This scenario tests make-before-break reauthentication using overlapping IKE_SAs by setting the make_before_break strongswan.conf option for clients using an assigned virtual IP. The initiator carol reauthenticates the IKE_SA with host moon using ikelifetime=10s, but does not close the old IKE_SA before the replacement CHILD_SA using the same virtual IP is in place. A constant ping from carol to client alice hiding in the subnet behind moon tests if the CHILD_SA works during the whole procedure.