The roadwarriors carol and dave restart a connection each to gateway moon. The authentication is based on X.509 certificates. Both carol and dave request a virtual IP via the IKEv2 configuration payload. The gateway moon reassigns the static and reserved virtual IP addresses from a pool named bigpool predefined in the SQL database.

Upon the successful establishment of the IPsec tunnels, automatically inserted iptables-based firewall rules let pass the tunneled traffic. In order to test both tunnel and firewall, both carol and dave ping the client alice behind the gateway moon.