I agree with Daniel Pittman's reply, I would just like to add that if you cannot touch the Cicso at all, you probably will need to turn on proxy-arp in the Debian box. BM -- To UNSUBSCRIBE, email to debian-firewall-request@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org