Working from home, I am unable to get to our webserver, which sits
behind BorderManager 3.7 (FP4A, on NW6sp4 with TCP608V) with a static
NAT. I took a trace, which shows the SYN http request going to the
public IP of the webserver, with the SYN,ACK response coming from the
private IP of the webserver and the RST going to the private IP. The
final packet is an ICMP destination unreachable packet coming from the
ISP's router. The problem appears to be with NAT. Is that fair assessment?

Thanks in advance.