In your previous mail you wrote: If a user changes his network attachment and gets new IP address from DHCP, does IPsec support SA endpoint update? => not yet (there is a post-IKEv2 scheduled activity to provide this feature, today you have at least to rekey). Regards Francis.Dupont@enst-bretagne.fr