Tunnel is already established between 3002 and 3015. I have already configured 3015 to provide external NT authentication for users behind hardware client. can users behind hardware client authenticate directly to NT authentication server when they first log in to their windows 2000 workstation; or Do they need to log in to pc locally then use broweser to log into NT authentication server before they can check corporate e-mail, browse , etc.