I got a report from either NetScout or eHealth that shows over 10% of our bandwidth usage is from IPsec traffic. The only IPsec configuration I am aware of is between two site DS3 routers for a GRE tunnel. In an Enterprise environment, is there IPsec traffic that I am unaware of? One theory from the boss is that when a client authenticates the domain controller talk is in an IPsec tunnel. I did a couple of "show crypto IPsec" commands in our Core router and it shows nothing exists including the sa. We have a 5510 for VPN clients with 2 licenses. Wouldn't that use IPsec also? I am so confused.