFqmi&uX9^Tk)(Ss_y?4J&$9VtwKZXk5$b5S$C z)rC}v>Oz7_^Ggshz_Vmr?nY&0(HLNmhe&4`>3!g6Y&vfp842@)xWnV@uPKSP|NR@r zyXX}+ZdC)|x9%Ukj=XbufUc0j>U)M;TO+ji&eJ|$yq23lbACHKdWt}x{Yd#7P3@PL zJLSQe>Jv5uL>AtMPTDB?Pz^{IOP_?99x4*OppO+Qc1kS|h*nWQmiiPuK~Vo;azaq$ zXaZ?WQMT;aeKnyr_X)-&sL{OvV*gF{wCC|-YEl5kqFF>0>D08Y6NlS&UoNUbw+9Pk$!0nsu^NEA}>hvZRg#qsgPV@ip)i zTEM4raJLFXI;=DfPr5DTUdCUEXoxHvSURP+83QyE#6H`d6i2D4{f`8PON3@ zJ9T;*(3L2$3Y&*|L_d0%ntt+ZCdoJ~y4N0dhmkR2`E}mtZpAg zDo30&Qxxg<%}4}FSfL#n@Wp$2*ZiLRM9Rfy$<6o2(#}UhBIeib9;vP>za_U4k*)~m(PgPsrwB?Ex%~h_<7YTwSv=pqxt5`{D_Xfz@Ccjmjh=tPc^GznzQ2Q{k zp1Bb7=CCZWB~AQ&e%q5h(DW*U@eF-;i}fiSJ4!u2)+9|8E>h%mtNaIf)j+(|xLX;- zlYZxZ)3+k5vkSilnva_X$zM4$-Ep&Ym(eNxz(DROuGfqm#n*|J&FKx1Ykpz>ym%Z~l6%C3_z+<0R-z>gH9vZc zrv?VuR3nz}Iyii5xLRnj!@{cwYCkyZ9OS0*O1`XDxE|Pji1oM!1KytP0wl;_tD|j* z7g22WZ2WJ#5)|QaGC%ds|#Q<$n4r%r2@A!3BbpSDL_-Y1sCzWC;tk+^n>?Y z4B5$|mJijucdW-j%%oLR^qxZLWqYcHXn&GxZeB>jmA*#9)gMsQoA=1?nga%CZ#TKz zs39Gg6bFtg{-Z~~p{~}4_ICBP+xDyf|3*SdHG4w9zMt+b(xg7nRGb}6KR}q|=%E1<5NW*p4Qaa?>X|-BgZp7yj;=50*ZDk?Nyfb3!7@`w=XxO z=L{bE?nGtA!;v=ctJsbP@5Z0qzNZHvB2~}dzha0d?`Pv=X|H4uTc;IRx^ zcPY9zcJ-EaNy&zTwgSVBQXBBG6`?TbipdVrU!}9e<_5437|<5~S~?}3r4UQ3+$vqw z5@*)->K_f1yvyqA&6d1`s0yC=PySW)DH|={>V{2t)HEvU3Hb5xo!c0e3rBSO(J;LesmkNZT z>WrqxmMOx@YfQA;uJVm>Zj?)T0J#VNBlq2-a-Huo@u%W6f)8&I@B_CcuDQh{9&&f1bTvbeDbwEvbU0QH*n70G)0VGZRIIzD;{>4sn!pvau&2- z?Q%C%|Hjfd5OL0~@UaP=Q%OZD?B4#;ETwmEHb~sT&X~t|J{+tUBpYXZPN3KPHG9;BQ1EB<`~p@aojpdO zo7G`cU92jq|ZjCi|N8X3#5h(wMbOly;n@}r!GO~A@ zp?Q-R*n#~%uXwn8X*Gr5=?T8|cY>lcFTHJi3ti5_tVu8@DX{p|U}@bH~gv zS^^2OVjE@aPonc-E*XNW{9SM*MR>TYN-n?7`X}AaUE8vnIn&JZwwzC$Uw;@HU7%{b z%4^;$)73c?c>ck4r;GL_*1NAuI`U&~%EoRPqVu#E1i6dmcM9C?1G@P$ikDOhRY;Lr^ZU{(|`bEyxNV1gkimDlJG*^iNsCDx4 z@}N4px`0MCEG&$QmKL^1{hg{RE-NeR_4PGjW~zYmZpXzQ2EIimI9N?SH>VpwilMF^ zFC|~PGnT7SZvaLXuCA@2HP<_A0P$q0QG1Bx)m!Q^MkzSEJ8WH1zuIz=!4iL*pLVoR z=!1TNV-rv0XaRA`U#hWLZ3Fj0DX*|`m*A4%Sz?7Qx0@Z^5cH~VsloD(6H|youeJx;?a%-}j{wPDSFZJ@$v$`)>Bb3fd@m z#?Mt`tg8>J=%V;0_r(q!&jpB{zyMCh0$FEycEtqFz{j=eXoOJk(N{+ksDAPTvvLD1&e z6xJMY>+WXDmPA=#s>{+ zg^en{3C>DH;`1$hHF~H)bD)6?RrMnQ&t+(k5@i>hxPjjc^7SjoTQtTb3kmyDH2zp$ zN{g9->&IIGgB}m-m?%r*fHVPTWGUtC$s!WhqeU>=e*fU$1vvFvgK7M(hon&CJPUoF5s8G4X=8SA|aeh2~WJ+%1aLigcUk{e=aWPBYn`ZGAYeOkzV-v2S=BhLXjf+ zq3BTUk*+F6|8c9M$b>z$Z7o`&v}U1phc`YjXFoDP^c6hzg~qxjP1t<&Pvm~;hNLN; z&oGRs?^S>edNDmW2f7e+sy~Y<BEJ3pe?(<_sUuWTPL5${^Iw7Qx9;?$>>_DszJHAxvjKuvdqzpA%eWitCk({7*wlB zl7=uH`&(4^6qr*l%JvBOh+wABB@Xc0@QdwZMv-A~`3y2Zwkk5bXv{ES>j2-v)1;T36Nm?b`tl`Z`B*D91k2)NmCBw4%%I zPW}pik#3o`#AnMn*O~Bx;n{iap#s~Bhed@_O4<&`{q1!O{v+l<>XLW2b0@4=xOncX z8{UIgHkibk}ORf9zl6WnyMW+eT!zC&I!wvGkv5rI8;I7v0#O| z=>4QXl1;8KF%Fv|;G9ndE%&m5DQgk-otzv;s?{JY3Oc&kdQa?z>gC1zG9>und^M)7 z7z*1-*uMULNoCy2!v!m+`N_%n+FHIJE(*^P(K6sgB;jjl42+m(Ctb(Zc?0Pypxkjx zyn_y!rQCdiDZ4b`TgTAA5EF~uuyhZ@mJ~zRT|~Mwr(RtO9ByviXQ134D(ytDe~A@- zdgS>sO!D*-HJCl{?yn#p!JI!5@YeTdp^X=Vh<7f7X!QLv@A^|I6@#v5MYq|$UGqv` z3kM#1618c!v`t~z+fwsfN$r!u{2iNk6BbBi$Bv5*+tx%>Y9;jf0bborT%HMX&Cu3N z)b`{q2Th`adrfT~un>lk5@b8g6B2Atd3#+1(%okY5pWW!rni>9IstKy1GY>Vxs3TQ zBt@d8r^yDHmB&=VkJRrOG(QCOG{2}zzzTN9OQ)6#|9MX8Fc$Tz-puWk75NO4H@ba< z9dhEQg*FT)+C9?gYuZ*)R45|zAznj4q4XJJ?E2Kz&euyjE0n&CqaUevJ#ye+K`h~I zbvc}WD<_BSd39*o;`ai;K7SYl;IPESp=F{;UvKYD6hKve8i7_)QYzM~msVHD7kxO7 zi?smGh=}7OWW*|ll;2o(r!X=<(NN7|X>t{V;{w3+r|} z_ZlrZ?(OjXz<%;vLJHPX1fnXYzmnLxui=4t=@5av2b}H#Mja6(KsSi7>4_o(^Zjp? zDW9nrs?kYmboe%Uio_-2fOMIDkAPG^4L-u%&eYOiR18tui<{E;|MOFLc~|}}k_Y3N zI-`iMHN=>oU{?E~C0kjz)jCOMEWQlm1SGeXx#O|vI&d0FQ3O31P+kvVo)V}T4HzyO zP};Lo^R6wLf3&Asy)>QXCA&8ezvf=PZAeJ0zF1PvV0zh?pF>aR7ZHIHo{33F_=ztE z?A89X5uaI@Q%@X&5;5Mq25xXXiw=kFqR_Iwk(Y`>G8dBH__(Tel4|&rzA2`@oke)3pD-TM=er1J{d!6_J#8H_~2BIO? z)-R105-=}i5+{Qieu&yr_NQ1F>1>mvTU}h;7=aM-Oe9VkL{!~oYUJDOoWa=0FI~aY zy(4}j4>LVX>_otHoA`lF{@ViyvoB5#qn({gFnuE9tM^uQy4QHDHoUU?DR7+ney@k9 zeInSFXekGaLrd`yeMyQ3?{Jzwj~yp5ryAIPM8eruUhn62j|EV2KEK#lFsL5eqMGPF z4eMd}yn@Wic2Cf$97T1C)Df>l=}j_Ur&V`CC%1fQT5GQwgr1--NXWf#wM zV$yCif)HQx#uB6xx$p_&qgv%}DCG~ZNugK-2@=GGW^&|e(52U)068qa2{tAY%@HV8y9`(WQU#?*y)eSey zErT4S)|dPg0}?b-x)@?*ce$Rc)e}nITx+P&-nqwBzCsMe>tBCnNh9mm zV;r;)xkc+6>`5moNxm?8SN*>B_-#jkbm^`y=2kpq_|d$to<<^q&RuIHgVEgY@V+fv zg0|w95WlD3<0pRzetuhugsck0UL%n19D;ozkl-r5KgYfYh8gJ_noh&Q2TeRJ@csH% z_#s_Xh)1y45 zEjosBhh_SN$M|mU*a~5KJ?y%QH=E_ne3A4wb!CxNL&E-}fN5?$g`MA#I=P0iOt8Xe z_J?Y=&lMH-=kz|`_m-LuA@>F64XcA*)IdqOw(qqND@@Lb|Ivx|LG#k6#J3Kv5V|PC z3c+>Kl58$93rQC(yv?>rHluuK9RxA^n}w8MMrE4TV)B4J88mDQF#H?FxH5nb_ruCk zL9I8^PA{%!`Y8_Y!AZ)W|nFrWEU3q2Tm7H1NLXQ)Z6^w0U4Wjv$; zv>9StO@(MMqrHN%0Wm9ER)CpQ~fs!KHg ztiY8X%#NQ_rB5UsqrOzoxYL4vPNT+Otxmp_OvLwj{{tHb)vu6Cb2aSPGui5A3Fm9C z+=->LS#SfzY2@hRn@gXIzh2HR@L1vtlOlIQ^L){@KEtxQ!mzI8{RV5Ntj8*h$g#18 z7it)RnVHm10%V6F;*xS)wy; zNLIUy*6s$X9=%b_?SMG^Pk@4pWFFU(FI?oEmr7;jE)i5CfEO)nvC=g zy-ZSUe-{~UD*urR_&5X!s!_PtHFO=-Jd?WSe9ga3r+!}~V%7^Ld>KcMUp{S^c z4s~*Ja=tUxEqj~m2!=SLlJGq7xJc6D_X)thtbNFjx1 zq(FnMp`ig15y7du2iVdLeaG8#3n&gw&LlAWAx+TrIY9wzNmkpVZnIAsl|;z$%1UeE zYZEY2^!0slxyupnV)*8{vSgvRTokO%nMQ3{)+r9>RqG#o$VN4!($A8MlJbnJ!xtH= zgbKgO#;F+#h16&dv8Q02T>S&0`Q&dnPneA0o`eE!5#U5>{&OOKf0nS3MC(#YAW(R( zD$KbYGHaK`15KcG)`%)0QnkyR{#T_mPL5XTDDrn9=!*xV-+7lTZ6VB#+j}}z^wZVT zi}^^^nMmTUle50*->DBbsW$JwV?Rlc!m5CKMEL*9vU8rdIrc}(D-z8I>{O(nOyu-I zf(>eP)DU;%&quIu8U>Gkf7OR*9t0ESw#+W>R$oqGERB8l&L2@530+K+mnDT7OQ94` zkE7QVj;EUjBSt~bqV;SgvTw7^f&e@Qc|YKfSwG%?}#`T*hpT?GRv{KTYK01;XbEp2NYz16Hd0 z+e;NlWF*K9t8Er6FFkTd`Rx3{a2P<3B#lfo7b)*lv0^TbfI#x)!E=f~GcyCF`^PD) zrR7aBudQN%deN)2P_XGn02*h%jZ5S-M+a=n)q$&n0|$6^yX80d%$j~hMJ#>sEHH+T z_cyh*wSA{>81tWfMQkVP^Pe|L2)cCNCyqfDg zpg2^R3UxqQM`glbY{YcziHtR?`m9+IZhx*V-sYCmPwO1aoo(tI5b=8yis2<0ZdIW0 zyWhmeg3gEz*N@vj+6BpO*3a0;!;#_%_ay%AhLmPwt+we__zF@Vp=J*R^u31E^AK>hVpUDQCZf+LUt9LO4r;JZP0PG`+ zb|ob}ea^fUV8lb!3rw#L7xot$Nq}?ciXxE#q}ivDOt_yve@aSAkAkv>c9mu4J-HXa@V;E&Aa z0oIERN$J9##h*oSvP<#=|qMUg+)8 znMoDN-&SBR)Arv$!`kDrdzd<9FeCRupOjvstmY}A9#0xI!bGT;-=LP1!qF)BkN2)vo*gH5FE8lAiG*3mj9NGf; z#nW+JY9BL@5!$tOz>++!5zc40z@t-rlE__M(_^XVacvT`a=h zQF9?2{Xoqr}y!)N^ zm4JW>{nCFS&G1U_*Dh4prJcJ)C%xv1H6J$u&sE5h@xb9Oom}|1_0f>^8|Go^9PT$k zzay{!LnG>}SFo|vTzhJ*PC>78InZvmO5wILb7FZI z^58Vy9{w4!#BIAcfBYoqvcJ6A84;3kA)T1XC@CdHl-YFd;OLm8lpzAlFD;D>&?H>D z1}-iy`7ZOdlpKtAav9Nd^H&*EKkZ4#mdCMoLCj zR#TH}K9nBvyL=#p*Tl+7r}*IaZ^k#=YdqGok~TK1;03r+9e2lHf=eEHVrk6g8kgJ@ zw$7D14FkT1^O0ztAaqz5Ncwa&BCuz|Iz+ereGTyz?whw=^iMm4tdoBqXT$p9jQth9 zb?|6;GOzcJI_OV@{UE>O=%^&`QAr2=~+l5_xC2Y1K<1+^2wID%YGDq8R-xXD?GP5lcW>+H;M0}Wk7 zPlgs+xK$5o2iE+qczyS&AKQvIQ%L@dJptArqf8GPCSXLe);!YbDQ5PNw$-7W=GGJhR32bWz z2iB^#uQ)lukRLv;Ykk5$H8nL<9}b@PzeIy5CqzMQ)*BP2aQ{Ay8{DwS7ZgX>U zw~~P>&*qa!4IFve={H_G!sZn)+1G7FA0;2Z?^?HfNE5*&cw+;feH66N+%oS=ox>{* zD`e!<{CtDjhbM5c+_zsFJhb5%o3>np8u8Pa#t7^ET1Ff{+sdIcJx_}LyRNnf%arwfSH+|3lz(~}AKeSh0?W=Cf%+<722y570s4r>UwC$Rf5ME_OAdM+Ehj5>XjC=?>H45u%c{ zvhMne7)}PBax_8h{#fo?OVvj{F0@f~4b8YQJIfI=$xRDB@}Fj~1E2g5n+Pz$m%;oe z`umqyyH0ZD&%=)878I&d7FT|;-;aR&dO|@OEbT_HcY;sVM@+z3*|hHwL8wch;?wca>UI822iv?X*Rf(Q6XE6|5j!UH$m$&>CiV6|G z!$8D$)vj4 z+EVK|p7tYgaq&-+g+u^@eAh4GkVhkNJlJ&~c9NA+)~x&#yRsz~2>+ZyRXkiC9~*W+ zu%sXMfZ@5jyGzQ*kX-x(&Ip96Z`s+jxKdP{DhnMFw&m&kjybv+=Tc{VIZ@Ext98Dg zOj6(!{=D%VeC~Nzbc`1XgFK*6KXOlxBH1s?@L@rlYy39&U7;v3*y(wdGVjz=2h2D3 zD0s}?juH2(PY@pl{>Jm(G4BzG&RX{@Qi(n&PpjslDdo%@I>X69--?i zr&SapoW?Acex0;wEqPC>BB|-xR^Dvp0XtJZC&(S#0SeJ}9~rYt#J67!LH&Ly?n=gL z6Dquh6|ofLM-PZPNl4L%w^p(tJjj;O|J7~2<%Lfs^0q|c(-+8z;wFIR6g0^hN^xRw zLmEU&R4UM~aTqqtfYqw>rX>!drPT7Ri@grZSWcp&5FWD3FrItlk@ULxBdzAcw_ggS zz{3F#4YJP7@x0S2KTFF103lL=-v)jUROFd;sw2Ta5?gvHfI1}T)&WuW?x?wB7~f`{kZt1yk}^Kmhc!7U5Y?7jbe?tf<{@31==)IKm;TOP5NyW3b_Tncr zyPwftUV>@=Z9whS+bC_&Tu_LVp7^+=4;RcCM}^m$eu3jh<6>WWTsh<(nN>#`9FrxCg*_<>DGY{sU@-M2(xb z7kf}3*KRR9eEBOcoq$!h_UHmAYb2i@AEIt2E6kOoqlitN3d>zCwj(yS*4GKiFaT~G z85!CB7jQy`gHZ@jkLofR!?xU~{#OeCQmyZx3<<2n$cPFgf!xFekB#${7I7oeNFZ`> z+}rF;7KN+<`w2;-dJ(u%{dtBX%NNB1Z~@8IQ}e(ARJ>n(nu&rUN2=y2nSGEp$jIhm z$uLD`u2w$cMZxRvB7s!;v%`VCZbq_%Ai5)CX`gvUYhJTi4JH1MTgYeeCjTb2XB%L* zEeLnO%V|d;^xRUY77t`em1JBvfShz&Fh}+!D)k!*u*$_x)Nf{e`1v%6_GiN0y8gBLs4sH&nA-g2Izd5I$j-`?5 z>F-~kEYjH+{5v$X)e(jx?fkp{=h#lqz(A4x5(ftdpW`Mf9bFgqEiwwq+qZA??8wV2 zDxzG>#vQK?^*{}`mq_`lUSBP*aA6mlfWTZ<0gmzI%M}neK7Rc8O>j!Lna!Z7|2vb$ ztIsst+*P_oT<^EGf%$|87+?g{xfHYmW{)4}fTBvy-oL#;R}SX#l921lA3c}#hIP=Q zVb=C%grg>rxK>HD$^Kvx{DgIRr|sDVB(rb;tEm>fD)bwIENzP zXH(>PAUg*?Tqop=QR2td06n^m6L0(6 z-ZuUK8Up(6DoUniFG2_FWG!{~5OiVU!-jc0*nhR8GB8)eGZ$F>d@_=s7At6GtIB(> zILi6`-{HxZU!oPPuAX)@;5mih; z{6T1MO-6lEQkr9FK`4!(A5SFeP5-Boej^ng^O1}DZ3OK;2If<|_87Q1Xk75Q+VwTx zDp|yrg%0UzrmiltvgdmAuIz0P&-2ODwG7fKmKS^bNo6xM_)N|1K(ccJ?>|NKa|+P^ z*WA~N`m45`*@NS}o?`}C!?_Z4FR{@(`EdLpHOf;YL|^2#^rFczKhT!9O|5VE^i|_n z!7ELl1Fn4W9gts1BffBNri#98*))UPSr31>e0Oy^ioh1pmm~EGQ|)${?%pC_$6PX~ z2`Ym7ix9buLFMH>P=;!^0Rr(Q=uQv}VoQ9tn7>t^PoAr*o&7fGavq*NH@0)vc{7y9 zL~5GWt8LF0HuwM6i}GI)H*Pt{+j<6%qYWt=+6a1%RrWa4t?;mG6isCMAgT|*_F?$O zwnwCt8S1@jT40G-23=2>#kzHE(`6?1uCCp4b93*V8h`(Wh#S zMjJb>74ERy%fYvl~i20uXPFWf2@bIv_#{*@WR#c;{#jR`s?Q& z7hp!OGLD71r0FW$|GsfhfB1QOA<&l%+5m%GKCU4YV|g>25A7o!gxXHK+=eby-`)!` z|KAD7FBrP2A2n}|fAN>~`rz~5u8su$niUIV?9Ys#&+fU&PEM@wJ!YRZW{ySd2r}K% z(qf~Gls$t7bVQP<7?xUL86Ef08TK=jiEnm1VV)v|XS5}*EE6rTY@aH=$%c%$0iC<4RIQ?M(OkL4r;By`q;7&w} zL*)QxmwJ$axov#c_%;PfQ$}T)=^n)p57w7r5Av=djm6rne&7M%9y@kJ7p5AsB533&{ItU|tizub&^{vebtdW|;yC->NZBklp z$G{Qs`1lyk^p2g)E`ufBFtUcDY1B_j1}4^bonYEw+jnj3;R#0O>d{rz`yMBC_JYQ% z>de6I&wV%F#Y)V3@av>A^eOy-;&$yJ#@GM*9n9;a(l^p{w$2~Z*DZ?l>hWV^V|#jg z17AAn zrZZ)dA1K4vJz4QJv4yUE5INqGUta&j7mWrNjS7n{1)Xt$fPRU9-UXG>`66`8f30Gf z?~L_$f#J=7yZ(-pq=;y%X<~XTd?ZtTXXGm9wCW$+t!lWnmFOqrJDDdU1&Rk6a_{j$ z>)652b=xoL_f#rs3eGBS=iP}?i}$CCLS>47x?0_WM9{QREP@X%1@<>kv;TcKzqJj+Ej ziviMEtt7S${;R9T=erYqrq8r*PhX!(Q}xW}FSJNsX^qypqVo5wB0P~MXAW*}ZhjUP z%DWGN-jI>r7#C`4>Rl*YE9pRvd$yUxb2f| zsqKR~m(2~^C)PU#F57zsu7pP@g`)?kOIKe+&ocOnJ)cO=V9`#pIX3&TOA_76;I&Ui z0*h?@-EEm!J=cOPjq{uzXSRk1lEZ!YRVIACmBFg4iRkR1+jJ-~5E^M)oZld^wX^s4 z&`=RJ^hLJT_bWX_d3k8*{lo3Mv7Gy*4ySux(A(K2#Z-t3y+aAGrarb zerU>~U&n;mIOZtgrMG27XN z8JJuDw0Ku*1~evyC7VkYMh#6Fd+7i95Rk_22>+G#XJsWWSgb^DD}11VfHLg;_7V{l zRZ>C%CcmHn3zXVGQkPj)hD96&@3`6D3J%(rq$DI!QBf{lUK7A3f|^_lC^IPQ=tLml z(6@Zz$}h%%0vvGk*RR+K-i~ao0`&_G4MIRCqTA#}1gOX0=H});&Nc`rOm|5?>wKf4 z@|%0Gu!MP;TM0vUkc^Nf;SMW0vG+UW*X3b?FxjO)#g@u!xZ8gJi79Sqw;0#P>{N^X z2XkciF0Md)#5SP8rs(Y(ME@5RsItY#tvwHB?(U_2laxOuJc~^_4!e&=`i^kKDNiae z5veFEp~czECF>f7+G~=iDxu@;Jz|{EmZ(asItCdslo0)cgw29V;ZdNX)N(@3Vp+QB{`r-jlJpP!_ z@PRKp8p#FH&;h3s(!TP>%#1z=6A=Rgd<>iu7owEdSgI%9u}?vm&}W+iFi@a-X~v|k zeWeAQpC1#JSlHN^pF<%Y^znxBN{XYaoU(e}Q(JefLU*OGd(c-i#z>dOU0MPBIQ;E? z>n2o1O&Xuz+N5{Vy;xwGo2O`aLbbFI9I}8jZ#L1xs>UY(>O<%#x)WDIADh=o|kcODU)gH!GN@ z_M$E3MB$Hiz>7E5)+~dm{DC1M@G(=x`i=SD)L3Q?TvGWRyVkPrfzj2volt|npWUsV z)i#g;@e`~`>&4!bV51(j!6&T%B&y*O1JM}qUJFp`#}sFLg6FYaM5Tg#_3Blr=amgq z%fVa?XnIi;^18+pM+6EKRP<071qFrev0Mxgcx)CMkf?$_Km^}a#e+PW-D&$h)Tx0D zo;YI-eQ0PX4Aip$P{B6cY?6QuB;<>Wi(2nHo*>NW3iFt$t#C*>#=lin-NoKUHR~`v z_~31@yE`YV>xMkp25&l(=vr(vzG^#5YEm^pVXA^w}^3wy14Owm2V z6uS9DJPj<~2NTqkGJ=-{Hf`F+P&7+I{y}ixWi{W2#q#?GRV}|5MLwjl>C#6{siUyC zsVXY&GxfBxG_0DSGV-BYH7D!n;Z&=UePwJ|bUc1fp;p|W-Jx-AD zW)n#hWtZJ@#KN>08(-C>&p4J&lc078|6M5o=OJApCbU4so6k*KEMJvvdymM}umY|J z=n<*dfe1!CWXEv7q;ng`L3y$}U!vzdi<8;ZXwS3~$`~a}2rgXT)4Mw+4_fk5<`!(1 zzrWPlx{Eb(_}{Vj6?jMv@KT%AHN^bw7XRYK3@cFKfrS5BjhujcX?g{lnM*A6MFrY$ z5}f#|6Irs#=1m6)9U+#p5_lX=AdKz;U_ftCM?(W4O)(UYNxfyoj*^QD_gReIP2meR z8R`e{Y~qMOo`f!r2z-wg(bJ51h8Uv%-PI9|kPs;r7S?o?l}5qcL^-UW`zdV@X05|U z_&cP_P67kQjYJhSHMIhbcr4|iR_w@~zhQEEnfEnZv<|e=&E91bS5b+su;PfcZ2Y;* zoEK!_%ZnpLO`=81A^~?D;)n-pPfWwSKCeb2_TAi15l(N${Uo;)yoYT&oMKL3IMw?! zK7>lO65`aVOhZNLyC7)?B87ZG+(xBhPrReHj}bE8O?CN@(O_3O*`+Owh<`g1*%B8947b@Vgt@Qeqs`w5GJ`SlU{G^g4MOpzu%BlYzSg20tMk+BX)=ET_tc1SrG z1niwXN4%ZouzQL|NYdx4mIbh5mQ}qh%`8Cb{`O^gs)oO?$2lVKaYv0;vs1!wT?P;h*FoKjFw=aH_-)<9KVomxPESXo&)QP7nY9NuqpB*B=8 z!k#>S3^fu02}8-;DB!F^*_~}FY&!|`r}C?4NlOZ2ykpN{$TdZx7uA;z?HRG9ZtTP} z*pYJ4L?QXXt7BN+LEYFBy*`g}O2+NTggGkuB5U!M6YO#+YD#45+B;0*B*e7Vpz(>C zSbf?hmzO~;eQ~^5LwzM;h(8ObcB_lB>3o6DF2kAZE5YOG(fBUR+Bz>P(c4QR%T{jE z(U5goxAnDxwd9KYtJYv175-_3Tf8xaI zpJ&5zCbF>0bkMLEuyzMw5^_y$o~`BK#~bP`i|EjW@~)VxL?UXnhyHGswP$Osg!eZ} znHA~!N#i`6v~eYnff4V;j4RH78EfG;{1@)S(TG5ud_J=GeL5y$@1*!NCyq zf(y-DOlY9!V(m-S2oQEVh61}@(s)S>#i$X$Pl^s)4gh-zLni>&yI6=odag7BUJLV+ z(Xu#Da8etTAA$+(9n!GLp^xbA z)BgY3yV7td`?fzyqFX{Gk|tY}HPT}3maLVKv1A$CQj#@g9T{s+6D4bCq7-8?$Wlax zN*PPCGfb9g%2uqLpwI{+A_~q z{Mks7!^yt!+bCaTH+ExuX30iJd>)(3)K8#1X zly~i`G_k)N7$0msWRp#PXnP?e1d++ z9S2B9Xw`Gtx|u`N9dOML9$&ZAQn+t%tB8@5cA|ZFt2zReqLbqB6Q7 zFPo0S)Y|yxg}hh)qsD}l)8`)?bZUibDia`G-3(_1Y!(I<@S|>-0RbJ z9=K2-ZJL;QF`9x~Y>=w82tdDmz|HsqTWOPF% z1^eI37`Mdm=Pt0R?`%Pz}i{EX?A#pZ7QB5t2tZmX5-58E)AG`A%Lf0X} zR_1yp6K*6VfLNjRYniGOw1-yppoeMU?7Za|=5{Tr@J(&_Pfp_q6z4Z$(AnMX3WU3S zBJuTbL!4yvF+aZ&$|3t90Xq~5ETZ+k4%1)jkKo{=(SrF!MX_C;F=X^HYwPU<0>Q!i zj!f=-`Ze{pBk*#)vbq_MpHOS=cw8<_1P7D49C)iS)XHWME4c3XW3Nb*k3MbjB6!uq z>3BuaW)aA~$u~k4sJ4?ZZc(NFC8OR3_jgMK!Hgr`?+f znaZQtvbJaY2jWdb#r-<2%9G}h8awR6RSlJNrG3m4oP&g@a;QG1-nz4_Wo5q#OVI9v zE^#4<2?dv?;A%WP0nTZYu_qE^C1uuqJ>k!Hp7+LeL3^BoZ$154%!$O`IoA#jR3cVX z2_U09vblUNe|@)Mog%sO&$J7w;@zEZz1xd+2NI?02mhYJGGSee!@(527p4l|kMZ&} ztL@RYPJGwLL*Gx3l->IylW1g{D}nu^XN!PhVzU zeHSSfENHJI9I)Cs#R&BFd7X9qX_11rJ!`bEZ#7qOtNw$9JqjOh-lq!eBN^R{W~DTR zRxu}UE0SOSSyGv3_m;cLeZ9b|zjf@K%&Dj{r#`vZ;QpWncpgAW7|VZ`9)_yG3>7)# zO^pX8X`tr>)N%(f%R#`qa_cX&o|KLNtw)lO48u)oPieT$f+Z)O;O49Kqc6^HHt`7T%PoaV0LO- zEPV1k;tMsg@>4gUPaB^+8BIoiT39a>m_ai46??4Umx?|>5((AbNG!+M|M1|IL_-R7 z4>tZoDq1i;bX5A$j=nqhsF$i&4zjP}-0pj3{|I^(r>#ZES z-Ict~6bV1$&yLqUE(h`|w8Ywt?A<4pF>CY%=kh_Uxk+t7jW}I=GHo(u%W4fpolJF` zkk}CJE2`*s7tMb&$!8#pp$S4xMuUcUk=i2mQ6?!ZC0|md{-T*3P zSYp9Tpr3tR#$<7Rz=sP_={<;*G0D%*|MF!Um_fnJ9G`N-qT0g%_R`|-ONRW}OF3-| zao_p>0zCN}uJmXtF|3_i|2TiX-n9f43P$A$B#PZ`B1-n$CP^I000SLB8^G%UFR@^0 z>ggeqWXOO@YG`PfMoQ}__hhlz;HT|WDh{Zn0LTsJr8!~ocqAZuFq?}&e{RlD{&@t9 z5$a?0^Ee~EtHANxb=3d0G>GtorKK>y!gsQ=_;0?!0?3!=)p6ks*};# zeN(`%hN&Kh?!xv9$sPwmD1j-QI1%g8$pIy)9yeu08&n51%qe!*4cy$HfcK|N0k3QC z>>TsgqS-iyZ-9wlxP5hx)=wYv%uFS%!52mw6KAt2!3YGuqKU!pXREiNTH~Cx%!*;w z8&Q{YJTCcTVQ%g^kdkW&)Nc=JYn|*EKp{yHR@}RnXNQUt_XCX97`P#dp_eVOxBjdurEkKvsf&^ z?q`gl)e*}thK1scUIRB11BTs-*GmM-k^&_&GZS=p#>pumD{EJpJ`e=gVK5j3;$eII z@i@q>+qZ42gOCh9dLbbEGE^#>&m0-nfsom_5P7e)BUZyQ2V|wBLUz{blHCC%G)6__ zE^Umo#TNK+8WP~2Px$-2$KSF0+X>yKu;ZNHSBV4;+FQ4iFyap42e_-)_01-F#apO3 zAonU%ikl|-JR_1w*Mj%Z9U&eQ}S^}bwOf}d%=Mo@ z+zP@0aee2iz;A z-0d7IBPB(0<%5J|&TCezyw+*rDE3Mow-p>waa)iTtR-jx_zu^{2spZrDUxSqX1+m; zMVeg-<87e13-7_Y^rcux1(GzqCuI(E)CSs=|9Npr^C*6U52g zl*y}F0CEF#&HR3^e@T;|J^(ibbeU$W?a`c20LYI^`hCG)#q=6FeL5H=n|`=lkqkP_ zXZ+1#e?$uttEzSa91m5_kGUdfGFa>==HUNw(SPDCsiZ=HRBRVWaNXM+8BGkBiFsi(m%#f>wz%V8D ztveN_(CYrDQ&AlYclX6^Eh+vhqOA2W{#XA~bIofj=B}Fo?OIegrk5`wh=})NHvRXmQnC4QLDU6(+nld`D{sx<E(?R;IS4qT!4m zFaJj4wpfsV`|QYaw)BB%5<%`kcYO%XF5ubZ7|m-z1{Jt`FSA&ryCA{5e9%e)pA=D; z-S*+bly2FAnB^w#!US`r=L6-z6Lq?{_w3B^#e)OkUEeQOY-}60?bhpX>njPraDibv zWI@|_u0@>|H=jt4x|%>=ffr5l+e&A-Ti=v+#ZR9Rm$=nae`jnEQKH>nJq^j#T+X&? z3Oz?@+iTaa(}xmgckmhVpTjr=hK=QJCX7aCDCG=}XbuzIk!D4dTSZrU1bz|n|e0HX2 z%EIOUeiI;gzR$34OGPU+2v2MP5bT%V0V|g zoX(k4uE2jlFpyEzORAd}=fb2hI(WdJIfsSTzvZ1Cj$1(|asQgv0mzwpRt)RhtV(!X zbGQ3}ESWH>Bz}@GI;zK9(p~l}g8ijdr_Ty*$P*>O{+KntkW)Gq1D*p#!y40l`L8^0x8twq}8x4Dh9x3);HEmo+&bq!~N z*0`JGP2Zt&4Hsb@$N1!zEqZa&Ca$Ifz4W z7;iUI)u`3gTvH&tjco@VE-rofC3%p&O)<2PnGcWub%GNaf*C1M;MdIx2?cNX{|o%z il)*0r|NFZWFB>^5Zloo!#iJephslZ421WX4>^}iX-T|Zl literal 0 HcmV?d00001 From d476052fab7ea28d64cc9506ea28b3e1e42d5834 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Wed, 1 Dec 2021 13:05:15 +0400 Subject: [PATCH 09/10] Update L3VPN Hub and Spoke use case --- docs/configexamples/l3vpn-hub-and-spoke.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index a2520ea4..72505554 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -53,7 +53,7 @@ General information can be found in the :ref:`l3vpn-vrfs` chapter. ******** Topology ******** -.. image:: /_static/images/L3VPN_hub_spoke.png +.. image:: /_static/images/L3VPN_hub_and_spoke.png :width: 80% :align: center :alt: Network Topology Diagram From 751f425228c0ef5eed80967c594c9eeb02797325 Mon Sep 17 00:00:00 2001 From: ekhudiyev <88712424+ekhudiyev@users.noreply.github.com> Date: Tue, 7 Dec 2021 17:17:52 +0400 Subject: [PATCH 10/10] Minor corrections to the syntax and addressing Corrected syntax and replaced public addresses with private. --- docs/configexamples/l3vpn-hub-and-spoke.rst | 544 ++++++++++---------- 1 file changed, 272 insertions(+), 272 deletions(-) diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 72505554..ad85ef0e 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -68,15 +68,15 @@ As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE and the VyOS-CE1-HUB is the central customer office device that is responsible for controlling access between all spokes and announcing its network prefixes -(100.100.100.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its own Route-Distinguisher(RD) and route-target import/export lists. Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to the nodes across network where PEs Spokes import the route-target 60535:1030 (this is export route-target of vrf BLUE_HUB) and export its own route-target 60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the Customer edge nodes can only learn the network prefixes of the HUB site -[100.100.100.100/32]. For this example VyOS-CE1 has network prefixes -[80.80.80.80/32] / VyOS-CE2 has network prefixes [90.90.90.90/32]. +[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes +[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network routes exchange and minimize iBGP peerings between devices. @@ -102,7 +102,7 @@ Configuration Step-1: Configuring IGP and enabling MPLS LDP -===================================== +============================================= At the first step we need to configure the IP/MPLS backbone network using OSPF as IGP protocol and LDP as label-switching protocol for the base connectivity between @@ -113,7 +113,7 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe .. code-block:: none # interfaces - set interfaces dummy dum10 address '3.3.3.3/32' + set interfaces dummy dum10 address '10.0.0.3/32' set interfaces ethernet eth0 address '172.16.30.1/24' set interfaces ethernet eth1 address '172.16.40.1/24' set interfaces ethernet eth2 address '172.16.90.1/24' @@ -126,16 +126,16 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe set protocols mpls interface 'eth3' set protocols mpls interface 'eth5' set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '3.3.3.3' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' set protocols mpls ldp interface 'eth0' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth2' set protocols mpls ldp interface 'eth3' set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '3.3.3.3' + set protocols mpls ldp router-id '10.0.0.3' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '3.3.3.3 + set protocols ospf parameters router-id '10.0.0.3 - VyOS-P2: @@ -143,7 +143,7 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe .. code-block:: none # interfaces - set interfaces dummy dum10 address '4.4.4.4/32' + set interfaces dummy dum10 address '10.0.0.4/32' set interfaces ethernet eth0 address '172.16.30.2/24' set interfaces ethernet eth1 address '172.16.20.1/24' set interfaces ethernet eth2 address '172.16.120.1/24' @@ -154,22 +154,22 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe set protocols mpls interface 'eth2' set protocols mpls interface 'eth3' set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '4.4.4.4' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' set protocols mpls ldp interface 'eth0' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth2' set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '4.4.4.4' + set protocols mpls ldp router-id '10.0.0.4' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '4.4.4.4' + set protocols ospf parameters router-id '10.0.0.4' - VyOS-P3: .. code-block:: none # interfaces - set interfaces dummy dum10 address '5.5.5.5/32' + set interfaces dummy dum10 address '10.0.0.5/32' set interfaces ethernet eth0 address '172.16.110.1/24' set interfaces ethernet eth1 address '172.16.40.2/24' set interfaces ethernet eth2 address '172.16.50.1/24' @@ -180,22 +180,22 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe set protocols mpls interface 'eth2' set protocols mpls interface 'eth3' set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '5.5.5.5' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' set protocols mpls ldp interface 'eth0' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth2' set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '5.5.5.5' + set protocols mpls ldp router-id '10.0.0.5' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '5.5.5.5' + set protocols ospf parameters router-id '10.0.0.5' - VyOS-P4: .. code-block:: none # interfaces - set interfaces dummy dum10 address '6.6.6.6/32' + set interfaces dummy dum10 address '10.0.0.6/32' set interfaces ethernet eth0 address '172.16.80.2/24' set interfaces ethernet eth1 address '172.16.130.1/24' set interfaces ethernet eth2 address '172.16.50.2/24' @@ -209,40 +209,40 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe set protocols mpls interface 'eth3' set protocols mpls interface 'eth0' set protocols mpls interface 'eth5' - set protocols mpls ldp discovery transport-ipv4-address '6.6.6.6' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' set protocols mpls ldp interface 'eth0' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth2' set protocols mpls ldp interface 'eth3' set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '6.6.6.6' + set protocols mpls ldp router-id '10.0.0.6' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '6.6.6.6' + set protocols ospf parameters router-id '10.0.0.6' - VyOS-PE1: .. code-block:: none # interfaces - set interfaces dummy dum10 address '7.7.7.7/32' + set interfaces dummy dum10 address '10.0.0.7/32' set interfaces ethernet eth0 address '172.16.90.2/24' # protocols ospf + ldp set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '7.7.7.7' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '7.7.7.7' + set protocols mpls ldp router-id '10.0.0.7' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '7.7.7.7' + set protocols ospf parameters router-id '10.0.0.7' - VyOS-PE2: .. code-block:: none # interfaces - set interfaces dummy dum10 address '8.8.8.8/32' + set interfaces dummy dum10 address '10.0.0.8/32' set interfaces ethernet eth0 address '172.16.110.2/24' set interfaces ethernet eth1 address '172.16.100.2/24' set interfaces ethernet eth2 address '172.16.80.1/24' @@ -250,30 +250,30 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe # protocols ospf + ldp set protocols mpls interface 'eth0' set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '8.8.8.8' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' set protocols mpls ldp interface 'eth0' set protocols mpls ldp interface 'eth1' - set protocols mpls ldp router-id '8.8.8.8' + set protocols mpls ldp router-id '10.0.0.8' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '8.8.8.8' + set protocols ospf parameters router-id '10.0.0.8' - VyOS-PE3: .. code-block:: none # interfaces - set interfaces dummy dum10 address '10.10.10.10/32' + set interfaces dummy dum10 address '10.0.0.10/32' set interfaces ethernet eth0 address '172.16.140.2/24' # protocols ospf + ldp set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.10.10.10' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.10.10.10' + set protocols mpls ldp router-id '10.0.0.10' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.10.10.10' + set protocols ospf parameters router-id '10.0.0.10' - VyOS-RR1: @@ -282,18 +282,18 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe # interfaces set interfaces ethernet eth1 address '172.16.20.2/24' set interfaces ethernet eth2 address '172.16.10.2/24' - set interfaces dummy dum10 address '1.1.1.1/32' + set interfaces dummy dum10 address '10.0.0.1/32' # protocols ospf + ldp set protocols mpls interface 'eth1' set protocols mpls interface 'eth2' - set protocols mpls ldp discovery transport-ipv4-address '1.1.1.1' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth2' - set protocols mpls ldp router-id '1.1.1.1' + set protocols mpls ldp router-id '10.0.0.1' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '1.1.1.1' + set protocols ospf parameters router-id '10.0.0.1' - VyOS-RR2: @@ -302,18 +302,18 @@ IGP protocol and LDP as label-switching protocol for the base connectivity betwe # interfaces set interfaces ethernet eth0 address '172.16.80.1/24' set interfaces ethernet eth1 address '172.16.70.2/24' - set interfaces dummy dum10 address '2.2.2.2/32' + set interfaces dummy dum10 address '10.0.0.2/32' # protocols ospf + ldp set protocols mpls interface 'eth0' set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '2.2.2.2' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' set protocols mpls ldp interface 'eth1' set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '2.2.2.2' + set protocols mpls ldp router-id '10.0.0.2' set protocols ospf area 0 network '0.0.0.0/0' set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '2.2.2.2' + set protocols ospf parameters router-id '10.0.0.2' @@ -329,18 +329,18 @@ VPN (L3VPN) routes between them: .. code-block:: none set protocols bgp local-as '65001' - set protocols bgp neighbor 7.7.7.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 7.7.7.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 8.8.8.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 8.8.8.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 9.9.9.9 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 9.9.9.9 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.10.10.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.10.10.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '1.1.1.1' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.9 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.9 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' set protocols bgp parameters default no-ipv4-unicast set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '1.1.1.1' + set protocols bgp parameters router-id '10.0.0.1' set protocols bgp peer-group RR_VPNv4 remote-as '65001' set protocols bgp peer-group RR_VPNv4 update-source 'dum10' @@ -349,18 +349,18 @@ VPN (L3VPN) routes between them: .. code-block:: none set protocols bgp local-as '65001' - set protocols bgp neighbor 7.7.7.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 7.7.7.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 8.8.8.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 8.8.8.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 9.9.9.9 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 9.9.9.9 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.10.10.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.10.10.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '1.1.1.1' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.9 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.9 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' set protocols bgp parameters default no-ipv4-unicast set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '2.2.2.2' + set protocols bgp parameters router-id '10.0.0.2' set protocols bgp peer-group RR_VPNv4 remote-as '65001' set protocols bgp peer-group RR_VPNv4 update-source 'dum10' @@ -369,13 +369,13 @@ VPN (L3VPN) routes between them: .. code-block:: none set protocols bgp local-as '65001' - set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' set protocols bgp parameters default no-ipv4-unicast set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '7.7.7.7' + set protocols bgp parameters router-id '10.0.0.7' set protocols bgp peer-group RR_VPNv4 remote-as '65001' set protocols bgp peer-group RR_VPNv4 update-source 'dum10' @@ -384,13 +384,13 @@ VPN (L3VPN) routes between them: .. code-block:: none set protocols bgp local-as '65001' - set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' set protocols bgp parameters default no-ipv4-unicast set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '8.8.8.8' + set protocols bgp parameters router-id '10.0.0.8' set protocols bgp peer-group RR_VPNv4 remote-as '65001' set protocols bgp peer-group RR_VPNv4 update-source 'dum10' @@ -399,13 +399,13 @@ VPN (L3VPN) routes between them: .. code-block:: none set protocols bgp local-as '65001' - set protocols bgp neighbor 1.1.1.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 1.1.1.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 2.2.2.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 2.2.2.2 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' set protocols bgp parameters default no-ipv4-unicast set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.10.10.10' + set protocols bgp parameters router-id '10.0.0.10' set protocols bgp peer-group RR_VPNv4 remote-as '65001' set protocols bgp peer-group RR_VPNv4 update-source 'dum10' @@ -500,11 +500,11 @@ configured L3VPN parameters. .. code-block:: none # interfaces - set interfaces dummy dum20 address '80.80.80.80/32' + set interfaces dummy dum20 address '10.0.0.80/32' set interfaces ethernet eth0 address '10.50.50.2/24' # BGP for peering with PE - set protocols bgp 65035 address-family ipv4-unicast network 80.80.80.80/32 + set protocols bgp 65035 address-family ipv4-unicast network 10.0.0.80/32 set protocols bgp 65035 neighbor 10.50.50.1 ebgp-multihop '2' set protocols bgp 65035 neighbor 10.50.50.1 remote-as '65001' set protocols bgp 65035 neighbor 10.50.50.1 update-source 'eth0' @@ -517,11 +517,11 @@ configured L3VPN parameters. .. code-block:: none # interfaces - set interfaces dummy dum20 address '100.100.100.100/32' + set interfaces dummy dum20 address '10.0.0.100/32' set interfaces ethernet eth0 address '10.80.80.2/24' # BGP for peering with PE - set protocols bgp 65035 address-family ipv4-unicast network 100.100.100.100/32 + set protocols bgp 65035 address-family ipv4-unicast network 10.0.0.100/32 set protocols bgp 65035 address-family ipv4-unicast redistribute connected set protocols bgp 65035 neighbor 10.80.80.1 ebgp-multihop '2' set protocols bgp 65035 neighbor 10.80.80.1 remote-as '65001' @@ -535,11 +535,11 @@ configured L3VPN parameters. .. code-block:: none # interfaces - set interfaces dummy dum20 address '90.90.90.90/32' + set interfaces dummy dum20 address '10.0.0.90/32' set interfaces ethernet eth0 address '10.60.60.2/24' # BGP for peering with PE - set protocols bgp 65035 address-family ipv4-unicast network 90.90.90.90/32 + set protocols bgp 65035 address-family ipv4-unicast network 10.0.0.90/32 set protocols bgp 65035 neighbor 10.60.60.1 ebgp-multihop '2' set protocols bgp 65035 neighbor 10.60.60.1 remote-as '65001' set protocols bgp 65035 neighbor 10.60.60.1 update-source 'eth0' @@ -566,11 +566,11 @@ Let’s check IPv4 routing and MPLS information on provider nodes vyos@VyOS-P1:~$ show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 4.4.4.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 - 5.5.5.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 - 7.7.7.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 - 1.1.1.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 - 8.8.8.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 - “show mpls ldp neighbor “ for checking ldp neighbors @@ -578,11 +578,11 @@ Let’s check IPv4 routing and MPLS information on provider nodes vyos@VyOS-P1:~$ show mpls ldp neighbor AF ID State Remote Address Uptime - ipv4 1.1.1.1 OPERATIONAL 1.1.1.1 07w5d06h - ipv4 4.4.4.4 OPERATIONAL 4.4.4.4 09w3d00h - ipv4 5.5.5.5 OPERATIONAL 5.5.5.5 09w2d23h - ipv4 7.7.7.7 OPERATIONAL 7.7.7.7 03w0d01h - ipv4 8.8.8.8 OPERATIONAL 8.8.8.8 01w3d02h + ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h + ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h + ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h + ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h + ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h - “show mpls ldp binding” for checking mpls label assignment @@ -590,56 +590,56 @@ Let’s check IPv4 routing and MPLS information on provider nodes vyos@VyOS-P1:~$ show mpls ldp discovery AF Destination Nexthop Local Label Remote Label In Use - ipv4 1.1.1.1/32 1.1.1.1 23 imp-null yes - ipv4 1.1.1.1/32 4.4.4.4 23 20 no - ipv4 1.1.1.1/32 5.5.5.5 23 17 no - ipv4 1.1.1.1/32 7.7.7.7 23 16 no - ipv4 1.1.1.1/32 8.8.8.8 23 16 no - ipv4 2.2.2.2/32 1.1.1.1 20 16 no - ipv4 2.2.2.2/32 4.4.4.4 20 22 no - ipv4 2.2.2.2/32 5.5.5.5 20 24 yes - ipv4 2.2.2.2/32 7.7.7.7 20 17 no - ipv4 2.2.2.2/32 8.8.8.8 20 17 no - ipv4 3.3.3.3/32 1.1.1.1 imp-null 17 no - ipv4 3.3.3.3/32 4.4.4.4 imp-null 16 no - ipv4 3.3.3.3/32 5.5.5.5 imp-null 18 no - ipv4 3.3.3.3/32 7.7.7.7 imp-null 18 no - ipv4 3.3.3.3/32 8.8.8.8 imp-null 18 no - ipv4 4.4.4.4/32 1.1.1.1 16 18 no - ipv4 4.4.4.4/32 4.4.4.4 16 imp-null yes - ipv4 4.4.4.4/32 5.5.5.5 16 19 no - ipv4 4.4.4.4/32 7.7.7.7 16 19 no - ipv4 4.4.4.4/32 8.8.8.8 16 19 no - ipv4 5.5.5.5/32 1.1.1.1 21 19 no - ipv4 5.5.5.5/32 4.4.4.4 21 17 no - ipv4 5.5.5.5/32 5.5.5.5 21 imp-null yes - ipv4 5.5.5.5/32 7.7.7.7 21 20 no - ipv4 5.5.5.5/32 8.8.8.8 21 20 no - ipv4 6.6.6.6/32 1.1.1.1 17 20 no - ipv4 6.6.6.6/32 4.4.4.4 17 23 yes - ipv4 6.6.6.6/32 5.5.5.5 17 21 yes - ipv4 6.6.6.6/32 7.7.7.7 17 21 no - ipv4 6.6.6.6/32 8.8.8.8 17 21 no - ipv4 7.7.7.7/32 1.1.1.1 22 21 no - ipv4 7.7.7.7/32 4.4.4.4 22 18 no - ipv4 7.7.7.7/32 5.5.5.5 22 20 no - ipv4 7.7.7.7/32 7.7.7.7 22 imp-null yes - ipv4 7.7.7.7/32 8.8.8.8 22 22 no - ipv4 8.8.8.8/32 1.1.1.1 24 22 no - ipv4 8.8.8.8/32 4.4.4.4 24 19 no - ipv4 8.8.8.8/32 5.5.5.5 24 16 no - ipv4 8.8.8.8/32 7.7.7.7 24 22 no - ipv4 8.8.8.8/32 8.8.8.8 24 imp-null yes - ipv4 9.9.9.9/32 1.1.1.1 18 23 no - ipv4 9.9.9.9/32 4.4.4.4 18 21 yes - ipv4 9.9.9.9/32 5.5.5.5 18 22 no - ipv4 9.9.9.9/32 7.7.7.7 18 23 no - ipv4 9.9.9.9/32 8.8.8.8 18 23 no - ipv4 10.10.10.10/32 1.1.1.1 19 24 no - ipv4 10.10.10.10/32 4.4.4.4 19 24 yes - ipv4 10.10.10.10/32 5.5.5.5 19 23 yes - ipv4 10.10.10.10/32 7.7.7.7 19 24 no - ipv4 10.10.10.10/32 8.8.8.8 19 24 no + ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes + ipv4 10.0.0.1/32 10.0.0.4 23 20 no + ipv4 10.0.0.1/32 10.0.0.5 23 17 no + ipv4 10.0.0.1/32 10.0.0.7 23 16 no + ipv4 10.0.0.1/32 10.0.0.8 23 16 no + ipv4 10.0.0.2/32 10.0.0.1 20 16 no + ipv4 10.0.0.2/32 10.0.0.4 20 22 no + ipv4 10.0.0.2/32 10.0.0.5 20 24 yes + ipv4 10.0.0.2/32 10.0.0.7 20 17 no + ipv4 10.0.0.2/32 10.0.0.8 20 17 no + ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no + ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no + ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no + ipv4 10.0.0.4/32 10.0.0.1 16 18 no + ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes + ipv4 10.0.0.4/32 10.0.0.5 16 19 no + ipv4 10.0.0.4/32 10.0.0.7 16 19 no + ipv4 10.0.0.4/32 10.0.0.8 16 19 no + ipv4 10.0.0.5/32 10.0.0.1 21 19 no + ipv4 10.0.0.5/32 10.0.0.4 21 17 no + ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes + ipv4 10.0.0.5/32 10.0.0.7 21 20 no + ipv4 10.0.0.5/32 10.0.0.8 21 20 no + ipv4 10.0.0.6/32 10.0.0.1 17 20 no + ipv4 10.0.0.6/32 10.0.0.4 17 23 yes + ipv4 10.0.0.6/32 10.0.0.5 17 21 yes + ipv4 10.0.0.6/32 10.0.0.7 17 21 no + ipv4 10.0.0.6/32 10.0.0.8 17 21 no + ipv4 10.0.0.7/32 10.0.0.1 22 21 no + ipv4 10.0.0.7/32 10.0.0.4 22 18 no + ipv4 10.0.0.7/32 10.0.0.5 22 20 no + ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes + ipv4 10.0.0.7/32 10.0.0.8 22 22 no + ipv4 10.0.0.8/32 10.0.0.1 24 22 no + ipv4 10.0.0.8/32 10.0.0.4 24 19 no + ipv4 10.0.0.8/32 10.0.0.5 24 16 no + ipv4 10.0.0.8/32 10.0.0.7 24 22 no + ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes + ipv4 10.0.0.9/32 10.0.0.1 18 23 no + ipv4 10.0.0.9/32 10.0.0.4 18 21 yes + ipv4 10.0.0.9/32 10.0.0.5 18 22 no + ipv4 10.0.0.9/32 10.0.0.7 18 23 no + ipv4 10.0.0.9/32 10.0.0.8 18 23 no + ipv4 10.0.0.10/32 10.0.0.1 19 24 no + ipv4 10.0.0.10/32 10.0.0.4 19 24 yes + ipv4 10.0.0.10/32 10.0.0.5 19 23 yes + ipv4 10.0.0.10/32 10.0.0.7 19 24 no + ipv4 10.0.0.10/32 10.0.0.8 19 24 no Now we’re checking iBGP status and routes from route-reflector nodes to other devices: @@ -649,17 +649,17 @@ nodes to other devices: .. code-block:: none vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary - BGP router identifier 1.1.1.1, local AS number 65001 vrf-id 0 + BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 BGP table version 0 RIB entries 9, using 1728 bytes of memory Peers 4, using 85 KiB of memory Peer groups 1, using 64 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 7.7.7.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 - 8.8.8.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 - 9.9.9.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - 10.10.10.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 Total number of neighbors 4 @@ -668,7 +668,7 @@ nodes to other devices: .. code-block:: none vyos@VyOS-RR1:~$ show bgp ipv4 vpn - BGP table version is 2, local router ID is 1.1.1.1, vrf id 0 + BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed @@ -677,45 +677,45 @@ nodes to other devices: Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.50.50.1:1011 - *>i10.50.50.0/24 7.7.7.7 0 100 0 i - UN=7.7.7.7 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i80.80.80.80/32 7.7.7.7 0 100 0 65035 i - UN=7.7.7.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.60.60.1:1011 - *>i10.60.60.0/24 10.10.10.10 0 100 0 i - UN=10.10.10.10 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i90.90.90.90/32 10.10.10.10 0 100 0 65035 i - UN=10.10.10.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.80.80.1:1011 - *>i10.80.80.0/24 8.8.8.8 0 100 0 i - UN=8.8.8.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 *>i100.100.100.100/32 - 8.8.8.8 0 100 0 65035 i - UN=8.8.8.8 EC{65035:1030} label=80 type=bgp, subtype=0 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 Route Distinguisher: 172.16.80.1:2011 - *>i10.110.110.0/24 8.8.8.8 0 100 0 65050 i - UN=8.8.8.8 EC{65050:2011} label=81 type=bgp, subtype=0 - *>i172.16.80.0/24 8.8.8.8 0 100 0 i - UN=8.8.8.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 Route Distinguisher: 172.16.100.1:2011 - *>i10.210.210.0/24 9.9.9.9 0 100 0 65050 i - UN=9.9.9.9 EC{65050:2011} label=80 type=bgp, subtype=0 - *>i172.16.100.0/24 9.9.9.9 0 100 0 i - UN=9.9.9.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected for specific VPNv4 destination .. code-block:: none - vyos@VyOS-RR1:~$ show bgp ipv4 vpn 100.100.100.100/32 - BGP routing table entry for 10.80.80.1:1011:100.100.100.100/32 + vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 not allocated Paths: (1 available, best #1) Advertised to non peer-group peers: - 7.7.7.7 8.8.8.8 9.9.9.9 10.10.10.10 + 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 65035, (Received from a RR-client) - 8.8.8.8 from 8.8.8.8 (8.8.8.8) + 10.0.0.8 from 10.0.0.8 (10.0.0.8) Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) Extended Community: RT:65035:1030 Remote label: 80 @@ -730,15 +730,15 @@ and installing them to the specific customer VRFs: .. code-block:: none vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary - BGP router identifier 7.7.7.7, local AS number 65001 vrf-id 0 + BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 BGP table version 0 RIB entries 9, using 1728 bytes of memory Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 1.1.1.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 - 2.2.2.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 - “show bgp vrf all” for checking all the prefix learning on BGP within VRFs: @@ -761,12 +761,12 @@ and installing them to the specific customer VRFs: Network Next Hop Metric LocPrf Weight Path * 10.50.50.0/24 0.0.0.0 0 32768 ? *> 0.0.0.0 0 32768 i - *> 10.80.80.0/24 8.8.8.8@0< 0 100 0 i - * 8.8.8.8@0< 0 100 0 i - *> 80.80.80.80/32 10.50.50.2 0 0 65035 i - *> 100.100.100.100/32 - 8.8.8.8@0< 0 100 0 65035 ? - * 8.8.8.8@0< 0 100 0 65035 ? + *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i + * 10.0.0.8@0< 0 100 0 i + *> 10.0.0.80/32 10.50.50.2 0 0 65035 i + *> 10.0.0.100/32 + 10.0.0.8@0< 0 100 0 65035 ? + * 10.0.0.8@0< 0 100 0 65035 ? - “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor information between PE and CE: @@ -789,7 +789,7 @@ and installing them to the specific customer VRFs: - “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. Using this command we are also able to check the transport and - customer label (inner/outer) for Hub network prefix (100.100.100.100/32): + customer label (inner/outer) for Hub network prefix (10.0.0.100/32): .. code-block:: none @@ -804,10 +804,10 @@ and installing them to the specific customer VRFs: VRF BLUE_SPOKE: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h - B> 10.80.80.0/24 [200/0] via 8.8.8.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - B>* 80.80.80.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m - B> 100.100.100.100/32 [200/0] via 8.8.8.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m + B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the @@ -816,23 +816,23 @@ and installing them to the specific customer VRFs: .. code-block:: none - vyos@VyOS-PE1:~$ show bgp ipv4 vpn 100.100.100.100/32 - BGP routing table entry for 10.80.80.1:1011:100.100.100.100/32 + vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 not allocated Paths: (2 available, best #1) Not advertised to any peer 65035 - 8.8.8.8 from 1.1.1.1 (8.8.8.8) + 10.0.0.8 from 10.0.0.1 (10.0.0.8) Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) Extended Community: RT:65035:1030 - Originator: 8.8.8.8, Cluster list: 1.1.1.1 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 Remote label: 80 Last update: Tue Oct 19 13:45:26 2021 65035 - 8.8.8.8 from 2.2.2.2 (8.8.8.8) + 10.0.0.8 from 10.0.0.2 (10.0.0.8) Origin incomplete, metric 0, localpref 100, valid, internal Extended Community: RT:65035:1030 - Originator: 8.8.8.8, Cluster list: 1.1.1.1 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 Remote label: 80 Last update: Wed Oct 13 12:39:34 202 @@ -843,15 +843,15 @@ Now, let’s check routing information on out Hub PE: .. code-block:: none vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary - BGP router identifier 8.8.8.8, local AS number 65001 vrf-id 0 + BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 BGP table version 0 RIB entries 9, using 1728 bytes of memory Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 1.1.1.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 - 2.2.2.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 Total number of neighbors @@ -873,26 +873,26 @@ Now, let’s check routing information on out Hub PE: Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path - *> 10.50.50.0/24 7.7.7.7@0< 0 100 0 i - * 7.7.7.7@0< 0 100 0 i - *> 10.60.60.0/24 10.10.10.10@0< 0 100 0 i - * 10.10.10.10@0< 0 100 0 i + *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i + * 10.0.0.7@0< 0 100 0 i + *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i + * 10.0.0.10@0< 0 100 0 i * 10.80.80.0/24 10.80.80.2 0 0 65035 ? * 0.0.0.0 0 32768 i *> 0.0.0.0 0 32768 ? *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i - *> 10.210.210.0/24 9.9.9.9@0< 0 100 0 65050 i - * 9.9.9.9@0< 0 100 0 65050 i - *> 80.80.80.80/32 7.7.7.7@0< 0 100 0 65035 i - * 7.7.7.7@0< 0 100 0 65035 i - *> 90.90.90.90/32 10.10.10.10@0< 0 100 0 65035 i - * 10.10.10.10@0< 0 100 0 65035 i - *> 100.100.100.100/32 + *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i + * 10.0.0.9@0< 0 100 0 65050 i + *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i + * 10.0.0.7@0< 0 100 0 65035 i + *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i + * 10.0.0.10@0< 0 100 0 65035 i + *> 10.0.0.100/32 10.80.80.2 0 0 65035 ? *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? 0.0.0.0@9< 0 32768 i - *> 172.16.100.0/24 9.9.9.9@0< 0 100 0 i - * 9.9.9.9@0< 0 100 0 i + *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i + * 10.0.0.9@0< 0 100 0 i - “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor CE Hub device @@ -913,7 +913,7 @@ Now, let’s check routing information on out Hub PE: - “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. With this command we are able to check the transport and customer label (inner/outer) for network spokes prefixes - 80.80.80.80/32 - 90.90.90.90/32 + 10.0.0.80/32 - 10.0.0.90/32 .. code-block:: none @@ -925,22 +925,22 @@ Now, let’s check routing information on out Hub PE: > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF BLUE_HUB: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h - B> 10.50.50.0/24 [200/0] via 7.7.7.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.60.60.0/24 [200/0] via 10.10.10.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 10.210.210.0/24 [200/0] via 9.9.9.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - B> 80.80.80.80/32 [200/0] via 7.7.7.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 90.90.90.90/32 [200/0] via 10.10.10.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 - B>* 100.100.100.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h + B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 172.16.100.0/24 [200/0] via 9.9.9.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 @@ -949,43 +949,43 @@ Now, let’s check routing information on out Hub PE: .. code-block:: none - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 80.80.80.80/32 - BGP routing table entry for 10.50.50.1:1011:80.80.80.80/32 + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 + BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 not allocated Paths: (2 available, best #1) Not advertised to any peer 65035 - 7.7.7.7 from 1.1.1.1 (7.7.7.7) + 10.0.0.7 from 10.0.0.1 (10.0.0.7) Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) Extended Community: RT:65035:1011 - Originator: 7.7.7.7, Cluster list: 1.1.1.1 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 Remote label: 144 Last update: Tue Oct 19 13:45:30 2021 65035 - 7.7.7.7 from 2.2.2.2 (7.7.7.7) + 10.0.0.7 from 10.0.0.2 (10.0.0.7) Origin IGP, metric 0, localpref 100, valid, internal Extended Community: RT:65035:1011 - Originator: 7.7.7.7, Cluster list: 1.1.1.1 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 Remote label: 144 Last update: Wed Oct 13 12:39:37 2021 - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 90.90.90.90/32 - BGP routing table entry for 10.60.60.1:1011:90.90.90.90/32 + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 + BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 not allocated Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.10.10.10 from 1.1.1.1 (10.10.10.10) + 10.0.0.10 from 10.0.0.1 (10.0.0.10) Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) Extended Community: RT:65035:1011 - Originator: 10.10.10.10, Cluster list: 1.1.1.1 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 Remote label: 144 Last update: Tue Oct 19 13:45:30 2021 65035 - 10.10.10.10 from 2.2.2.2 (10.10.10.10) + 10.0.0.10 from 10.0.0.2 (10.0.0.10) Origin IGP, metric 0, localpref 100, valid, internal Extended Community: RT:65035:1011 - Originator: 10.10.10.10, Cluster list: 1.1.1.1 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 Remote label: 144 Last update: Wed Oct 13 12:45:44 2021 @@ -1007,27 +1007,27 @@ Finally, let’s check the reachability between CEs: B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - C>* 80.80.80.80/32 is directly connected, dum20, 09w0d00h - B>* 100.100.100.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h + B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m # check icmp - vyos@VyOS-CE1-SPOKE:~$ ping 100.100.100.100 interface 80.80.80.80 - PING 100.100.100.100 (100.100.100.100) from 80.80.80.80 : 56(84) bytes of data. - 64 bytes from 100.100.100.100: icmp_seq=1 ttl=62 time=6.52 ms - 64 bytes from 100.100.100.100: icmp_seq=2 ttl=62 time=4.13 ms - 64 bytes from 100.100.100.100: icmp_seq=3 ttl=62 time=4.04 ms - 64 bytes from 100.100.100.100: icmp_seq=4 ttl=62 time=4.03 ms + vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms ^C - --- 100.100.100.100 ping statistics --- + --- 10.0.0.100 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 8ms rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms # check network path - vyos@VyOS-CE1-SPOKE:~$ traceroute 100.100.100.100 - traceroute to 100.100.100.100 (100.100.100.100), 30 hops max, 60 byte packets + vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms 2 * * * - 3 100.100.100.100 (100.100.100.100) 9.225 ms 9.159 ms 9.121 m + 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m - VyOS-CE-HUB -------> VyOS-CE1-SPOKE - VyOS-CE-HUB -------> VyOS-CE2-SPOKE @@ -1047,47 +1047,47 @@ Finally, let’s check the reachability between CEs: C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - B>* 80.80.80.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m - B>* 90.90.90.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - C>* 100.100.100.100/32 is directly connected, dum20, 01w6d07h + B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m # check icmp - vyos@VyOS-CE-HUB:~$ ping 80.80.80.80 interface 100.100.100.100 c 4 - PING 80.80.80.80 (80.80.80.80) from 100.100.100.100 : 56(84) bytes of data. - 64 bytes from 80.80.80.80: icmp_seq=1 ttl=62 time=3.31 ms - 64 bytes from 80.80.80.80: icmp_seq=2 ttl=62 time=4.23 ms - 64 bytes from 80.80.80.80: icmp_seq=3 ttl=62 time=3.89 ms - 64 bytes from 80.80.80.80: icmp_seq=4 ttl=62 time=3.22 ms + vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 + PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms + 64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms + 64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms + 64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms - --- 80.80.80.80 ping statistics --- + --- 10.0.0.80 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 9ms rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms - vyos@VyOS-CE-HUB:~$ ping 90.90.90.90 interface 100.100.100.100 c 4 - PING 90.90.90.90 (90.90.90.90) from 100.100.100.100 : 56(84) bytes of data. - 64 bytes from 90.90.90.90: icmp_seq=1 ttl=62 time=7.46 ms - 64 bytes from 90.90.90.90: icmp_seq=2 ttl=62 time=4.43 ms - 64 bytes from 90.90.90.90: icmp_seq=3 ttl=62 time=4.60 ms + vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 + PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms + 64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms + 64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms ^C - --- 90.90.90.90 ping statistics --- + --- 10.0.0.90 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 6ms rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms # check network path - vyos@VyOS-CE-HUB:~$ traceroute 80.80.80.80 - traceroute to 80.80.80.80 (80.80.80.80), 30 hops max, 60 byte packets + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 + traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms 2 * * * - 3 80.80.80.80 (80.80.80.80) 8.125 ms 8.019 ms 7.781 ms + 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms - vyos@VyOS-CE-HUB:~$ traceroute 90.90.90.90 - traceroute to 90.90.90.90 (90.90.90.90), 30 hops max, 60 byte packets + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 + traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms 2 * * * 3 * * * - 4 90.90.90.90 (90.90.90.90) 9.358 ms 9.325 ms 9.292 ms + 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms - VyOS-CE2-SPOKE -------> VyOS-CE-HUB @@ -1104,27 +1104,27 @@ Finally, let’s check the reachability between CEs: B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - C>* 90.90.90.90/32 is directly connected, dum20, 02w6d00h - B>* 100.100.100.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h + B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m # check icmp - vyos@rt-ce2-SPOKE:~$ ping 100.100.100.100 interface 90.90.90.90 c 4 - PING 100.100.100.100 (100.100.100.100) from 90.90.90.90 : 56(84) bytes of data. - 64 bytes from 100.100.100.100: icmp_seq=1 ttl=62 time=4.97 ms - 64 bytes from 100.100.100.100: icmp_seq=2 ttl=62 time=4.45 ms - 64 bytes from 100.100.100.100: icmp_seq=3 ttl=62 time=4.20 ms - 64 bytes from 100.100.100.100: icmp_seq=4 ttl=62 time=4.29 ms + vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms - --- 100.100.100.100 ping statistics --- + --- 10.0.0.100 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 9ms rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms # check network path - vyos@rt-ce2-SPOKE:~$ traceroute 100.100.100.100 - traceroute to 100.100.100.100 (100.100.100.100), 30 hops max, 60 byte packets + vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms 2 * * * 3 * * * - 4 100.100.100.100 (100.100.100.100) 7.504 ms 7.480 ms 7.488 ms + 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms **Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone.