I have been looking for information regarding order of operations within a PIX (5.1(2) code) when terminating an IPSEC tunnel and then filtering and natting the untunneled packets. I have to assume that it goes something like this: Tunneled packet enters the outside interface and is unpacked The new packet with its different properties is then handled as mandated by the rule set I have had little luck finding anything on CCO that spells this out in detail and in a linear manner particularly the filtering and natting processes. Any help will be appreciated greatly! Thanks in advance, Nathan Miller _________________________________ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]