Sorry, missed the very first packet to pass from client to Exchange via ISA which gets an HTTP 401 access denied response as follows: 00000030 48 54 54 50 2F 31 2E 31 20 34 HTTP/1.1.4 00000040 30 31 20 41 63 63 65 73 73 20 44 65 6E 69 65 64 01.Access.Denied 00000050 0D 0A 53 65 72 76 65 72 3A 20 4D 69 63 72 6F 73 ..Server:.Micros 00000060 6F 66 74 2D 49 49 53 2F 35 2E 30 0D 0A 44 61 74 oft-IIS/5.0..Dat 00000070 65 3A 20 4D 6F 6E 2C 20 32 30 20 4D 61 79 20 32 e:.Mon,.20.May.2 00000080 30 30 32 20 30 35 3A 30 36 3A 35 31 20 47 4D 54 002.05:06:51.GMT 00000090 0D 0A 57 57 57 2D 41 75 74 68 65 6E 74 69 63 61 ..WWW-Authentica 000000A0 74 65 3A 20 4E 65 67 6F 74 69 61 74 65 0D 0A 57 te:.Negotiate..W 000000B0 57 57 2D 41 75 74 68 65 6E 74 69 63 61 74 65 3A WW-Authenticate: 000000C0 20 4E 54 4C 4D 0D 0A 57 57 57 2D 41 75 74 68 65 .NTLM..WWW-Authe 000000D0 6E 74 69 63 61 74 65 3A 20 42 61 73 69 63 20 72 nticate:.Basic.r 000000E0 65 61 6C 6D 3D 22 my servers FQDN... 00000110 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A .Content-Length: 00000120 20 32 34 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 .24..Content-Typ 00000130 65 3A 20 74 65 78 74 2F 68 74 6D 6C 0D 0A 0D 0A e:.text/html.... 00000140 45 72 72 6F 72 3A 20 41 63 63 65 73 73 20 69 73 Error:.Access.is 00000150 20 44 65 6E 69 65 64 2E .Denied. This seems to verify what I said earlier that it's asking for either basic or Integrated (NTLM) athentication. This packet then throws up the authentication dialogue box at the client and when correct credentials are entered gives the four packets I described in my earlier posting.