Juniper Networks In various applications of MPLS, label stacks with multiple entries are used. In some cases, it is possible to replace the top label of the stack with an IP-based encapsulation, thereby enabling the application to run over networks which do not have MPLS enabled in their core routers. MPLS-in-IP and MPLS-in-GRE encapsulations have already been specified by the MPLS WG. In some cases, in addition to IP and GRE tunnels, it may be desirable to use IPsec for transporting MPLS packets securely over non-MPLS networks, using standard IPsec authentication and/or encryption functions. This draft describes procedures for encapsulating MPLS packets in IPsec.