This test demonstrates the problem that a machine has trying to be the initiator of two tunnels to two different systems. The combination is that of having an extrusion of some kind (i.e. wavesec) as well as having attempting to do Opportunistic Encryption. The situation looks like: japan west east OE-rw wavesec-gw OE-peer #1 <***wavesec******>------------------------| #2 <*****************************************> There is no problem on wavesec-gw, which has no problem terminating the single extrusion to japan. There is also no problem on OE-peer if west is not OE enabled. (If it is, then this is another instance of co-terminal-01) The problem is on jpan, where the eroute table has to contain: #1 japan/32 0.0.0.0/0 tunnel via OE-gw #2 japan/32 0.0.0.0/0 %trap for OE. The desire is that japan will have just the %trap (#2). When pluto determines that it can do OE, then it should produce an SA like: japan/32 OE-peer/32 tunnel-via-wavesec-gw tunnel-via-OE-peer When pluto determines that it can not do OE, then it should produce an SA like: japan/32 OE-peer/32 tunnel-via-wavesec-gw In this test, we have three nodes involves, plus DNS. The non-OE enabled node is an alias on NIC.