My guess is that the reason you are having trouble, JDV, is that the router only knows about two networks: 10.0.0.0/8 (private network), and 0.0.0.0/0 (everything else).

You've taken the 10.0.0.0/8 supernet and subnetted into into smaller networks. But, the router doesn't know about those subnets. It only knows about the supernet.

Machines on the outside can reach the hosts on the inside because those hosts, even though you put them on their own subnets, are still a member of the 10.0.0.0/8 supernet. So, the router takes the external request and forwards it to the internal network, where it is received by the appropriate host.

Machines on the inside that are on the same subnet can find each other because they use Address Resolution Protocol rather than going through the router. They send out a broadcast on their own subnet looking for the destination host. The host replies with a "Here-I-Am!" message, and they can see each other.

Machines on the inside that are on different subnets cannot see each other because they are trying to go through the router. But, the router doesn't know how to distinguish between all of the different subnets you have created. As far as the router is concerned, it only knows about the 10.0.0.0/8 supernet. The only sensible way to route traffic to 10.0.0.0/8 is from the WAN interface to the LAN interface, not from the LAN interface to itself.

Actually, that isn't QUITE the circumstance. We have a set of IPs from our ISP which our main Cisco router handles; then there is a LinkSys (I think) router that creates the private network and provides connection to the main router. Your explanation may still be accurate, however, I'm going to have to think about it.

But here is an oddity. When I create a port using the configuration utility, ifconfig uses a broadcast IP identical to the actual IP; however, the original IP on en0 has a broadcast of xxx.yyy.zzz.255. Now, I can CREATE that using IFCONFIG and change that broadcast IP, but only if I first delete the port and create it manually. When I do THAT, believe it or not, it disappears from the outside world. So, I have to re-create the port....which changes the broadcast IP. I'm missing something here.

Nonetheless, I've decided to make the point moot. I'm still curious about the issue, but this machine has a second ethernet card in it connected to the internal network. I created site with the IP of 10.0.0.xxx which links to exactly the same site, and I am simply adding the 10.0.0.xxx address with the desired canonical name to the hosts file on the individual machines in our building. Thus, everyone can see it...just not in quite the same way.

The is is an inelegant solution, but it seems to work satisfactorily in this particular case. I do have a feeling that broadcast IP is implicated in this failure, because the internal machines see the first en0 IP with the .255 broadcast IP without problems, but not the second and third IPs on that card, but the OUTSIDE world sees them without complaining.

I've killed a lot more brain cells on this than it was worth. I knew I could go the other route from the beginning...it just seemed like the wrong thing to need to do.

Joe VanZandt