1. An apparatus for performing network routing, the apparatus comprising: authentication logic configured to receive packets sent from a source agent to an endpoint of a tunnel and to determine whether a security association of a packet received corresponds to said source agent, the tunnel being configured by said source agent in accordance with a network protocol; decision logic configured to make a routing decision for each authenticated packet that is constrained based on the security association of the authenticated packet; and routing logic configured to select a routing destination for each authenticated packet and to route the authenticated packet to the selected routing destination, the routing destination selection being based at least partially on said routing decision.