I know this has been answered in the past - but without the How-To's to really accomplish it. I am runnng a NT4 network with ISA on the edge and the ISA is on its own workgroup. I need to connect to the internal network - but how. Everyone keeps saying VPN is the answer, but how. How does one VPN to the ISA, and then VPN from ISA to VPN Server internally. I have external salesman that require access to the Internal network, and a sister company in England (also running ISA) to connect to internal network - but HOW. Tom, I have bought your book :) - but it doesnt help me in this case. It did great for everything else, but not here. Has anyone in the world actually VPN'd into the ISA server, then somehow jumped onto the internal network - (remembering the recommendation that ISA server not be part of the internal domain). I can not have the internal network trust the ISA authenications - so VPN is apparently the answer - but HOW. Please dont answer this with quick - well create a VPN and assume I know what you are talking about - because I DONT :) Somebody please give me the road map to this quest and I make the journey - but I need the map. Any help from the ISA Experts - would of be of great help. Thanks in advance Paul