On 3/19/2012 4:15 PM, Dave McGuire wrote: Brian, I think the best way to approach it is to just try this: interface Tunnel1 no ip address decnet cost 10 bridge-group 1 Sometimes the simplest approach is best. =) Offhand I don't see why that wouldn't work. We'll find out, but I don't see why it wouldn't. Another possibility might be to to just bridge everything across the tunnel, then use ACLs to filter on EtherType (DECnet Phase IV is 0x6003): We'll have to do some testing, but I don't *think* we should need to do that. I'll check with some cisco guys smarter than me. access-list 200 permit 0x6003 ... interface Tunnel1 no ip address bridge-group 1 input-type-list 200 # or output-type-list?www What about LAT/MOP/etc? I'm assuming we may or may not want to allow those? -brian