diff --git a/src/vnet/ipsec/ipsec_output.c b/src/vnet/ipsec/ipsec_output.c
index a255376..83ab629 100644
--- a/src/vnet/ipsec/ipsec_output.c
+++ b/src/vnet/ipsec/ipsec_output.c
@@ -82,16 +82,16 @@
     if (PREDICT_FALSE (p->protocol && (p->protocol != pr)))
       continue;
 
-    if (ra < clib_net_to_host_u32 (p->raddr.start.ip4.as_u32))
+    if (ra < p->raddr.start.ip4.as_u32)
       continue;
 
-    if (ra > clib_net_to_host_u32 (p->raddr.stop.ip4.as_u32))
+    if (ra > p->raddr.stop.ip4.as_u32)
       continue;
 
-    if (la < clib_net_to_host_u32 (p->laddr.start.ip4.as_u32))
+    if (la < p->laddr.start.ip4.as_u32)
       continue;
 
-    if (la > clib_net_to_host_u32 (p->laddr.stop.ip4.as_u32))
+    if (la > p->laddr.stop.ip4.as_u32)
       continue;
 
     if (PREDICT_FALSE
@@ -239,10 +239,8 @@
 	  p0 = ipsec6_output_policy_match (spd0,
 					   &ip6_0->src_address,
 					   &ip6_0->dst_address,
-					   clib_net_to_host_u16
-					   (udp0->src_port),
-					   clib_net_to_host_u16
-					   (udp0->dst_port), ip6_0->protocol);
+					   udp0->src_port,
+					   udp0->dst_port, ip6_0->protocol);
 	}
       else
 	{
@@ -258,14 +256,9 @@
 #endif
 
 	  p0 = ipsec_output_policy_match (spd0, ip0->protocol,
-					  clib_net_to_host_u32
-					  (ip0->src_address.as_u32),
-					  clib_net_to_host_u32
-					  (ip0->dst_address.as_u32),
-					  clib_net_to_host_u16
-					  (udp0->src_port),
-					  clib_net_to_host_u16
-					  (udp0->dst_port));
+					  ip0->src_address.as_u32,
+					  ip0->dst_address.as_u32,
+					  udp0->src_port, udp0->dst_port);
 	}
       tcp0 = (void *) udp0;