By the way, does anybody know if SRX/Netscreen route-based VPNs use any sort of transport encapsulation like GRE or IPIP? Or is it just plain tunnel with 0.0.0.0/0 encryption domain and policy-based routing? thanks Nick