> I have also expressed the concern to do similar provisioning for > esp= param as well. Can the check be extended for PROTO_ESP too ? There is no PRF involved in ESP SAs, nor is a dedicated PRF used in CHILD_SA establishment. Hence I see no reason what we could configure there. Regards Martin