This may be hard to explain but I'll do my best. Also, this may be a crazy idea. But heres my situation and design. We have a fiber line coming in from our service provider's router, which connects directly to our catalyst 4503 on vlan 2. We do not have our own router. From the catalyst I have a pix 501 hanging off vlan 2 and then going to a content filter and back to the switch on vlan 1. Well we have some video conference units and I dont want them passing thru the content filter. Would it cause any problems to have another pix hanging off with access to vlan 2 and giving the video conf units that ip as the gateway? All nodes would have the 10. private ip and the vid units would have a 1 to 1 static nat in the latter pix. Is this a good design for the vid units to by pass the content filter? Would this cause routing loops or should I go with a separate vlan? The only security concern I have is that if someone finds out, they could use the latter pix as the gateway and bypass the content filter. Any tips or suggestions are welcomed. Or if more info is needed let me know. Thanks.