On 03/20/2012 10:18 AM, Brian Hechinger wrote: Another possibility might be to to just bridge everything across the tunnel, then use ACLs to filter on EtherType (DECnet Phase IV is 0x6003): We'll have to do some testing, but I don't *think* we should need to do that. I'll check with some cisco guys smarter than me. What'd you find out? I'm ready to start hacking whenever you are. access-list 200 permit 0x6003 ... interface Tunnel1 no ip address bridge-group 1 input-type-list 200 # or output-type-list?www What about LAT/MOP/etc? I'm assuming we may or may not want to allow those? Definitely LAT, but I kinda think not for MOP. I mean, everyone has a copy of PR0801ENG.SYS, right? ;) -Dave -- Dave McGuire, AK4HZ New Kensington, PA