This is a test case for the "subnets=" declaration, but with enough of them to trigger potential timing issues. This testcase also uses the alternative syntax of "sub/net, sub/net" instead of {subnet subnet} Pluto doesn't really understand multiple subnets, and IKE can't really negotiate it. However, the following does occur. 1) subnets= generates a set of policies. So, this is a processing time "macro", if you wish. 2) each policy is given an "alias", and if one --up's an alias, then all connections with that alias are brought up (or down).