The negotiation of a phase 2 Security Association results in the dynamic creation of new filters used to map the Security Association to a specific type of traffic. These dynamic filters are then added to the filter table and remain as long as the Security Association is available for use. Additional structures are added to the filter table when the remote security endpoint is behind a NAT.