I know when ISAKMP renegotiates a new key with a remote partner that the documentation says this creates a new SA. Does this new SA have to have a different SPI than the previous one? If so, why? Thanx, CJ CJ Gibson cjgibson@semaphorecom.com Semaphore Communications Corporation Santa Clara, CA