On 04/24/2012 08:25 AM, Muenz, Michael wrote: > I had l2tp-X.509-NAT with "rightsubnet=vhost:%priv,%no" and > l2tp-X.509-noNAT with "rightsubnet=vhost:%no,%priv". > > Shouldn't this work out? vhost:%priv,%no and vhost:%no,%priv are the same. I don't think the order matters.