The roadwarriors carol and dave set up a connection to gateway moon. The authentication is based on RSA public key signatures (pubkey) using X.509 certificates in the first round followed by extended authentication (xauth) of carol and dave based on user names equal to the IKEv1 identity (carol@strongswan.org and dave@strongswan.org, respectively) and corresponding XAuth user passwords.

Upon the successful establishment of the IPsec tunnel, automatically inserted iptables-based firewall rules let pass the tunneled traffic. In order to test both tunnel and firewall, carol and dave ping the client alice behind the gateway moon.