Hello. Is there a way to identify that ipencap packet on external interface did not come from wire but was decapsulated from allowed ESP packet? ... or should I fill PR for that? :=) Regards, Dmitry Andrianov