Eep! Or rather, eap! It's bad to have eap conflicting with ipsp, though I can probably live with that; it's very bad to have it conflict with saag. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)