On my nets, I need to be able to telnet/ssh into the border router, from the inside, to futz with it. But is there any reason at all to allow anything, aside from some ICMP, to go beyond the ACL on its Internet facing interface -- to get to the router itself, that is? -- Glenn English ghe@slsware.com