diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index e120f654aac0..15be36014a01 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -563,7 +563,8 @@ ipsec4_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
 }
 
 static struct secpolicy *
-ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
+ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
+    int needport)
 {
 	struct secpolicyindex spidx;
 	struct secpolicy *sp;
@@ -573,7 +574,7 @@ ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
 		/* Make an index to look for a policy. */
 		ipsec4_setspidx_ipaddr(m, &spidx);
 		/* Fill ports in spidx if we have inpcb. */
-		ipsec4_get_ulp(m, &spidx, inp != NULL);
+		ipsec4_get_ulp(m, &spidx, needport);
 		spidx.dir = dir;
 		sp = key_allocsp(&spidx, dir);
 	}
@@ -586,12 +587,13 @@ ipsec4_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
  * Check security policy for *OUTBOUND* IPv4 packet.
  */
 struct secpolicy *
-ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
+ipsec4_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
+    int needport)
 {
 	struct secpolicy *sp;
 
 	*error = 0;
-	sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
+	sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
 	if (sp != NULL)
 		sp = ipsec_checkpolicy(sp, inp, error);
 	if (sp == NULL) {
@@ -623,7 +625,7 @@ ipsec4_in_reject(const struct mbuf *m, struct inpcb *inp)
 	struct secpolicy *sp;
 	int result;
 
-	sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND);
+	sp = ipsec4_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
 	result = ipsec_in_reject(sp, inp, m);
 	key_freesp(&sp);
 	if (result != 0)
@@ -731,7 +733,8 @@ ipsec6_setspidx_ipaddr(const struct mbuf *m, struct secpolicyindex *spidx)
 }
 
 static struct secpolicy *
-ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
+ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir,
+    int needport)
 {
 	struct secpolicyindex spidx;
 	struct secpolicy *sp;
@@ -741,7 +744,7 @@ ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
 		/* Make an index to look for a policy. */
 		ipsec6_setspidx_ipaddr(m, &spidx);
 		/* Fill ports in spidx if we have inpcb. */
-		ipsec6_get_ulp(m, &spidx, inp != NULL);
+		ipsec6_get_ulp(m, &spidx, needport);
 		spidx.dir = dir;
 		sp = key_allocsp(&spidx, dir);
 	}
@@ -754,12 +757,13 @@ ipsec6_getpolicy(const struct mbuf *m, struct inpcb *inp, u_int dir)
  * Check security policy for *OUTBOUND* IPv6 packet.
  */
 struct secpolicy *
-ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error)
+ipsec6_checkpolicy(const struct mbuf *m, struct inpcb *inp, int *error,
+    int needport)
 {
 	struct secpolicy *sp;
 
 	*error = 0;
-	sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND);
+	sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_OUTBOUND, needport);
 	if (sp != NULL)
 		sp = ipsec_checkpolicy(sp, inp, error);
 	if (sp == NULL) {
@@ -791,7 +795,7 @@ ipsec6_in_reject(const struct mbuf *m, struct inpcb *inp)
 	struct secpolicy *sp;
 	int result;
 
-	sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND);
+	sp = ipsec6_getpolicy(m, inp, IPSEC_DIR_INBOUND, 0);
 	result = ipsec_in_reject(sp, inp, m);
 	key_freesp(&sp);
 	if (result)
diff --git a/sys/netipsec/ipsec.h b/sys/netipsec/ipsec.h
index 429e1c49114e..cbd9f7fbadc8 100644
--- a/sys/netipsec/ipsec.h
+++ b/sys/netipsec/ipsec.h
@@ -320,7 +320,7 @@ int ipsec_if_input(struct mbuf *, struct secasvar *, uint32_t);
 struct ipsecrequest *ipsec_newisr(void);
 void ipsec_delisr(struct ipsecrequest *);
 struct secpolicy *ipsec4_checkpolicy(const struct mbuf *, struct inpcb *,
-    int *);
+    int *, int);
 
 u_int ipsec_get_reqlevel(struct secpolicy *, u_int);
 
diff --git a/sys/netipsec/ipsec6.h b/sys/netipsec/ipsec6.h
index a5fae4d13378..33aa30f3ff88 100644
--- a/sys/netipsec/ipsec6.h
+++ b/sys/netipsec/ipsec6.h
@@ -60,7 +60,7 @@ VNET_DECLARE(int, ip6_ipsec_ecn);
 
 struct inpcb;
 struct secpolicy *ipsec6_checkpolicy(const struct mbuf *,
-    struct inpcb *, int *);
+    struct inpcb *, int *, int);
 
 void ipsec6_setsockaddrs(const struct mbuf *, union sockaddr_union *,
     union sockaddr_union *);
diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
index e36a70a433d5..e64b52e17102 100644
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -297,7 +297,7 @@ ipsec4_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
 	int error;
 
 	/* Lookup for the corresponding outbound security policy */
-	sp = ipsec4_checkpolicy(m, inp, &error);
+	sp = ipsec4_checkpolicy(m, inp, &error, !forwarding);
 	if (sp == NULL) {
 		if (error == -EINVAL) {
 			/* Discarded by policy. */
@@ -599,7 +599,7 @@ ipsec6_common_output(struct mbuf *m, struct inpcb *inp, int forwarding)
 	int error;
 
 	/* Lookup for the corresponding outbound security policy */
-	sp = ipsec6_checkpolicy(m, inp, &error);
+	sp = ipsec6_checkpolicy(m, inp, &error, !forwarding);
 	if (sp == NULL) {
 		if (error == -EINVAL) {
 			/* Discarded by policy. */