I want to buy a pix, my network has many Public IPS that i need to map on the firewall to internal web servers. Does the 501 do this the same as the 515? According to Cisco Press pix book, they didnt mention a difference in the way they handle the transactions. I currently have Checkpoint 4 Device that does Proxy-ARP, someone else told me that to do the same think the nokia device is doing that I would need a 515. Can someone shed some light on how this works? I do not have a router, the ISP just gives use the IPs to the internet. Thanks. P.S. I have also read doing proxy-arp is not so secure, because you can spoof the ARP entry. I am not sure what cisco calls the feature of proxy ARP.