This is needed by Mobile IPv6 (there should be at least 3 SA pairs between a Mobile Node and its Home Agent to protect Binding Updates, Return Routability test messages and prefix discovery). Regards Francis.Dupont@enst-bretagne.fr PS: they can't be merged in less than two pairs even using a protect everything policy.