Eric Crawley at symbolics explained it all to me. Seems I went from
a (bogus) class A address to class B. The change required that
the secure subnets attribute be set to a.b.0.0 and a user
property defined for the internet network object as
INTERNET-SUBNET-MASKS ((" a.b.0.0" "255.255.255.0"))
Thanks to the folks at symbolics for a quick response.
strip