A method for a data network comprising: storing a data structure in a first data processing apparatus, wherein the first data processing apparatus and a plurality of second data processing apparatuses are connected to a data network, wherein the data structure accommodates a plurality of entries, wherein each entry comprises a plurality of selectors and an IPsec specification of a logical tunnel (64, 65) between the first data processing apparatus and the second data processing apparatuses, and wherein a selector specifies values for certain header fields of a datagram, processing each outgoing datagram by the first data processing apparatus, comprising: searching the data structure for an entry whose selectors match the datagram, for deciding whether the datagram is sent over one of the logical tunnels (64, 65), and if so, over which one, afterwards deciding to which second data processing apparatus in the data network the datagram is sent, sending a reachability information to the first data processing apparatus by a second data processing apparatus which is an endpoint of a logical tunnel (64, 65), wherein said reachability information comprises at least the following elements: a network destination address, a gateway, and an indication whether the network destination address is newly reachable or no longer reachable via the gateway, incorporating the reachability information into the data structure by the first data processing apparatus. storing a data structure in a first data processing apparatus, wherein the first data processing apparatus and a plurality of second data processing apparatuses are connected to a data network, wherein the data structure accommodates a plurality of entries, wherein each entry comprises a plurality of selectors and an IPsec specification of a logical tunnel (64, 65) between the first data processing apparatus and the second data processing apparatuses, and wherein a selector specifies values for certain header fields of a datagram, wherein the first data processing apparatus and a plurality of second data processing apparatuses are connected to a data network, wherein the data structure accommodates a plurality of entries, wherein each entry comprises a plurality of selectors and an IPsec specification of a logical tunnel (64, 65) between the first data processing apparatus and the second data processing apparatuses, and wherein a selector specifies values for certain header fields of a datagram, processing each outgoing datagram by the first data processing apparatus, comprising: searching the data structure for an entry whose selectors match the datagram, for deciding whether the datagram is sent over one of the logical tunnels (64, 65), and if so, over which one, afterwards deciding to which second data processing apparatus in the data network the datagram is sent, searching the data structure for an entry whose selectors match the datagram, for deciding whether the datagram is sent over one of the logical tunnels (64, 65), and if so, over which one, afterwards deciding to which second data processing apparatus in the data network the datagram is sent, sending a reachability information to the first data processing apparatus by a second data processing apparatus which is an endpoint of a logical tunnel (64, 65), wherein said reachability information comprises at least the following elements: a network destination address, a gateway, and an indication whether the network destination address is newly reachable or no longer reachable via the gateway, to the first data processing apparatus by a second data processing apparatus which is an endpoint of a logical tunnel (64, 65), wherein said reachability information comprises at least the following elements: a network destination address, a gateway, and an indication whether the network destination address is newly reachable or no longer reachable via the gateway, incorporating the reachability information into the data structure by the first data processing apparatus.