hi, I recall , in the past, seeing a resource either in email or on the web that used a method of NAS-Identifier to stop a Handler sending authentications back to a realm from whence they ame - ie avoid authentication loops. can anyone prod my memory or even verride that resource with their best practice? many thanks alan