Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german):
Tunneling, an essential element of IPsec [...], is problematic for existing firewalls and security gateways on the border to the company LAN. It's impossible to control traffic with an IPsec-tunnel, which has to be defined end-to-end, on the firwall. To solve the problem there has to be defined end-to-security-gateway SAs instead of end-to-end SAs. Therefor exists no standard at the moment.[...]
My question: Any idea what she does mean? I can't see a problem to establish a tunnel from endpoint to security gateway. Or does she mean, that it is a problem, because the traffic wouldn't be encypted in the LAN (from security gateway to endpoint)?