If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, it will
If the destination IP address in the outer IP header of ESP does not match the IP address of the ingress interface, it will
If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based packet.
If the destination address of the outer IP header of the ESP packet matches the IP address of the ingress interface, based of inner header, it will decrypt the packet.