>How do you determine if X is within the site or outside? NAT-PT device usually reside at the site border, so you can configure what's inside (like 10.0.0.0/8) and what's not. itojun