It seems newer kernels (or ip route) display the replay counter in the ip xfrm output: anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000 It seems some test hosts are running older versions that don't do this, so this causes a diff in the output. Some people might want to run a yum update on their VMs ? Paul