Hi, I read to use NAT clients behind firewalls to use nat=yes and qualify=xxx to keep a nat connection open. I am using sip clients behind a firewall that is symmetric and my * box on public internet. Are these the only two options that I need in my configuration? Isnt the qualify command actually the amount of time it waits when it sends out the "keepalive" packet to the client before determining that its unreachable. How often does * send this "keepalive" packet? Is it configurable? Does anyone have this working with clients behind symmetric firewalls? If i turn off qualify, I am able to make calls to the sip client, but after 60 secs of inactivity calls made to the client time out, due to firewall closing nat connection. I dont understand why i can dial to the phone, but the "keepalive" fails right away. any ideas what would cause this? ----------------------- Harold Workman CCNA, CCNP Cytel Communications hworkman@cytelcom.com Ph. 281-449-4000 x3098