Plenty here will say why use PIX, just use ISA. Only need ISA, only need ISA. Maybe you do only need ISA and maybe you don't. But if you do use a PIX, which we do and maybe plenty of others but they are too afraid to speak up, just set the default gateway of the ISA to your PIX, or your router which has a default gateway of your PIX and away you go. We are using our ISA just for proxy, so we only need the one NICin the ISA server. Then we block all outgoing HTTP/S and FTP on the PIX except for the ISA server. HTH Nathan