/testing/guestbin/swan-prep --nokey
Initializing NSS database
east #
 ../../guestbin/ifconfig.sh eth0 add 192.0.20.254/24
    inet 192.0.20.254/24 scope global eth0
east #
 ipsec start
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec whack --impair suppress_retransmits
east #
 ipsec add a
"a": added oriented IKEv2 connection
east #
 ipsec add b
"b": added oriented IKEv2 connection
east #
 ipsec whack --impair ignore_viable_parent
east #
 ipsec whack --impair revival # stop B comming back
east #
 ipsec up b
IMPAIR: "b": ignoring viable IKE SA "a" #1
"b" #3: initiating IKEv2 connection to 192.1.2.45 using UDP
"b" #3: sent IKE_SA_INIT request to 192.1.2.45:UDP/500
"b" #3: processed IKE_SA_INIT response from 192.1.2.45:UDP/500 {cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 ke=DH19}, initiating IKE_AUTH
"b" #3: sent IKE_AUTH request to 192.1.2.45:UDP/500 with shared-key-mac and FQDN '@east'; Child SA #4 {ESP <0xESPESP} [192.0.20.0/24===192.0.3.254/32]
"b" #3: processing IKE_AUTH response from 192.1.2.45:UDP/500 containing SK{IDr,AUTH,SA,TSi,TSr}
"b" #3: initiator established IKE SA; authenticated peer using authby=secret and FQDN '@west'
"b" #4: initiator established Child SA using #3; IPsec tunnel [192.0.20.0/24===192.0.3.254/32] {ESP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256 DPD=passive}
east #
 # non-zero counts confirm encrypted traffic flowing
east #
 ipsec trafficstatus
east #
 # do things line up?
east #
 ipsec _kernel state
east #
 ipsec _kernel policy
src 192.0.20.0/24 dst 192.0.3.254/32
	dir out priority PRIORITY ptype main
	tmpl src 0.0.0.0 dst 0.0.0.0
		proto esp reqid REQID mode transport
east #
