diff -Naur xl2tpd-1.3.8-orig/file.c xl2tpd-1.3.8/file.c
--- xl2tpd-1.3.8-orig/file.c	2016-08-11 20:56:53.000000000 -0400
+++ xl2tpd-1.3.8/file.c	2016-08-24 11:46:12.046031065 -0400
@@ -42,6 +42,8 @@
 
     gconfig.port = UDP_LISTEN_PORT;
     gconfig.sarefnum = IP_IPSEC_REFINFO; /* default use the latest we know */
+    gconfig.ipsecsaref = 0; /* default off - requires patched KLIPS kernel module */
+    gconfig.forceuserspace = 0; /* default off - allow kernel decap of data packets */
     gconfig.listenaddr = htonl(INADDR_ANY); /* Default is to bind (listen) to all interfaces */
     gconfig.debug_avp = 0;
     gconfig.debug_network = 0;
diff -Naur xl2tpd-1.3.8-orig/network.c xl2tpd-1.3.8/network.c
--- xl2tpd-1.3.8-orig/network.c	2016-08-11 20:56:53.000000000 -0400
+++ xl2tpd-1.3.8/network.c	2016-08-24 11:47:01.683781479 -0400
@@ -80,6 +80,12 @@
      * For L2TP/IPsec with KLIPSng, set the socket to receive IPsec REFINFO
      * values.
      */
+    if (!gconfig.ipsecsaref)
+    {
+        l2tp_log (LOG_INFO, "Not looking for kernel SAref support.\n");
+    }
+    else
+    { 
     arg=1;
     if(setsockopt(server_socket, IPPROTO_IP, gconfig.sarefnum,
 		  &arg, sizeof(arg)) != 0) {
@@ -87,6 +93,7 @@
 
 	    gconfig.ipsecsaref=0;
     }
+    }
 
     arg=1;
     if(setsockopt(server_socket, IPPROTO_IP, IP_PKTINFO, (char*)&arg, sizeof(arg)) != 0) {