A method for establishing a secure connection between two network devices, such as a source end host and a destination end host, is disclosed. An initiator peer that sends network traffic on behalf of the source end host sends to a responder peer a first description of network traffic that is to be protected. In response, the initiator peer receives a second description of network traffic that is to be protected from the responder peer. The initiator peer then derives a third description of network traffic that is mutually acceptable to both the initiator peer and the responder peer. The third description of the network traffic is based on the first description of network traffic and the second description of the network traffic. The third description of network traffic is derived by finding the largest common subset of proxies from the first and second descriptions of network traffic.