Rich, The IPsec architecture does not envision processing by intermediate nodes in the fashion you allude to. Only end systems and security gateways perform IPsec processing, and they are arranged in pairs to bracket SAs. Steve