>|  # setkey -c <<EOF
>|  spdadd tagged "ssh" -P in ipsec esp/transport//use;
>|  spdadd 127.0.0.1 127.0.0.1 -P in ipsec esp/transport//require;
>
>  Why does the second line still specify some classification
>requirements? Wouldn't it be cleaner (and simpler) to _only_
>use tags here, ie.
>
>	spdadd tagged "ssh" -P in ipsec esp/transport//use;
>	spdadd tagged "from-to-localhost" -P in ipsec esp/transport//require;
>
>  with appropriate packet filter lines?

	the above is of course possible.

itojun