--- road.console.txt	2019-09-20 17:49:12.354189399 +0000
+++ OUTPUT/road.console.txt	2019-09-21 07:17:29.834738026 +0000
@@ -19,12 +19,8 @@
 1v2 "road"[1] 192.1.2.23 #1: initiate
 1v2 "road"[1] 192.1.2.23 #1: STATE_PARENT_I1: sent v2I1, expected v2R1
 1v2 "road"[1] 192.1.2.23 #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}
-002 "road"[1] 192.1.2.23 #2: certificate verified OK: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA
-002 "road"[1] 192.1.2.23 #2: IKEv2 mode peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
-003 "road"[1] 192.1.2.23 #2: Authenticated using RSA
-002 "road"[1] 192.1.2.23 #2: received INTERNAL_IP4_ADDRESS 192.0.2.101
-002 "road"[1] 192.1.2.23 #2: negotiated connection [192.0.2.101-192.0.2.101:0-65535 0] -> [0.0.0.0-255.255.255.255:0-65535 0]
-004 "road"[1] 192.1.2.23 #2: STATE_V2_IPSEC_I: IPsec SA established tunnel mode {ESP/NAT=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE NATOA=none NATD=192.1.2.23:4500 DPD=passive}
+002 "road"[1] 192.1.2.23 #2: IKE SA authentication request rejected by peer: AUTHENTICATION_FAILED
+000 "road"[1] 192.1.2.23 #2: scheduling retry attempt 1 of an unlimited number, but releasing whack
 road #
  ping -n -I 192.0.2.100 -c 4 192.0.2.254
 bind: Cannot assign requested address
@@ -33,41 +29,20 @@
 done
 road #
  ipsec whack --trafficstatus
-006 #2: "road"[1] 192.1.2.23, type=ESP, add_time=1234567890, inBytes=0, outBytes=0, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org', lease=192.0.2.101/32
 road #
  ../../pluto/bin/ipsec-look.sh | sed "s/dport [0-9][0-9][0-9][0-9][0-9]/dport DPORT/"
 road NOW
 XFRM state:
 src 192.1.2.23 dst 192.1.3.209
 	proto esp spi 0xSPISPI reqid REQID mode tunnel
-	replay-window 32 flag af-unspec
-	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
-	encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
-src 192.1.3.209 dst 192.1.2.23
-	proto esp spi 0xSPISPI reqid REQID mode tunnel
-	replay-window 32 flag af-unspec
-	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
-	encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
+	replay-window 0 
+	sel src 192.1.2.23/32 dst 192.1.3.209/32 
 XFRM policy:
-src 0.0.0.0/0 dst 192.0.2.101/32
-	dir fwd priority 1040383 ptype main
-	tmpl src 192.1.2.23 dst 192.1.3.209
-		proto esp reqid REQID mode tunnel
-src 0.0.0.0/0 dst 192.0.2.101/32
-	dir in priority 1040383 ptype main
-	tmpl src 192.1.2.23 dst 192.1.3.209
-		proto esp reqid REQID mode tunnel
-src 192.0.2.101/32 dst 0.0.0.0/0
-	dir out priority 1040383 ptype main
-	tmpl src 192.1.3.209 dst 192.1.2.23
-		proto esp reqid REQID mode tunnel
 XFRM done
 IPSEC mangle TABLES
 NEW_IPSEC_CONN mangle TABLES
 ROUTING TABLES
-0.0.0.0/1 via 192.1.3.254 dev eth0 src 192.0.2.101
 default via 192.1.3.254 dev eth0
-128.0.0.0/1 via 192.1.3.254 dev eth0 src 192.0.2.101
 192.1.3.0/24 dev eth0 proto kernel scope link src 192.1.3.209
 NSS_CERTIFICATES
 Certificate Nickname                                         Trust Attributes