/testing/guestbin/swan-prep
east #
 cp policies/* /etc/ipsec.d/policies/
east #
 echo "192.1.3.0/24"  >> /etc/ipsec.d/policies/private-or-clear
east #
 ipsec start
Redirecting to: [initsystem]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec auto --add authenticated
"authenticated": added IKEv2 connection
east #
 # give OE policies time to load
east #
 ../../guestbin/wait-for.sh --match 'loaded 11,' -- ipsec auto --status
Total IPsec connections: loaded 11, active 0
east #
 echo "initdone"
initdone
east #
 # only east should show 1 tunnel
east #
 ipsec whack --trafficstatus
#2: "authenticated"[1] 192.1.3.209, type=ESP, add_time=1234567890, inBytes=84, outBytes=84, maxBytes=2^63B, id='@road'
east #
 # east shows the authnull is matched on preferred non-null connection,
east #
 # then cannot find a (non-authnull) match and rejects it. So an
east #
 # additional 'authenticated' partial state lingers
east #
 ipsec showstates
#1: "authenticated"[1] 192.1.3.209:500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in XXs; REPLACE in XXs; newest; idle;
#2: "authenticated"[1] 192.1.3.209:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
#2: "authenticated"[1] 192.1.3.209 esp.ESPSPIi@192.1.3.209 esp.ESPSPIi@192.1.2.23 tun.0@192.1.3.209 tun.0@192.1.2.23 Traffic: ESPin=84B ESPout=84B ESPmax=2^63B 
east #
 
