Hi! I'm trying to setup a configuration mentioned in the subject... Everything works nice with sensing, shunning, alarming, etc... but I have one question. Should I direct the syslog data stream to the sensor or to the policy manager when monitoring ACL violations? -- cU, Laszlo Csosza _________________________________ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]