The roadwarriors carol and dave set up a connection each to gateway moon. The authentication is based on X.509 certificates. High priority passthrough rules cause ssh connections to be exempted from both ESP encryption and a general drop rule for moon's external eth0 interface.