[ddarby1]

Hi again,

I had a quick go on what I presume is a similar configuration: it worked using the 'nat 0' command on the PIX for both the Management/Log Server and the Enforcement Module (causing the PIX to perform like a router).

Other than that, an access-list was required to let tcp/257 through from the enforcement module to the Smart Center (the E/Module was on the PIX's outside interface and the Smart Center server on the inside).

The final thing would be to make sure routing is setup properly on all 3 parties, but it sounds like you had that configured properly anyway.

Does this reflect your config at all?

S/W used: PIX OS 6.3(5), Check Point NGX