Hi!

If Im correct, when a reqid is specified in an SP, SA with the same id will be chosen for applying it and vica versa. Otherwise, in case of 'use' level in an SP, the kernel will look after a suitable SA. if it can not be found, the pocket wont be processed further.
Am I right?
What if there is more than one suitable SA in the SADB? Which one will be applied?

Also I need to configure almost half a million SAs and SPs, but when the reqid of an SP gets above IPSEC_MANUAL_REQID_MAX(0x3fff), the kernel will drop the value and generate a new one.
It seems this is needed because of IKE daemons, but i wont have such beasts, so may i safely increase this value?
Anybody know why is this ceiling necessary and why is that so low?

thanks,
Zsolt