I'm trying to restrict the traffic selector to GRE/BGP: rightsubnet=%dynamic[gre/bgp] auto=route But GRE-encapsulated BGP traffic doesn't go through. However, if I change the TS to: rightsubnet=%dynamic[gre] auto=route BGP (and other GRE-encapsulated traffic) does go through. Am I missing something? Tiago