Possible to configure this?? I have created the packet filters to allow TCP/UDP 123 and all SNAT clients can update with time.windows.com without error. However no non-snat clients can do so. Is the only solution to install the ISA box as an SNTP server and point all internal systems to it? We are still in an NT4 environment.