I finally got the Nortel client to work behind my linux firewall. For future reference the ip_masq_ipsec module has to be loaded. Not sure why but it works. I wish they'd put that in a faq ... grumble grumble. Matt