The error in the app log is event ID 14141 This ISA server is sitting on a remote site accross a wan link. It's purpose is cache only. I have 18 of such servers and all are logging this error. I am seeing intermittent stopping of upstream requests and a firewall restart fixes the prob. The only error we see is the one commented on thus investigation. The other thing I am seeing is securNat sessions. I was not expecting to see these (only web proxy) as I am using automatic discovery using DHCP pointing at the WPAD. (Plus some direct settings) I am not reguiring authentication and am not using the firewall client. Any ideas why I see these securenat sessions?