I see that too. I think it's that the internal NIC gets noticed by ISA before the VPN replies to the DHCP request. thanks, Amy Babinchak Harbor Computer Services |(248) 850-8616 Tech Blog http://securesmb.harborcomputerservices.net Client Blog http://smalltechnotes.blogspot.com Website http://www.harborcomputerservices.net From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Thomas W Shinder Sent: Friday, May 02, 2008 3:37 PM To: isalist@xxxxxxxxxxxxx Subject: [isalist] Re: IP spoofing and VPN I've seen the same thing. Nothing to worry about. Tom From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Neil Cassidy Sent: Friday, May 02, 2008 9:26 AM To: Neil Cassidy; isalist@xxxxxxxxxxxxx Subject: [isalist] Re: IP spoofing and VPN Sorry, forgot to mention it is 2004. No, we haven't all gone back in time, my ISA is 2004. From: Neil Cassidy Sent: Friday, May 02, 2008 10:23 AM To: isalist@xxxxxxxxxxxxx Subject: IP spoofing and VPN I have a remote VPN client, who keeps showing up as IP spoofing alert in ISA. Is this just because my logging threshold is too low? Is it due to his internal assigned IP not matching his real external IP? Should I be worried? He does keep getting kicked out randomly. Thanks.