Dear all, Thank you for the information provided. So validation on dhcp address seems a wrong direction. I will look for other way to prevent routing intranet traffic to outside. ching