Thanks for the info. It looks like the Cisco 678 filters are like the ipchains rules that Linux has. Presumably you have to decide what you want and set them up yourself or you get no filtering. Is there a good source for pre-canned Cisco 678 filters?