Tero Kivinen wrote: > The other one will then start sending those packets using that SA just > negotiated. The ip address must be from the range that is covered by > the quick mode selectors. Tero, Interesting idea. Question: how do you send ICMP heartbeats on IPSec SAs that are restricted to TCP-only or UDP-only protocols?