The VPN gateway moon controls the access to the hosts alice and
venus by means of two different PKIs. Access to alice is granted
to users presenting a certificate issued by the Levels Root CA (or any of its
intermediate CAs) whereas venus can only be reached with a certificate
issued by the regular strongSwan Root CA.
The roadwarriors carol and dave have certificates from the
Levels CA (actually from an second level intermediate CA) and strongSwan CA,
respectively. Therefore carol can access alice and dave
can reach venus.