>RFC 2401 et al. are quite clear on this point. The triple used for inbound >SA lookups does not include the source address. I agree that source address is not used in inbound SA lookups. I'm talking about outbound and IKE. itojun