I notice if there are multiple conn sections with *nearly* identical settings, they will be merged to a single connection with multiple childSAs. Is there a way of configuring this more explicitly in the ipsec.conf or is this just how you do it? Fred