Instead we use the actual IP protocol identifier (the conversion now happens in child_sa_t and kernel_handler_t).