Eric Crawley at symbolics explained it all to me. Seems I went from a (bogus) class A address to class B. The change required that the secure subnets attribute be set to a.b.0.0 and a user property defined for the internet network object as INTERNET-SUBNET-MASKS ((" a.b.0.0" "255.255.255.0")) Thanks to the folks at symbolics for a quick response. strip