I'm testing IOS 12.4(15)T and see that NBAR now works on int tunnel (both GRE and VTI) and with plain IPSec crypto maps on the physical interface. At the same time documentation says that NBAR is not supported in these cases.
Can anybody clarify on this ??? Is the change related to the Zone-based policy firewall ;) ???