+static u8 *
+ipsec_tun_protect_adj_delegate_format (const adj_delegate_t * aed, u8 * s)
+{
+ const ipsec_tun_protect_t *itp;
+
+ itp = ipsec_tun_protect_from_const_base (aed);
+ s = format (s, "ipsec-tun-protect:\n%U", format_ipsec_tun_protect, itp);
+
+ return (s);
+}
+
+static void
+ipsec_tun_teib_entry_added (const teib_entry_t * ne)
+{
+ ipsec_tun_protect_t *itp;
+ index_t itpi;
+
+ itpi = ipsec_tun_protect_find (teib_entry_get_sw_if_index (ne),
+ teib_entry_get_peer (ne));
+
+ if (INDEX_INVALID == itpi)
+ return;
+
+ itp = ipsec_tun_protect_get (itpi);
+ ipsec_tun_protect_rx_db_remove (&ipsec_main, itp);
+ ipsec_tun_protect_update_from_teib (itp, ne);
+ ipsec_tun_protect_set_crypto_addr (itp);
+ ipsec_tun_protect_rx_db_add (&ipsec_main, itp);
+
+ ITP_DBG (itp, "teib-added");
+}
+
+static void
+ipsec_tun_teib_entry_deleted (const teib_entry_t * ne)
+{
+ ipsec_tun_protect_t *itp;
+ index_t itpi;
+
+ itpi = ipsec_tun_protect_find (teib_entry_get_sw_if_index (ne),
+ teib_entry_get_peer (ne));
+
+ if (INDEX_INVALID == itpi)
+ return;
+
+ itp = ipsec_tun_protect_get (itpi);
+ ipsec_tun_protect_rx_db_remove (&ipsec_main, itp);
+ ipsec_tun_protect_update_from_teib (itp, NULL);
+ ipsec_tun_protect_set_crypto_addr (itp);
+
+ ITP_DBG (itp, "teib-removed");
+}
+
+/**
+ * VFT registered with the adjacency delegate
+ */
+const static adj_delegate_vft_t ipsec_tun_adj_delegate_vft = {
+ .adv_adj_deleted = ipsec_tun_protect_adj_delegate_adj_deleted,
+ .adv_adj_created = ipsec_tun_protect_adj_delegate_adj_created,
+ .adv_adj_modified = ipsec_tun_protect_adj_delegate_adj_modified,
+ .adv_format = ipsec_tun_protect_adj_delegate_format,
+};
+
+const static teib_vft_t ipsec_tun_teib_vft = {
+ .nv_added = ipsec_tun_teib_entry_added,
+ .nv_deleted = ipsec_tun_teib_entry_deleted,
+};
+
+static void
+ipsec_tun_table_init (ip_address_family_t af, uword table_size, u32 n_buckets)
+{
+ ipsec_main_t *im;
+
+ im = &ipsec_main;
+
+ if (AF_IP4 == af)
+ clib_bihash_init_8_16 (&im->tun4_protect_by_key,
+ "IPSec IPv4 tunnels", n_buckets, table_size);
+ else
+ clib_bihash_init_24_16 (&im->tun6_protect_by_key,
+ "IPSec IPv6 tunnels", n_buckets, table_size);
+}
+
+static clib_error_t *
+ipsec_tunnel_protect_init (vlib_main_t *vm)