> Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point You are confirming what

> Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point You are confirming what I said: that it's only easy if you have something to copy and paste off of. It took me hours because I was trying to do something less common, namely peer to peer transport mode between LAN hosts with rules to exclude SSH access and multicasts. That this was a less common config is no excuse for the amount of prodding and debugging I had to do until I figured out what magical set of policies did what I want.