Hi all, little bit confusing here:

According to 4.1 doc:

Enable Network Access (L3 or L2)
•All options left unchecked (Default setting)— The CAS performs in L2 
mode and expects that all clients are one hop away. The CAS will not be 
able to distinguish if a router is between the CAS and the client and 
will allow the MAC address of router as the machine of the first user 
who logs in and any subsequent users. Checks will not be performed on 
the actual client machines passing through the router as a result, as 
their MAC addresses will not be seen.

Seems users behind a NAT device should work with or without Agent. We 
are running L2 IB VG mode, and it does not work in our test: web logon 
is ok, but Agent won't pop-up at all. Any idea?

-- 
David Wang, Networking Services,CCS
www.uoguelph.ca 519-824-4120 x52046