Cheers for the clarification Jim! -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Thursday, October 06, 2005 5:35 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: securenat clients http://www.ISAserver.org SecureNAT session is not necessarily the same as SecureNAT clients. Application filter action will create "SecureNAT" mappings because ISA is actually making the connections to the upstream server. The correct math is: SecureNAT client sessions == (Firewall sessions + Web Proxy sessions) - SecureNAT Mappings