Norm, Okay, mandatory if using dynamic keying and authentication is selected... I'm certainly not suggesting that anti-replay be decoupled from authentication for ESP. Derrell