This is an IKEv2, insist, test using X509 certs on the initiator (road), and on the responder(east). It has two connections, IPv4 and IPv6. IPv4 has leftsubnets and IPv6 has a subnet and rekey timers are short. Though the rekey timers are short, automatic runs don't wait that long. If you want to rekey correctly run the test manually (with patience). NOTE: this test seems to suffer from flow control issues, so reference output not committed. NOTE: timers can be replaced by rekey-ike and rekey-ipsec whack commands NOTE: seems to trigger: dropping unexpected ISAKMP_v2_CREATE_CHILD_SA message containing v2N_TS_UNACCEPTABLE