Should have mentioned the first time, this is for the cow-orker to connect with his Linux box to a W2K-based VPN. Since you (and most of the docs I saw) are assuming the same system on both ends of the connection, what other details would I need to know? There seems to be some distinction between whether it's W2K or the Cisco hardware in between that makes the difference.