Output processing ND processing Add a nonce CGA header processing Add a CGA header, if the source address is a CGA address IPsec processing Use the source address to select an SA If found an SA, create a signature and add AH Otherwise send out without AH |