Major new upstream release, just ran svn-upgrade for now (and wrote some

debian/changelong entries).

1161 files changed, 9013 insertions, 945 deletions

diff --git a/testing/INSTALL b/testing/INSTALL
index 7f2fb70cd..e11b7302e 100644
--- a/testing/INSTALL
+++ b/testing/INSTALL
@@ -53,7 +53,7 @@ are required for the strongSwan testing environment:
     * A vanilla Linux kernel on which the UML kernel will be based on.
       We recommend the use of
 
-      http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.1.tar.bz2
+      http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.3.tar.bz2
 
     * Starting with Linux kernel 2.6.9 no patch must be applied any more in order
       to make the vanilla kernel UML-capable. For older kernels you'll find
@@ -71,7 +71,7 @@ are required for the strongSwan testing environment:
 
     * The latest strongSwan distribution
 
-      http://download.strongswan.org/strongswan-2.8.3.tar.gz
+      http://download.strongswan.org/strongswan-4.1.0.tar.gz
 
 
 3. Creating the environment
@@ -146,5 +146,5 @@ README document.
 
 -----------------------------------------------------------------------------
 
-This file is RCSID $Id: INSTALL,v 1.46 2007/02/21 22:17:52 as Exp $
+This file is RCSID $Id: INSTALL,v 1.39 2006/04/24 16:58:03 as Exp $
 
diff --git a/testing/do-tests b/testing/do-tests
index 6119d37d4..fd11a6324 100755
--- a/testing/do-tests
+++ b/testing/do-tests
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: do-tests,v 1.21 2006/10/19 21:12:43 as Exp $
+# RCSID $Id: do-tests,v 1.20 2006/02/08 21:27:59 as Exp $
 
 DIR=`dirname $0`
 
@@ -45,6 +45,7 @@ TESTDATE=`date +%Y%m%d-%H%M`
 TODAYDIR=$TESTRESULTSDIR/$TESTDATE
 mkdir $TODAYDIR
 TESTRESULTSHTML=$TODAYDIR/index.html
+ALLHTML=$TODAYDIR/all.html
 DEFAULTTESTSDIR=$UMLTESTDIR/testing/tests
 
 testnumber="0"
@@ -58,9 +59,6 @@ passed_cnt="0"
 
 TESTSDIR=$BUILDDIR/tests
 [ -d $TESTSDIR ] || mkdir $TESTSDIR
-rm -rf $TESTSDIR/*
-cp -rfp $DEFAULTTESTSDIR/* $TESTSDIR
-
 
 ##############################################################################
 # assign IP for each host to hostname
@@ -68,44 +66,38 @@ cp -rfp $DEFAULTTESTSDIR/* $TESTSDIR
 
 for host in $STRONGSWANHOSTS
 do
-    eval ip_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
+    eval ipv4_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
+    eval ipv6_${host}="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
 
     case $host in
     moon)
-        eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
-        searchandreplace PH_IP_MOON $ip_moon $TESTSDIR
-        searchandreplace PH_IP1_MOON $ip1_moon $TESTSDIR
+        eval ipv4_moon1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
+        eval ipv6_moon1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
         ;;
     sun)
-        eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
-        searchandreplace PH_IP_SUN $ip_sun $TESTSDIR
-        searchandreplace PH_IP1_SUN $ip1_sun $TESTSDIR
+        eval ipv4_sun1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
+        eval ipv6_sun1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
         ;;
     alice)
-        searchandreplace PH_IP_ALICE $ip_alice $TESTSDIR
         ;;
     venus)
-        searchandreplace PH_IP_VENUS $ip_venus $TESTSDIR
         ;;
     bob)
-        searchandreplace PH_IP_BOB $ip_bob $TESTSDIR
         ;;
     carol)
-        eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
-        searchandreplace PH_IP_CAROL $ip_carol $TESTSDIR
-        searchandreplace PH_IP1_CAROL $ip1_carol $TESTSDIR
-        ;;
+        eval ipv4_carol1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
+        eval ipv6_carol1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
+         ;;
     dave)
-        eval ip1_${host}="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
-        searchandreplace PH_IP_DAVE $ip_dave $TESTSDIR
-        searchandreplace PH_IP1_DAVE $ip1_dave $TESTSDIR
+        eval ipv4_dave1="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
+        eval ipv6_dave1="`echo $HOSTNAMEIPV6 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $2 }' | awk '{ print $1 }'`"
         ;;
     winnetou)
-        searchandreplace PH_IP_WINNETOU $ip_winnetou $TESTSDIR
         ;;
     esac
 done
 
+
 ##############################################################################
 # create header for the results html file
 #
@@ -131,6 +123,21 @@ cat > $TESTRESULTSHTML <<@EOF
     <thead align="left"><th>Number</th><th>Test</th><th>Result</th></thead>
 @EOF
 
+cat > $ALLHTML <<@EOF
+<html>
+<head>
+  <title>strongSwan UML Testing</title>
+</head>
+<body>
+  <h2>strongSwan UML Testing</h2>
+  <table border="0" cellspacing="2">
+    <tr><td><b>Host:</b></td><td>`uname -a`</td></tr>
+    <tr><td><b>UML kernel: &nbsp;</b></td><td>$KERNEL_VERSION</td></tr>
+    <tr><td><b>IPsec:</b></td><td>$IPSEC_VERSION</td></tr>
+    <tr><td><b>Date:</b></td><td>$TESTDATE</td></tr>
+    <tr><td colspan="2">&nbsp;</td></tr>
+@EOF
+
 cecho "UML kernel: $KERNEL_VERSION"
 cecho "IPsec:      $IPSEC_VERSION"
 cecho "Date:       $TESTDATE"
@@ -150,143 +157,217 @@ then
     TESTS=$SELECTEDTESTS
 else
     # set internal field seperator
-    TESTS="`ls $TESTSDIR`"
+    TESTS="`ls $DEFAULTTESTSDIR`"
 fi
 
-for testname in $TESTS
+for SUBDIR in $TESTS
 do
-    let "testnumber += 1"
-    cecho-n " $testnumber $testname.."
-    
-    if [ ! -d $TESTSDIR/${testname} ]
+    SUBTESTS="`basename $SUBDIR`"
+
+    if [ $SUBTESTS = $SUBDIR ]
     then
-	cecho "is missing..skipped"
-	continue
+	SUBTESTS="`ls $DEFAULTTESTSDIR/$SUBDIR`"
+    else
+	SUBDIR="`dirname $SUBDIR`"
     fi
 
-    [ -f $TESTSDIR/${testname}/description.txt ] || die "!! File 'description.txt' is missing"
-    [ -f $TESTSDIR/${testname}/test.conf ]       || die "!! File 'test.conf' is missing"
-    [ -f $TESTSDIR/${testname}/pretest.dat ]     || die "!! File 'pretest.dat' is missing"
-    [ -f $TESTSDIR/${testname}/posttest.dat ]    || die "!! File 'posttest.dat' is missing"
-    [ -f $TESTSDIR/${testname}/evaltest.dat ]    || die "!! File 'evaltest.dat' is missing"
+    if [ ! -d $TODAYDIR/$SUBDIR ]
+    then
+	mkdir $TODAYDIR/$SUBDIR
+	echo "<tr><td>&nbsp;</td><td><a href=\"$SUBDIR\">$SUBDIR</a></td>" >> $ALLHTML
+    fi
 
-    TESTRESULTDIR=$TODAYDIR/$testname
-    mkdir $TESTRESULTDIR
-    CONSOLE_LOG=$TESTRESULTDIR/console.log
-    touch $CONSOLE_LOG
+    for name in $SUBTESTS
+    do
+	let "testnumber += 1"
+	testname=$SUBDIR/$name
+	cecho-n " $testnumber $testname.."
+
+	if [ ! -d $DEFAULTTESTSDIR/${testname} ]
+	then
+	    cecho "is missing..skipped"
+	    continue
+	fi
 
+	[ -f $DEFAULTTESTSDIR/${testname}/description.txt ] || die "!! File 'description.txt' is missing"
+	[ -f $DEFAULTTESTSDIR/${testname}/test.conf ]       || die "!! File 'test.conf' is missing"
+	[ -f $DEFAULTTESTSDIR/${testname}/pretest.dat ]     || die "!! File 'pretest.dat' is missing"
+	[ -f $DEFAULTTESTSDIR/${testname}/posttest.dat ]    || die "!! File 'posttest.dat' is missing"
+	[ -f $DEFAULTTESTSDIR/${testname}/evaltest.dat ]    || die "!! File 'evaltest.dat' is missing"
 
-    ##########################################################################
-    # copy test specific configurations to uml hosts and clear auth.log files
-    #
+	TESTRESULTDIR=$TODAYDIR/$testname
+	mkdir -p $TESTRESULTDIR
+	CONSOLE_LOG=$TESTRESULTDIR/console.log
+	touch $CONSOLE_LOG
 
-    $DIR/scripts/load-testconfig $testname
-    source $TESTSDIR/$testname/test.conf
+	TESTDIR=$TESTSDIR/${testname}
+	rm -rf $TESTDIR
+	mkdir -p $TESTDIR
+	cp -rfp $DEFAULTTESTSDIR/${testname}/* $TESTDIR
 
-    
-    ##########################################################################
-    # run tcpdump in the background
-    #
 
-    if [ "$TCPDUMPHOSTS" != "" ]
-    then
-        echo -e "TCPDUMP\n" >> $CONSOLE_LOG 2>&1
-
-        for host_iface in $TCPDUMPHOSTS
-        do
-	    host=`echo $host_iface | awk -F ":" '{print $1}'`
-	    iface=`echo $host_iface | awk -F ":" '{if ($2 != "") { print $2 } else { printf("eth0") }}'`
-	    tcpdump_cmd="tcpdump -i $iface not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &"
-            echo "${host}# $tcpdump_cmd" >> $CONSOLE_LOG
-            ssh root@`eval echo \\\$ip_$host '$tcpdump_cmd'`
-	    eval TDUP_${host}="true"
-        done
-    fi
+	##############################################################################
+	# replace IP wildcards with actual IPv4 and IPv6 addresses
+	#
 
-    ##########################################################################
-    # execute pre-test commands
-    #
+	for host in $STRONGSWANHOSTS
+	do
+	    case $host in
+	    moon)
+		searchandreplace PH_IP_MOON1     $ipv4_moon1 $TESTDIR
+		searchandreplace PH_IP_MOON      $ipv4_moon  $TESTDIR
+		searchandreplace PH_IP6_MOON1    $ipv6_moon1 $TESTDIR
+		searchandreplace PH_IP6_MOON     $ipv6_moon  $TESTDIR
+		;;
+	    sun)
+		searchandreplace PH_IP_SUN1      $ipv4_sun1 $TESTDIR
+		searchandreplace PH_IP_SUN       $ipv4_sun  $TESTDIR
+		searchandreplace PH_IP6_SUN1     $ipv6_sun1 $TESTDIR
+		searchandreplace PH_IP6_SUN      $ipv6_sun  $TESTDIR
+		;;
+	    alice)
+		searchandreplace PH_IP_ALICE     $ipv4_alice $TESTDIR
+		searchandreplace PH_IP6_ALICE    $ipv6_alice $TESTDIR
+		;;
+	    venus)
+		searchandreplace PH_IP_VENUS     $ipv4_venus $TESTDIR
+		searchandreplace PH_IP6_VENUS    $ipv6_venus $TESTDIR
+		;;
+	    bob)
+		searchandreplace PH_IP_BOB       $ipv4_bob $TESTDIR
+		searchandreplace PH_IPV6_BOB     $ipv6_bob $TESTDIR
+		;;
+	    carol)
+		searchandreplace PH_IP_CAROL1    $ipv4_carol1 $TESTDIR
+		searchandreplace PH_IP_CAROL     $ipv4_carol  $TESTDIR
+		searchandreplace PH_IP6_CAROL1   $ipv6_carol1 $TESTDIR
+		searchandreplace PH_IP6_CAROL    $ipv6_carol  $TESTDIR
+		;;
+	    dave)
+		searchandreplace PH_IP_DAVE1     $ipv4_dave1 $TESTDIR
+		searchandreplace PH_IP_DAVE      $ipv4_dave  $TESTDIR
+		searchandreplace PH_IP6_DAVE1    $ipv6_dave1 $TESTDIR
+		searchandreplace PH_IP6_DAVE     $ipv6_dave  $TESTDIR
+		;;
+	    winnetou)
+		searchandreplace PH_IP_WINNETOU  $ipv4_winnetou $TESTDIR
+		searchandreplace PH_IP6_WINNETOU $ipv6_winnetou $TESTDIR
+		;;
+	    esac
+	done
 
-    cecho-n "pre.."
-    echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1
 
-    eval `awk -F "::" '{
-	if ($2 != "")
-	{
-	    printf("echo \"%s# %s\"; ", $1, $2)
-	    printf("ssh root@\044ip_%s \"%s\"; ", $1, $2)
-	    printf("echo;\n")
-	}
-    }' $TESTSDIR/${testname}/pretest.dat` >> $CONSOLE_LOG 2>&1
+	##########################################################################
+	# copy test specific configurations to uml hosts and clear auth.log files
+	#
 
+	$DIR/scripts/load-testconfig $testname
+	source $TESTDIR/test.conf
 
-    ##########################################################################
-    # stop tcpdump
-    #
 
-    function stop_tcpdump {
-        echo "${1}# killall tcpdump" >> $CONSOLE_LOG
-        eval ssh root@\$ip_${1} killall tcpdump
-        eval TDUP_${1}="false"
-	echo ""
-    }
+	##########################################################################
+	# run tcpdump in the background
+	#
 
+	if [ "$TCPDUMPHOSTS" != "" ]
+	then
+	    echo -e "TCPDUMP\n" >> $CONSOLE_LOG 2>&1
+
+	    for host_iface in $TCPDUMPHOSTS
+	    do
+		host=`echo $host_iface | awk -F ":" '{print $1}'`
+		iface=`echo $host_iface | awk -F ":" '{if ($2 != "") { print $2 } else { printf("eth0") }}'`
+		tcpdump_cmd="tcpdump -i $iface not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &"
+		echo "${host}# $tcpdump_cmd" >> $CONSOLE_LOG
+		ssh root@`eval echo \\\$ipv4_$host '$tcpdump_cmd'`
+		eval TDUP_${host}="true"
+	    done
+	fi
 
-    ##########################################################################
-    # get and evaluate test results
-    #
 
-    cecho-n "test.."
-    echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1
+	##########################################################################
+	# execute pre-test commands
+	#
 
-    STATUS="passed"
+	cecho-n "pre.."
+	echo -e "\nPRE-TEST\n" >> $CONSOLE_LOG 2>&1
 
-    eval `awk -F "::" '{
-	host=$1
-	command=$2
-	pattern=$3
-	hit=$4
-	if (command != "")
-	{
-	    if (command == "tcpdump")
-	    {
-		printf("if [ \044TDUP_%s == \"true\" ]; then stop_tcpdump %s; fi; \n", host, host)
-		printf("echo \"%s# cat /tmp/tcpdump.log | grep \047%s\047  [%s]\"; ", host, pattern, hit)
-		printf("ssh root@\044ip_%s cat /tmp/tcpdump.log | grep \"%s\"; ", host, pattern)
-	    }
-	    else
+	eval `awk -F "::" '{
+	    if ($2 != "")
 	    {
-		printf("echo \"%s# %s | grep \047%s\047  [%s]\"; ", host, command, pattern, hit)
-		printf("ssh root@\044ip_%s %s | grep \"%s\"; ",  host, command, pattern)
+		printf("echo \"%s# %s\"; ", $1, $2)
+		printf("ssh root@\044ipv4_%s \"%s\"; ", $1, $2)
+		printf("echo;\n")
 	    }
-	    printf("cmd_exit=\044?; ")
-	    printf("echo; ")
-	    printf("if [ \044cmd_exit -eq 0 -a \"%s\" = \"NO\"  ] ", hit)
-	    printf("|| [ \044cmd_exit -ne 0 -a \"%s\" = \"YES\" ] ", hit)
-	    printf("; then STATUS=\"failed\"; fi; \n")
+	}' $TESTDIR/pretest.dat` >> $CONSOLE_LOG 2>&1
+
+
+	##########################################################################
+	# stop tcpdump
+	#
 
+	function stop_tcpdump {
+	    echo "${1}# killall tcpdump" >> $CONSOLE_LOG
+	    eval ssh root@\$ipv4_${1} killall tcpdump
+	    eval TDUP_${1}="false"
+	    echo ""
 	}
-    }' $TESTSDIR/${testname}/evaltest.dat` >> $CONSOLE_LOG 2>&1
 
 
-    ##########################################################################
-    # set counters
-    #
+	##########################################################################
+	# get and evaluate test results
+	#
 
-    if [ $STATUS = "failed" ]
-    then
-        let "failed_cnt += 1"
-    else
-        let "passed_cnt += 1"
-    fi
+	cecho-n "test.."
+	echo -e "\nTEST\n" >> $CONSOLE_LOG 2>&1
 
+	STATUS="passed"
+
+	eval `awk -F "::" '{
+	    host=$1
+	    command=$2
+	    pattern=$3
+	    hit=$4
+	    if (command != "")
+	    {
+		if (command == "tcpdump")
+		{
+		    printf("if [ \044TDUP_%s == \"true\" ]; then stop_tcpdump %s; fi; \n", host, host)
+		    printf("echo \"%s# cat /tmp/tcpdump.log | grep \047%s\047  [%s]\"; ", host, pattern, hit)
+		    printf("ssh root@\044ipv4_%s cat /tmp/tcpdump.log | grep \"%s\"; ", host, pattern)
+		}
+		else
+		{
+		    printf("echo \"%s# %s | grep \047%s\047  [%s]\"; ", host, command, pattern, hit)
+		    printf("ssh root@\044ipv4_%s %s | grep \"%s\"; ",  host, command, pattern)
+		}
+		printf("cmd_exit=\044?; ")
+		printf("echo; ")
+		printf("if [ \044cmd_exit -eq 0 -a \"%s\" = \"NO\"  ] ", hit)
+		printf("|| [ \044cmd_exit -ne 0 -a \"%s\" = \"YES\" ] ", hit)
+		printf("; then STATUS=\"failed\"; fi; \n")
+	    }
+	}' $TESTDIR/evaltest.dat` >> $CONSOLE_LOG 2>&1
+
+
+	##########################################################################
+	# set counters
+	#
+
+	if [ $STATUS = "failed" ]
+	then
+	    let "failed_cnt += 1"
+	else
+	    let "passed_cnt += 1"
+	fi
 
-    ##########################################################################
-    # log statusall and listall output
-    # get copies of ipsec.conf, ipsec.secrets
-    # create index.html for the given test case
 
-    cat > $TESTRESULTDIR/index.html <<@EOF
+	##########################################################################
+	# log statusall and listall output
+	# get copies of ipsec.conf, ipsec.secrets
+	# create index.html for the given test case
+
+	cat > $TESTRESULTDIR/index.html <<@EOF
 <html>
 <head>
   <title>Test $testname</title>
@@ -298,46 +379,62 @@ do
     <h3>Description</h3>
 @EOF
 
-    cat $TESTSDIR/${testname}/description.txt >> $TESTRESULTDIR/index.html
+	cat $TESTDIR/description.txt >> $TESTRESULTDIR/index.html
 
-    cat >> $TESTRESULTDIR/index.html <<@EOF
+	cat >> $TESTRESULTDIR/index.html <<@EOF
     <ul>
       <li><a href="console.log">console.log</a></li>
     </ul>
-    <img src="../images/$DIAGRAM" alt="$UMLHOSTS">
+    <img src="../../images/$DIAGRAM" alt="$UMLHOSTS">
 @EOF
 
-
-    for host in $IPSECHOSTS
-    do
-	eval HOSTLOGIN=root@\$ip_${host}
-
-	for command in statusall listall
-	do
-	    ssh $HOSTLOGIN ipsec $command \
-		> $TESTRESULTDIR/${host}.$command 2>/dev/null
-	done
-
-	for file in ipsec.conf ipsec.secrets
+	for host in $IPSECHOSTS
 	do
-	    scp $HOSTLOGIN:/etc/$file \
-		$TESTRESULTDIR/${host}.$file  > /dev/null 2>&1
-	done
-
-	cat >> $TESTRESULTDIR/index.html <<@EOF
+	    eval HOSTLOGIN=root@\$ipv4_${host}
+
+	    for command in statusall listall
+	    do
+		ssh $HOSTLOGIN ipsec $command \
+		    > $TESTRESULTDIR/${host}.$command 2>/dev/null
+	    done
+
+	    for file in ipsec.conf ipsec.secrets
+	    do
+		scp $HOSTLOGIN:/etc/$file \
+		    $TESTRESULTDIR/${host}.$file  > /dev/null 2>&1
+	    done
+
+	    ssh $HOSTLOGIN ip route list \
+		    > $TESTRESULTDIR/${host}.iproute 2>/dev/null
+	    ssh $HOSTLOGIN iptables -v -n -L \
+		    > $TESTRESULTDIR/${host}.iptables 2>/dev/null
+	    cat >> $TESTRESULTDIR/index.html <<@EOF
     <h3>$host</h3>
-    <ul>
-      <li><a href="$host.ipsec.conf">ipsec.conf</a></li>
-      <li><a href="$host.ipsec.secrets">ipsec.secrets</a></li>
-      <li><a href="$host.statusall">ipsec statusall</a></li>
-      <li><a href="$host.listall">ipsec listall</a></li>
-      <li><a href="$host.auth.log">auth.log</a></li>
-    </ul>
+      <table border="0" cellspacing="0" width="400">
+      <tr>
+	<td>
+	  <ul>
+	    <li><a href="$host.ipsec.conf">ipsec.conf</a></li>
+	    <li><a href="$host.ipsec.secrets">ipsec.secrets</a></li>
+	    <li><a href="$host.statusall">ipsec statusall</a></li>
+	    <li><a href="$host.listall">ipsec listall</a></li>
+	  </ul>
+	</td>
+	<td>
+	  <ul>
+	    <li><a href="$host.auth.log">auth.log</a></li>
+	    <li><a href="$host.daemon.log">daemon.log</a></li>
+	    <li><a href="$host.iproute">ip route list</a></li>
+	    <li><a href="$host.iptables">iptables -L</a></li>
+	</ul>
+      </td>
+    </tr>
+    </table>
 @EOF
 
-    done
+	done
 
-    cat >> $TESTRESULTDIR/index.html <<@EOF
+	cat >> $TESTRESULTDIR/index.html <<@EOF
   </td></tr>
   <tr><td align="right">
     <b><a href="../index.html">Back</a></b>
@@ -348,70 +445,88 @@ do
 @EOF
 
 
-    ##########################################################################
-    # execute post-test commands
-    #
+	##########################################################################
+	# execute post-test commands
+	#
 
-    cecho-n "post.."
-    echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1
+	cecho-n "post.."
+	echo -e "\nPOST-TEST\n" >> $CONSOLE_LOG 2>&1
 
-    eval `awk -F "::" '{
-	if ($2 != "")
-	{
-	    printf("echo \"%s# %s\"; ", $1, $2)
-	    printf("ssh root@\044ip_%s \"%s\"; ", $1, $2)
-	    printf("echo;\n")
-	}
-    }' $TESTSDIR/${testname}/posttest.dat` >> $CONSOLE_LOG 2>&1
+	eval `awk -F "::" '{
+	    if ($2 != "")
+	    {
+		printf("echo \"%s# %s\"; ", $1, $2)
+		printf("ssh root@\044ipv4_%s \"%s\"; ", $1, $2)
+		printf("echo;\n")
+	    }
+	}' $TESTDIR/posttest.dat` >> $CONSOLE_LOG 2>&1
 
 
-    ##########################################################################
-    # get a copy of /var/log/auth.log
-    #
+	##########################################################################
+	# get a copy of /var/log/auth.log
+	#
 
-    for host in $IPSECHOSTS
-    do
-	eval HOSTLOGIN=root@\$ip_${host}
-	ssh $HOSTLOGIN grep pluto /var/log/auth.log \
-	    > $TESTRESULTDIR/${host}.auth.log
-    done
+	for host in $IPSECHOSTS
+	do
+	    eval HOSTLOGIN=root@\$ipv4_${host}
+	    ssh $HOSTLOGIN grep pluto /var/log/auth.log \
+		> $TESTRESULTDIR/${host}.auth.log
+	    echo >> $TESTRESULTDIR/${host}.auth.log
+	    ssh $HOSTLOGIN grep charon /var/log/auth.log \
+		>> $TESTRESULTDIR/${host}.auth.log
+	done
 
 
-    ##########################################################################
-    # stop tcpdump if necessary
-    #
+	##########################################################################
+	# get a copy of /var/log/daemon.log
+	#
 
-    for host in $TCPDUMPHOSTS
-    do
-	if [ "`eval echo \\\$TDUP_${host}`" = "true" ]
-	then
-	    echo "${host}# killall tcpdump" >> $CONSOLE_LOG
-	    eval ssh root@\$ip_$host killall tcpdump
-	    eval TDUP_${host}="false"
-	fi
-    done
+	for host in $IPSECHOSTS
+	do
+	    eval HOSTLOGIN=root@\$ipv4_${host}
+	    ssh $HOSTLOGIN grep pluto /var/log/daemon.log \
+		> $TESTRESULTDIR/${host}.daemon.log
+	    echo >> $TESTRESULTDIR/${host}.daemon.log
+	    ssh $HOSTLOGIN grep charon /var/log/daemon.log \
+		>> $TESTRESULTDIR/${host}.daemon.log
+	done
 
 
-    ##########################################################################
-    # copy default host config back if necessary
-    #
+	##########################################################################
+	# stop tcpdump if necessary
+	#
 
-    $DIR/scripts/restore-defaults $testname
+	for host in $TCPDUMPHOSTS
+	do
+	    if [ "`eval echo \\\$TDUP_${host}`" = "true" ]
+	    then
+		echo "${host}# killall tcpdump" >> $CONSOLE_LOG
+		eval ssh root@\$ipv4_$host killall tcpdump
+		eval TDUP_${host}="false"
+	    fi
+	done
 
 
-    ##########################################################################
-    # write test status to html file
-    #
+	##########################################################################
+	# copy default host config back if necessary
+	#
 
-    cecho "$STATUS"
-    if [ $STATUS = "passed" ]
-    then
-        COLOR="green"
-    else
-        COLOR="red"
-    fi
+	$DIR/scripts/restore-defaults $testname
 
-    cat >> $TESTRESULTSHTML << @EOF
+
+	##########################################################################
+	# write test status to html file
+	#
+
+	cecho "$STATUS"
+	if [ $STATUS = "passed" ]
+	then
+	    COLOR="green"
+	else
+	    COLOR="red"
+	fi
+
+	cat >> $TESTRESULTSHTML << @EOF
   <tr>
     <td>$testnumber</td>
     <td><a href="$testname/">$testname</a></td>
@@ -419,6 +534,7 @@ do
   </tr>
 @EOF
 
+    done
 done
 
 
@@ -436,6 +552,12 @@ cat >> $TESTRESULTSHTML << @EOF
 </html>
 @EOF
 
+cat >> $ALLHTML << @EOF
+  </table>
+</body>
+</html>
+@EOF
+
 cecho ""
 cecho "Passed:   $passed_cnt"
 cecho "Failed:   $failed_cnt"
@@ -449,10 +571,10 @@ cecho ""
 HTDOCS="/var/www/localhost/htdocs"
 
 cecho-n "Copying test results to winnetou.."
-ssh root@${ip_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1
-scp -r $TODAYDIR root@${ip_winnetou}:$HTDOCS/testresults > /dev/null 2>&1
-ssh root@${ip_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1
+ssh root@${ipv4_winnetou} mkdir -p $HTDOCS/testresults > /dev/null 2>&1
+scp -r $TODAYDIR root@${ipv4_winnetou}:$HTDOCS/testresults > /dev/null 2>&1
+ssh root@${ipv4_winnetou} ln -s $HTDOCS/images $HTDOCS/testresults/$TESTDATE/images > /dev/null 2>&1
 cecho "done"
 cecho ""
 cecho "The results are available in $TODAYDIR"
-cecho "or via the link http://$ip_winnetou/testresults/$TESTDATE"
+cecho "or via the link http://$ipv4_winnetou/testresults/$TESTDATE"
diff --git a/testing/hosts/alice/etc/ipsec.conf b/testing/hosts/alice/etc/ipsec.conf
index 4e525d929..312cadb8f 100755
--- a/testing/hosts/alice/etc/ipsec.conf
+++ b/testing/hosts/alice/etc/ipsec.conf
@@ -5,6 +5,7 @@ config setup
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/bob/etc/ipsec.conf b/testing/hosts/bob/etc/ipsec.conf
index 9040fc25d..0172c043b 100755
--- a/testing/hosts/bob/etc/ipsec.conf
+++ b/testing/hosts/bob/etc/ipsec.conf
@@ -5,6 +5,7 @@ config setup
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/carol/etc/ipsec.conf b/testing/hosts/carol/etc/ipsec.conf
index 43deae00f..6f1097e9e 100755
--- a/testing/hosts/carol/etc/ipsec.conf
+++ b/testing/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/dave/etc/ipsec.conf b/testing/hosts/dave/etc/ipsec.conf
index 5fc5eef46..16e5299ce 100755
--- a/testing/hosts/dave/etc/ipsec.conf
+++ b/testing/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/moon/etc/ipsec.conf b/testing/hosts/moon/etc/ipsec.conf
index c7d7dc2ed..b26f81911 100755
--- a/testing/hosts/moon/etc/ipsec.conf
+++ b/testing/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/moon/etc/ipsec.secrets b/testing/hosts/moon/etc/ipsec.secrets
index c90b4c4a3..e86d6aa5c 100644
--- a/testing/hosts/moon/etc/ipsec.secrets
+++ b/testing/hosts/moon/etc/ipsec.secrets
@@ -1,7 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
 : RSA moonKey.pem
-
-
-
-
diff --git a/testing/hosts/sun/etc/ipsec.conf b/testing/hosts/sun/etc/ipsec.conf
index 1106ded6f..77d3fb183 100755
--- a/testing/hosts/sun/etc/ipsec.conf
+++ b/testing/hosts/sun/etc/ipsec.conf
@@ -5,6 +5,7 @@ config setup
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/venus/etc/ipsec.conf b/testing/hosts/venus/etc/ipsec.conf
index 8e4e47459..524640cda 100755
--- a/testing/hosts/venus/etc/ipsec.conf
+++ b/testing/hosts/venus/etc/ipsec.conf
@@ -5,6 +5,7 @@ config setup
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/hosts/winnetou/etc/apache2/httpd.conf b/testing/hosts/winnetou/etc/apache2/httpd.conf
new file mode 100644
index 000000000..41c74453a
--- /dev/null
+++ b/testing/hosts/winnetou/etc/apache2/httpd.conf
@@ -0,0 +1,1103 @@
+#
+#  This is a modification of the default Apache 2 configuration
+#  file by Gentoo Linux.  .... [insert more]
+#  
+#  Support:
+#     http://www.gentoo.org/main/en/lists.xml    [mailing lists]
+#     http://forums.gentoo.org/                  [web forums]
+#
+#  Bug Reports:
+#     http://bugs.gentoo.org/      [gentoo related bugs]
+#     http://bugs.apache.org/      [apache httpd related bugs]
+
+#
+#
+#
+# Based upon the NCSA server configuration files originally by Rob McCool.
+#
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://httpd.apache.org/docs/2.0/> for detailed information about
+# the directives.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# The configuration directives are grouped into three basic sections:
+#  1. Directives that control the operation of the Apache server process as a
+#     whole (the 'global environment').
+#  2. Directives that define the parameters of the 'main' or 'default' server,
+#     which responds to requests that aren't handled by a virtual host.
+#     These directives also provide default values for the settings
+#     of all virtual hosts.
+#  3. Settings for virtual hosts, which allow Web requests to be sent to
+#     different IP addresses or hostnames and have them handled by the
+#     same Apache server process.
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "logs/foo.log"
+# with ServerRoot set to "/usr/lib/apache2" will be interpreted by the
+# server as "/usr/lib/apache2/logs/foo.log".
+#
+
+### Section 1: Global Environment
+#
+# The directives in this section affect the overall operation of Apache,
+# such as the number of concurrent requests it can handle or where it
+# can find its configuration files.
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the LockFile documentation (available
+# at <URL:http://httpd.apache.org/docs/2.0/mod/mpm_common.html#lockfile>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+ServerRoot "/usr/lib/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+#LockFile "/var/run/apache2.lock"
+
+#
+# ScoreBoardFile: File used to store internal server process information.
+# If unspecified (the default), the scoreboard will be stored in an
+# anonymous shared memory segment, and will be unavailable to third-party
+# applications.
+# If specified, ensure that no two invocations of Apache share the same
+# scoreboard file. The scoreboard file MUST BE STORED ON A LOCAL DISK.
+#
+<IfModule !perchild.c>
+    #ScoreBoardFile /var/run/apache2_runtime_status
+</IfModule>
+
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+#
+PidFile "/var/run/apache2.pid"
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 15
+
+##
+## Server-Pool Size Regulation (MPM specific)
+## 
+
+# prefork MPM [DEFAULT IF USE=-threads]
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxClients: maximum number of server processes allowed to start
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule prefork.c>
+    StartServers         5
+    MinSpareServers      5
+    MaxSpareServers     10
+    MaxClients         150
+    MaxRequestsPerChild  0
+</IfModule>
+
+# worker MPM [DEFAULT IF USE=threads]
+# StartServers: initial number of server processes to start
+# MaxClients: maximum number of simultaneous client connections
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule worker.c>
+    StartServers         2
+    MaxClients         150
+    MinSpareThreads     25
+    MaxSpareThreads     75 
+    ThreadsPerChild     25
+    MaxRequestsPerChild  0
+</IfModule>
+
+# perchild MPM [THIS MPM IS NOT SUPPORTED]
+# NumServers: constant number of server processes
+# StartThreads: initial number of worker threads in each server process
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# MaxThreadsPerChild: maximum number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of connections per server process
+<IfModule perchild.c>
+    NumServers           5
+    StartThreads         5
+    MinSpareThreads      5
+    MaxSpareThreads     10
+    MaxThreadsPerChild  20
+    MaxRequestsPerChild  0
+</IfModule>
+
+# peruser MPM [THIS MPM IS NOT SUPPORTED]
+# MinSpareServers - Minimum number of idle children, to handle request spikes 
+# MaxClients - Maximum number of children alive at the same time 
+# MaxProcessors - Maximum number of processors per vhost
+# Multiplexer - Specify an Multiplexer Child configuration.
+# Processor - Specify a User and Group for a specific child process.
+# ServerEnvironment - Specify the server environment for this virtual host.
+<IfModule peruser.c>
+    ServerLimit          256
+    MaxClients           256
+    MinSpareProcessors     2
+    MaxProcessors         10
+    MaxRequestsPerChild 1000
+    
+    # kill off idle processors after this many seconds
+    # set to 0 to disable
+    ExpireTimeout       1800
+    
+    Multiplexer nobody nobody
+    
+    Processor apache apache
+    
+    # chroot dir is optional:
+    # Processor user group /path/to/chroot
+</IfModule>
+
+# itk MPM [THIS MPM IS NOT SUPPORTED]
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxClients: maximum number of server processes allowed to start
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule itk.c>
+    StartServers           5
+    MinSpareServers        2
+    MaxSpareServers       10
+    MaxClients           150
+    MaxRequestsPerChild 1000
+</IfModule>
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
+#
+#Listen 12.34.56.78:80
+Listen 80
+Listen 8880
+Listen 8881
+Listen 8882
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Statically compiled modules (those listed by `httpd -l') do not need
+# to be loaded here.
+#
+# The following modules are considered as the default configuration.
+# If you wish to disable one of them, you may have to alter other 
+# configuration directives.
+#
+# You should always leave these three, as they are needed for normal use.
+# mod_access (Order, Allow, etc..)
+# mod_log_config (Transferlog, etc..)
+# mod_mime (AddType, etc...)
+#
+# Example:
+# LoadModule foo_module modules/mod_foo.so
+
+
+# Authentication Modules
+#
+# These modules provide authentication and authorization for
+# clients. They should not normally be disabled.
+#
+LoadModule access_module                 modules/mod_access.so
+LoadModule auth_module                   modules/mod_auth.so
+LoadModule auth_anon_module              modules/mod_auth_anon.so
+LoadModule auth_dbm_module               modules/mod_auth_dbm.so
+LoadModule auth_digest_module            modules/mod_auth_digest.so
+
+#
+# Metadata Modules
+# 
+# These modules provide extra data to clients about
+# a file, such as the mime-type or charset.
+#
+LoadModule charset_lite_module           modules/mod_charset_lite.so
+LoadModule env_module                    modules/mod_env.so
+LoadModule expires_module                modules/mod_expires.so
+LoadModule headers_module                modules/mod_headers.so
+LoadModule mime_module                   modules/mod_mime.so
+LoadModule negotiation_module            modules/mod_negotiation.so
+LoadModule setenvif_module               modules/mod_setenvif.so
+
+#
+# Logging Modules
+# 
+# These modules provide logging services for Apache
+#
+LoadModule log_config_module             modules/mod_log_config.so
+LoadModule logio_module                  modules/mod_logio.so
+
+
+#
+# CGI Modules
+#
+# These modules provide the ability to execute CGI Scripts.
+#
+LoadModule cgi_module                    modules/mod_cgi.so
+LoadModule cgid_module                   modules/mod_cgid.so
+
+
+#
+# This `suexec` module provides the ability to exeucte CGI scripts under
+# a different user than apache is run.
+#
+LoadModule suexec_module                 modules/mod_suexec.so
+
+
+#
+# Mappers
+#
+# These Modules provide URL mappings or translations.
+LoadModule alias_module                  modules/mod_alias.so
+LoadModule rewrite_module                modules/mod_rewrite.so
+<IfDefine USERDIR>
+    LoadModule userdir_module            modules/mod_userdir.so
+</IfDefine>
+
+
+#
+# Handlers
+#
+# These modules create content for a client.
+#
+<IfDefine INFO>
+    LoadModule info_module               modules/mod_info.so
+    LoadModule status_module             modules/mod_status.so
+</IfDefine>
+LoadModule actions_module                modules/mod_actions.so
+LoadModule autoindex_module              modules/mod_autoindex.so
+LoadModule dir_module                    modules/mod_dir.so
+
+#
+# Filters
+#
+# These modules provide filters for Apache.
+# They preform common tasks like gzip encoding or SSI
+#
+#
+LoadModule ext_filter_module             modules/mod_ext_filter.so
+LoadModule deflate_module                modules/mod_deflate.so
+LoadModule include_module                modules/mod_include.so
+
+
+#
+# Cache Modules
+#
+# The following modules are used for storing a cache of
+# generated or proxied content.
+#
+#LoadModule cache_module                  modules/mod_cache.so
+#LoadModule disk_cache_module             modules/mod_disk_cache.so
+#LoadModule mem_cache_module              modules/mod_mem_cache.so
+#LoadModule file_cache_module             modules/mod_file_cache.so
+
+#
+# Proxy Modules
+# 
+# The following modules are only needed if you are running
+# Apache as a Forward or Reverse Proxy.
+# 
+# WARNING: Enabling these modules can be dangerous! 
+#   READ THE DOCUMENTATION FIRST:
+#   http://httpd.apache.org/docs/2.0/mod/mod_proxy.html
+<IfDefine PROXY>
+    LoadModule proxy_module                  modules/mod_proxy.so
+    LoadModule proxy_connect_module          modules/mod_proxy_connect.so
+    LoadModule proxy_ftp_module              modules/mod_proxy_ftp.so
+    LoadModule proxy_http_module             modules/mod_proxy_http.so
+</IfDefine>
+
+#
+# Uncommon Modules
+#
+# The following Modules are not commonly loaded for Apache
+#
+#LoadModule case_filter_module            modules/mod_case_filter.so
+#LoadModule case_filter_in_module         modules/mod_case_filter_in.so
+#LoadModule echo_module                   modules/mod_echo.so
+#LoadModule mime_magic_module             modules/mod_mime_magic.so
+#LoadModule speling_module                modules/mod_speling.so
+#LoadModule unique_id_module              modules/mod_unique_id.so
+#LoadModule vhost_alias_module            modules/mod_vhost_alias.so
+
+#
+# Obsolete Modules
+# 
+# The Following modules are not commonly needed and use 
+# obsolete technologies.
+#
+#LoadModule cern_meta_module              modules/mod_cern_meta.so
+#LoadModule imap_module                   modules/mod_imap.so
+#LoadModule usertrack_module              modules/mod_usertrack.so
+#LoadModule asis_module                   modules/mod_asis.so
+
+
+#
+# Extra Modules
+#
+# We Include extra .conf files from /etc/apache2/modules.d
+# This is used to load things like PHP and mod_ssl.
+#
+Include /etc/apache2/modules.d/*.conf
+
+### Section 2: 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+#  . On SCO (ODT 3) use "User nouser" and "Group nogroup".
+#  . On HPUX you may not be able to use shared memory as nobody, and the
+#    suggested workaround is to create a user www and use that user.
+#  NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET)
+#  when the value of (unsigned)Group is above 60000; 
+#  don't use Group #-1 on these systems!
+#
+User apache
+Group apache
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+#
+ServerAdmin root@localhost
+
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If this is not set to valid DNS name for your host, server-generated
+# redirections will not work.  See also the UseCanonicalName directive.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+# You will have to access it by its address anyway, and this will make 
+# redirections work in a sensible way.
+#
+#ServerName localhost
+
+#
+# UseCanonicalName: Determines how Apache constructs self-referencing 
+# URLs and the SERVER_NAME and SERVER_PORT variables.
+# When set "Off", Apache will use the Hostname and Port supplied
+# by the client.  When set "On", Apache will use the value of the
+# ServerName directive.
+#
+UseCanonicalName Off
+
+
+#
+# Each directory to which Apache has access can be configured with respect
+# to which services and features are allowed and/or disabled in that
+# directory (and its subdirectories). 
+#
+# First, we configure the "default" to be a very restrictive set of 
+# features.  
+#
+<Directory />
+    Options FollowSymLinks
+    AllowOverride None
+</Directory>
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# UserDir: The name of the directory that is appended onto a user's home
+# directory if a ~user request is received.
+# enable by adding -D USERDIR to /etc/conf.d/apache2
+#
+<IfModule mod_userdir.c>
+    UserDir public_html
+
+#
+# Control access to UserDir directories.  The following is an example
+# for a site where these directories are restricted to read-only.
+#
+    <Directory /home/*/public_html>
+        AllowOverride FileInfo AuthConfig Limit Indexes
+        Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+        <Limit GET POST OPTIONS PROPFIND>
+            Order allow,deny
+            Allow from all
+       </Limit>
+       <LimitExcept GET POST OPTIONS PROPFIND>
+            Order deny,allow
+            Deny from all
+       </LimitExcept>
+    </Directory>
+
+
+# Enable this additional section if you would like to make use of a
+# suexec-enabled cgi-bin directory on a per-user basis.
+#
+#<Directory /home/*/public_html/cgi-bin>
+#    Options ExecCGI
+#    SetHandler cgi-script
+#</Directory>
+
+</IfModule>
+
+
+#
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+# The index.html.var file (a type-map) is used to deliver content-
+# negotiated documents.  The MultiViews Option can be used for the 
+# same purpose, but it is much slower.
+#
+DirectoryIndex index.html ocsp.cgi
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride 
+# directive.
+#
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<FilesMatch "^\.ht">
+    Order allow,deny
+    Deny from all
+</FilesMatch>
+
+#
+# TypesConfig describes where the mime.types file (or equivalent) is
+# to be found.
+#
+TypesConfig /etc/mime.types
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+DefaultType text/plain
+
+#
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+#
+<IfModule mod_mime_magic.c>
+    MIMEMagicFile /etc/apache2/magic
+</IfModule>
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+#
+# EnableMMAP: Control whether memory-mapping is used to deliver
+# files (assuming that the underlying OS supports it).
+# The default is on; turn this off if you serve from NFS-mounted 
+# filesystems.  On some systems, turning it off (regardless of
+# filesystem) can improve performance; for details, please see
+# http://httpd.apache.org/docs/2.0/mod/core.html#enablemmap
+#
+#EnableMMAP off
+
+#
+# EnableSendfile: Control whether the sendfile kernel support is 
+# used  to deliver files (assuming that the OS supports it).
+# The default is on; turn this off if you serve from NFS-mounted 
+# filesystems.  Please see
+# http://httpd.apache.org/docs/2.0/mod/core.html#enablesendfile
+#
+#EnableSendfile off
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog logs/error_log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+#
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %b" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+LogFormat "%v %h %l %u %t \"%r\" %>s %b %T" script
+LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" VLOG=%{VLOG}e" vhost
+
+# You need to enable mod_logio.c to use %I and %O
+#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+
+#
+# The location and format of the access logfile (Common Logfile Format).
+# If you do not define any access logfiles within a <VirtualHost>
+# container, they will be logged here.  Contrariwise, if you *do*
+# define per-<VirtualHost> access logfiles, transactions will be
+# logged therein and *not* in this file.
+#
+CustomLog logs/access_log common
+
+#
+# If you would like to have agent and referer logfiles, uncomment the
+# following directives.
+#
+#CustomLog logs/referer_log referer
+#CustomLog logs/agent_log agent
+
+#
+# If you prefer a single logfile with access, agent, and referer information
+# (Combined Logfile Format) you can use the following directive.
+#
+#CustomLog logs/access_log combined
+
+#
+# ServerTokens
+# This directive configures what you return as the Server HTTP response
+# Header. The default is 'Full' which sends information about the OS-Type
+# and compiled in modules.
+# Set to one of:  Full | OS | Minor | Minimal | Major | Prod
+# where Full conveys the most information, and Prod the least.
+#
+ServerTokens Prod
+
+#
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (internal error documents, FTP directory 
+# listings, mod_status and mod_info output etc., but not CGI generated 
+# documents or custom error documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+#
+ServerSignature On
+
+#
+# Aliases: Add here as many aliases as you need (with no limit). The format is 
+# Alias fakename realname
+#
+# Note that if you include a trailing / on fakename then the server will
+# require it to be present in the URL.  So "/icons" isn't aliased in this
+# example, only "/icons/".  If the fakename is slash-terminated, then the 
+# realname must also be slash terminated, and if the fakename omits the 
+# trailing slash, the realname must also omit it.
+#
+# We include the /icons/ alias for FancyIndexed directory listings.  If you
+# do not use FancyIndexing, you may comment this out.
+#
+Alias /icons/ "/var/www/localhost/icons/"
+
+<Directory "/var/www/localhost/icons/">
+    Options Indexes MultiViews
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+#
+# ScriptAlias: This controls which directories contain server scripts.
+# ScriptAliases are essentially the same as Aliases, except that
+# documents in the realname directory are treated as applications and
+# run by the server when requested rather than as documents sent to the client.
+# The same rules about trailing "/" apply to ScriptAlias directives as to
+# Alias.
+#
+ScriptAlias /cgi-bin/ /var/www/localhost/cgi-bin/
+
+<IfModule mod_cgid.c>
+    #
+    # Additional to mod_cgid.c settings, mod_cgid has Scriptsock <path>
+    # for setting UNIX socket for communicating with cgid.
+    #
+    #Scriptsock            /var/run/cgisock
+</IfModule>
+
+#
+# "/var/www/localhost/cgi-bin/" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "/var/www/localhost/cgi-bin/">
+    AllowOverride None
+    Options None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+#
+# Redirect allows you to tell clients about documents which used to exist in
+# your server's namespace, but do not anymore. This allows you to tell the
+# clients where to look for the relocated document.
+# Example:
+# Redirect permanent /foo http://www.example.com/bar
+
+#
+# Directives controlling the display of server-generated directory listings.
+#
+<IfModule mod_autoindex.c>
+    #
+    # IndexOptions: Controls the appearance of server-generated directory
+    # listings.
+    #
+    IndexOptions FancyIndexing VersionSort
+
+    #
+    # AddIcon* directives tell the server which icon to show for different
+    # files or filename extensions.  These are only displayed for
+    # FancyIndexed directories.
+    #
+    AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
+
+    AddIconByType (TXT,/icons/text.gif) text/*
+    AddIconByType (IMG,/icons/image2.gif) image/*
+    AddIconByType (SND,/icons/sound2.gif) audio/*
+    AddIconByType (VID,/icons/movie.gif) video/*
+
+    AddIcon /icons/binary.gif .bin .exe
+    AddIcon /icons/binhex.gif .hqx
+    AddIcon /icons/tar.gif .tar
+    AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+    AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
+    AddIcon /icons/a.gif .ps .ai .eps
+    AddIcon /icons/layout.gif .html .shtml .htm .pdf
+    AddIcon /icons/text.gif .txt
+    AddIcon /icons/c.gif .c
+    AddIcon /icons/p.gif .pl .py
+    AddIcon /icons/f.gif .for
+    AddIcon /icons/dvi.gif .dvi
+    AddIcon /icons/uuencoded.gif .uu
+    AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+    AddIcon /icons/tex.gif .tex
+    AddIcon /icons/bomb.gif core
+
+    AddIcon /icons/back.gif ..
+    AddIcon /icons/hand.right.gif README
+    AddIcon /icons/folder.gif ^^DIRECTORY^^
+    AddIcon /icons/blank.gif ^^BLANKICON^^
+
+    #
+    # DefaultIcon is which icon to show for files which do not have an icon
+    # explicitly set.
+    #
+    DefaultIcon /icons/unknown.gif
+
+    #
+    # AddDescription allows you to place a short description after a file in
+    # server-generated indexes.  These are only displayed for FancyIndexed
+    # directories.
+    # Format: AddDescription "description" filename
+    #
+    #AddDescription "GZIP compressed document" .gz
+    #AddDescription "tar archive" .tar
+    #AddDescription "GZIP compressed tar archive" .tgz
+
+    #
+    # ReadmeName is the name of the README file the server will look for by
+    # default, and append to directory listings.
+    #
+    # HeaderName is the name of a file which should be prepended to
+    # directory indexes. 
+    ReadmeName README.html
+    HeaderName HEADER.html
+
+    #
+    # IndexIgnore is a set of filenames which directory indexing should ignore
+    # and not include in the listing.  Shell-style wildcarding is permitted.
+    #
+    IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t .svn
+</IfModule>
+
+#
+# DefaultLanguage and AddLanguage allows you to specify the language of 
+# a document. You can then use content negotiation to give a browser a 
+# file in a language the user can understand.
+#
+# Specify a default language. This means that all data
+# going out without a specific language tag (see below) will 
+# be marked with this one. You probably do NOT want to set
+# this unless you are sure it is correct for all cases.
+#
+# * It is generally better to not mark a page as 
+# * being a certain language than marking it with the wrong
+# * language!
+#
+# DefaultLanguage nl
+#
+# Note 1: The suffix does not have to be the same as the language
+# keyword --- those with documents in Polish (whose net-standard
+# language code is pl) may wish to use "AddLanguage pl .po" to
+# avoid the ambiguity with the common suffix for perl scripts.
+#
+# Note 2: The example entries below illustrate that in some cases 
+# the two character 'Language' abbreviation is not identical to 
+# the two character 'Country' code for its country,
+# E.g. 'Danmark/dk' versus 'Danish/da'.
+#
+# Note 3: In the case of 'ltz' we violate the RFC by using a three char
+# specifier. There is 'work in progress' to fix this and get
+# the reference data for rfc1766 cleaned up.
+#
+# Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl)
+# English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de)
+# Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja)
+# Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn)
+# Norwegian (no) - Polish (pl) - Portugese (pt)
+# Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv)
+# Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW)
+#
+AddLanguage ca .ca
+AddLanguage cs .cz .cs
+AddLanguage da .dk
+AddLanguage de .de
+AddLanguage el .el
+AddLanguage en .en
+AddLanguage eo .eo
+AddLanguage es .es
+AddLanguage et .et
+AddLanguage fr .fr
+AddLanguage he .he
+AddLanguage hr .hr
+AddLanguage it .it
+AddLanguage ja .ja
+AddLanguage ko .ko
+AddLanguage ltz .ltz
+AddLanguage nl .nl
+AddLanguage nn .nn
+AddLanguage no .no
+AddLanguage pl .po
+AddLanguage pt .pt
+AddLanguage pt-BR .pt-br
+AddLanguage ru .ru
+AddLanguage sv .sv
+AddLanguage zh-CN .zh-cn
+AddLanguage zh-TW .zh-tw
+
+#
+# LanguagePriority allows you to give precedence to some languages
+# in case of a tie during content negotiation.
+#
+# Just list the languages in decreasing order of preference. We have
+# more or less alphabetized them here. You probably want to change this.
+#
+LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW
+
+#
+# ForceLanguagePriority allows you to serve a result page rather than
+# MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback)
+# [in case no accepted languages matched the available variants]
+#
+ForceLanguagePriority Prefer Fallback
+
+#
+# Commonly used filename extensions to character sets. You probably
+# want to avoid clashes with the language extensions, unless you
+# are good at carefully testing your setup after each change.
+# See http://www.iana.org/assignments/character-sets for the
+# official list of charset names and their respective RFCs.
+#
+AddCharset ISO-8859-1  .iso8859-1  .latin1
+AddCharset ISO-8859-2  .iso8859-2  .latin2 .cen
+AddCharset ISO-8859-3  .iso8859-3  .latin3
+AddCharset ISO-8859-4  .iso8859-4  .latin4
+AddCharset ISO-8859-5  .iso8859-5  .latin5 .cyr .iso-ru
+AddCharset ISO-8859-6  .iso8859-6  .latin6 .arb
+AddCharset ISO-8859-7  .iso8859-7  .latin7 .grk
+AddCharset ISO-8859-8  .iso8859-8  .latin8 .heb
+AddCharset ISO-8859-9  .iso8859-9  .latin9 .trk
+AddCharset ISO-2022-JP .iso2022-jp .jis
+AddCharset ISO-2022-KR .iso2022-kr .kis
+AddCharset ISO-2022-CN .iso2022-cn .cis
+AddCharset Big5        .Big5       .big5
+# For russian, more than one charset is used (depends on client, mostly):
+AddCharset WINDOWS-1251 .cp-1251   .win-1251
+AddCharset CP866       .cp866
+AddCharset KOI8-r      .koi8-r .koi8-ru
+AddCharset KOI8-ru     .koi8-uk .ua
+AddCharset ISO-10646-UCS-2 .ucs2
+AddCharset ISO-10646-UCS-4 .ucs4
+AddCharset UTF-8       .utf8
+
+# The set below does not map to a specific (iso) standard
+# but works on a fairly wide range of browsers. Note that
+# capitalization actually matters (it should not, but it
+# does for some browsers).
+#
+# See http://www.iana.org/assignments/character-sets
+# for a list of sorts. But browsers support few.
+#
+AddCharset GB2312      .gb2312 .gb 
+AddCharset utf-7       .utf7
+AddCharset utf-8       .utf8
+AddCharset big5        .big5 .b5
+AddCharset EUC-TW      .euc-tw
+AddCharset EUC-JP      .euc-jp
+AddCharset EUC-KR      .euc-kr
+AddCharset shift_jis   .sjis
+
+#
+# AddType allows you to add to or override the MIME configuration
+# file mime.types for specific file types.
+#
+#AddType application/x-tar .tgz
+#
+# AddEncoding allows you to have certain browsers uncompress
+# information on the fly. Note: Not all browsers support this.
+# Despite the name similarity, the following Add* directives have nothing
+# to do with the FancyIndexing customization directives above.
+#
+#AddEncoding x-compress .Z
+#AddEncoding x-gzip .gz .tgz
+#
+# If the AddEncoding directives above are commented-out, then you
+# probably should define those extensions to indicate media types:
+#
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+
+#
+# AddHandler allows you to map certain file extensions to "handlers":
+# actions unrelated to filetype. These can be either built into the server
+# or added with the Action directive (see below)
+#
+# To use CGI scripts outside of ScriptAliased directories:
+# (You will also need to add "ExecCGI" to the "Options" directive.)
+#
+AddHandler cgi-script .cgi
+
+#
+# For files that include their own HTTP headers:
+#
+#AddHandler send-as-is asis
+
+#
+# For server-parsed imagemap files:
+#
+#AddHandler imap-file map
+
+#
+# For type maps (negotiated resources):
+# (This is enabled by default to allow the Apache "It Worked" page
+#  to be distributed in multiple languages.)
+#
+AddHandler type-map var
+
+#
+# Filters allow you to process content before it is sent to the client.
+#
+# To parse .shtml files for server-side includes (SSI):
+# (You will also need to add "Includes" to the "Options" directive.)
+#
+#AddType text/html .shtml
+#AddOutputFilter INCLUDES .shtml
+
+#
+# Action lets you define media types that will execute a script whenever
+# a matching file is called. This eliminates the need for repeated URL
+# pathnames for oft-used CGI file processors.
+# Format: Action media/type /cgi-script/location
+# Format: Action handler-name /cgi-script/location
+#
+
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# Putting this all together, we can internationalize error responses.
+#
+# We use Alias to redirect any /error/HTTP_<error>.html.var response to
+# our collection of by-error message multi-language collections.  We use 
+# includes to substitute the appropriate text.
+#
+# You can modify the messages' appearance without changing any of the
+# default HTTP_<error>.html.var files by adding the line:
+#
+#   Alias /error/include/ "/your/include/path/"
+#
+# which allows you to create your own set of files by starting with the
+# /var/www/localhost/error/include files and copying them to /your/includepath/ 
+# even on a per-VirtualHost basis.  The default include files will display
+# your Apache version number and your ServerAdmin email address regardless
+# of the setting of ServerSignature.
+#
+# The internationalized error documents require mod_alias, mod_include
+# and mod_negotiation.  To activate them, uncomment the following 30 lines.
+
+#    Alias /error/ "/var/www/localhost/error/"
+#
+#    <Directory "/var/www/localhost/error">
+#        AllowOverride None
+#        Options IncludesNoExec
+#        AddOutputFilter Includes html
+#        AddHandler type-map var
+#        Order allow,deny
+#        Allow from all
+#        LanguagePriority en cs de es fr it nl sv pt-br ro
+#        ForceLanguagePriority Prefer Fallback
+#    </Directory>
+#
+#    ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
+#    ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
+#    ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
+#    ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
+#    ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
+#    ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
+#    ErrorDocument 410 /error/HTTP_GONE.html.var
+#    ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
+#    ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
+#    ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
+#    ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
+#    ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
+#    ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
+#    ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
+#    ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
+#    ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
+#    ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
+
+
+#
+# The following directives modify normal HTTP response behavior to
+# handle known problems with browser implementations.
+#
+BrowserMatch "Mozilla/2" nokeepalive
+BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
+BrowserMatch "RealPlayer 4\.0" force-response-1.0
+BrowserMatch "Java/1\.0" force-response-1.0
+BrowserMatch "JDK/1\.0" force-response-1.0
+
+#
+# The following directive disables redirects on non-GET requests for
+# a directory that does not include the trailing slash.  This fixes a 
+# problem with Microsoft WebFolders which does not appropriately handle 
+# redirects for folders with DAV methods.
+# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV.
+#
+BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+BrowserMatch "MS FrontPage" redirect-carefully
+BrowserMatch "^WebDrive" redirect-carefully
+BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
+BrowserMatch "^gnome-vfs" redirect-carefully
+BrowserMatch "^XML Spy" redirect-carefully
+BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+
+#
+# Allow server status reports generated by mod_status,
+# with the URL of http://servername/server-status
+# Change the ".example.com" to match your domain to enable.
+#
+<IfDefine INFO>
+    ExtendedStatus On
+    <Location /server-status>
+        SetHandler server-status
+        Order deny,allow
+        Deny from all
+        Allow from localhost
+    </Location>
+</IfDefine>
+
+#
+# Allow remote server configuration reports, with the URL of
+#  http://localhost/server-info (This is useful for debugging)
+#
+<IfDefine INFO>
+    <Location /server-info>
+       SetHandler server-info
+       Order deny,allow
+       Deny from all
+       Allow from localhost
+    </Location>
+</IfDefine>
+
+
+#
+# Gentoo VHosts
+# 
+# For Gentoo we include External Virtual Hosts Files.
+# Please see vhosts.d/00_default_vhost.conf for the default virtual host.
+#
+Include /etc/apache2/vhosts.d/*.conf
diff --git a/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf b/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf
new file mode 100644
index 000000000..c97c30936
--- /dev/null
+++ b/testing/hosts/winnetou/etc/apache2/vhosts.d/01_ocsp_vhost.conf
@@ -0,0 +1,37 @@
+# OCSP Server
+
+<VirtualHost *:8880>
+    ServerAdmin  root@strongswan.org
+    DocumentRoot /etc/openssl/ocsp
+    ServerName   ocsp.strongswan.org
+    ServerAlias	 192.168.0.150
+    <Directory "/etc/openssl/ocsp">
+       Options      +ExecCGI
+   </Directory>
+   ErrorLog     /var/log/apache2/ocsp/error_log
+   CustomLog    /var/log/apache2/ocsp/access_log combined
+</VirtualHost>
+
+<VirtualHost *:8881>
+    ServerAdmin  root@research.strongswan.org
+    DocumentRoot /etc/openssl/research/ocsp
+    ServerName   ocsp.research.strongswan.org
+    ServerAlias	 ocsp.strongswan.org 192.168.0.150
+    <Directory "/etc/openssl/research/ocsp">
+       Options      +ExecCGI
+   </Directory>
+   ErrorLog     /var/log/apache2/ocsp/error_log
+   CustomLog    /var/log/apache2/ocsp/access_log combined
+</VirtualHost>
+
+<VirtualHost *:8882>
+    ServerAdmin  root@sales.strongswan.org
+    DocumentRoot /etc/openssl/sales/ocsp
+    ServerName   ocsp.sales.strongswan.org
+    ServerAlias	 ocsp.strongswan.org 192.168.0.150
+    <Directory "/etc/openssl/sales/ocsp">
+       Options      +ExecCGI
+   </Directory>
+   ErrorLog     /var/log/apache2/ocsp/error_log
+   CustomLog    /var/log/apache2/ocsp/access_log combined
+</VirtualHost>
diff --git a/testing/hosts/winnetou/etc/openssl/index.txt b/testing/hosts/winnetou/etc/openssl/index.txt
index 9e744674d..12025d75c 100644
--- a/testing/hosts/winnetou/etc/openssl/index.txt
+++ b/testing/hosts/winnetou/etc/openssl/index.txt
@@ -16,3 +16,4 @@ V	100620195806Z		0F	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
 V	111007105811Z		10	unknown	/C=CH/O=Linux strongSwan/OU=SHA-256/CN=moon.strongswan.org
 V	111007121250Z		11	unknown	/C=CH/O=Linux strongSwan/OU=SHA-384/CN=carol@strongswan.org
 V	111007122112Z		12	unknown	/C=CH/O=Linux strongSwan/OU=SHA-512/CN=dave@strongswan.org
+V	120224075857Z		13	unknown	/C=CH/O=Linux strongSwan/OU=OCSP/CN=carol@strongswan.org
diff --git a/testing/hosts/winnetou/etc/openssl/index.txt.old b/testing/hosts/winnetou/etc/openssl/index.txt.old
index 4d7201a35..9e744674d 100644
--- a/testing/hosts/winnetou/etc/openssl/index.txt.old
+++ b/testing/hosts/winnetou/etc/openssl/index.txt.old
@@ -15,3 +15,4 @@ V	100607191714Z		0E	unknown	/C=CH/O=Linux strongSwan/CN=winnetou.strongswan.org
 V	100620195806Z		0F	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
 V	111007105811Z		10	unknown	/C=CH/O=Linux strongSwan/OU=SHA-256/CN=moon.strongswan.org
 V	111007121250Z		11	unknown	/C=CH/O=Linux strongSwan/OU=SHA-384/CN=carol@strongswan.org
+V	111007122112Z		12	unknown	/C=CH/O=Linux strongSwan/OU=SHA-512/CN=dave@strongswan.org
diff --git a/testing/hosts/winnetou/etc/openssl/newcerts/13.pem b/testing/hosts/winnetou/etc/openssl/newcerts/13.pem
new file mode 100644
index 000000000..aeca7e1db
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/newcerts/13.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax
+HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5
+vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8
+G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J
+5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt
+kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If
+pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD
+VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ
+2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD
+VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry
+b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u
+b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry
+b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0
+cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc
+1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj
+o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc
+ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8
+pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s
+pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1
+/xsH+BXYZtKJbYjlnyc8
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
new file mode 100755
index 000000000..cb585ed08
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+                      -rkey ocspKey.pem -rsigner ocspCert.pem \
+		      -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem b/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem
new file mode 100644
index 000000000..77f5bde52
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/ocspCert-self.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ
+IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu
+Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT
+AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl
+bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y
+ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM
+BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828
+P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD
+mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ
+DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb
+UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr
+4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW
+BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt
+rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0
+cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww
+GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw
+FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
+BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ
+9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI
+zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V
+14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL
+lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v
+1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg==
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem b/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem
new file mode 100644
index 000000000..1af5ecdb9
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/ocspKey-self.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAyBI4V4N1bFgoY9RJSEwEUAQsaYcp+DZHblpaUTyO7/8jQHJq
+giybwE9qlKKKLBN2Gj8k8/jj+e8dwNC7zbw/e5jldtI9mmKIGAWijwELb9j+vFj+
+ySMTOqgcReOD+87VsDS2qNWflrSOmRqLukOZTIGuafUCs6OFH8cC6kIewhvuwAv4
+gRcHIxxlArpu80v08xNgjVPvb63/1xkAAQkN8SHIlkzFAqCZPVI3MvDKzPLUzUcX
+3kPn2AGiTg9pFZawt3DOmV9MqHrUJ4YJiptQ/eqkwqsnxju6/57W9XO5hsmDkNH5
+sXUgYhz1BHImVOSFlyj7NMJBjGm+w07XzKvipwIDAQABAoIBABXLPk3yKQFjXQr6
+3fy9Ix8gRUI9kgnSx9cyinIc+akVDt7/V7DUcSbyv7ZvOkPw3sWfKURWUWcxb/lI
+A502q2eoUR6vajx+DTsoqfuP7pIBfkZAH4kDhB24oFPQo9jzP/3Q0DD2DEtbYck1
+xhDFOlbGLZynLuMopeC/SgcAqt8UAIe5AHoUdkPUZH3MqJppH+PCjhkMzreaY9wc
+mEh7tjKuItdGYt0ZmdrnQboyklMhOikn3nKOQWVINtzTLD4AsOcExPmO3m5j4m+n
+h0AGDFyxUvY/l/DH2xC1C5qu13yumesJ1irURShdwO05nrWUzqT0BH4VyJCvcZiC
+TnLhELkCgYEA6vmBxHXbh58VpJEfnXl8D01ZI7YgXHaNPb43j4GA26pd8JVYkPcQ
+TBRZYRGEYL9CT7mfssJ6yie1ZLdGn+vkKyT2LWXxbO8kvfX5lG93sFmE1oauEuug
+zau/eEh1k5fzlm6KClvFGnmMHqqxy0YMUVkAdT0Kb7PG36Bd9tDMLjsCgYEA2fkw
+p8JVIAwyWF99iubxIL9sNnjJgq2j4Rj4zjtT45ZA1LCe7L1EGhQGsP/0u5u+miX6
+GdMSzwehHVBtTl/Gkg/IjWUQbL/jILeFQM2i6hdo8BCmi8k4f6ZF/Pf+m7ZRcLb/
+opJhvhhelnxfNwxHrshohCvGpGVGvSS8xtXzuoUCgYEAmxeuwHauPNkTFvk27eD2
+sr7x/DFFMOKLHVrFH3JyFAtiT96zg5OfbSftSrWeM6Fp6mdx8jKNi4skHmMeOYYg
+px2RY6uq66T5Em0dnAzq6jpcBKEGmrRuAfK/wWvKN24POJajhGzIL05U3xT5n1sP
+3E2rkLaGge4ecRJPkw6EBmsCgYBQWhL8lJ/Ku5RHjZP7A106JDag8e/e02HJFeqK
+I8at6/KkNSOww6h6MI2y6/fsvOILcxp6MJwLY5WZ988DiDzsFRNqRCpE3Iu+wMhH
+dkarIswVSx4KA7hnHgVI1qauAgyNj3g3Ft0fNV6Q/PIgmc9G+CvHJVgJvCfSi9tn
+NPGu/QKBgExju7N5hrJUlfylwydp7X7jymHJGAac9J2+VhqWIhveCnTYrlwTcuJ6
+NqQDdBvDT0F+7fMxQ9wRglMadfnrwWh0Y7BGybzhlR4NDAAZk1GoxegWOR7HnacT
+bbHir6keeWggJgWHsRew3Yxckzqvi+vn/v3MF/wfRijzXzSAenNl
+-----END RSA PRIVATE KEY-----
diff --git a/testing/hosts/winnetou/etc/openssl/openssl.cnf b/testing/hosts/winnetou/etc/openssl/openssl.cnf
index dbe31abbd..165d8bbeb 100644
--- a/testing/hosts/winnetou/etc/openssl/openssl.cnf
+++ b/testing/hosts/winnetou/etc/openssl/openssl.cnf
@@ -43,7 +43,7 @@ crl_extensions	= crl_ext  		  # The extentions to add to the CRL
 
 default_days    = 1825                    # how long to certify for
 default_crl_days= 30			  # how long before next CRL
-default_md      = md5                     # which md to use.
+default_md      = sha1                    # which md to use.
 preserve        = no                      # keep passed DN ordering
 email_in_dn	= no			  # allow/forbid EMail in DN
 
@@ -146,7 +146,7 @@ keyUsage 			= digitalSignature, keyEncipherment, keyAgreement
 subjectKeyIdentifier            = hash
 authorityKeyIdentifier          = keyid, issuer:always
 subjectAltName			= DNS:$ENV::COMMON_NAME
-#extendedKeyUsage		= OCSPSigner
+#extendedKeyUsage		= OCSPSigning
 crlDistributionPoints          	= URI:http://crl.strongswan.org/strongswan.crl
 
 ####################################################################
@@ -158,6 +158,7 @@ keyUsage                        = digitalSignature, keyEncipherment, keyAgreemen
 subjectKeyIdentifier            = hash
 authorityKeyIdentifier          = keyid, issuer:always
 subjectAltName                  = email:$ENV::COMMON_NAME 
+#authorityInfoAccess		= OCSP;URI:http://ocsp.strongswan.org:8880
 crlDistributionPoints          	= URI:http://crl.strongswan.org/strongswan.crl
 
 ####################################################################
diff --git a/testing/hosts/winnetou/etc/openssl/research/index.txt b/testing/hosts/winnetou/etc/openssl/research/index.txt
index 4bd650072..2ccf6489c 100644
--- a/testing/hosts/winnetou/etc/openssl/research/index.txt
+++ b/testing/hosts/winnetou/etc/openssl/research/index.txt
@@ -1,2 +1,3 @@
 V	100322070423Z		01	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=carol@strongswan.org
 V	100615195710Z		02	unknown	/C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA
+V	120323210330Z		03	unknown	/C=CH/O=Linux strongSwan/OU=Research OCSP Signing Authority/CN=ocsp.research.strongswan.org
diff --git a/testing/hosts/winnetou/etc/openssl/research/index.txt.old b/testing/hosts/winnetou/etc/openssl/research/index.txt.old
index 148bab7d6..4bd650072 100644
--- a/testing/hosts/winnetou/etc/openssl/research/index.txt.old
+++ b/testing/hosts/winnetou/etc/openssl/research/index.txt.old
@@ -1 +1,2 @@
 V	100322070423Z		01	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=carol@strongswan.org
+V	100615195710Z		02	unknown	/C=CH/O=Linux strongSwan/OU=Sales/CN=Sales CA
diff --git a/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem b/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem
new file mode 100644
index 000000000..279b4191d
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/research/newcerts/03.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEaDCCA1CgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS
+BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA3MDMyNTIxMDMzMFoXDTEyMDMyMzIxMDMz
+MFoweTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xKDAm
+BgNVBAsTH1Jlc2VhcmNoIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxJTAjBgNVBAMT
+HG9jc3AucmVzZWFyY2guc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCuXf1wGjBk5wthfyJcNgYu5uVdK9fqB7k5Qswy76M2JjZ2
+ECv8JZMvGDC9ciKwEqL3QkN+E90RusdCqgabAl2K3AvbR4VOpaCdy31pdPaKfRXA
+TazIH0GG8T/BImWTuweFt0XmsCl65ShoVul0DHWTli4jOAgHIj6eoYlQpRI6CbZs
+qdcGZJRWzZMPa86Q3i2nKAsOiWh7jg04uLFsWu+2uBYmsPSbKqZe76FY5m+PgAwo
+h0bFJI9qy4aryvNZiFT1+t3hd/wt/ZXnqYX4WsZcGlPOlKZoiDlmXzU1K1YY71io
+HUiH7QOYBYY+8+Mc5kwt/ropYEbfLfAENC7WV+8tAgMBAAGjggEhMIIBHTAJBgNV
+HRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU8xU4ukLOgkIafc7zHp5HlANw
+5/4wbQYDVR0jBGYwZIAU53XwoPKtIM3NYCPMx8gPKfPdVCChSaRHMEUxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv
+bmdTd2FuIFJvb3QgQ0GCAQ8wJwYDVR0RBCAwHoIcb2NzcC5yZXNlYXJjaC5zdHJv
+bmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDCTA3BgNVHR8EMDAuMCygKqAo
+hiZodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG
+9w0BAQUFAAOCAQEADH13ce0I8nXd5rjnDWck3JdBOgFMu2Wl8zpKIeLVYZnUc/Sn
+l0sULX6AIdMzKVsPh78CgsQf4tggdVCdbTURMp3SdLO5TDNlqPVMnjHjajWR+C0D
+4TQWnBz/bEg3aXGjjJlu00eXWx8kRLrOP/wMWba+SEwYDqANgmUgxpcBeg8/0Q78
+d7xEJPOPDXlO5Nh3zeVIXaDT+y2ENzgyTx9YGoAURxl5eTpBNI7dJm5fjXdGlbwj
+1vO+UprMEU6rB9BDFSfyXaXcQoIgRr0oZqvAUS/cF9LQRf4iUXCpr8Th7Wddqi2r
+qiwDZt4o+3EYtCcMEK9zKJK3KMZc9A9HPCE+RA==
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
new file mode 100755
index 000000000..c193e8779
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/research/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl/research
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA researchCert.pem \
+                      -rkey ocspKey.pem -rsigner ocspCert.pem \
+		      -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem b/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem
new file mode 100644
index 000000000..279b4191d
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/research/ocspCert.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEaDCCA1CgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS
+BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA3MDMyNTIxMDMzMFoXDTEyMDMyMzIxMDMz
+MFoweTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xKDAm
+BgNVBAsTH1Jlc2VhcmNoIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxJTAjBgNVBAMT
+HG9jc3AucmVzZWFyY2guc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCuXf1wGjBk5wthfyJcNgYu5uVdK9fqB7k5Qswy76M2JjZ2
+ECv8JZMvGDC9ciKwEqL3QkN+E90RusdCqgabAl2K3AvbR4VOpaCdy31pdPaKfRXA
+TazIH0GG8T/BImWTuweFt0XmsCl65ShoVul0DHWTli4jOAgHIj6eoYlQpRI6CbZs
+qdcGZJRWzZMPa86Q3i2nKAsOiWh7jg04uLFsWu+2uBYmsPSbKqZe76FY5m+PgAwo
+h0bFJI9qy4aryvNZiFT1+t3hd/wt/ZXnqYX4WsZcGlPOlKZoiDlmXzU1K1YY71io
+HUiH7QOYBYY+8+Mc5kwt/ropYEbfLfAENC7WV+8tAgMBAAGjggEhMIIBHTAJBgNV
+HRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU8xU4ukLOgkIafc7zHp5HlANw
+5/4wbQYDVR0jBGYwZIAU53XwoPKtIM3NYCPMx8gPKfPdVCChSaRHMEUxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv
+bmdTd2FuIFJvb3QgQ0GCAQ8wJwYDVR0RBCAwHoIcb2NzcC5yZXNlYXJjaC5zdHJv
+bmdzd2FuLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDCTA3BgNVHR8EMDAuMCygKqAo
+hiZodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG
+9w0BAQUFAAOCAQEADH13ce0I8nXd5rjnDWck3JdBOgFMu2Wl8zpKIeLVYZnUc/Sn
+l0sULX6AIdMzKVsPh78CgsQf4tggdVCdbTURMp3SdLO5TDNlqPVMnjHjajWR+C0D
+4TQWnBz/bEg3aXGjjJlu00eXWx8kRLrOP/wMWba+SEwYDqANgmUgxpcBeg8/0Q78
+d7xEJPOPDXlO5Nh3zeVIXaDT+y2ENzgyTx9YGoAURxl5eTpBNI7dJm5fjXdGlbwj
+1vO+UprMEU6rB9BDFSfyXaXcQoIgRr0oZqvAUS/cF9LQRf4iUXCpr8Th7Wddqi2r
+qiwDZt4o+3EYtCcMEK9zKJK3KMZc9A9HPCE+RA==
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem b/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem
new file mode 100644
index 000000000..adbfe0f92
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/research/ocspKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEArl39cBowZOcLYX8iXDYGLublXSvX6ge5OULMMu+jNiY2dhAr
+/CWTLxgwvXIisBKi90JDfhPdEbrHQqoGmwJditwL20eFTqWgnct9aXT2in0VwE2s
+yB9BhvE/wSJlk7sHhbdF5rApeuUoaFbpdAx1k5YuIzgIByI+nqGJUKUSOgm2bKnX
+BmSUVs2TD2vOkN4tpygLDoloe44NOLixbFrvtrgWJrD0myqmXu+hWOZvj4AMKIdG
+xSSPasuGq8rzWYhU9frd4Xf8Lf2V56mF+FrGXBpTzpSmaIg5Zl81NStWGO9YqB1I
+h+0DmAWGPvPjHOZMLf66KWBG3y3wBDQu1lfvLQIDAQABAoIBAEx5LnknE0h9yJEH
+GEPG8elKHRhC7VxX7NV/RV2lmjhahBI9v3zD4gyKmH3N/Aaq9cxpxH4cKh3nhBLp
+zSHY5LvNDGossPuwSoRKRgOlZ6ePeqWvq3LNuoh7cFG9Sz2CjqcHnWGyq06aCKHS
+VGswN7T17eBGZ8bxLvOVt0qmSxsmg2A2tmZQCAhc6IkEe3L4sqtS4N1y+8J1GSuu
+KlIuT9NtReDiXXQNxr48QJeddj6RE+5xgInUEUGPUrOnv+lllxN42u0Yrqnnci7M
+SNuxiCkYmvUm47zem3mUKrTJnr4uyKSVnzY5wKcbjebnjlaJmWefM6L7wTKYGbbF
+KsXXwOUCgYEA5cXCD09Oeb888dwgvOaVgZqfJaCex2wZ2Wgu8dm3y2YcrNHbrj13
+PU+1fBp29AE4cNowUitL0rHPE232WyKPCsvEt4H/ioucWvXUc9rzNlo+2H4J6ZMI
+4GQp2WXQZeqEAAI35qdcRwIDMRJdsDlg9fAwKAGJAYLhL4fZewmPb8cCgYEAwkU3
+ynMCj1XMvZzhPNS9bACD1euSLTopdAzlASX9bVnDGJ5/KeWl2PqJjrmV3LCjX/4t
+WnGsP5bgv6IGVRpTcjeJSebF2kEA/pwYEZJezwh304JUqsqg4K4QF1ra5v3Wp06e
+Y+sMdUphzTQFAvGzWTSQweSVlXHgrW+VWxdIEWsCgYApwL7b01h6TSMA/DRCv0/p
+pjRHPSG9MUqdNA5bymlYn6yURuo5hlfVn1dmPtTg0Bv2fd+L/uwfVEpByJicxPHj
+T1Xm1sud3HLEIKnDh8TsWofTBUw90ocpZ2onZBXzfyMPcVfBJSZijN4Rm7nEnRie
+eE/35ReFW8gZwADoF7ul3wKBgELkXo+BBnKgUn0/lXbCse6MRtjT4mNcUYW6IuhA
+UoDilYDWomakwnRx4Aea83UoBTk6ZhdsaKkEpKKXgaKwC+eaI9Wkdp/uHg+NY+Q5
+CBg1jDzx9YFRgA+dH8FK8XD0GoNFWNiCyKliUUa9ELSw0NZ4eReqQ69PpNNTRpQ0
+8gW9AoGBAIUpz52BrP0XcIEE+f9ONKGJq+cr1cRXDZlgHBE90GA/b5hfMiAmvaGm
+SVdBXfUzIwEv6fHRqFjXsGqRI1qD6my69khnoObu3H+DR4Dsk/3iwxDMEpK63dfM
+p2fp/wc8G/s/5YVQeAOW0NpPY7qyGDoXN5UcHfLjJw23gbkUJD58
+-----END RSA PRIVATE KEY-----
diff --git a/testing/hosts/winnetou/etc/openssl/research/openssl.cnf b/testing/hosts/winnetou/etc/openssl/research/openssl.cnf
index b5afd3d2e..706a52635 100644
--- a/testing/hosts/winnetou/etc/openssl/research/openssl.cnf
+++ b/testing/hosts/winnetou/etc/openssl/research/openssl.cnf
@@ -145,7 +145,7 @@ keyUsage 			= digitalSignature, keyEncipherment, keyAgreement
 subjectKeyIdentifier            = hash
 authorityKeyIdentifier          = keyid, issuer:always
 subjectAltName			= DNS:$ENV::COMMON_NAME
-#extendedKeyUsage		= OCSPSigner
+#extendedKeyUsage		= OCSPSigning
 crlDistributionPoints          	= URI:http://crl.strongswan.org/research.crl
 
 ####################################################################
diff --git a/testing/hosts/winnetou/etc/openssl/research/serial b/testing/hosts/winnetou/etc/openssl/research/serial
index 75016ea36..64969239d 100644
--- a/testing/hosts/winnetou/etc/openssl/research/serial
+++ b/testing/hosts/winnetou/etc/openssl/research/serial
@@ -1 +1 @@
-03
+04
diff --git a/testing/hosts/winnetou/etc/openssl/research/serial.old b/testing/hosts/winnetou/etc/openssl/research/serial.old
index 9e22bcb8e..75016ea36 100644
--- a/testing/hosts/winnetou/etc/openssl/research/serial.old
+++ b/testing/hosts/winnetou/etc/openssl/research/serial.old
@@ -1 +1 @@
-02
+03
diff --git a/testing/hosts/winnetou/etc/openssl/sales/index.txt b/testing/hosts/winnetou/etc/openssl/sales/index.txt
index 5093b34e9..ab3c06416 100644
--- a/testing/hosts/winnetou/etc/openssl/sales/index.txt
+++ b/testing/hosts/winnetou/etc/openssl/sales/index.txt
@@ -1,2 +1,3 @@
 V	100322071017Z		01	unknown	/C=CH/O=Linux strongSwan/OU=Sales/CN=dave@strongswan.org
 V	100615195536Z		02	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
+V	120323211811Z		03	unknown	/C=CH/O=Linux strongSwan/OU=Sales OCSP Signing Authority/CN=ocsp.sales.strongswan.org
diff --git a/testing/hosts/winnetou/etc/openssl/sales/index.txt.old b/testing/hosts/winnetou/etc/openssl/sales/index.txt.old
index 7378ebb8a..5093b34e9 100644
--- a/testing/hosts/winnetou/etc/openssl/sales/index.txt.old
+++ b/testing/hosts/winnetou/etc/openssl/sales/index.txt.old
@@ -1 +1,2 @@
 V	100322071017Z		01	unknown	/C=CH/O=Linux strongSwan/OU=Sales/CN=dave@strongswan.org
+V	100615195536Z		02	unknown	/C=CH/O=Linux strongSwan/OU=Research/CN=Research CA
diff --git a/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem b/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem
new file mode 100644
index 000000000..ce2ff7b9d
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/sales/newcerts/03.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEVjCCAz6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV
+BAMTCFNhbGVzIENBMB4XDTA3MDMyNTIxMTgxMVoXDTEyMDMyMzIxMTgxMVowczEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xJTAjBgNVBAsT
+HFNhbGVzIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxIjAgBgNVBAMTGW9jc3Auc2Fs
+ZXMuc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDGgB20WTzEVUNGDU/iwxN/eybmYAQ2rUytxoyKUHoN8Q7tATg7bwH3HrMdc5JV
+AA4uiWFdrNw7GGu+QJVrYi+7jdt76ffcck6eQjLmmVsGp4T16U900ZzFh6zLnhs9
+K/Sw8yiGMQcYncblST4Sl3Yd6XdiY/fZHscsbFjxVpPGxwebZPPirukeWDFLUwVO
+yc5A7pdqNlvmfy5tiO5Ds8hQMQyVqpmlDYwTQz3yZS2+X4In8GrgvBnUZ/etGzq8
+N+309wX/g2WvcKYDpWLqu3KxkwL+QTTYhIM6NvQXtPGCf3M5yBtoNqPzgIqXveuT
+oMwJwF+uDZddBWjAeI1G+J8BAgMBAAGjggEbMIIBFzAJBgNVHRMEAjAAMAsGA1Ud
+DwQEAwIDqDAdBgNVHQ4EFgQUY33heVHJfDUOz5Va8B1VPepgam4wbQYDVR0jBGYw
+ZIAUX5sTRvkgcsgA1Yi1p0wul+oLkyihSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
+VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
+Q0GCAQ0wJAYDVR0RBB0wG4IZb2NzcC5zYWxlcy5zdHJvbmdzd2FuLm9yZzATBgNV
+HSUEDDAKBggrBgEFBQcDCTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnN0
+cm9uZ3N3YW4ub3JnL3NhbGVzLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAXvU0ucW8
+DUgNkNdzIYtL48d44e+vDRuVZ6BmuovHqZuuWXfmxtM0q8zPUgrtXwX50nhVg8Y3
+csLLa4o7WOmDTMftvzuh9+T9CV8WIX6vioI7zS550ZwUwB0V08JTfrCiRaCql7Eg
+pDEZDfKXJCaq+I/FAH1Q03vXsDk+wTtJSeqoWCt7IiEYePwFLQ0ANjPhK6BbbcyH
+XkqZE2hYmroGele+UGwflRL9CP6F8UTFdg2LefeiZmZiSkgO2a0i4ik0ShQAPyIl
+is5KBiKuvsqkbMTCxdk0gdRqcTF0YUHcOCY0gHMiApsNC157fokP0Mg6rBDRCJkH
+kiJdzc42Apd8uw==
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
new file mode 100755
index 000000000..c53cb9a76
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/sales/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl/sales
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA salesCert.pem \
+                      -rkey ocspKey.pem -rsigner ocspCert.pem \
+		      -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem b/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem
new file mode 100644
index 000000000..ce2ff7b9d
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/sales/ocspCert.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEVjCCAz6gAwIBAgIBAzANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV
+BAMTCFNhbGVzIENBMB4XDTA3MDMyNTIxMTgxMVoXDTEyMDMyMzIxMTgxMVowczEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xJTAjBgNVBAsT
+HFNhbGVzIE9DU1AgU2lnbmluZyBBdXRob3JpdHkxIjAgBgNVBAMTGW9jc3Auc2Fs
+ZXMuc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDGgB20WTzEVUNGDU/iwxN/eybmYAQ2rUytxoyKUHoN8Q7tATg7bwH3HrMdc5JV
+AA4uiWFdrNw7GGu+QJVrYi+7jdt76ffcck6eQjLmmVsGp4T16U900ZzFh6zLnhs9
+K/Sw8yiGMQcYncblST4Sl3Yd6XdiY/fZHscsbFjxVpPGxwebZPPirukeWDFLUwVO
+yc5A7pdqNlvmfy5tiO5Ds8hQMQyVqpmlDYwTQz3yZS2+X4In8GrgvBnUZ/etGzq8
+N+309wX/g2WvcKYDpWLqu3KxkwL+QTTYhIM6NvQXtPGCf3M5yBtoNqPzgIqXveuT
+oMwJwF+uDZddBWjAeI1G+J8BAgMBAAGjggEbMIIBFzAJBgNVHRMEAjAAMAsGA1Ud
+DwQEAwIDqDAdBgNVHQ4EFgQUY33heVHJfDUOz5Va8B1VPepgam4wbQYDVR0jBGYw
+ZIAUX5sTRvkgcsgA1Yi1p0wul+oLkyihSaRHMEUxCzAJBgNVBAYTAkNIMRkwFwYD
+VQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2FuIFJvb3Qg
+Q0GCAQ0wJAYDVR0RBB0wG4IZb2NzcC5zYWxlcy5zdHJvbmdzd2FuLm9yZzATBgNV
+HSUEDDAKBggrBgEFBQcDCTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnN0
+cm9uZ3N3YW4ub3JnL3NhbGVzLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAXvU0ucW8
+DUgNkNdzIYtL48d44e+vDRuVZ6BmuovHqZuuWXfmxtM0q8zPUgrtXwX50nhVg8Y3
+csLLa4o7WOmDTMftvzuh9+T9CV8WIX6vioI7zS550ZwUwB0V08JTfrCiRaCql7Eg
+pDEZDfKXJCaq+I/FAH1Q03vXsDk+wTtJSeqoWCt7IiEYePwFLQ0ANjPhK6BbbcyH
+XkqZE2hYmroGele+UGwflRL9CP6F8UTFdg2LefeiZmZiSkgO2a0i4ik0ShQAPyIl
+is5KBiKuvsqkbMTCxdk0gdRqcTF0YUHcOCY0gHMiApsNC157fokP0Mg6rBDRCJkH
+kiJdzc42Apd8uw==
+-----END CERTIFICATE-----
diff --git a/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem b/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem
new file mode 100644
index 000000000..5d10a3467
--- /dev/null
+++ b/testing/hosts/winnetou/etc/openssl/sales/ocspKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxoAdtFk8xFVDRg1P4sMTf3sm5mAENq1MrcaMilB6DfEO7QE4
+O28B9x6zHXOSVQAOLolhXazcOxhrvkCVa2Ivu43be+n33HJOnkIy5plbBqeE9elP
+dNGcxYesy54bPSv0sPMohjEHGJ3G5Uk+Epd2Hel3YmP32R7HLGxY8VaTxscHm2Tz
+4q7pHlgxS1MFTsnOQO6XajZb5n8ubYjuQ7PIUDEMlaqZpQ2ME0M98mUtvl+CJ/Bq
+4LwZ1Gf3rRs6vDft9PcF/4Nlr3CmA6Vi6rtysZMC/kE02ISDOjb0F7Txgn9zOcgb
+aDaj84CKl73rk6DMCcBfrg2XXQVowHiNRvifAQIDAQABAoIBAQCUOZL02zYfPbPw
+mXwvzo++wA16NfSvh5UcpojHt/SMeJc2r5R3/Rqwl8IUmfqJcnMkmP2V38DMeB3s
+gXmSKE2QdguRalLl0I2Ya8Jqo9VvEKSepMvqZaP1dKy5l6SrdylPASQfoHi2Dws4
+qAqsA2H2UCIP3Kp0/SCpsXZxML9EzIWtYtvrqJ0p0EI9ZzEn5uFok91qTYqD9c3T
+v142OyfmHlwICLy7UlFkmawrV4PIIP2RGTRgr2b16Vis7mAkRC7blsFXUEBb8hwE
+SmISdZYXc+NCesonXYGeRhln8PPLI3/T+HHH8G2eFhyQISHgE0CbjK+zvFcAddvD
+BbeceDPhAoGBAOkXwIklHvzSj4QoCi572QNkNIkxlIa6PL3I2ygJczeB1vj9kvVc
+CV2onhvBL3FGy0BJrQI7UBySW59/GdSs+WJFQWlIwI9QglDS8itAQK6+9zeyg69U
+NbGw784NGn5cP3F4P3QCGEUg5Oj8t0iE8gKbljz6rlSjO5uhXYOYf0rtAoGBANoC
+E0noRtG4QloEbIiHjLbnNAjabOO9KNm9FLZZFnGvTHQ1690i+GBOXC/cbP3jo6tz
+07+Ob/+IKhXhEj9opGu8ZvEfarHmBEWxj6TdvFmlaHEcEFD0LqGu5ssSfW3S3AEB
+Z3rBLkEeJYUYQqCU+vgZHEbrLWeBt33AIeB1nN3lAoGAL0LJnwUPy2NGBh24MsSZ
+s75ViJus6cRJHJHlHbEM02xYEhQX//exTnQp2qbI38bi3x4RHiq4i5KBUU2MBzsr
+NWmlYZuGr4g7Y/fhcjOM6eF+bqSbXqlMWcLuXHD7tjMuCeu/sd3a3elVgIf9AY8z
+IqQ5ShPp1O9j3qJRO6Vn6eECgYBIu9KFoOonxArXD4zKTDcFOsPghEc5//0mD/Be
+GgDj8vFWADtt7uHg96PIEAmI9y6+4Ajwauww29P2sr2szBO3IgdSQQIO0kfwnJnp
+DlVtr0LWId/LsnvwU3MKo2OXhXcDGt3UValB7nXkHsDz5GCK743Al2vxkZSPbs+e
+nH62hQKBgQC8AouEwXXXQD8+MnW+qcIbaAzVMirc94sI3fQH1AnfiZHH6aMCOh/4
+xoh/RzylotQlOk1xjCOB4O/Hhd+MAnlH9ZawCnRdvB/4usxd4j2AYr0Np7Q+VUyx
+EFejvkdm20j1dh29jfSbiXHd2RCoFimX0Dr3weiRqffqi9aV2tdqLQ==
+-----END RSA PRIVATE KEY-----
diff --git a/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf b/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf
index adb204bc2..687956d60 100644
--- a/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf
+++ b/testing/hosts/winnetou/etc/openssl/sales/openssl.cnf
@@ -145,7 +145,7 @@ keyUsage 			= digitalSignature, keyEncipherment, keyAgreement
 subjectKeyIdentifier            = hash
 authorityKeyIdentifier          = keyid, issuer:always
 subjectAltName			= DNS:$ENV::COMMON_NAME
-#extendedKeyUsage		= OCSPSigner
+#extendedKeyUsage		= OCSPSigning
 crlDistributionPoints          	= URI:http://crl.strongswan.org/sales.crl
 
 ####################################################################
diff --git a/testing/hosts/winnetou/etc/openssl/sales/serial b/testing/hosts/winnetou/etc/openssl/sales/serial
index 75016ea36..64969239d 100644
--- a/testing/hosts/winnetou/etc/openssl/sales/serial
+++ b/testing/hosts/winnetou/etc/openssl/sales/serial
@@ -1 +1 @@
-03
+04
diff --git a/testing/hosts/winnetou/etc/openssl/sales/serial.old b/testing/hosts/winnetou/etc/openssl/sales/serial.old
index 9e22bcb8e..75016ea36 100644
--- a/testing/hosts/winnetou/etc/openssl/sales/serial.old
+++ b/testing/hosts/winnetou/etc/openssl/sales/serial.old
@@ -1 +1 @@
-02
+03
diff --git a/testing/hosts/winnetou/etc/openssl/serial b/testing/hosts/winnetou/etc/openssl/serial
index b1bd38b62..8351c1939 100644
--- a/testing/hosts/winnetou/etc/openssl/serial
+++ b/testing/hosts/winnetou/etc/openssl/serial
@@ -1 +1 @@
-13
+14
diff --git a/testing/hosts/winnetou/etc/openssl/serial.old b/testing/hosts/winnetou/etc/openssl/serial.old
index 48082f72f..b1bd38b62 100644
--- a/testing/hosts/winnetou/etc/openssl/serial.old
+++ b/testing/hosts/winnetou/etc/openssl/serial.old
@@ -1 +1 @@
-12
+13
diff --git a/testing/hosts/winnetou/etc/openssl/start-ocsp b/testing/hosts/winnetou/etc/openssl/start-ocsp
deleted file mode 100755
index bdc5dab38..000000000
--- a/testing/hosts/winnetou/etc/openssl/start-ocsp
+++ /dev/null
@@ -1,20 +0,0 @@
-#! /bin/sh
-# start an OpenSSL-based OCSP server
-#
-# Copyright (C) 2004  Andreas Steffen
-# Zuercher Hochschule Winterthur
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-# RCSID $Id: start-ocsp,v 1.3 2005/01/01 18:12:14 as Exp $
-
-cd /etc/openssl
-openssl ocsp -index index.txt -CA strongswanCert.pem -port 8880 -rkey ocspKey.pem -rsigner ocspCert.pem -nmin 5 < /dev/null > /dev/null 2>&1 &
diff --git a/testing/scripts/build-hostconfig b/testing/scripts/build-hostconfig
index 28b321a70..1dd268719 100755
--- a/testing/scripts/build-hostconfig
+++ b/testing/scripts/build-hostconfig
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: build-hostconfig,v 1.4 2006/10/19 21:38:45 as Exp $
+# RCSID $Id: build-hostconfig,v 1.3 2005/02/08 10:40:48 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/scripts/build-sshkeys b/testing/scripts/build-sshkeys
index 2faa3963d..23f62e005 100755
--- a/testing/scripts/build-sshkeys
+++ b/testing/scripts/build-sshkeys
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: build-sshkeys,v 1.3 2006/10/19 21:38:45 as Exp $
+# RCSID $Id: build-sshkeys,v 1.2 2005/02/15 14:12:16 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/scripts/build-umlhostfs b/testing/scripts/build-umlhostfs
index e77bfc025..69ad9fe02 100755
--- a/testing/scripts/build-umlhostfs
+++ b/testing/scripts/build-umlhostfs
@@ -68,6 +68,7 @@ do
     cp -rfp $BUILDDIR/hosts/${host}/etc $LOOPDIR
     if [ "$host" = "winnetou" ]
     then
+    	mkdir $LOOPDIR/var/log/apache2/ocsp
 	cp -rfp $UMLTESTDIR/testing/images $LOOPDIR/var/www/localhost/htdocs
         chroot $LOOPDIR /etc/openssl/generate-crl >> $LOGFILE 2>&1
     fi
diff --git a/testing/scripts/build-umlrootfs b/testing/scripts/build-umlrootfs
index 1d534c81b..f839e3e8e 100755
--- a/testing/scripts/build-umlrootfs
+++ b/testing/scripts/build-umlrootfs
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: build-umlrootfs,v 1.12 2006/10/20 14:26:05 as Exp $
+# RCSID $Id: build-umlrootfs,v 1.11 2006/01/08 22:29:56 as Exp $
 
 DIR=`dirname $0`
 
@@ -89,7 +89,6 @@ mount -o loop gentoo-fs $LOOPDIR >> $LOGFILE 2>&1
 tar xjpf $ROOTFS -C $LOOPDIR     >> $LOGFILE 2>&1
 cecho "done"
 
-
 ######################################################
 # remove /etc/resolv.conf
 #
@@ -102,14 +101,21 @@ rm -f $LOOPDIR/etc/resolv.conf
 cecho " * Copying '$HOSTCONFIGDIR/default/etc/hosts' to the root filesystem"
 cp -fp $HOSTCONFIGDIR/default/etc/hosts $LOOPDIR/etc/hosts
 
-#
 #####################################################
 # extracting strongSwan into the root filesystem
 #
-
 cecho " * Extracting strongSwan into the root filesystem"
 tar xjf $STRONGSWAN -C $LOOPDIR/root >> $LOGFILE 2>&1
 
+######################################################
+# setting up mountpoint for shared source tree
+#
+if [ "${SHAREDTREE+set}" = "set" ]; then
+    cecho " * setting up shared strongswan tree at '$SHAREDTREE'"
+    mkdir $LOOPDIR/root/strongswan-shared
+    echo "" >> $LOOPDIR/etc/fstab
+    echo "none /root/strongswan-shared hostfs $SHAREDTREE" >> $LOOPDIR/etc/fstab
+fi
 
 ######################################################
 # installing strongSwan and setting the local timezone
@@ -120,20 +126,27 @@ INSTALLSHELL=${LOOPDIR}/install.sh
 cecho " * Preparing strongSwan installation script"
 echo "ln -sf /usr/share/zoneinfo/${TZUML} /etc/localtime" >> $INSTALLSHELL
 
+echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL
+echo -n "./configure --sysconfdir=/etc" >> $INSTALLSHELL
+echo -n " --with-random-device=/dev/urandom" >> $INSTALLSHELL
 if [ "$USE_LIBCURL" = "yes" ]
 then
-    echo "export USE_LIBCURL=true" >> $INSTALLSHELL
+    echo -n " --enable-http" >> $INSTALLSHELL
 fi
 
 if [ "$USE_LDAP" = "yes" ]
 then
-    echo "export USE_LDAP=true" >> $INSTALLSHELL
+    echo -n " --enable-ldap" >> $INSTALLSHELL
 fi
 
-echo "export USERCOMPILE=\'-DRANDOM_DEVICE=\\\"/dev/urandom\\\"\'" >> $INSTALLSHELL
-echo "cd /root/${STRONGSWANVERSION}" >> $INSTALLSHELL
-echo "make programs" >> $INSTALLSHELL
+if [ "$USE_LEAK_DETECTIVE" = "yes" ]
+then
+    echo -n " --enable-leak-detective" >> $INSTALLSHELL
+fi
+echo "" >> $INSTALLSHELL
+echo "make" >> $INSTALLSHELL
 echo "make install" >> $INSTALLSHELL
+echo "ldconfig" >> $INSTALLSHELL
 
 cecho-n " * Compiling $STRONGSWANVERSION within the root file system as chroot.."
 chroot $LOOPDIR /bin/bash /install.sh >> $LOGFILE 2>&1
@@ -159,7 +172,7 @@ cp $LOOPDIR/etc/ssh/ssh_host_rsa_key $LOOPDIR/root/.ssh/id_rsa
 
 for host in $STRONGSWANHOSTS
 do
-    eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
+    eval ip="`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F- '{ print $1 }' | awk '{ print $1 }'`"
     echo "$host,$ip `cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub`" >> $LOOPDIR/root/.ssh/known_hosts
     echo "`cat $HOSTCONFIGDIR/ssh_host_rsa_key.pub` root@$host" >> $LOOPDIR/root/.ssh/authorized_keys
 done
diff --git a/testing/scripts/install-shared b/testing/scripts/install-shared
new file mode 100755
index 000000000..4cfac9e77
--- /dev/null
+++ b/testing/scripts/install-shared
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Install strongSwan from mounted strongswan-shared tree
+#
+# Copyright (C) 2006 Martin Willi
+# Hochschule fuer Technik Rapperswil
+# Copyright (C) 2004  Eric Marchionni, Patrik Rayo
+# Zuercher Hochschule Winterthur
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# for more details.
+#
+
+DIR=`dirname $0`
+
+source $DIR/function.sh
+
+[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
+
+source $DIR/../testing.conf
+
+cecho "installing strongSwan from shared tree"
+cecho-n "  on: "
+
+for host in $STRONGSWANHOSTS
+do
+    eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
+    cecho-n "$host... "
+    ssh $HOSTLOGIN 'cd ~/strongswan-shared && make install' > /dev/null
+done
+
+cecho
diff --git a/testing/scripts/kstart-umls b/testing/scripts/kstart-umls
index 21baee52c..8379438c8 100755
--- a/testing/scripts/kstart-umls
+++ b/testing/scripts/kstart-umls
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: kstart-umls,v 1.7 2007/01/11 20:32:01 as Exp $
+# RCSID $Id: kstart-umls,v 1.6 2005/08/30 22:13:12 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/scripts/load-testconfig b/testing/scripts/load-testconfig
index 9c0477e54..6558018c2 100755
--- a/testing/scripts/load-testconfig
+++ b/testing/scripts/load-testconfig
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: load-testconfig,v 1.3 2006/10/19 21:38:45 as Exp $
+# RCSID $Id: load-testconfig,v 1.2 2004/12/13 21:02:42 as Exp $
 
 DIR=`dirname $0`
 
@@ -53,12 +53,12 @@ fi
 
 
 ##########################################################################
-# clear the auth.log where IKE messages are logged
+# clear auth.log and daemon.log where IKE messages are logged
 #
 
 for host in $IPSECHOSTS
 do
     eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
-    ssh $HOSTLOGIN 'rm -f /var/log/auth.log; \
+    ssh $HOSTLOGIN 'rm -f /var/log/auth.log /var/log/daemon.log; \
 		    kill -SIGHUP `cat /var/run/syslogd.pid`' > /dev/null 2>&1
 done
diff --git a/testing/scripts/restore-defaults b/testing/scripts/restore-defaults
index 03f723e82..b1dae1ea2 100755
--- a/testing/scripts/restore-defaults
+++ b/testing/scripts/restore-defaults
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: restore-defaults,v 1.3 2006/10/19 21:40:27 as Exp $
+# RCSID $Id: restore-defaults,v 1.2 2004/12/20 07:56:33 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/scripts/shutdown-umls b/testing/scripts/shutdown-umls
new file mode 100755
index 000000000..e71e46602
--- /dev/null
+++ b/testing/scripts/shutdown-umls
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Install strongSwan from mounted strongswan-shared tree
+#
+# Copyright (C) 2006 Martin Willi
+# Hochschule fuer Technik Rapperswil
+# Copyright (C) 2004  Eric Marchionni, Patrik Rayo
+# Zuercher Hochschule Winterthur
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# for more details.
+#
+
+DIR=`dirname $0`
+
+source $DIR/function.sh
+
+[ -f $DIR/../testing.conf ] || die "Configuration file 'testing.conf' not found"
+
+source $DIR/../testing.conf
+
+cecho "shutting down"
+cecho-n "  "
+
+for host in $STRONGSWANHOSTS
+do
+    eval HOSTLOGIN="root@`echo $HOSTNAMEIPV4 | sed -n -e "s/^.*${host},//gp" | awk -F, '{ print $1 }' | awk '{ print $1 }'`"
+    cecho-n "$host... "
+    ssh $HOSTLOGIN 'shutdown now -h' > /dev/null
+done
+
+cecho
diff --git a/testing/scripts/start-switches b/testing/scripts/start-switches
index c90c9f86d..82433babe 100755
--- a/testing/scripts/start-switches
+++ b/testing/scripts/start-switches
@@ -31,7 +31,7 @@ do
 	cecho " * Great, umlswitch$n is already running!"
     else
 	cecho-n " * Starting umlswitch$n.."
-	uml_switch -tap tap$n -unix /tmp/umlswitch$n >/dev/null </dev/null &
+	uml_switch -hub -tap tap$n -unix /tmp/umlswitch$n >/dev/null </dev/null &
 	sleep 2
 	eval ifconfig "tap$n \$IFCONFIG_$n up"
 	cecho "done"
diff --git a/testing/scripts/start-umls b/testing/scripts/start-umls
index 89d9e0d81..1b875a696 100755
--- a/testing/scripts/start-umls
+++ b/testing/scripts/start-umls
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: start-umls,v 1.6 2007/01/11 20:32:01 as Exp $
+# RCSID $Id: start-umls,v 1.5 2005/08/30 22:13:12 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/scripts/xstart-umls b/testing/scripts/xstart-umls
index 5983d405f..9efbd1497 100755
--- a/testing/scripts/xstart-umls
+++ b/testing/scripts/xstart-umls
@@ -14,7 +14,7 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: xstart-umls,v 1.7 2007/01/11 20:32:01 as Exp $
+# RCSID $Id: xstart-umls,v 1.6 2005/08/30 22:13:12 as Exp $
 
 DIR=`dirname $0`
 
diff --git a/testing/start-testing b/testing/start-testing
index 375a82be5..28f9c3bf5 100755
--- a/testing/start-testing
+++ b/testing/start-testing
@@ -47,6 +47,10 @@ case $UMLSTARTMODE in
 	cecho "Start the uml instances  (scripts/kstart-umls)"
 	$DIR/scripts/kstart-umls $HOSTS
 	;;
+    gnome-terminal)
+	cecho "Start the uml instances  (scripts/gstart-umls)"
+	$DIR/scripts/gstart-umls $HOSTS
+	;;
     xterm)
 	cecho "Start the uml instances  (scripts/xstart-umls)"
 	$DIR/scripts/xstart-umls $HOSTS
diff --git a/testing/testing.conf b/testing/testing.conf
index 32169d985..d4d6767c9 100755
--- a/testing/testing.conf
+++ b/testing/testing.conf
@@ -14,14 +14,14 @@
 # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 # for more details.
 #
-# RCSID $Id: testing.conf,v 1.60 2007/02/21 22:17:52 as Exp $
+# RCSID $Id: testing.conf,v 1.52 2006/04/24 16:58:03 as Exp $
 
 # Root directory of testing
-UMLTESTDIR=~/strongswan-testing
+UMLTESTDIR=/home/strongswan-testing
 
 # Bzipped kernel sources
 # (file extension .tar.bz2 required)
-KERNEL=$UMLTESTDIR/linux-2.6.20.1.tar.bz2
+KERNEL=$UMLTESTDIR/linux-2.6.20.3.tar.bz2
 
 # Extract kernel version
 KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'`
@@ -30,15 +30,15 @@ KERNELVERSION=`basename $KERNEL .tar.bz2 | sed -e 's/linux-//'`
 KERNELCONFIG=$UMLTESTDIR/.config-2.6.20
 
 # Bzipped uml patch for kernel
-# (not needed anymore for 2.6.9 kernel or higher)
 UMLPATCH=$UMLTESTDIR/uml_jmpbuf-2.6.18.patch.bz2
 
 # Bzipped source of strongSwan
-STRONGSWAN=$UMLTESTDIR/strongswan-2.8.3.tar.bz2
+STRONGSWAN=$UMLTESTDIR/strongswan-4.1.0.tar.bz2
 
 # strongSwan compile options (use "yes" or "no")
 USE_LIBCURL="yes"
 USE_LDAP="yes"
+USE_LEAK_DETECTIVE="no"
 
 # Gentoo linux root filesystem
 ROOTFS=$UMLTESTDIR/gentoo-fs-20061006.tar.bz2
@@ -49,17 +49,22 @@ ROOTFSSIZE=544
 # Amount of Memory to use per UML [MB].
 # If "auto" is stated 1/12 of total host ram will be used.
 # Examples: MEM=64, MEM="128", MEM="auto"
-MEM=64
+MEM=96
 
 # Directory where the UML kernels and file system will be built
 BUILDDIR=$UMLTESTDIR/umlbuild
 
 # Filename of the built UML Kernel
-UMLKERNEL=$BUILDDIR/linux-uml-$KERNELVERSION
+UMLKERNEL=$UMLTESTDIR/linux
 
 # Directory where test results will be stored
 TESTRESULTSDIR=$UMLTESTDIR/testresults
 
+# Path to a full strongswan tree on the host system, which is
+# mounted into /root/strongswan-shared. This gives us an easy
+# way to apply and test changes instantly.
+SHAREDTREE=/home/martin/strongswan/trunk
+
 # Timezone for the UMLs, look in /usr/share/zoneinfo!
 TZUML="Europe/Zurich"
 
@@ -67,22 +72,22 @@ TZUML="Europe/Zurich"
 # Enable particular steps in the make-testing and
 # start-testing scripts
 #
-ENABLE_BUILD_UMLKERNEL="yes"
+ENABLE_BUILD_UMLKERNEL="no"
 ENABLE_BUILD_SSHKEYS="yes"
 ENABLE_BUILD_HOSTCONFIG="yes"
 ENABLE_BUILD_UMLROOTFS="yes"
 ENABLE_BUILD_UMLHOSTFS="yes"
-ENABLE_START_TESTING="yes"
-ENABLE_DO_TESTS="yes"
+ENABLE_START_TESTING="no"
+ENABLE_DO_TESTS="no"
 ENABLE_STOP_TESTING="no"
 
 ##############################################################
 # How to start the UMLs?
 #
 # Start the UML instance in KDE konsole (requires KDE)
-UMLSTARTMODE="konsole"
+#UMLSTARTMODE="gnome-terminal"
 # Start the UML instance in an xterm (requires X11R6)
-# UMLSTARTMODE="xterm"
+UMLSTARTMODE="xterm"
 # Start the UML instance without a terminal window
 # but screen -r <host> can open a window anytime
 # UMLSTARTMODE="screen"
@@ -95,7 +100,7 @@ SELECTEDTESTSONLY="no"
 
 # Tests to do if $SELECTEDTESTSONLY is set "yes".
 #
-SELECTEDTESTS="net2net-cert"
+SELECTEDTESTS="ikev2-net2net ikev2-rw"
 
 ##############################################################
 # hostname and corresponding IPv4 and IPv6 addresses
@@ -158,3 +163,7 @@ SWITCH_dave="eth0=daemon,fe:fd:c0:a8:00:c8,unix,/tmp/umlswitch0"
 SWITCH_sun="eth0=daemon,fe:fd:c0:a8:00:02,unix,/tmp/umlswitch0 \
             eth1=daemon,fe:fd:0a:02:00:01,unix,/tmp/umlswitch2"
 SWITCH_bob="eth0=daemon,fe:fd:0a:02:00:0a,unix,/tmp/umlswitch2"
+
+
+
+
diff --git a/testing/tests/compress/hosts/carol/etc/ipsec.conf b/testing/tests/compress/hosts/carol/etc/ipsec.conf
deleted file mode 100755
index 9462ba5e6..000000000
--- a/testing/tests/compress/hosts/carol/etc/ipsec.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug="control crypt"
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	compress=yes
-
-conn home
-	left=PH_IP_CAROL
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
diff --git a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf
deleted file mode 100755
index ae8d2b772..000000000
--- a/testing/tests/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug=control
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	ike=3des-sha
-	esp=3des-sha1
-conn home
-	left=PH_IP_CAROL
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
diff --git a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf
deleted file mode 100755
index ae8d2b772..000000000
--- a/testing/tests/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf
+++ /dev/null
@@ -1,25 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug=control
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	ike=3des-sha
-	esp=3des-sha1
-conn home
-	left=PH_IP_CAROL
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
diff --git a/testing/tests/ike/rw-cert/description.txt b/testing/tests/ike/rw-cert/description.txt
new file mode 100644
index 000000000..b48a89026
--- /dev/null
+++ b/testing/tests/ike/rw-cert/description.txt
@@ -0,0 +1,5 @@
+Roadwarrior <b>carol</b> sets up an IKEv1 connection and roadwarrior <b>dave</b>
+an IKEv2 tunnel, respectively, to the gateway <b>moon</b>.
+In order to test the established tunnels, both roadwarriors ping the client <b>alice</b>
+in the subnet behind gateway <b>moon</b>.
+.
diff --git a/testing/tests/ike/rw-cert/evaltest.dat b/testing/tests/ike/rw-cert/evaltest.dat
new file mode 100644
index 000000000..71496d2f2
--- /dev/null
+++ b/testing/tests/ike/rw-cert/evaltest.dat
@@ -0,0 +1,11 @@
+moon::ipsec statusall::rw.*STATE_QUICK_R2.*IPsec SA established::YES
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*STATE_QUICK_I2.*IPsec SA established::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..5d78605e9
--- /dev/null
+++ b/testing/tests/ike/rw-cert/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	leftid=dave@strongswan.org
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..841a67491
--- /dev/null
+++ b/testing/tests/ike/rw-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ike/rw-cert/posttest.dat
index ed530f6d9..ed530f6d9 100644
--- a/testing/tests/rw-psk-rsa-mixed/posttest.dat
+++ b/testing/tests/ike/rw-cert/posttest.dat
diff --git a/testing/tests/ike/rw-cert/pretest.dat b/testing/tests/ike/rw-cert/pretest.dat
new file mode 100644
index 000000000..587b6aeed
--- /dev/null
+++ b/testing/tests/ike/rw-cert/pretest.dat
@@ -0,0 +1,8 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1 
+carol::ipsec up home
+dave::ipsec up home
+dave::sleep 1
diff --git a/testing/tests/ike/rw-cert/test.conf b/testing/tests/ike/rw-cert/test.conf
new file mode 100644
index 000000000..845a6dcd7
--- /dev/null
+++ b/testing/tests/ike/rw-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ike/rw_v1-net_v2/description.txt b/testing/tests/ike/rw_v1-net_v2/description.txt
new file mode 100644
index 000000000..292e09d40
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/description.txt
@@ -0,0 +1,7 @@
+A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b>
+is set up using the IKEv2 key exchange protocol whereas the roadwarrior <b>carol</b>
+negotiates the connection via the IKEv1 protocol.
+In order to test the established tunnels, client <b>alice</b> behind gateway <b>moon</b>
+pings client <b>bob</b> located behind gateway <b>sun</b> and roadwarrior <b>carol</b>
+pings the client <b>alice</b> behind <b>moon</b>.
+.
diff --git a/testing/tests/ike/rw_v1-net_v2/evaltest.dat b/testing/tests/ike/rw_v1-net_v2/evaltest.dat
new file mode 100644
index 000000000..4eace50b7
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::net-net.*ESTABLISHED::YES
+sun::ipsec statusall::net-net.*ESTABLISHED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
+carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
+moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..b72a3e939
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+
+conn net-net
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	keyexchange=ikev2
+	auto=add
+
+conn rw
+	right=%any
+	rightid=carol@strongswan.org
+	keyexchange=ikev1
+	auto=add
+
diff --git a/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..e5a9fe396
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,15 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn net-net 
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ocsp-strict/posttest.dat b/testing/tests/ike/rw_v1-net_v2/posttest.dat
index 117f625f6..0980371a5 100644
--- a/testing/tests/ocsp-strict/posttest.dat
+++ b/testing/tests/ike/rw_v1-net_v2/posttest.dat
@@ -1,3 +1,3 @@
-moon::ipsec stop
 carol::ipsec stop
-winnetou::killall openssl
+moon::ipsec stop
+sun::ipsec stop
diff --git a/testing/tests/ike/rw_v1-net_v2/pretest.dat b/testing/tests/ike/rw_v1-net_v2/pretest.dat
new file mode 100644
index 000000000..03b8dc218
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/pretest.dat
@@ -0,0 +1,9 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::ipsec start
+sun::ipsec start
+carol::ipsec start
+moon::sleep 1 
+moon::ipsec up net-net
+carol::ipsec up home
+moon::sleep 1
diff --git a/testing/tests/ike/rw_v1-net_v2/test.conf b/testing/tests/ike/rw_v1-net_v2/test.conf
new file mode 100644
index 000000000..983881e5d
--- /dev/null
+++ b/testing/tests/ike/rw_v1-net_v2/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="carol moon sun"
diff --git a/testing/tests/alg-blowfish/description.txt b/testing/tests/ikev1/alg-blowfish/description.txt
index cff0a1915..cff0a1915 100644
--- a/testing/tests/alg-blowfish/description.txt
+++ b/testing/tests/ikev1/alg-blowfish/description.txt
diff --git a/testing/tests/alg-blowfish/evaltest.dat b/testing/tests/ikev1/alg-blowfish/evaltest.dat
index a9c9b803a..a9c9b803a 100644
--- a/testing/tests/alg-blowfish/evaltest.dat
+++ b/testing/tests/ikev1/alg-blowfish/evaltest.dat
diff --git a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf
index fa68c9d3d..04d5b977b 100755
--- a/testing/tests/alg-blowfish/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-blowfish/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf
index 39916a7ba..80163ffcd 100755
--- a/testing/tests/alg-blowfish/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-blowfish/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-blowfish/posttest.dat b/testing/tests/ikev1/alg-blowfish/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/alg-blowfish/posttest.dat
+++ b/testing/tests/ikev1/alg-blowfish/posttest.dat
diff --git a/testing/tests/alg-blowfish/pretest.dat b/testing/tests/ikev1/alg-blowfish/pretest.dat
index 6d2eeb5f9..6d2eeb5f9 100644
--- a/testing/tests/alg-blowfish/pretest.dat
+++ b/testing/tests/ikev1/alg-blowfish/pretest.dat
diff --git a/testing/tests/alg-blowfish/test.conf b/testing/tests/ikev1/alg-blowfish/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/alg-blowfish/test.conf
+++ b/testing/tests/ikev1/alg-blowfish/test.conf
diff --git a/testing/tests/alg-serpent/description.txt b/testing/tests/ikev1/alg-serpent/description.txt
index f49c0a1c0..f49c0a1c0 100644
--- a/testing/tests/alg-serpent/description.txt
+++ b/testing/tests/ikev1/alg-serpent/description.txt
diff --git a/testing/tests/alg-serpent/evaltest.dat b/testing/tests/ikev1/alg-serpent/evaltest.dat
index 6b792538b..6b792538b 100644
--- a/testing/tests/alg-serpent/evaltest.dat
+++ b/testing/tests/ikev1/alg-serpent/evaltest.dat
diff --git a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf
index 5d2369924..09cd583b4 100755
--- a/testing/tests/alg-serpent/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-serpent/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf
index 7bdddf008..ca1eb7b19 100755
--- a/testing/tests/alg-serpent/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-serpent/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
-
+	charonstart=no
+       
 conn %default
 	ikelifetime=60m
 	keylife=20m
diff --git a/testing/tests/alg-serpent/posttest.dat b/testing/tests/ikev1/alg-serpent/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/alg-serpent/posttest.dat
+++ b/testing/tests/ikev1/alg-serpent/posttest.dat
diff --git a/testing/tests/alg-serpent/pretest.dat b/testing/tests/ikev1/alg-serpent/pretest.dat
index 6d2eeb5f9..6d2eeb5f9 100644
--- a/testing/tests/alg-serpent/pretest.dat
+++ b/testing/tests/ikev1/alg-serpent/pretest.dat
diff --git a/testing/tests/alg-serpent/test.conf b/testing/tests/ikev1/alg-serpent/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/alg-serpent/test.conf
+++ b/testing/tests/ikev1/alg-serpent/test.conf
diff --git a/testing/tests/alg-sha-equals-sha1/description.txt b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt
index aeb2e1a88..aeb2e1a88 100644
--- a/testing/tests/alg-sha-equals-sha1/description.txt
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/description.txt
diff --git a/testing/tests/alg-sha-equals-sha1/evaltest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat
index c3656c690..c3656c690 100644
--- a/testing/tests/alg-sha-equals-sha1/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/evaltest.dat
diff --git a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf
index c7328faae..7c1ee3bb5 100755
--- a/testing/tests/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -24,3 +23,4 @@ conn home
 	rightsubnet=10.1.0.0/16
 	rightid=@moon.strongswan.org
 	auto=add
+
diff --git a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf
index 398c07fa9..7d00b538f 100755
--- a/testing/tests/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -24,3 +23,4 @@ conn rw
 	right=%any
 	rightid=carol@strongswan.org
 	auto=add
+
diff --git a/testing/tests/alg-sha-equals-sha1/posttest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/alg-sha-equals-sha1/posttest.dat
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/posttest.dat
diff --git a/testing/tests/alg-sha-equals-sha1/pretest.dat b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/alg-sha-equals-sha1/pretest.dat
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/pretest.dat
diff --git a/testing/tests/alg-sha-equals-sha1/test.conf b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/alg-sha-equals-sha1/test.conf
+++ b/testing/tests/ikev1/alg-sha-equals-sha1/test.conf
diff --git a/testing/tests/alg-sha2_256/description.txt b/testing/tests/ikev1/alg-sha2_256/description.txt
index 900fcf017..900fcf017 100644
--- a/testing/tests/alg-sha2_256/description.txt
+++ b/testing/tests/ikev1/alg-sha2_256/description.txt
diff --git a/testing/tests/alg-sha2_256/evaltest.dat b/testing/tests/ikev1/alg-sha2_256/evaltest.dat
index 9b4caa278..9b4caa278 100644
--- a/testing/tests/alg-sha2_256/evaltest.dat
+++ b/testing/tests/ikev1/alg-sha2_256/evaltest.dat
diff --git a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf
index c55ae8ab1..b10fb08b9 100755
--- a/testing/tests/alg-sha2_256/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha2_256/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf
index 748b1b85c..de832729b 100755
--- a/testing/tests/alg-sha2_256/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-sha2_256/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-sha2_256/posttest.dat b/testing/tests/ikev1/alg-sha2_256/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/alg-sha2_256/posttest.dat
+++ b/testing/tests/ikev1/alg-sha2_256/posttest.dat
diff --git a/testing/tests/alg-sha2_256/pretest.dat b/testing/tests/ikev1/alg-sha2_256/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/alg-sha2_256/pretest.dat
+++ b/testing/tests/ikev1/alg-sha2_256/pretest.dat
diff --git a/testing/tests/alg-sha2_256/test.conf b/testing/tests/ikev1/alg-sha2_256/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/alg-sha2_256/test.conf
+++ b/testing/tests/ikev1/alg-sha2_256/test.conf
diff --git a/testing/tests/alg-twofish/description.txt b/testing/tests/ikev1/alg-twofish/description.txt
index 0015561ee..0015561ee 100644
--- a/testing/tests/alg-twofish/description.txt
+++ b/testing/tests/ikev1/alg-twofish/description.txt
diff --git a/testing/tests/alg-twofish/evaltest.dat b/testing/tests/ikev1/alg-twofish/evaltest.dat
index 0568eec6e..0568eec6e 100644
--- a/testing/tests/alg-twofish/evaltest.dat
+++ b/testing/tests/ikev1/alg-twofish/evaltest.dat
diff --git a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf
index 8e3037a3b..95ddeb2b8 100755
--- a/testing/tests/alg-twofish/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-twofish/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf
index 01004e94e..2d7904563 100755
--- a/testing/tests/alg-twofish/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/alg-twofish/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/alg-twofish/posttest.dat b/testing/tests/ikev1/alg-twofish/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/alg-twofish/posttest.dat
+++ b/testing/tests/ikev1/alg-twofish/posttest.dat
diff --git a/testing/tests/alg-twofish/pretest.dat b/testing/tests/ikev1/alg-twofish/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/alg-twofish/pretest.dat
+++ b/testing/tests/ikev1/alg-twofish/pretest.dat
diff --git a/testing/tests/alg-twofish/test.conf b/testing/tests/ikev1/alg-twofish/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/alg-twofish/test.conf
+++ b/testing/tests/ikev1/alg-twofish/test.conf
diff --git a/testing/tests/attr-cert/description.txt b/testing/tests/ikev1/attr-cert/description.txt
index b7f809c36..b7f809c36 100644
--- a/testing/tests/attr-cert/description.txt
+++ b/testing/tests/ikev1/attr-cert/description.txt
diff --git a/testing/tests/attr-cert/evaltest.dat b/testing/tests/ikev1/attr-cert/evaltest.dat
index 59f6eb76a..59f6eb76a 100644
--- a/testing/tests/attr-cert/evaltest.dat
+++ b/testing/tests/ikev1/attr-cert/evaltest.dat
diff --git a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf
index 62fc49868..eae669641 100755
--- a/testing/tests/attr-cert/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/attr-cert/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf
index 9d932dc54..989784124 100755
--- a/testing/tests/attr-cert/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/attr-cert/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf
index bd72715ff..6c16db587 100755
--- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem
index 3c5c5d91d..3c5c5d91d 100644
--- a/testing/tests/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/ipsec.d/aacerts/aaCert.pem
diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem
index 209b48f3a..209b48f3a 100644
--- a/testing/tests/attr-cert/hosts/moon/etc/openac/aaKey.pem
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/aaKey.pem
diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem
index 8492fbd45..8492fbd45 100644
--- a/testing/tests/attr-cert/hosts/moon/etc/openac/carolCert.pem
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/carolCert.pem
diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem
index abd1554e5..abd1554e5 100644
--- a/testing/tests/attr-cert/hosts/moon/etc/openac/daveCert.pem
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/daveCert.pem
diff --git a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf
index 134218eec..134218eec 100644
--- a/testing/tests/attr-cert/hosts/moon/etc/openac/default.conf
+++ b/testing/tests/ikev1/attr-cert/hosts/moon/etc/openac/default.conf
diff --git a/testing/tests/attr-cert/posttest.dat b/testing/tests/ikev1/attr-cert/posttest.dat
index a59c3ff63..a59c3ff63 100644
--- a/testing/tests/attr-cert/posttest.dat
+++ b/testing/tests/ikev1/attr-cert/posttest.dat
diff --git a/testing/tests/attr-cert/pretest.dat b/testing/tests/ikev1/attr-cert/pretest.dat
index b3fecaf3c..b3fecaf3c 100644
--- a/testing/tests/attr-cert/pretest.dat
+++ b/testing/tests/ikev1/attr-cert/pretest.dat
diff --git a/testing/tests/attr-cert/test.conf b/testing/tests/ikev1/attr-cert/test.conf
index 08e5cc145..08e5cc145 100644
--- a/testing/tests/attr-cert/test.conf
+++ b/testing/tests/ikev1/attr-cert/test.conf
diff --git a/testing/tests/compress/description.txt b/testing/tests/ikev1/compress/description.txt
index 47829839d..47829839d 100644
--- a/testing/tests/compress/description.txt
+++ b/testing/tests/ikev1/compress/description.txt
diff --git a/testing/tests/compress/evaltest.dat b/testing/tests/ikev1/compress/evaltest.dat
index ff72e1762..ff72e1762 100644
--- a/testing/tests/compress/evaltest.dat
+++ b/testing/tests/ikev1/compress/evaltest.dat
diff --git a/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..abf3049d8
--- /dev/null
+++ b/testing/tests/ikev1/compress/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug="control crypt"
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	compress=yes
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/compress/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf
index b8dfae646..855718f5d 100755
--- a/testing/tests/compress/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/compress/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/compress/posttest.dat b/testing/tests/ikev1/compress/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/compress/posttest.dat
+++ b/testing/tests/ikev1/compress/posttest.dat
diff --git a/testing/tests/compress/pretest.dat b/testing/tests/ikev1/compress/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/compress/pretest.dat
+++ b/testing/tests/ikev1/compress/pretest.dat
diff --git a/testing/tests/compress/test.conf b/testing/tests/ikev1/compress/test.conf
index fd33cfb57..fd33cfb57 100644
--- a/testing/tests/compress/test.conf
+++ b/testing/tests/ikev1/compress/test.conf
diff --git a/testing/tests/crl-from-cache/description.txt b/testing/tests/ikev1/crl-from-cache/description.txt
index 17866f572..17866f572 100644
--- a/testing/tests/crl-from-cache/description.txt
+++ b/testing/tests/ikev1/crl-from-cache/description.txt
diff --git a/testing/tests/crl-from-cache/evaltest.dat b/testing/tests/ikev1/crl-from-cache/evaltest.dat
index dd200c8ef..dd200c8ef 100644
--- a/testing/tests/crl-from-cache/evaltest.dat
+++ b/testing/tests/ikev1/crl-from-cache/evaltest.dat
diff --git a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf
index 93c4d7956..59cbe67ba 100755
--- a/testing/tests/crl-from-cache/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-from-cache/hosts/carol/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
 	cachecrls=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf
index ef9237518..9a2efb73d 100755
--- a/testing/tests/crl-from-cache/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-from-cache/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
 	cachecrls=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-from-cache/posttest.dat b/testing/tests/ikev1/crl-from-cache/posttest.dat
index be17847c1..be17847c1 100644
--- a/testing/tests/crl-from-cache/posttest.dat
+++ b/testing/tests/ikev1/crl-from-cache/posttest.dat
diff --git a/testing/tests/crl-from-cache/pretest.dat b/testing/tests/ikev1/crl-from-cache/pretest.dat
index acdb265ed..acdb265ed 100644
--- a/testing/tests/crl-from-cache/pretest.dat
+++ b/testing/tests/ikev1/crl-from-cache/pretest.dat
diff --git a/testing/tests/crl-from-cache/test.conf b/testing/tests/ikev1/crl-from-cache/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/crl-from-cache/test.conf
+++ b/testing/tests/ikev1/crl-from-cache/test.conf
diff --git a/testing/tests/crl-ldap/description.txt b/testing/tests/ikev1/crl-ldap/description.txt
index 02dc0cbbe..02dc0cbbe 100644
--- a/testing/tests/crl-ldap/description.txt
+++ b/testing/tests/ikev1/crl-ldap/description.txt
diff --git a/testing/tests/crl-ldap/evaltest.dat b/testing/tests/ikev1/crl-ldap/evaltest.dat
index 2b98e086a..2b98e086a 100644
--- a/testing/tests/crl-ldap/evaltest.dat
+++ b/testing/tests/ikev1/crl-ldap/evaltest.dat
diff --git a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables
index 571459bae..571459bae 100755
--- a/testing/tests/crl-ldap/hosts/carol/etc/init.d/iptables
+++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/init.d/iptables
diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf
index 669a47d06..40e32f14a 100755
--- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
 	cachecrls=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
index 75e8b0959..75e8b0959 100644
--- a/testing/tests/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
+++ b/testing/tests/ikev1/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
diff --git a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables
index 8de514a2e..8de514a2e 100755
--- a/testing/tests/crl-ldap/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf
index d5c0dd163..eaaaa3f42 100755
--- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
 	cachecrls=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
index 75e8b0959..75e8b0959 100644
--- a/testing/tests/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
+++ b/testing/tests/ikev1/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
diff --git a/testing/tests/crl-ldap/posttest.dat b/testing/tests/ikev1/crl-ldap/posttest.dat
index 04f762331..bddd87424 100644
--- a/testing/tests/crl-ldap/posttest.dat
+++ b/testing/tests/ikev1/crl-ldap/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 winnetou::/etc/init.d/slapd stop
diff --git a/testing/tests/crl-ldap/pretest.dat b/testing/tests/ikev1/crl-ldap/pretest.dat
index 64fa8116b..64fa8116b 100644
--- a/testing/tests/crl-ldap/pretest.dat
+++ b/testing/tests/ikev1/crl-ldap/pretest.dat
diff --git a/testing/tests/crl-ldap/test.conf b/testing/tests/ikev1/crl-ldap/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/crl-ldap/test.conf
+++ b/testing/tests/ikev1/crl-ldap/test.conf
diff --git a/testing/tests/crl-revoked/description.txt b/testing/tests/ikev1/crl-revoked/description.txt
index 780068ce6..780068ce6 100644
--- a/testing/tests/crl-revoked/description.txt
+++ b/testing/tests/ikev1/crl-revoked/description.txt
diff --git a/testing/tests/crl-revoked/evaltest.dat b/testing/tests/ikev1/crl-revoked/evaltest.dat
index 0fd1cae8c..0fd1cae8c 100644
--- a/testing/tests/crl-revoked/evaltest.dat
+++ b/testing/tests/ikev1/crl-revoked/evaltest.dat
diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf
index 5a1d246a6..6b4650fb8 100755
--- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
index 5b742fc9e..5b742fc9e 100644
--- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
+++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
index 8aefcc5a6..8aefcc5a6 100644
--- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
+++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
diff --git a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets
index 8e31be4cb..8e31be4cb 100644
--- a/testing/tests/crl-revoked/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/crl-revoked/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf
index a8953f557..143bace9a 100755
--- a/testing/tests/crl-revoked/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-revoked/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-revoked/posttest.dat b/testing/tests/ikev1/crl-revoked/posttest.dat
index d742e8410..d742e8410 100644
--- a/testing/tests/crl-revoked/posttest.dat
+++ b/testing/tests/ikev1/crl-revoked/posttest.dat
diff --git a/testing/tests/crl-revoked/pretest.dat b/testing/tests/ikev1/crl-revoked/pretest.dat
index d92333d86..d92333d86 100644
--- a/testing/tests/crl-revoked/pretest.dat
+++ b/testing/tests/ikev1/crl-revoked/pretest.dat
diff --git a/testing/tests/crl-revoked/test.conf b/testing/tests/ikev1/crl-revoked/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/crl-revoked/test.conf
+++ b/testing/tests/ikev1/crl-revoked/test.conf
diff --git a/testing/tests/crl-strict/description.txt b/testing/tests/ikev1/crl-strict/description.txt
index 97011482e..97011482e 100644
--- a/testing/tests/crl-strict/description.txt
+++ b/testing/tests/ikev1/crl-strict/description.txt
diff --git a/testing/tests/crl-strict/evaltest.dat b/testing/tests/ikev1/crl-strict/evaltest.dat
index 1d7adb05e..1d7adb05e 100644
--- a/testing/tests/crl-strict/evaltest.dat
+++ b/testing/tests/ikev1/crl-strict/evaltest.dat
diff --git a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf
index 6d0aee86a..93bd80758 100755
--- a/testing/tests/crl-strict/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-strict/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf
index a8953f557..143bace9a 100755
--- a/testing/tests/crl-strict/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-strict/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-strict/posttest.dat b/testing/tests/ikev1/crl-strict/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/crl-strict/posttest.dat
+++ b/testing/tests/ikev1/crl-strict/posttest.dat
diff --git a/testing/tests/crl-strict/pretest.dat b/testing/tests/ikev1/crl-strict/pretest.dat
index d92333d86..d92333d86 100644
--- a/testing/tests/crl-strict/pretest.dat
+++ b/testing/tests/ikev1/crl-strict/pretest.dat
diff --git a/testing/tests/crl-strict/test.conf b/testing/tests/ikev1/crl-strict/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/crl-strict/test.conf
+++ b/testing/tests/ikev1/crl-strict/test.conf
diff --git a/testing/tests/crl-to-cache/description.txt b/testing/tests/ikev1/crl-to-cache/description.txt
index 9f542e73d..9f542e73d 100644
--- a/testing/tests/crl-to-cache/description.txt
+++ b/testing/tests/ikev1/crl-to-cache/description.txt
diff --git a/testing/tests/crl-to-cache/evaltest.dat b/testing/tests/ikev1/crl-to-cache/evaltest.dat
index be7737185..be7737185 100644
--- a/testing/tests/crl-to-cache/evaltest.dat
+++ b/testing/tests/ikev1/crl-to-cache/evaltest.dat
diff --git a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf
index 955f08b1f..e64a8fb5a 100755
--- a/testing/tests/crl-to-cache/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-to-cache/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	cachecrls=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf
index 885354ab5..666fc0698 100755
--- a/testing/tests/crl-to-cache/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/crl-to-cache/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	cachecrls=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/crl-to-cache/posttest.dat b/testing/tests/ikev1/crl-to-cache/posttest.dat
index be17847c1..be17847c1 100644
--- a/testing/tests/crl-to-cache/posttest.dat
+++ b/testing/tests/ikev1/crl-to-cache/posttest.dat
diff --git a/testing/tests/crl-to-cache/pretest.dat b/testing/tests/ikev1/crl-to-cache/pretest.dat
index d92333d86..d92333d86 100644
--- a/testing/tests/crl-to-cache/pretest.dat
+++ b/testing/tests/ikev1/crl-to-cache/pretest.dat
diff --git a/testing/tests/crl-to-cache/test.conf b/testing/tests/ikev1/crl-to-cache/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/crl-to-cache/test.conf
+++ b/testing/tests/ikev1/crl-to-cache/test.conf
diff --git a/testing/tests/default-keys/description.txt b/testing/tests/ikev1/default-keys/description.txt
index 639e909da..639e909da 100644
--- a/testing/tests/default-keys/description.txt
+++ b/testing/tests/ikev1/default-keys/description.txt
diff --git a/testing/tests/self-signed/evaltest.dat b/testing/tests/ikev1/default-keys/evaltest.dat
index f190d7066..a18e3997e 100644
--- a/testing/tests/self-signed/evaltest.dat
+++ b/testing/tests/ikev1/default-keys/evaltest.dat
@@ -1,3 +1,5 @@
+carol::cat /var/log/auth.log::scepclient::YES
+moon::cat /var/log/auth.log::scepclient::YES
 carol::cat /var/log/auth.log::we have a cert but are not sending it::YES
 moon::cat /var/log/auth.log::we have a cert but are not sending it::YES
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
diff --git a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf
index c4bb10a65..0ec9d47ed 100755
--- a/testing/tests/default-keys/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/default-keys/hosts/carol/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=0
 	strictcrlpolicy=no
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables
index 13ad3063f..13ad3063f 100755
--- a/testing/tests/default-keys/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf
index eeeec645b..ed1b40549 100755
--- a/testing/tests/default-keys/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/default-keys/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=0
 	strictcrlpolicy=no
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 	keyingtries=1
 
 conn carol
-	left=192.168.0.1
+	left=PH_IP_MOON
 	leftnexthop=%direct
 	leftcert=selfCert.der
 	leftsendcert=never
diff --git a/testing/tests/default-keys/posttest.dat b/testing/tests/ikev1/default-keys/posttest.dat
index 52b48b9ef..8cada5e7e 100644
--- a/testing/tests/default-keys/posttest.dat
+++ b/testing/tests/ikev1/default-keys/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/default-keys/pretest.dat b/testing/tests/ikev1/default-keys/pretest.dat
index 54f70cbe9..88f9a2ca9 100644
--- a/testing/tests/default-keys/pretest.dat
+++ b/testing/tests/ikev1/default-keys/pretest.dat
@@ -10,7 +10,7 @@ moon::rm /etc/ipsec.d/private/*
 moon::rm /etc/ipsec.d/certs/*
 moon::rm /etc/ipsec.d/cacerts/*
 moon::ipsec start
-moon::sleep 4 
+moon::sleep 5 
 moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der
 moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der
 moon::ipsec reload 
diff --git a/testing/tests/default-keys/test.conf b/testing/tests/ikev1/default-keys/test.conf
index 0baa48d90..0baa48d90 100644
--- a/testing/tests/default-keys/test.conf
+++ b/testing/tests/ikev1/default-keys/test.conf
diff --git a/testing/tests/double-nat-net/description.txt b/testing/tests/ikev1/double-nat-net/description.txt
index ff09155f6..ff09155f6 100644
--- a/testing/tests/double-nat-net/description.txt
+++ b/testing/tests/ikev1/double-nat-net/description.txt
diff --git a/testing/tests/double-nat-net/evaltest.dat b/testing/tests/ikev1/double-nat-net/evaltest.dat
index 41eba6501..d00613c07 100644
--- a/testing/tests/double-nat-net/evaltest.dat
+++ b/testing/tests/ikev1/double-nat-net/evaltest.dat
@@ -1,5 +1,5 @@
 alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES
 bob::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES
-alice::ping -c 1 PH_IP1_SUN::64 bytes from PH_IP1_SUN: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES
 moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
 moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf
index 395e62e7c..5c0763734 100755
--- a/testing/tests/double-nat-net/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev1/double-nat-net/hosts/alice/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf
index 6927a5ce4..e79b2ca35 100755
--- a/testing/tests/double-nat-net/hosts/bob/etc/ipsec.conf
+++ b/testing/tests/ikev1/double-nat-net/hosts/bob/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/double-nat-net/posttest.dat b/testing/tests/ikev1/double-nat-net/posttest.dat
index 0eb2c0d6c..484297418 100644
--- a/testing/tests/double-nat-net/posttest.dat
+++ b/testing/tests/ikev1/double-nat-net/posttest.dat
@@ -1,9 +1,9 @@
-alice::iptables -v -n -L
-bob::iptables -v -n -L
 bob::ipsec stop
 alice::ipsec stop
 alice::/etc/init.d/iptables stop 2> /dev/null
 bob::/etc/init.d/iptables stop 2> /dev/null
 moon::iptables -t nat -F
 sun::iptables -t nat -F
+moon::conntrack -F
+sun::conntrack -F
 sun::ip route del 10.1.0.0/16 via PH_IP_BOB
diff --git a/testing/tests/double-nat-net/pretest.dat b/testing/tests/ikev1/double-nat-net/pretest.dat
index 84bc15092..84bc15092 100644
--- a/testing/tests/double-nat-net/pretest.dat
+++ b/testing/tests/ikev1/double-nat-net/pretest.dat
diff --git a/testing/tests/double-nat-net/test.conf b/testing/tests/ikev1/double-nat-net/test.conf
index 1ca2ffe5a..1ca2ffe5a 100644
--- a/testing/tests/double-nat-net/test.conf
+++ b/testing/tests/ikev1/double-nat-net/test.conf
diff --git a/testing/tests/double-nat/description.txt b/testing/tests/ikev1/double-nat/description.txt
index ce7de0e56..ce7de0e56 100644
--- a/testing/tests/double-nat/description.txt
+++ b/testing/tests/ikev1/double-nat/description.txt
diff --git a/testing/tests/double-nat/evaltest.dat b/testing/tests/ikev1/double-nat/evaltest.dat
index 05e751422..05e751422 100644
--- a/testing/tests/double-nat/evaltest.dat
+++ b/testing/tests/ikev1/double-nat/evaltest.dat
diff --git a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf
index 5b3cddb63..3533c3f8b 100755
--- a/testing/tests/double-nat/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev1/double-nat/hosts/alice/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/double-nat/posttest.dat b/testing/tests/ikev1/double-nat/posttest.dat
index 07f22d07d..5d39e406d 100644
--- a/testing/tests/double-nat/posttest.dat
+++ b/testing/tests/ikev1/double-nat/posttest.dat
@@ -1,8 +1,8 @@
-alice::iptables -v -n -L
-bob::iptables -v -n -L
 bob::ipsec stop
 alice::ipsec stop
 alice::/etc/init.d/iptables stop 2> /dev/null
 bob::/etc/init.d/iptables stop 2> /dev/null
 moon::iptables -t nat -F
 sun::iptables -t nat -F
+moon::conntrack -F
+sun::conntrack -F
diff --git a/testing/tests/double-nat/pretest.dat b/testing/tests/ikev1/double-nat/pretest.dat
index cf495b778..cf495b778 100644
--- a/testing/tests/double-nat/pretest.dat
+++ b/testing/tests/ikev1/double-nat/pretest.dat
diff --git a/testing/tests/double-nat/test.conf b/testing/tests/ikev1/double-nat/test.conf
index 1ca2ffe5a..1ca2ffe5a 100644
--- a/testing/tests/double-nat/test.conf
+++ b/testing/tests/ikev1/double-nat/test.conf
diff --git a/testing/tests/dpd-clear/description.txt b/testing/tests/ikev1/dpd-clear/description.txt
index f76b2d741..f76b2d741 100644
--- a/testing/tests/dpd-clear/description.txt
+++ b/testing/tests/ikev1/dpd-clear/description.txt
diff --git a/testing/tests/dpd-clear/evaltest.dat b/testing/tests/ikev1/dpd-clear/evaltest.dat
index da3567d3e..98d5b146b 100644
--- a/testing/tests/dpd-clear/evaltest.dat
+++ b/testing/tests/ikev1/dpd-clear/evaltest.dat
@@ -1,6 +1,5 @@
 carol::ipsec status::STATE_MAIN_I4 (ISAKMP SA established)::YES
 carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
-moon::ipsec statusall::DPD active::YES
 moon::sleep 50::no output expected::NO
 moon::cat /var/log/auth.log::inserting event EVENT_DPD::YES
 moon::cat /var/log/auth.log::DPD: No response from peer - declaring peer dead::YES
diff --git a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf
index cac521c8f..281293545 100755
--- a/testing/tests/dpd-clear/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/dpd-clear/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/dpd-clear/posttest.dat b/testing/tests/ikev1/dpd-clear/posttest.dat
index 931db4272..931db4272 100644
--- a/testing/tests/dpd-clear/posttest.dat
+++ b/testing/tests/ikev1/dpd-clear/posttest.dat
diff --git a/testing/tests/dpd-clear/pretest.dat b/testing/tests/ikev1/dpd-clear/pretest.dat
index 14ed95322..14ed95322 100644
--- a/testing/tests/dpd-clear/pretest.dat
+++ b/testing/tests/ikev1/dpd-clear/pretest.dat
diff --git a/testing/tests/dpd-clear/test.conf b/testing/tests/ikev1/dpd-clear/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/dpd-clear/test.conf
+++ b/testing/tests/ikev1/dpd-clear/test.conf
diff --git a/testing/tests/esp-ah-transport/description.txt b/testing/tests/ikev1/esp-ah-transport/description.txt
index c7918fa38..c7918fa38 100644
--- a/testing/tests/esp-ah-transport/description.txt
+++ b/testing/tests/ikev1/esp-ah-transport/description.txt
diff --git a/testing/tests/esp-ah-transport/evaltest.dat b/testing/tests/ikev1/esp-ah-transport/evaltest.dat
index 7c498ad83..7c498ad83 100644
--- a/testing/tests/esp-ah-transport/evaltest.dat
+++ b/testing/tests/ikev1/esp-ah-transport/evaltest.dat
diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables
index 8c8817539..8c8817539 100755
--- a/testing/tests/esp-ah-transport/hosts/carol/etc/init.d/iptables
+++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/init.d/iptables
diff --git a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf
index 13ab3e07f..21f56705c 100755
--- a/testing/tests/esp-ah-transport/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-ah-transport/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables
index 3e8922581..3e8922581 100755
--- a/testing/tests/esp-ah-transport/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf
index 809f3c74b..274a1aa18 100755
--- a/testing/tests/esp-ah-transport/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-ah-transport/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-ah-transport/posttest.dat b/testing/tests/ikev1/esp-ah-transport/posttest.dat
index 26848212b..94a400606 100644
--- a/testing/tests/esp-ah-transport/posttest.dat
+++ b/testing/tests/ikev1/esp-ah-transport/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/esp-ah-transport/pretest.dat b/testing/tests/ikev1/esp-ah-transport/pretest.dat
index bd68efb0b..bd68efb0b 100644
--- a/testing/tests/esp-ah-transport/pretest.dat
+++ b/testing/tests/ikev1/esp-ah-transport/pretest.dat
diff --git a/testing/tests/esp-ah-transport/test.conf b/testing/tests/ikev1/esp-ah-transport/test.conf
index fd33cfb57..fd33cfb57 100644
--- a/testing/tests/esp-ah-transport/test.conf
+++ b/testing/tests/ikev1/esp-ah-transport/test.conf
diff --git a/testing/tests/esp-ah-tunnel/description.txt b/testing/tests/ikev1/esp-ah-tunnel/description.txt
index 809f28c57..809f28c57 100644
--- a/testing/tests/esp-ah-tunnel/description.txt
+++ b/testing/tests/ikev1/esp-ah-tunnel/description.txt
diff --git a/testing/tests/esp-ah-tunnel/evaltest.dat b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat
index 8f4a99641..8f4a99641 100644
--- a/testing/tests/esp-ah-tunnel/evaltest.dat
+++ b/testing/tests/ikev1/esp-ah-tunnel/evaltest.dat
diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables
index 8c8817539..8c8817539 100755
--- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/init.d/iptables
+++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/init.d/iptables
diff --git a/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..8c72a7b7f
--- /dev/null
+++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	auth=ah
+	ike=aes128-sha
+	esp=aes128-sha1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables
index 3e8922581..3e8922581 100755
--- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf
index 7f976376d..ccf8e91fa 100755
--- a/testing/tests/esp-ah-tunnel/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-ah-tunnel/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-ah-tunnel/posttest.dat b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat
index 26848212b..94a400606 100644
--- a/testing/tests/esp-ah-tunnel/posttest.dat
+++ b/testing/tests/ikev1/esp-ah-tunnel/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/esp-ah-tunnel/pretest.dat b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat
index bd68efb0b..bd68efb0b 100644
--- a/testing/tests/esp-ah-tunnel/pretest.dat
+++ b/testing/tests/ikev1/esp-ah-tunnel/pretest.dat
diff --git a/testing/tests/esp-ah-tunnel/test.conf b/testing/tests/ikev1/esp-ah-tunnel/test.conf
index fd33cfb57..fd33cfb57 100644
--- a/testing/tests/esp-ah-tunnel/test.conf
+++ b/testing/tests/ikev1/esp-ah-tunnel/test.conf
diff --git a/testing/tests/esp-alg-des/description.txt b/testing/tests/ikev1/esp-alg-des/description.txt
index 9546569dd..9546569dd 100644
--- a/testing/tests/esp-alg-des/description.txt
+++ b/testing/tests/ikev1/esp-alg-des/description.txt
diff --git a/testing/tests/esp-alg-des/evaltest.dat b/testing/tests/ikev1/esp-alg-des/evaltest.dat
index 8e06392f1..8e06392f1 100644
--- a/testing/tests/esp-alg-des/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-des/evaltest.dat
diff --git a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf
index b4f067b6d..b8ef03cfe 100755
--- a/testing/tests/esp-alg-des/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-des/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf
index 9513f810d..3ac0bf4cf 100755
--- a/testing/tests/esp-alg-des/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-des/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-des/posttest.dat b/testing/tests/ikev1/esp-alg-des/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/esp-alg-des/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-des/posttest.dat
diff --git a/testing/tests/esp-alg-des/pretest.dat b/testing/tests/ikev1/esp-alg-des/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/esp-alg-des/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-des/pretest.dat
diff --git a/testing/tests/esp-alg-des/test.conf b/testing/tests/ikev1/esp-alg-des/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/esp-alg-des/test.conf
+++ b/testing/tests/ikev1/esp-alg-des/test.conf
diff --git a/testing/tests/esp-alg-null/description.txt b/testing/tests/ikev1/esp-alg-null/description.txt
index 7880a799c..7880a799c 100644
--- a/testing/tests/esp-alg-null/description.txt
+++ b/testing/tests/ikev1/esp-alg-null/description.txt
diff --git a/testing/tests/esp-alg-null/evaltest.dat b/testing/tests/ikev1/esp-alg-null/evaltest.dat
index de2f2a571..de2f2a571 100644
--- a/testing/tests/esp-alg-null/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-null/evaltest.dat
diff --git a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf
index b732eba93..7a8ae37c9 100755
--- a/testing/tests/esp-alg-null/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-null/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf
index af11591a1..187a3fb17 100755
--- a/testing/tests/esp-alg-null/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-null/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-null/posttest.dat b/testing/tests/ikev1/esp-alg-null/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/esp-alg-null/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-null/posttest.dat
diff --git a/testing/tests/esp-alg-weak/pretest.dat b/testing/tests/ikev1/esp-alg-null/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/esp-alg-weak/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-null/pretest.dat
diff --git a/testing/tests/esp-alg-null/test.conf b/testing/tests/ikev1/esp-alg-null/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/esp-alg-null/test.conf
+++ b/testing/tests/ikev1/esp-alg-null/test.conf
diff --git a/testing/tests/esp-alg-strict-fail/description.txt b/testing/tests/ikev1/esp-alg-strict-fail/description.txt
index 03c655480..03c655480 100644
--- a/testing/tests/esp-alg-strict-fail/description.txt
+++ b/testing/tests/ikev1/esp-alg-strict-fail/description.txt
diff --git a/testing/tests/esp-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat
index 6f2024ff9..6f2024ff9 100644
--- a/testing/tests/esp-alg-strict-fail/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-strict-fail/evaltest.dat
diff --git a/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..4ed2fb645
--- /dev/null
+++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	ike=3des-sha
+	esp=3des-sha1
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf
index 2dd1c763a..f8c27ad7c 100755
--- a/testing/tests/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-strict-fail/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-strict-fail/posttest.dat b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/esp-alg-strict-fail/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-strict-fail/posttest.dat
diff --git a/testing/tests/esp-alg-null/pretest.dat b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat
index f5aa989fe..f5aa989fe 100644
--- a/testing/tests/esp-alg-null/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-strict-fail/pretest.dat
diff --git a/testing/tests/esp-alg-strict-fail/test.conf b/testing/tests/ikev1/esp-alg-strict-fail/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/esp-alg-strict-fail/test.conf
+++ b/testing/tests/ikev1/esp-alg-strict-fail/test.conf
diff --git a/testing/tests/esp-alg-strict/description.txt b/testing/tests/ikev1/esp-alg-strict/description.txt
index b4fc08253..b4fc08253 100644
--- a/testing/tests/esp-alg-strict/description.txt
+++ b/testing/tests/ikev1/esp-alg-strict/description.txt
diff --git a/testing/tests/esp-alg-strict/evaltest.dat b/testing/tests/ikev1/esp-alg-strict/evaltest.dat
index d5dd12d4e..d5dd12d4e 100644
--- a/testing/tests/esp-alg-strict/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-strict/evaltest.dat
diff --git a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf
index 5a14de070..da86d14df 100755
--- a/testing/tests/esp-alg-strict/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-strict/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf
index 2dd1c763a..f8c27ad7c 100755
--- a/testing/tests/esp-alg-strict/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-strict/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-strict/posttest.dat b/testing/tests/ikev1/esp-alg-strict/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/esp-alg-strict/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-strict/posttest.dat
diff --git a/testing/tests/esp-alg-strict-fail/pretest.dat b/testing/tests/ikev1/esp-alg-strict/pretest.dat
index f5aa989fe..f5aa989fe 100644
--- a/testing/tests/esp-alg-strict-fail/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-strict/pretest.dat
diff --git a/testing/tests/esp-alg-strict/test.conf b/testing/tests/ikev1/esp-alg-strict/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/esp-alg-strict/test.conf
+++ b/testing/tests/ikev1/esp-alg-strict/test.conf
diff --git a/testing/tests/esp-alg-weak/description.txt b/testing/tests/ikev1/esp-alg-weak/description.txt
index ffb6882f5..ffb6882f5 100644
--- a/testing/tests/esp-alg-weak/description.txt
+++ b/testing/tests/ikev1/esp-alg-weak/description.txt
diff --git a/testing/tests/esp-alg-weak/evaltest.dat b/testing/tests/ikev1/esp-alg-weak/evaltest.dat
index 72b14e805..72b14e805 100644
--- a/testing/tests/esp-alg-weak/evaltest.dat
+++ b/testing/tests/ikev1/esp-alg-weak/evaltest.dat
diff --git a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf
index b4f067b6d..b8ef03cfe 100755
--- a/testing/tests/esp-alg-weak/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-weak/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf
index 3f07213ae..691b6b74f 100755
--- a/testing/tests/esp-alg-weak/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/esp-alg-weak/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/esp-alg-weak/posttest.dat b/testing/tests/ikev1/esp-alg-weak/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/esp-alg-weak/posttest.dat
+++ b/testing/tests/ikev1/esp-alg-weak/posttest.dat
diff --git a/testing/tests/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/esp-alg-weak/pretest.dat
index 7d077c126..7d077c126 100644
--- a/testing/tests/ike-alg-sha2_512/pretest.dat
+++ b/testing/tests/ikev1/esp-alg-weak/pretest.dat
diff --git a/testing/tests/esp-alg-weak/test.conf b/testing/tests/ikev1/esp-alg-weak/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/esp-alg-weak/test.conf
+++ b/testing/tests/ikev1/esp-alg-weak/test.conf
diff --git a/testing/tests/host2host-cert/description.txt b/testing/tests/ikev1/host2host-cert/description.txt
index 6be21bf8f..6be21bf8f 100644
--- a/testing/tests/host2host-cert/description.txt
+++ b/testing/tests/ikev1/host2host-cert/description.txt
diff --git a/testing/tests/host2host-cert/evaltest.dat b/testing/tests/ikev1/host2host-cert/evaltest.dat
index d19f970f2..d19f970f2 100644
--- a/testing/tests/host2host-cert/evaltest.dat
+++ b/testing/tests/ikev1/host2host-cert/evaltest.dat
diff --git a/testing/tests/host2host-transport/posttest.dat b/testing/tests/ikev1/host2host-cert/posttest.dat
index 52979508d..5a9150bc8 100644
--- a/testing/tests/host2host-transport/posttest.dat
+++ b/testing/tests/ikev1/host2host-cert/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/host2host-cert/pretest.dat b/testing/tests/ikev1/host2host-cert/pretest.dat
index 3536fd886..3536fd886 100644
--- a/testing/tests/host2host-cert/pretest.dat
+++ b/testing/tests/ikev1/host2host-cert/pretest.dat
diff --git a/testing/tests/host2host-cert/test.conf b/testing/tests/ikev1/host2host-cert/test.conf
index cf2e704fd..cf2e704fd 100644
--- a/testing/tests/host2host-cert/test.conf
+++ b/testing/tests/ikev1/host2host-cert/test.conf
diff --git a/testing/tests/host2host-swapped/description.txt b/testing/tests/ikev1/host2host-swapped/description.txt
index 34cfe43cc..34cfe43cc 100644
--- a/testing/tests/host2host-swapped/description.txt
+++ b/testing/tests/ikev1/host2host-swapped/description.txt
diff --git a/testing/tests/host2host-swapped/evaltest.dat b/testing/tests/ikev1/host2host-swapped/evaltest.dat
index d19f970f2..d19f970f2 100644
--- a/testing/tests/host2host-swapped/evaltest.dat
+++ b/testing/tests/ikev1/host2host-swapped/evaltest.dat
diff --git a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf
index 4b66a5ecb..10597bc58 100755
--- a/testing/tests/host2host-swapped/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/host2host-swapped/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf
index a58894b33..45121d967 100755
--- a/testing/tests/host2host-swapped/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/host2host-swapped/hosts/sun/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-cert/posttest.dat b/testing/tests/ikev1/host2host-swapped/posttest.dat
index 52979508d..5a9150bc8 100644
--- a/testing/tests/net2net-cert/posttest.dat
+++ b/testing/tests/ikev1/host2host-swapped/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/host2host-swapped/pretest.dat b/testing/tests/ikev1/host2host-swapped/pretest.dat
index e2d98f2eb..e2d98f2eb 100644
--- a/testing/tests/host2host-swapped/pretest.dat
+++ b/testing/tests/ikev1/host2host-swapped/pretest.dat
diff --git a/testing/tests/host2host-swapped/test.conf b/testing/tests/ikev1/host2host-swapped/test.conf
index cf2e704fd..cf2e704fd 100644
--- a/testing/tests/host2host-swapped/test.conf
+++ b/testing/tests/ikev1/host2host-swapped/test.conf
diff --git a/testing/tests/host2host-transport/description.txt b/testing/tests/ikev1/host2host-transport/description.txt
index fe3482c96..fe3482c96 100644
--- a/testing/tests/host2host-transport/description.txt
+++ b/testing/tests/ikev1/host2host-transport/description.txt
diff --git a/testing/tests/host2host-transport/evaltest.dat b/testing/tests/ikev1/host2host-transport/evaltest.dat
index d19f970f2..d19f970f2 100644
--- a/testing/tests/host2host-transport/evaltest.dat
+++ b/testing/tests/ikev1/host2host-transport/evaltest.dat
diff --git a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf
index af5000fa8..44ac885ce 100755
--- a/testing/tests/host2host-transport/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/host2host-transport/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf
index 10bea9847..a89e799bd 100755
--- a/testing/tests/host2host-transport/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/host2host-transport/hosts/sun/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/host2host-cert/posttest.dat b/testing/tests/ikev1/host2host-transport/posttest.dat
index 52979508d..5a9150bc8 100644
--- a/testing/tests/host2host-cert/posttest.dat
+++ b/testing/tests/ikev1/host2host-transport/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/host2host-transport/pretest.dat b/testing/tests/ikev1/host2host-transport/pretest.dat
index e2d98f2eb..e2d98f2eb 100644
--- a/testing/tests/host2host-transport/pretest.dat
+++ b/testing/tests/ikev1/host2host-transport/pretest.dat
diff --git a/testing/tests/host2host-transport/test.conf b/testing/tests/ikev1/host2host-transport/test.conf
index cf2e704fd..cf2e704fd 100644
--- a/testing/tests/host2host-transport/test.conf
+++ b/testing/tests/ikev1/host2host-transport/test.conf
diff --git a/testing/tests/ike-alg-sha2_384/description.txt b/testing/tests/ikev1/ike-alg-sha2_384/description.txt
index a347a3fed..a347a3fed 100644
--- a/testing/tests/ike-alg-sha2_384/description.txt
+++ b/testing/tests/ikev1/ike-alg-sha2_384/description.txt
diff --git a/testing/tests/ike-alg-sha2_384/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat
index 31959f53a..31959f53a 100644
--- a/testing/tests/ike-alg-sha2_384/evaltest.dat
+++ b/testing/tests/ikev1/ike-alg-sha2_384/evaltest.dat
diff --git a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf
index 027ad4fd2..2bf2f8740 100755
--- a/testing/tests/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf
index 46742d8fb..5baf8f1d9 100755
--- a/testing/tests/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_384/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-sha2_384/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/ike-alg-sha2_384/posttest.dat
+++ b/testing/tests/ikev1/ike-alg-sha2_384/posttest.dat
diff --git a/testing/tests/ike-alg-sha2_384/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat
index 87e219e73..7d077c126 100644
--- a/testing/tests/ike-alg-sha2_384/pretest.dat
+++ b/testing/tests/ikev1/ike-alg-sha2_384/pretest.dat
@@ -1,5 +1,5 @@
 moon::echo 1 > /proc/sys/net/ipv4/ip_forward
 carol::ipsec start
 moon::ipsec start
-carol::sleep 3 
+carol::sleep 2
 carol::ipsec up home
diff --git a/testing/tests/ike-alg-sha2_384/test.conf b/testing/tests/ikev1/ike-alg-sha2_384/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/ike-alg-sha2_384/test.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_384/test.conf
diff --git a/testing/tests/ike-alg-sha2_512/description.txt b/testing/tests/ikev1/ike-alg-sha2_512/description.txt
index 1bec4b8c6..1bec4b8c6 100644
--- a/testing/tests/ike-alg-sha2_512/description.txt
+++ b/testing/tests/ikev1/ike-alg-sha2_512/description.txt
diff --git a/testing/tests/ike-alg-sha2_512/evaltest.dat b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat
index dbd35429c..dbd35429c 100644
--- a/testing/tests/ike-alg-sha2_512/evaltest.dat
+++ b/testing/tests/ikev1/ike-alg-sha2_512/evaltest.dat
diff --git a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf
index 1f73cdc21..8b1052f91 100755
--- a/testing/tests/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf
index 90911997e..62b93c428 100755
--- a/testing/tests/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_512/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug="control crypt"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-sha2_512/posttest.dat b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/ike-alg-sha2_512/posttest.dat
+++ b/testing/tests/ikev1/ike-alg-sha2_512/posttest.dat
diff --git a/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat
new file mode 100644
index 000000000..7d077c126
--- /dev/null
+++ b/testing/tests/ikev1/ike-alg-sha2_512/pretest.dat
@@ -0,0 +1,5 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+carol::ipsec start
+moon::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ike-alg-sha2_512/test.conf b/testing/tests/ikev1/ike-alg-sha2_512/test.conf
index a6c8f026c..a6c8f026c 100644
--- a/testing/tests/ike-alg-sha2_512/test.conf
+++ b/testing/tests/ikev1/ike-alg-sha2_512/test.conf
diff --git a/testing/tests/ike-alg-strict-fail/description.txt b/testing/tests/ikev1/ike-alg-strict-fail/description.txt
index 03c655480..03c655480 100644
--- a/testing/tests/ike-alg-strict-fail/description.txt
+++ b/testing/tests/ikev1/ike-alg-strict-fail/description.txt
diff --git a/testing/tests/ike-alg-strict-fail/evaltest.dat b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat
index 931b8855a..931b8855a 100644
--- a/testing/tests/ike-alg-strict-fail/evaltest.dat
+++ b/testing/tests/ikev1/ike-alg-strict-fail/evaltest.dat
diff --git a/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..4ed2fb645
--- /dev/null
+++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	ike=3des-sha
+	esp=3des-sha1
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf
index 85cd235dc..1a8b0b966 100755
--- a/testing/tests/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-strict-fail/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-strict-fail/posttest.dat b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/ike-alg-strict-fail/posttest.dat
+++ b/testing/tests/ikev1/ike-alg-strict-fail/posttest.dat
diff --git a/testing/tests/esp-alg-strict/pretest.dat b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat
index f5aa989fe..f5aa989fe 100644
--- a/testing/tests/esp-alg-strict/pretest.dat
+++ b/testing/tests/ikev1/ike-alg-strict-fail/pretest.dat
diff --git a/testing/tests/ike-alg-strict-fail/test.conf b/testing/tests/ikev1/ike-alg-strict-fail/test.conf
index 7e7848831..7e7848831 100644
--- a/testing/tests/ike-alg-strict-fail/test.conf
+++ b/testing/tests/ikev1/ike-alg-strict-fail/test.conf
diff --git a/testing/tests/ike-alg-strict/description.txt b/testing/tests/ikev1/ike-alg-strict/description.txt
index 35d266e20..35d266e20 100644
--- a/testing/tests/ike-alg-strict/description.txt
+++ b/testing/tests/ikev1/ike-alg-strict/description.txt
diff --git a/testing/tests/ike-alg-strict/evaltest.dat b/testing/tests/ikev1/ike-alg-strict/evaltest.dat
index 46140be8a..46140be8a 100644
--- a/testing/tests/ike-alg-strict/evaltest.dat
+++ b/testing/tests/ikev1/ike-alg-strict/evaltest.dat
diff --git a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf
index 5a14de070..da86d14df 100755
--- a/testing/tests/ike-alg-strict/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-strict/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf
index 85cd235dc..1a8b0b966 100755
--- a/testing/tests/ike-alg-strict/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ike-alg-strict/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ike-alg-strict/posttest.dat b/testing/tests/ikev1/ike-alg-strict/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/ike-alg-strict/posttest.dat
+++ b/testing/tests/ikev1/ike-alg-strict/posttest.dat
diff --git a/testing/tests/ike-alg-strict-fail/pretest.dat b/testing/tests/ikev1/ike-alg-strict/pretest.dat
index f5aa989fe..f5aa989fe 100644
--- a/testing/tests/ike-alg-strict-fail/pretest.dat
+++ b/testing/tests/ikev1/ike-alg-strict/pretest.dat
diff --git a/testing/tests/ike-alg-strict/test.conf b/testing/tests/ikev1/ike-alg-strict/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/ike-alg-strict/test.conf
+++ b/testing/tests/ikev1/ike-alg-strict/test.conf
diff --git a/testing/tests/mode-config-push/description.txt b/testing/tests/ikev1/mode-config-push/description.txt
index 387c3b409..387c3b409 100644
--- a/testing/tests/mode-config-push/description.txt
+++ b/testing/tests/ikev1/mode-config-push/description.txt
diff --git a/testing/tests/mode-config-push/evaltest.dat b/testing/tests/ikev1/mode-config-push/evaltest.dat
index 7de32d681..7de32d681 100644
--- a/testing/tests/mode-config-push/evaltest.dat
+++ b/testing/tests/ikev1/mode-config-push/evaltest.dat
diff --git a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf
index d66c4d329..db8cfd5c4 100755
--- a/testing/tests/mode-config-push/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-push/hosts/carol/etc/ipsec.conf
@@ -1,18 +1,16 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
-	modeconfig=push
 
 conn home
 	left=PH_IP_CAROL
@@ -24,6 +22,7 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	rightid=@moon.strongswan.org
+	modeconfig=push
 	auto=add
 
 
diff --git a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf
index bf2625148..cc330b47f 100755
--- a/testing/tests/mode-config-push/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-push/hosts/dave/etc/ipsec.conf
@@ -1,18 +1,16 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
-	modeconfig=push
 
 conn home
 	left=PH_IP_DAVE
@@ -24,6 +22,7 @@ conn home
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
 	rightid=@moon.strongswan.org
+	modeconfig=push
 	auto=add
 
 
diff --git a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf
index 3416c5d68..3de856642 100755
--- a/testing/tests/mode-config-push/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-push/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 	modeconfig=push
 	left=PH_IP_MOON
 	leftsubnet=10.1.0.0/16
-	leftsourceip=PH_IP1_MOON
+	leftsourceip=PH_IP_MOON1
 	leftnexthop=%direct
 	leftcert=moonCert.pem
 	leftid=@moon.strongswan.org
@@ -24,11 +23,11 @@ conn %default
 conn rw-carol
 	right=%any
 	rightid=carol@strongswan.org
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 	auto=add
 
 conn rw-dave
 	right=%any
 	rightid=dave@strongswan.org
-	rightsourceip=PH_IP1_DAVE
+	rightsourceip=PH_IP_DAVE1
 	auto=add
diff --git a/testing/tests/ikev1/mode-config-push/posttest.dat b/testing/tests/ikev1/mode-config-push/posttest.dat
new file mode 100644
index 000000000..42fa8359b
--- /dev/null
+++ b/testing/tests/ikev1/mode-config-push/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
diff --git a/testing/tests/mode-config-swapped/pretest.dat b/testing/tests/ikev1/mode-config-push/pretest.dat
index 1e45f00fd..bb222992e 100644
--- a/testing/tests/mode-config-swapped/pretest.dat
+++ b/testing/tests/ikev1/mode-config-push/pretest.dat
@@ -7,3 +7,4 @@ moon::ipsec start
 carol::sleep 2
 carol::ipsec up home
 dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/mode-config-push/test.conf b/testing/tests/ikev1/mode-config-push/test.conf
index 1a8f2a4e0..1a8f2a4e0 100644
--- a/testing/tests/mode-config-push/test.conf
+++ b/testing/tests/ikev1/mode-config-push/test.conf
diff --git a/testing/tests/mode-config-swapped/description.txt b/testing/tests/ikev1/mode-config-swapped/description.txt
index e29e6f654..e29e6f654 100644
--- a/testing/tests/mode-config-swapped/description.txt
+++ b/testing/tests/ikev1/mode-config-swapped/description.txt
diff --git a/testing/tests/starter-includes/evaltest.dat b/testing/tests/ikev1/mode-config-swapped/evaltest.dat
index 7de32d681..9d60cf7b0 100644
--- a/testing/tests/starter-includes/evaltest.dat
+++ b/testing/tests/ikev1/mode-config-swapped/evaltest.dat
@@ -1,7 +1,7 @@
-carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES
+carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES
+dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES
 dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
 moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES
diff --git a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf
index bee23f4df..3bcc0ff25 100755
--- a/testing/tests/mode-config-swapped/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-swapped/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf
index 698cd9673..7933ef15a 100755
--- a/testing/tests/mode-config-swapped/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-swapped/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf
index b9e401080..53b81a534 100755
--- a/testing/tests/mode-config-swapped/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config-swapped/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -14,7 +13,7 @@ conn %default
 	keyingtries=1
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
-	rightsourceip=PH_IP1_MOON
+	rightsourceip=PH_IP_MOON1
 	rightnexthop=%direct
 	rightcert=moonCert.pem
 	rightid=@moon.strongswan.org
@@ -23,11 +22,11 @@ conn %default
 conn rw-carol
 	left=%any
 	leftid=carol@strongswan.org
-	leftsourceip=PH_IP1_CAROL
+	leftsourceip=PH_IP_CAROL1
 	auto=add
 
 conn rw-dave
 	left=%any
 	leftid=dave@strongswan.org
-	leftsourceip=PH_IP1_DAVE
+	leftsourceip=PH_IP_DAVE1
 	auto=add
diff --git a/testing/tests/ikev1/mode-config-swapped/posttest.dat b/testing/tests/ikev1/mode-config-swapped/posttest.dat
new file mode 100644
index 000000000..42fa8359b
--- /dev/null
+++ b/testing/tests/ikev1/mode-config-swapped/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
diff --git a/testing/tests/mode-config-push/pretest.dat b/testing/tests/ikev1/mode-config-swapped/pretest.dat
index 1e45f00fd..1e45f00fd 100644
--- a/testing/tests/mode-config-push/pretest.dat
+++ b/testing/tests/ikev1/mode-config-swapped/pretest.dat
diff --git a/testing/tests/mode-config-swapped/test.conf b/testing/tests/ikev1/mode-config-swapped/test.conf
index 1a8f2a4e0..1a8f2a4e0 100644
--- a/testing/tests/mode-config-swapped/test.conf
+++ b/testing/tests/ikev1/mode-config-swapped/test.conf
diff --git a/testing/tests/mode-config/description.txt b/testing/tests/ikev1/mode-config/description.txt
index 3e67f83f1..3e67f83f1 100644
--- a/testing/tests/mode-config/description.txt
+++ b/testing/tests/ikev1/mode-config/description.txt
diff --git a/testing/tests/mode-config/evaltest.dat b/testing/tests/ikev1/mode-config/evaltest.dat
index 7de32d681..9d60cf7b0 100644
--- a/testing/tests/mode-config/evaltest.dat
+++ b/testing/tests/ikev1/mode-config/evaltest.dat
@@ -1,7 +1,7 @@
-carol::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.1::YES
+carol::cat /var/log/auth.log::setting virtual IP source address to PH_IP_CAROL1::YES
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-dave::cat /var/log/auth.log::setting virtual IP source address to 10.3.0.2::YES
+dave::cat /var/log/auth.log::setting virtual IP source address to PH_IP_DAVE1::YES
 dave::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
 moon::ipsec status::rw-carol.*STATE_QUICK_R2.*IPsec SA established::YES
diff --git a/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..2fd734579
--- /dev/null
+++ b/testing/tests/ikev1/mode-config/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftsourceip=%modeconfig
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+
+
+
diff --git a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf
index da601389c..128c4aa29 100755
--- a/testing/tests/starter-includes/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf
index 49333e217..3367544eb 100755
--- a/testing/tests/mode-config/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/mode-config/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -14,7 +13,7 @@ conn %default
 	keyingtries=1
 	left=PH_IP_MOON
 	leftsubnet=10.1.0.0/16
-	leftsourceip=PH_IP1_MOON
+	leftsourceip=PH_IP_MOON1
 	leftnexthop=%direct
 	leftcert=moonCert.pem
 	leftid=@moon.strongswan.org
@@ -23,11 +22,11 @@ conn %default
 conn rw-carol
 	right=%any
 	rightid=carol@strongswan.org
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 	auto=add
 
 conn rw-dave
 	right=%any
 	rightid=dave@strongswan.org
-	rightsourceip=PH_IP1_DAVE
+	rightsourceip=PH_IP_DAVE1
 	auto=add
diff --git a/testing/tests/ikev1/mode-config/posttest.dat b/testing/tests/ikev1/mode-config/posttest.dat
new file mode 100644
index 000000000..42fa8359b
--- /dev/null
+++ b/testing/tests/ikev1/mode-config/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
diff --git a/testing/tests/mode-config/pretest.dat b/testing/tests/ikev1/mode-config/pretest.dat
index 1e45f00fd..bb222992e 100644
--- a/testing/tests/mode-config/pretest.dat
+++ b/testing/tests/ikev1/mode-config/pretest.dat
@@ -7,3 +7,4 @@ moon::ipsec start
 carol::sleep 2
 carol::ipsec up home
 dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/mode-config/test.conf b/testing/tests/ikev1/mode-config/test.conf
index 1a8f2a4e0..1a8f2a4e0 100644
--- a/testing/tests/mode-config/test.conf
+++ b/testing/tests/ikev1/mode-config/test.conf
diff --git a/testing/tests/multi-level-ca-ldap/description.txt b/testing/tests/ikev1/multi-level-ca-ldap/description.txt
index 18fb88840..18fb88840 100644
--- a/testing/tests/multi-level-ca-ldap/description.txt
+++ b/testing/tests/ikev1/multi-level-ca-ldap/description.txt
diff --git a/testing/tests/multi-level-ca-ldap/evaltest.dat b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat
index f504706e2..f504706e2 100644
--- a/testing/tests/multi-level-ca-ldap/evaltest.dat
+++ b/testing/tests/ikev1/multi-level-ca-ldap/evaltest.dat
diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf
index 222c3cf67..2917edd8a 100755
--- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 ca strongswan
         cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem
index 2990d6a12..2990d6a12 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/certs/carolCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem
index b91f9bf81..b91f9bf81 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf
index bfa0ebba3..3c8227f19 100755
--- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem
index b76032480..b76032480 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/certs/daveCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem
index 022436de4..022436de4 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/dave/etc/ipsec.d/private/daveKey.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables
index 8de514a2e..8de514a2e 100755
--- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf
index e2b60589b..9b1d03320 100755
--- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
index 154cff654..154cff654 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
index e50477872..e50477872 100644
--- a/testing/tests/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-ldap/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
diff --git a/testing/tests/multi-level-ca-ldap/posttest.dat b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat
index e618fc419..ec4ba6e10 100644
--- a/testing/tests/multi-level-ca-ldap/posttest.dat
+++ b/testing/tests/ikev1/multi-level-ca-ldap/posttest.dat
@@ -1,4 +1,3 @@
-moon::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/multi-level-ca-ldap/pretest.dat b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat
index 322f42102..322f42102 100644
--- a/testing/tests/multi-level-ca-ldap/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-ldap/pretest.dat
diff --git a/testing/tests/multi-level-ca-ldap/test.conf b/testing/tests/ikev1/multi-level-ca-ldap/test.conf
index 08e5cc145..08e5cc145 100644
--- a/testing/tests/multi-level-ca-ldap/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-ldap/test.conf
diff --git a/testing/tests/multi-level-ca-loop/description.txt b/testing/tests/ikev1/multi-level-ca-loop/description.txt
index 9b63c2c66..9b63c2c66 100644
--- a/testing/tests/multi-level-ca-loop/description.txt
+++ b/testing/tests/ikev1/multi-level-ca-loop/description.txt
diff --git a/testing/tests/multi-level-ca-loop/evaltest.dat b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat
index 781a7b4ac..781a7b4ac 100644
--- a/testing/tests/multi-level-ca-loop/evaltest.dat
+++ b/testing/tests/ikev1/multi-level-ca-loop/evaltest.dat
diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf
index c56678b59..2c645ead6 100755
--- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem
index 2990d6a12..2990d6a12 100644
--- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/certs/carolCert.pem
diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem
index b91f9bf81..b91f9bf81 100644
--- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf
index 343042f15..dcf3c94c7 100755
--- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem
index efb939e3a..efb939e3a 100644
--- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/research_by_salesCert.pem
diff --git a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem
index 90e207c4b..90e207c4b 100644
--- a/testing/tests/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-loop/hosts/moon/etc/ipsec.d/cacerts/sales_by_researchCert.pem
diff --git a/testing/tests/multi-level-ca-loop/posttest.dat b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat
index 076f51f4d..076f51f4d 100644
--- a/testing/tests/multi-level-ca-loop/posttest.dat
+++ b/testing/tests/ikev1/multi-level-ca-loop/posttest.dat
diff --git a/testing/tests/multi-level-ca-loop/pretest.dat b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat
index 0a0ec22bf..0a0ec22bf 100644
--- a/testing/tests/multi-level-ca-loop/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-loop/pretest.dat
diff --git a/testing/tests/multi-level-ca-loop/test.conf b/testing/tests/ikev1/multi-level-ca-loop/test.conf
index 3189fdfc7..3189fdfc7 100644
--- a/testing/tests/multi-level-ca-loop/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-loop/test.conf
diff --git a/testing/tests/multi-level-ca-revoked/description.txt b/testing/tests/ikev1/multi-level-ca-revoked/description.txt
index c91ac285b..c91ac285b 100644
--- a/testing/tests/multi-level-ca-revoked/description.txt
+++ b/testing/tests/ikev1/multi-level-ca-revoked/description.txt
diff --git a/testing/tests/multi-level-ca-revoked/evaltest.dat b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat
index 0fd1cae8c..0fd1cae8c 100644
--- a/testing/tests/multi-level-ca-revoked/evaltest.dat
+++ b/testing/tests/ikev1/multi-level-ca-revoked/evaltest.dat
diff --git a/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..93bd80758
--- /dev/null
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+
+conn home
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem
index 2990d6a12..2990d6a12 100644
--- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/certs/carolCert.pem
diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem
index b91f9bf81..b91f9bf81 100644
--- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf
index 39a298de9..ab336c3c8 100755
--- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
index c380a5110..c380a5110 100644
--- a/testing/tests/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-revoked/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
diff --git a/testing/tests/multi-level-ca-revoked/posttest.dat b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat
index f84b7e37b..f84b7e37b 100644
--- a/testing/tests/multi-level-ca-revoked/posttest.dat
+++ b/testing/tests/ikev1/multi-level-ca-revoked/posttest.dat
diff --git a/testing/tests/multi-level-ca-revoked/pretest.dat b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat
index d92333d86..d92333d86 100644
--- a/testing/tests/multi-level-ca-revoked/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-revoked/pretest.dat
diff --git a/testing/tests/multi-level-ca-revoked/test.conf b/testing/tests/ikev1/multi-level-ca-revoked/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/multi-level-ca-revoked/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-revoked/test.conf
diff --git a/testing/tests/multi-level-ca-strict/description.txt b/testing/tests/ikev1/multi-level-ca-strict/description.txt
index 32413e3de..32413e3de 100644
--- a/testing/tests/multi-level-ca-strict/description.txt
+++ b/testing/tests/ikev1/multi-level-ca-strict/description.txt
diff --git a/testing/tests/multi-level-ca-strict/evaltest.dat b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat
index 5a181a62d..5a181a62d 100644
--- a/testing/tests/multi-level-ca-strict/evaltest.dat
+++ b/testing/tests/ikev1/multi-level-ca-strict/evaltest.dat
diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf
index de179c565..d6d32a39d 100755
--- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem
index 2990d6a12..2990d6a12 100644
--- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/certs/carolCert.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem
index b91f9bf81..b91f9bf81 100644
--- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf
index 2fb6a301e..6156fadba 100755
--- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem
index b76032480..b76032480 100644
--- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/certs/daveCert.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem
index 022436de4..022436de4 100644
--- a/testing/tests/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/dave/etc/ipsec.d/private/daveKey.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf
index 6ed262d20..6b4e37b35 100755
--- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
index 154cff654..154cff654 100644
--- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
diff --git a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
index e50477872..e50477872 100644
--- a/testing/tests/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
+++ b/testing/tests/ikev1/multi-level-ca-strict/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
diff --git a/testing/tests/multi-level-ca-strict/posttest.dat b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat
index 1646d5ed2..1646d5ed2 100644
--- a/testing/tests/multi-level-ca-strict/posttest.dat
+++ b/testing/tests/ikev1/multi-level-ca-strict/posttest.dat
diff --git a/testing/tests/multi-level-ca-strict/pretest.dat b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat
index 67c50c2ef..67c50c2ef 100644
--- a/testing/tests/multi-level-ca-strict/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca-strict/pretest.dat
diff --git a/testing/tests/multi-level-ca-strict/test.conf b/testing/tests/ikev1/multi-level-ca-strict/test.conf
index 08e5cc145..08e5cc145 100644
--- a/testing/tests/multi-level-ca-strict/test.conf
+++ b/testing/tests/ikev1/multi-level-ca-strict/test.conf
diff --git a/testing/tests/multi-level-ca/description.txt b/testing/tests/ikev1/multi-level-ca/description.txt
index 64825cb30..64825cb30 100644
--- a/testing/tests/multi-level-ca/description.txt
+++ b/testing/tests/ikev1/multi-level-ca/description.txt
diff --git a/testing/tests/multi-level-ca/evaltest.dat b/testing/tests/ikev1/multi-level-ca/evaltest.dat
index 72f620b8e..72f620b8e 100644
--- a/testing/tests/multi-level-ca/evaltest.dat
+++ b/testing/tests/ikev1/multi-level-ca/evaltest.dat
diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf
index e851a82f0..316cdaecc 100755
--- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem
index 2990d6a12..2990d6a12 100644
--- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem
diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem
index b91f9bf81..b91f9bf81 100644
--- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/multi-level-ca/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/multi-level-ca/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf
index 458a4ca5e..5838f5f2f 100755
--- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem
index b76032480..b76032480 100644
--- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem
diff --git a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem
index 022436de4..022436de4 100644
--- a/testing/tests/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/dave/etc/ipsec.d/private/daveKey.pem
diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf
index e60bbc016..e47d453e4 100755
--- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
index 154cff654..154cff654 100644
--- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
diff --git a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
index e50477872..e50477872 100644
--- a/testing/tests/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
+++ b/testing/tests/ikev1/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
diff --git a/testing/tests/multi-level-ca/posttest.dat b/testing/tests/ikev1/multi-level-ca/posttest.dat
index 1646d5ed2..1646d5ed2 100644
--- a/testing/tests/multi-level-ca/posttest.dat
+++ b/testing/tests/ikev1/multi-level-ca/posttest.dat
diff --git a/testing/tests/multi-level-ca/pretest.dat b/testing/tests/ikev1/multi-level-ca/pretest.dat
index 67c50c2ef..67c50c2ef 100644
--- a/testing/tests/multi-level-ca/pretest.dat
+++ b/testing/tests/ikev1/multi-level-ca/pretest.dat
diff --git a/testing/tests/multi-level-ca/test.conf b/testing/tests/ikev1/multi-level-ca/test.conf
index 08e5cc145..08e5cc145 100644
--- a/testing/tests/multi-level-ca/test.conf
+++ b/testing/tests/ikev1/multi-level-ca/test.conf
diff --git a/testing/tests/ikev1/nat-before-esp/description.txt b/testing/tests/ikev1/nat-before-esp/description.txt
new file mode 100644
index 000000000..e42ace476
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/description.txt
@@ -0,0 +1,6 @@
+An IPsec tunnel connecting the gateway <b>moon</b> with the subnet behind
+gateway <b>sun</b> is set up. This host-to-net connection can also be
+used by the clients <b>alice</b> and <b>venus</b> via the trick of NAT-ing
+them to the outer IP address of gateway <b>moon</b> prior to tunnelling.
+The IPsec tunnel is first tested by <b>moon</b> pinging <b>bob</b> and vice versa,
+followed by the NAT-ed clients <b>alice</b> and <b>venus</b> pinging <b>bob</b>.
diff --git a/testing/tests/ikev1/nat-before-esp/evaltest.dat b/testing/tests/ikev1/nat-before-esp/evaltest.dat
new file mode 100644
index 000000000..d466038ed
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/evaltest.dat
@@ -0,0 +1,9 @@
+moon::ipsec status::host-net.*STATE_QUICK_I2.*IPsec SA established::YES
+sun::ipsec status::host-net.*STATE_QUICK_R2.*IPsec SA established::YES
+moon::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+bob::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
+bob::tcpdump::ICMP::YES
diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables
new file mode 100755
index 000000000..f87ec0e58
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/init.d/iptables
@@ -0,0 +1,83 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+	before net
+	need logger
+}
+
+start() {
+	ebegin "Starting firewall"
+
+	# enable IP forwarding
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+	
+	# default policy is DROP
+	/sbin/iptables -P INPUT DROP
+	/sbin/iptables -P OUTPUT DROP
+	/sbin/iptables -P FORWARD DROP
+
+	# NAT traffic from 10.1.0.0/16
+	iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -j MASQUERADE
+	
+	# forward traffic from 10.1.0.0/16 to POSTROUTING chain
+	iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -d 10.2.0.0/16 -j ACCEPT
+	iptables -A FORWARD -o eth1 -i eth0 -d 10.1.0.0/16 -s 10.2.0.0/16 -j ACCEPT
+
+	# allow esp
+	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+	# allow IKE
+	iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+	# allow crl fetch from winnetou
+	iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+	# allow ssh
+	iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+	
+			if [ $a == nat ]; then
+				/sbin/iptables -t nat -P PREROUTING ACCEPT
+				/sbin/iptables -t nat -P POSTROUTING ACCEPT
+				/sbin/iptables -t nat -P OUTPUT ACCEPT
+			elif [ $a == mangle ]; then
+				/sbin/iptables -t mangle -P PREROUTING ACCEPT
+				/sbin/iptables -t mangle -P INPUT ACCEPT
+				/sbin/iptables -t mangle -P FORWARD ACCEPT
+				/sbin/iptables -t mangle -P OUTPUT ACCEPT
+				/sbin/iptables -t mangle -P POSTROUTING ACCEPT
+			elif [ $a == filter ]; then
+				/sbin/iptables -t filter -P INPUT ACCEPT
+				/sbin/iptables -t filter -P FORWARD ACCEPT
+				/sbin/iptables -t filter -P OUTPUT ACCEPT
+			fi
+		done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+		done;
+        eend $?
+	start
+}
+
diff --git a/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..9637dcf06
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn host-net
+	left=192.168.0.1
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=192.168.0.2
+	rightsubnet=10.2.0.0/16
+	rightid=@sun.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..506417867
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	nat_traversal=yes
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn host-net
+	left=192.168.0.2
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+	leftsubnet=10.2.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/host2host-swapped/posttest.dat b/testing/tests/ikev1/nat-before-esp/posttest.dat
index 52979508d..307b96888 100644
--- a/testing/tests/host2host-swapped/posttest.dat
+++ b/testing/tests/ikev1/nat-before-esp/posttest.dat
@@ -1,5 +1,4 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
+moon::iptables -t nat -v -n -L
 moon::ipsec stop
 sun::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev1/nat-before-esp/pretest.dat b/testing/tests/ikev1/nat-before-esp/pretest.dat
new file mode 100644
index 000000000..75565540a
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 2
+moon::ipsec up host-net
diff --git a/testing/tests/ikev1/nat-before-esp/test.conf b/testing/tests/ikev1/nat-before-esp/test.conf
new file mode 100644
index 000000000..4234eaf63
--- /dev/null
+++ b/testing/tests/ikev1/nat-before-esp/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun bob"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/nat-one-rw/description.txt b/testing/tests/ikev1/nat-one-rw/description.txt
index c3b9bb820..c3b9bb820 100644
--- a/testing/tests/nat-one-rw/description.txt
+++ b/testing/tests/ikev1/nat-one-rw/description.txt
diff --git a/testing/tests/nat-one-rw/evaltest.dat b/testing/tests/ikev1/nat-one-rw/evaltest.dat
index bc193963d..bc193963d 100644
--- a/testing/tests/nat-one-rw/evaltest.dat
+++ b/testing/tests/ikev1/nat-one-rw/evaltest.dat
diff --git a/testing/tests/nat-one-rw/posttest.dat b/testing/tests/ikev1/nat-one-rw/posttest.dat
index af8e00575..cd0d4df25 100644
--- a/testing/tests/nat-one-rw/posttest.dat
+++ b/testing/tests/ikev1/nat-one-rw/posttest.dat
@@ -1,8 +1,6 @@
-alice::iptables -v -n -L
-sun::iptables -v -n -L
 alice::ipsec stop
 sun::ipsec stop
 alice::/etc/init.d/iptables stop 2> /dev/null
 sun::/etc/init.d/iptables stop 2> /dev/null
 moon::iptables -t nat -F
-
+moon::conntrack -F
diff --git a/testing/tests/nat-one-rw/pretest.dat b/testing/tests/ikev1/nat-one-rw/pretest.dat
index 9dacc672c..9dacc672c 100644
--- a/testing/tests/nat-one-rw/pretest.dat
+++ b/testing/tests/ikev1/nat-one-rw/pretest.dat
diff --git a/testing/tests/nat-one-rw/test.conf b/testing/tests/ikev1/nat-one-rw/test.conf
index d84149aaf..d84149aaf 100644
--- a/testing/tests/nat-one-rw/test.conf
+++ b/testing/tests/ikev1/nat-one-rw/test.conf
diff --git a/testing/tests/ikev1/nat-two-rw-psk/description.txt b/testing/tests/ikev1/nat-two-rw-psk/description.txt
new file mode 100644
index 000000000..c74897d9a
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
+tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
+Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>.
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
+the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
+ping the client <b>bob</b> behind the gateway <b>sun</b>.
diff --git a/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat
new file mode 100644
index 000000000..e8aaf0b5f
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/evaltest.dat
@@ -0,0 +1,9 @@
+alice::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES
+venus::ipsec status::nat-t.*STATE_QUICK_I2.*IPsec SA established::YES
+sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES
+sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES
+sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..e8576f0e7
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	nat_traversal=yes
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	authby=secret
+		
+conn nat-t
+	left=%defaultroute
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets
index e8c151f05..e8c151f05 100644
--- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..573069f75
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	nat_traversal=yes
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	authby=secret
+	leftnexthop=%direct
+	
+conn nat-t
+	left=PH_IP_SUN
+	leftsubnet=10.2.0.0/16
+	leftfirewall=yes
+	right=%any
+	rightsubnetwithin=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets
new file mode 100644
index 000000000..e8c151f05
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf
new file mode 100755
index 000000000..e8576f0e7
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	nat_traversal=yes
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	authby=secret
+		
+conn nat-t
+	left=%defaultroute
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets
new file mode 100644
index 000000000..e8c151f05
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
diff --git a/testing/tests/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat
index f019842ed..52572ece8 100644
--- a/testing/tests/nat-two-rw/posttest.dat
+++ b/testing/tests/ikev1/nat-two-rw-psk/posttest.dat
@@ -1,6 +1,3 @@
-alice::iptables -v -n -L
-venus::iptables -v -n -L
-sun::iptables -v -n -L
 sun::ipsec stop
 alice::ipsec stop
 venus::ipsec stop
@@ -8,4 +5,4 @@ alice::/etc/init.d/iptables stop 2> /dev/null
 venus::/etc/init.d/iptables stop 2> /dev/null
 sun::/etc/init.d/iptables stop 2> /dev/null
 moon::iptables -t nat -F
-
+moon::conntrack -F
diff --git a/testing/tests/ikev1/nat-two-rw-psk/pretest.dat b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat
new file mode 100644
index 000000000..6172bd088
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw-psk/pretest.dat
@@ -0,0 +1,16 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+venus::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+alice::rm /etc/ipsec.d/cacerts/*
+venus::rm /etc/ipsec.d/cacerts/*
+sun::rm /etc/ipsec.d/cacerts/*
+alice::ipsec start
+venus::ipsec start
+sun::ipsec start
+alice::sleep 5 
+alice::ipsec up nat-t
+venus::sleep 5 
+venus::ipsec up nat-t
diff --git a/testing/tests/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw-psk/test.conf
index 84317fd70..84317fd70 100644
--- a/testing/tests/nat-two-rw/test.conf
+++ b/testing/tests/ikev1/nat-two-rw-psk/test.conf
diff --git a/testing/tests/nat-two-rw/description.txt b/testing/tests/ikev1/nat-two-rw/description.txt
index dcf4b94bd..dcf4b94bd 100644
--- a/testing/tests/nat-two-rw/description.txt
+++ b/testing/tests/ikev1/nat-two-rw/description.txt
diff --git a/testing/tests/nat-two-rw/evaltest.dat b/testing/tests/ikev1/nat-two-rw/evaltest.dat
index b1a7d59ee..b1a7d59ee 100644
--- a/testing/tests/nat-two-rw/evaltest.dat
+++ b/testing/tests/ikev1/nat-two-rw/evaltest.dat
diff --git a/testing/tests/ikev1/nat-two-rw/posttest.dat b/testing/tests/ikev1/nat-two-rw/posttest.dat
new file mode 100644
index 000000000..52572ece8
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw/posttest.dat
@@ -0,0 +1,8 @@
+sun::ipsec stop
+alice::ipsec stop
+venus::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+moon::conntrack -F
diff --git a/testing/tests/nat-two-rw/pretest.dat b/testing/tests/ikev1/nat-two-rw/pretest.dat
index dd5259936..dd5259936 100644
--- a/testing/tests/nat-two-rw/pretest.dat
+++ b/testing/tests/ikev1/nat-two-rw/pretest.dat
diff --git a/testing/tests/ikev1/nat-two-rw/test.conf b/testing/tests/ikev1/nat-two-rw/test.conf
new file mode 100644
index 000000000..84317fd70
--- /dev/null
+++ b/testing/tests/ikev1/nat-two-rw/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/net2net-cert/description.txt b/testing/tests/ikev1/net2net-cert/description.txt
index 7eea9192f..7eea9192f 100644
--- a/testing/tests/net2net-cert/description.txt
+++ b/testing/tests/ikev1/net2net-cert/description.txt
diff --git a/testing/tests/net2net-cert/evaltest.dat b/testing/tests/ikev1/net2net-cert/evaltest.dat
index 7cbf92687..7cbf92687 100644
--- a/testing/tests/net2net-cert/evaltest.dat
+++ b/testing/tests/ikev1/net2net-cert/evaltest.dat
diff --git a/testing/tests/ikev1/net2net-cert/posttest.dat b/testing/tests/ikev1/net2net-cert/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev1/net2net-cert/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-cert/pretest.dat b/testing/tests/ikev1/net2net-cert/pretest.dat
index 9f60760c6..9f60760c6 100644
--- a/testing/tests/net2net-cert/pretest.dat
+++ b/testing/tests/ikev1/net2net-cert/pretest.dat
diff --git a/testing/tests/net2net-cert/test.conf b/testing/tests/ikev1/net2net-cert/test.conf
index d9a61590f..d9a61590f 100644
--- a/testing/tests/net2net-cert/test.conf
+++ b/testing/tests/ikev1/net2net-cert/test.conf
diff --git a/testing/tests/net2net-pgp/description.txt b/testing/tests/ikev1/net2net-pgp/description.txt
index c85f2e5d0..c85f2e5d0 100644
--- a/testing/tests/net2net-pgp/description.txt
+++ b/testing/tests/ikev1/net2net-pgp/description.txt
diff --git a/testing/tests/net2net-pgp/evaltest.dat b/testing/tests/ikev1/net2net-pgp/evaltest.dat
index 7cbf92687..7cbf92687 100644
--- a/testing/tests/net2net-pgp/evaltest.dat
+++ b/testing/tests/ikev1/net2net-pgp/evaltest.dat
diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf
index e7de6cf0b..eb72ed85f 100755
--- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.conf
@@ -1,10 +1,9 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc
index 135cfaec0..135cfaec0 100644
--- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/moonCert.asc
diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc
index 32f204b10..32f204b10 100644
--- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/certs/sunCert.asc
diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc
index 6524773e0..6524773e0 100644
--- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.d/private/moonKey.asc
diff --git a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets
index afb1ff927..afb1ff927 100644
--- a/testing/tests/net2net-pgp/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-pgp/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf
index 5dd8a8587..205f235c8 100755
--- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.conf
@@ -1,10 +1,9 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc
index 135cfaec0..135cfaec0 100644
--- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/moonCert.asc
diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc
index 32f204b10..32f204b10 100644
--- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/certs/sunCert.asc
diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc
index de2393649..de2393649 100644
--- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc
+++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.d/private/sunKey.asc
diff --git a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets
index ee98b1611..ee98b1611 100644
--- a/testing/tests/net2net-pgp/hosts/sun/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-pgp/hosts/sun/etc/ipsec.secrets
diff --git a/testing/tests/net2net-pgp/posttest.dat b/testing/tests/ikev1/net2net-pgp/posttest.dat
index 80e765dfc..fafcde975 100644
--- a/testing/tests/net2net-pgp/posttest.dat
+++ b/testing/tests/ikev1/net2net-pgp/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
 moon::ipsec stop
 sun::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-pgp/pretest.dat b/testing/tests/ikev1/net2net-pgp/pretest.dat
index 9e40684ab..9e40684ab 100644
--- a/testing/tests/net2net-pgp/pretest.dat
+++ b/testing/tests/ikev1/net2net-pgp/pretest.dat
diff --git a/testing/tests/net2net-pgp/test.conf b/testing/tests/ikev1/net2net-pgp/test.conf
index f74d0f7d6..f74d0f7d6 100644
--- a/testing/tests/net2net-pgp/test.conf
+++ b/testing/tests/ikev1/net2net-pgp/test.conf
diff --git a/testing/tests/net2net-psk-fail/description.txt b/testing/tests/ikev1/net2net-psk-fail/description.txt
index 5a794bd17..5a794bd17 100644
--- a/testing/tests/net2net-psk-fail/description.txt
+++ b/testing/tests/ikev1/net2net-psk-fail/description.txt
diff --git a/testing/tests/net2net-psk-fail/evaltest.dat b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat
index 7f7cb9726..7f7cb9726 100644
--- a/testing/tests/net2net-psk-fail/evaltest.dat
+++ b/testing/tests/ikev1/net2net-psk-fail/evaltest.dat
diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf
index 87396e455..e095c0b7b 100755
--- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets
index be95c4d99..be95c4d99 100644
--- a/testing/tests/net2net-psk-fail/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-psk-fail/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf
index 7e102b25c..b21f863f5 100755
--- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets
index b53577e1d..b53577e1d 100644
--- a/testing/tests/net2net-psk-fail/hosts/sun/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-psk-fail/hosts/sun/etc/ipsec.secrets
diff --git a/testing/tests/net2net-psk-fail/posttest.dat b/testing/tests/ikev1/net2net-psk-fail/posttest.dat
index dff181797..dff181797 100644
--- a/testing/tests/net2net-psk-fail/posttest.dat
+++ b/testing/tests/ikev1/net2net-psk-fail/posttest.dat
diff --git a/testing/tests/net2net-psk-fail/pretest.dat b/testing/tests/ikev1/net2net-psk-fail/pretest.dat
index aa8e332e0..aa8e332e0 100644
--- a/testing/tests/net2net-psk-fail/pretest.dat
+++ b/testing/tests/ikev1/net2net-psk-fail/pretest.dat
diff --git a/testing/tests/net2net-psk-fail/test.conf b/testing/tests/ikev1/net2net-psk-fail/test.conf
index f6e064e7d..f6e064e7d 100644
--- a/testing/tests/net2net-psk-fail/test.conf
+++ b/testing/tests/ikev1/net2net-psk-fail/test.conf
diff --git a/testing/tests/net2net-psk/description.txt b/testing/tests/ikev1/net2net-psk/description.txt
index 02cddbb83..02cddbb83 100644
--- a/testing/tests/net2net-psk/description.txt
+++ b/testing/tests/ikev1/net2net-psk/description.txt
diff --git a/testing/tests/net2net-psk/evaltest.dat b/testing/tests/ikev1/net2net-psk/evaltest.dat
index 7cbf92687..7cbf92687 100644
--- a/testing/tests/net2net-psk/evaltest.dat
+++ b/testing/tests/ikev1/net2net-psk/evaltest.dat
diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf
index 51c53a505..a3536e2b2 100755
--- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets
index be95c4d99..be95c4d99 100644
--- a/testing/tests/net2net-psk/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-psk/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf
index 9c3695178..12e38962e 100755
--- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets
index be95c4d99..be95c4d99 100644
--- a/testing/tests/net2net-psk/hosts/sun/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-psk/hosts/sun/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/net2net-psk/posttest.dat b/testing/tests/ikev1/net2net-psk/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev1/net2net-psk/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-psk/pretest.dat b/testing/tests/ikev1/net2net-psk/pretest.dat
index 9e40684ab..9e40684ab 100644
--- a/testing/tests/net2net-psk/pretest.dat
+++ b/testing/tests/ikev1/net2net-psk/pretest.dat
diff --git a/testing/tests/net2net-psk/test.conf b/testing/tests/ikev1/net2net-psk/test.conf
index f74d0f7d6..f74d0f7d6 100644
--- a/testing/tests/net2net-psk/test.conf
+++ b/testing/tests/ikev1/net2net-psk/test.conf
diff --git a/testing/tests/net2net-route/description.txt b/testing/tests/ikev1/net2net-route/description.txt
index 323f09555..323f09555 100644
--- a/testing/tests/net2net-route/description.txt
+++ b/testing/tests/ikev1/net2net-route/description.txt
diff --git a/testing/tests/net2net-route/evaltest.dat b/testing/tests/ikev1/net2net-route/evaltest.dat
index 38d589e5a..38d589e5a 100644
--- a/testing/tests/net2net-route/evaltest.dat
+++ b/testing/tests/ikev1/net2net-route/evaltest.dat
diff --git a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf
index 4063ae05f..466235099 100755
--- a/testing/tests/net2net-route/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-route/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ikev1/net2net-route/posttest.dat b/testing/tests/ikev1/net2net-route/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev1/net2net-route/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-route/pretest.dat b/testing/tests/ikev1/net2net-route/pretest.dat
index 2eef7de19..2eef7de19 100644
--- a/testing/tests/net2net-route/pretest.dat
+++ b/testing/tests/ikev1/net2net-route/pretest.dat
diff --git a/testing/tests/net2net-route/test.conf b/testing/tests/ikev1/net2net-route/test.conf
index d9a61590f..d9a61590f 100644
--- a/testing/tests/net2net-route/test.conf
+++ b/testing/tests/ikev1/net2net-route/test.conf
diff --git a/testing/tests/net2net-rsa/description.txt b/testing/tests/ikev1/net2net-rsa/description.txt
index a23fae8c3..a23fae8c3 100644
--- a/testing/tests/net2net-rsa/description.txt
+++ b/testing/tests/ikev1/net2net-rsa/description.txt
diff --git a/testing/tests/net2net-rsa/evaltest.dat b/testing/tests/ikev1/net2net-rsa/evaltest.dat
index 7cbf92687..7cbf92687 100644
--- a/testing/tests/net2net-rsa/evaltest.dat
+++ b/testing/tests/ikev1/net2net-rsa/evaltest.dat
diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf
index 772762321..e4c0614a1 100755
--- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets
index 9859ae8ed..9859ae8ed 100644
--- a/testing/tests/net2net-rsa/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-rsa/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf
index 9626ef168..d0c8752a3 100755
--- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets
index bf976a8d3..bf976a8d3 100644
--- a/testing/tests/net2net-rsa/hosts/sun/etc/ipsec.secrets
+++ b/testing/tests/ikev1/net2net-rsa/hosts/sun/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/net2net-rsa/posttest.dat b/testing/tests/ikev1/net2net-rsa/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev1/net2net-rsa/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-rsa/pretest.dat b/testing/tests/ikev1/net2net-rsa/pretest.dat
index 9e40684ab..9e40684ab 100644
--- a/testing/tests/net2net-rsa/pretest.dat
+++ b/testing/tests/ikev1/net2net-rsa/pretest.dat
diff --git a/testing/tests/net2net-rsa/test.conf b/testing/tests/ikev1/net2net-rsa/test.conf
index f74d0f7d6..f74d0f7d6 100644
--- a/testing/tests/net2net-rsa/test.conf
+++ b/testing/tests/ikev1/net2net-rsa/test.conf
diff --git a/testing/tests/net2net-start/description.txt b/testing/tests/ikev1/net2net-start/description.txt
index f5320685e..f5320685e 100644
--- a/testing/tests/net2net-start/description.txt
+++ b/testing/tests/ikev1/net2net-start/description.txt
diff --git a/testing/tests/net2net-start/evaltest.dat b/testing/tests/ikev1/net2net-start/evaltest.dat
index 7cbf92687..7cbf92687 100644
--- a/testing/tests/net2net-start/evaltest.dat
+++ b/testing/tests/ikev1/net2net-start/evaltest.dat
diff --git a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf
index 677955bc1..95abd046a 100755
--- a/testing/tests/net2net-start/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/net2net-start/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ikev1/net2net-start/posttest.dat b/testing/tests/ikev1/net2net-start/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev1/net2net-start/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-start/pretest.dat b/testing/tests/ikev1/net2net-start/pretest.dat
index ed8f39316..ed8f39316 100644
--- a/testing/tests/net2net-start/pretest.dat
+++ b/testing/tests/ikev1/net2net-start/pretest.dat
diff --git a/testing/tests/net2net-start/test.conf b/testing/tests/ikev1/net2net-start/test.conf
index d9a61590f..d9a61590f 100644
--- a/testing/tests/net2net-start/test.conf
+++ b/testing/tests/ikev1/net2net-start/test.conf
diff --git a/testing/tests/no-priv-key/description.txt b/testing/tests/ikev1/no-priv-key/description.txt
index 21b8eccb1..21b8eccb1 100644
--- a/testing/tests/no-priv-key/description.txt
+++ b/testing/tests/ikev1/no-priv-key/description.txt
diff --git a/testing/tests/no-priv-key/evaltest.dat b/testing/tests/ikev1/no-priv-key/evaltest.dat
index 9bd85ba12..9bd85ba12 100644
--- a/testing/tests/no-priv-key/evaltest.dat
+++ b/testing/tests/ikev1/no-priv-key/evaltest.dat
diff --git a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets
index 23b311aa6..23b311aa6 100644
--- a/testing/tests/no-priv-key/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/no-priv-key/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/no-priv-key/posttest.dat b/testing/tests/ikev1/no-priv-key/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/no-priv-key/posttest.dat
+++ b/testing/tests/ikev1/no-priv-key/posttest.dat
diff --git a/testing/tests/no-priv-key/pretest.dat b/testing/tests/ikev1/no-priv-key/pretest.dat
index d92333d86..d92333d86 100644
--- a/testing/tests/no-priv-key/pretest.dat
+++ b/testing/tests/ikev1/no-priv-key/pretest.dat
diff --git a/testing/tests/no-priv-key/test.conf b/testing/tests/ikev1/no-priv-key/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/no-priv-key/test.conf
+++ b/testing/tests/ikev1/no-priv-key/test.conf
diff --git a/testing/tests/ocsp-revoked/description.txt b/testing/tests/ikev1/ocsp-revoked/description.txt
index cbdd1305a..cbdd1305a 100644
--- a/testing/tests/ocsp-revoked/description.txt
+++ b/testing/tests/ikev1/ocsp-revoked/description.txt
diff --git a/testing/tests/ocsp-revoked/evaltest.dat b/testing/tests/ikev1/ocsp-revoked/evaltest.dat
index f5286cb61..f5286cb61 100644
--- a/testing/tests/ocsp-revoked/evaltest.dat
+++ b/testing/tests/ikev1/ocsp-revoked/evaltest.dat
diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf
index 7d4384767..5b32ef007 100755
--- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
index 5b742fc9e..5b742fc9e 100644
--- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
+++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
index 8aefcc5a6..8aefcc5a6 100644
--- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
+++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
diff --git a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets
index 8e31be4cb..8e31be4cb 100644
--- a/testing/tests/ocsp-revoked/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/ocsp-revoked/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf
index 7134b6ee9..d9da3f78a 100755
--- a/testing/tests/ocsp-strict/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ocsp-revoked/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/ocsp-revoked/posttest.dat b/testing/tests/ikev1/ocsp-revoked/posttest.dat
index d883459e7..d742e8410 100644
--- a/testing/tests/ocsp-revoked/posttest.dat
+++ b/testing/tests/ikev1/ocsp-revoked/posttest.dat
@@ -1,5 +1,4 @@
 moon::ipsec stop
 carol::ipsec stop
-winnetou::killall openssl
 carol::rm /etc/ipsec.d/private/*
 carol::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/xauth-rsa-nosecret/pretest.dat b/testing/tests/ikev1/ocsp-revoked/pretest.dat
index f5aa989fe..d92333d86 100644
--- a/testing/tests/xauth-rsa-nosecret/pretest.dat
+++ b/testing/tests/ikev1/ocsp-revoked/pretest.dat
@@ -1,4 +1,4 @@
-carol::ipsec start
 moon::ipsec start
+carol::ipsec start
 carol::sleep 2
 carol::ipsec up home
diff --git a/testing/tests/ocsp-revoked/test.conf b/testing/tests/ikev1/ocsp-revoked/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/ocsp-revoked/test.conf
+++ b/testing/tests/ikev1/ocsp-revoked/test.conf
diff --git a/testing/tests/ocsp-strict/description.txt b/testing/tests/ikev1/ocsp-strict/description.txt
index 7cb983140..7cb983140 100644
--- a/testing/tests/ocsp-strict/description.txt
+++ b/testing/tests/ikev1/ocsp-strict/description.txt
diff --git a/testing/tests/ocsp-strict/evaltest.dat b/testing/tests/ikev1/ocsp-strict/evaltest.dat
index 66b27aaac..66b27aaac 100644
--- a/testing/tests/ocsp-strict/evaltest.dat
+++ b/testing/tests/ikev1/ocsp-strict/evaltest.dat
diff --git a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf
index b34719401..fd950ecd5 100755
--- a/testing/tests/ocsp-strict/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/ocsp-strict/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf
index 7134b6ee9..d9da3f78a 100755
--- a/testing/tests/ocsp-revoked/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/ocsp-strict/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	charonstart=no
 
 ca strongswan
 	cacert=strongswanCert.pem
diff --git a/testing/tests/rw-psk-no-policy/posttest.dat b/testing/tests/ikev1/ocsp-strict/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/rw-psk-no-policy/posttest.dat
+++ b/testing/tests/ikev1/ocsp-strict/posttest.dat
diff --git a/testing/tests/ocsp-revoked/pretest.dat b/testing/tests/ikev1/ocsp-strict/pretest.dat
index d5516fd3b..d92333d86 100644
--- a/testing/tests/ocsp-revoked/pretest.dat
+++ b/testing/tests/ikev1/ocsp-strict/pretest.dat
@@ -1,4 +1,3 @@
-winnetou::/etc/openssl/start-ocsp
 moon::ipsec start
 carol::ipsec start
 carol::sleep 2
diff --git a/testing/tests/ocsp-strict/test.conf b/testing/tests/ikev1/ocsp-strict/test.conf
index 2b240d895..2b240d895 100644
--- a/testing/tests/ocsp-strict/test.conf
+++ b/testing/tests/ikev1/ocsp-strict/test.conf
diff --git a/testing/tests/protoport-dual/description.txt b/testing/tests/ikev1/protoport-dual/description.txt
index 7bed8b959..7bed8b959 100644
--- a/testing/tests/protoport-dual/description.txt
+++ b/testing/tests/ikev1/protoport-dual/description.txt
diff --git a/testing/tests/protoport-pass/evaltest.dat b/testing/tests/ikev1/protoport-dual/evaltest.dat
index 625c8c54c..11c34929f 100644
--- a/testing/tests/protoport-pass/evaltest.dat
+++ b/testing/tests/ikev1/protoport-dual/evaltest.dat
@@ -1,7 +1,7 @@
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
 carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
 moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf
index 9e05ecf61..0dc25b7bb 100755
--- a/testing/tests/protoport-dual/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-dual/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf
index 84b9b0ba3..3b01128c2 100755
--- a/testing/tests/protoport-dual/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-dual/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/protoport-pass/posttest.dat b/testing/tests/ikev1/protoport-dual/posttest.dat
index 26848212b..94a400606 100644
--- a/testing/tests/protoport-pass/posttest.dat
+++ b/testing/tests/ikev1/protoport-dual/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/protoport-dual/pretest.dat b/testing/tests/ikev1/protoport-dual/pretest.dat
index d3d0061c3..d3d0061c3 100644
--- a/testing/tests/protoport-dual/pretest.dat
+++ b/testing/tests/ikev1/protoport-dual/pretest.dat
diff --git a/testing/tests/protoport-dual/test.conf b/testing/tests/ikev1/protoport-dual/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/protoport-dual/test.conf
+++ b/testing/tests/ikev1/protoport-dual/test.conf
diff --git a/testing/tests/protoport-pass/description.txt b/testing/tests/ikev1/protoport-pass/description.txt
index 63744fa47..63744fa47 100644
--- a/testing/tests/protoport-pass/description.txt
+++ b/testing/tests/ikev1/protoport-pass/description.txt
diff --git a/testing/tests/protoport-dual/evaltest.dat b/testing/tests/ikev1/protoport-pass/evaltest.dat
index 625c8c54c..11c34929f 100644
--- a/testing/tests/protoport-dual/evaltest.dat
+++ b/testing/tests/ikev1/protoport-pass/evaltest.dat
@@ -1,7 +1,7 @@
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
 carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
 moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf
index ade7308f6..093f9b1fc 100755
--- a/testing/tests/protoport-pass/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-pass/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf
index fd67e2b4b..e64b3be7a 100755
--- a/testing/tests/protoport-pass/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-pass/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/protoport-dual/posttest.dat b/testing/tests/ikev1/protoport-pass/posttest.dat
index 26848212b..94a400606 100644
--- a/testing/tests/protoport-dual/posttest.dat
+++ b/testing/tests/ikev1/protoport-pass/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/protoport-pass/pretest.dat b/testing/tests/ikev1/protoport-pass/pretest.dat
index 13b4ad4a0..13b4ad4a0 100644
--- a/testing/tests/protoport-pass/pretest.dat
+++ b/testing/tests/ikev1/protoport-pass/pretest.dat
diff --git a/testing/tests/protoport-pass/test.conf b/testing/tests/ikev1/protoport-pass/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/protoport-pass/test.conf
+++ b/testing/tests/ikev1/protoport-pass/test.conf
diff --git a/testing/tests/protoport-route/description.txt b/testing/tests/ikev1/protoport-route/description.txt
index ec7ec69b0..ec7ec69b0 100644
--- a/testing/tests/protoport-route/description.txt
+++ b/testing/tests/ikev1/protoport-route/description.txt
diff --git a/testing/tests/protoport-route/evaltest.dat b/testing/tests/ikev1/protoport-route/evaltest.dat
index 8f3eb208f..759295675 100644
--- a/testing/tests/protoport-route/evaltest.dat
+++ b/testing/tests/ikev1/protoport-route/evaltest.dat
@@ -1,5 +1,5 @@
 carol::ping -c 2 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES
-carol::ping -c 2 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq::YES
+carol::ping -c 2 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES
 carol::ssh PH_IP_ALICE hostname::alice::YES
 carol::cat /var/log/auth.log::initiate on demand::YES
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
diff --git a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf
index 31c25c12f..99b410c32 100755
--- a/testing/tests/protoport-route/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-route/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf
index 84b9b0ba3..3b01128c2 100755
--- a/testing/tests/protoport-route/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/protoport-route/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/ikev1/protoport-route/posttest.dat b/testing/tests/ikev1/protoport-route/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/protoport-route/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/protoport-route/pretest.dat b/testing/tests/ikev1/protoport-route/pretest.dat
index f233ad48f..f233ad48f 100644
--- a/testing/tests/protoport-route/pretest.dat
+++ b/testing/tests/ikev1/protoport-route/pretest.dat
diff --git a/testing/tests/protoport-route/test.conf b/testing/tests/ikev1/protoport-route/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/protoport-route/test.conf
+++ b/testing/tests/ikev1/protoport-route/test.conf
diff --git a/testing/tests/req-pkcs10/description.txt b/testing/tests/ikev1/req-pkcs10/description.txt
index a958cb8e8..a958cb8e8 100644
--- a/testing/tests/req-pkcs10/description.txt
+++ b/testing/tests/ikev1/req-pkcs10/description.txt
diff --git a/testing/tests/req-pkcs10/evaltest.dat b/testing/tests/ikev1/req-pkcs10/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/req-pkcs10/evaltest.dat
+++ b/testing/tests/ikev1/req-pkcs10/evaltest.dat
diff --git a/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..e32aca0b9
--- /dev/null
+++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=myCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+
+
+
diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets
index 167d743df..167d743df 100644
--- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf
index 6afd3fa11..6afd3fa11 100644
--- a/testing/tests/req-pkcs10/hosts/carol/etc/scepclient.conf
+++ b/testing/tests/ikev1/req-pkcs10/hosts/carol/etc/scepclient.conf
diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets
index b9ec17dbc..b9ec17dbc 100644
--- a/testing/tests/req-pkcs10/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf
index da8177348..da8177348 100644
--- a/testing/tests/req-pkcs10/hosts/moon/etc/scepclient.conf
+++ b/testing/tests/ikev1/req-pkcs10/hosts/moon/etc/scepclient.conf
diff --git a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt
index 9b48ee4cf..9b48ee4cf 100644
--- a/testing/tests/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt
+++ b/testing/tests/ikev1/req-pkcs10/hosts/winnetou/etc/openssl/yy.txt
diff --git a/testing/tests/req-pkcs10/posttest.dat b/testing/tests/ikev1/req-pkcs10/posttest.dat
index 534e3af20..933b4b6c4 100644
--- a/testing/tests/req-pkcs10/posttest.dat
+++ b/testing/tests/ikev1/req-pkcs10/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/req-pkcs10/pretest.dat b/testing/tests/ikev1/req-pkcs10/pretest.dat
index 18b8b16e6..18b8b16e6 100644
--- a/testing/tests/req-pkcs10/pretest.dat
+++ b/testing/tests/ikev1/req-pkcs10/pretest.dat
diff --git a/testing/tests/req-pkcs10/test.conf b/testing/tests/ikev1/req-pkcs10/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/req-pkcs10/test.conf
+++ b/testing/tests/ikev1/req-pkcs10/test.conf
diff --git a/testing/tests/rw-cert/description.txt b/testing/tests/ikev1/rw-cert/description.txt
index 8df6b1c0d..8df6b1c0d 100644
--- a/testing/tests/rw-cert/description.txt
+++ b/testing/tests/ikev1/rw-cert/description.txt
diff --git a/testing/tests/rw-cert/evaltest.dat b/testing/tests/ikev1/rw-cert/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/rw-cert/evaltest.dat
+++ b/testing/tests/ikev1/rw-cert/evaltest.dat
diff --git a/testing/tests/ikev1/rw-cert/posttest.dat b/testing/tests/ikev1/rw-cert/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/rw-cert/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/virtual-ip-swapped/pretest.dat b/testing/tests/ikev1/rw-cert/pretest.dat
index 4fe0ee90b..4fe0ee90b 100644
--- a/testing/tests/virtual-ip-swapped/pretest.dat
+++ b/testing/tests/ikev1/rw-cert/pretest.dat
diff --git a/testing/tests/rw-cert/test.conf b/testing/tests/ikev1/rw-cert/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/rw-cert/test.conf
+++ b/testing/tests/ikev1/rw-cert/test.conf
diff --git a/testing/tests/rw-psk-fqdn-named/description.txt b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt
index adfab2f4d..adfab2f4d 100644
--- a/testing/tests/rw-psk-fqdn-named/description.txt
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/description.txt
diff --git a/testing/tests/rw-psk-fqdn-named/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/rw-psk-fqdn-named/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/evaltest.dat
diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf
index da5e198a8..1e9a27129 100755
--- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets
index db3884e57..db3884e57 100644
--- a/testing/tests/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf
index c32dfaf9b..05d209c44 100755
--- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets
index 6281340ae..6281340ae 100644
--- a/testing/tests/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-fqdn-named/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat
index dbf03f552..dbf03f552 100644
--- a/testing/tests/rw-psk-fqdn-named/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/pretest.dat
diff --git a/testing/tests/rw-psk-fqdn-named/test.conf b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/rw-psk-fqdn-named/test.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn-named/test.conf
diff --git a/testing/tests/rw-psk-fqdn/description.txt b/testing/tests/ikev1/rw-psk-fqdn/description.txt
index d6c79afb2..d6c79afb2 100644
--- a/testing/tests/rw-psk-fqdn/description.txt
+++ b/testing/tests/ikev1/rw-psk-fqdn/description.txt
diff --git a/testing/tests/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/rw-psk-fqdn/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn/evaltest.dat
diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf
index da5e198a8..1e9a27129 100755
--- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets
index db3884e57..db3884e57 100644
--- a/testing/tests/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf
index 9a894806c..beda12b3c 100755
--- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets
index 6281340ae..661168fb5 100644
--- a/testing/tests/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets
@@ -1,7 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file
 
 @moon.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
-
-
-
-
diff --git a/testing/tests/ikev1/rw-psk-fqdn/posttest.dat b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/rw-psk-fqdn/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-fqdn/pretest.dat b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat
index dbf03f552..dbf03f552 100644
--- a/testing/tests/rw-psk-fqdn/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-fqdn/pretest.dat
diff --git a/testing/tests/rw-psk-fqdn/test.conf b/testing/tests/ikev1/rw-psk-fqdn/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/rw-psk-fqdn/test.conf
+++ b/testing/tests/ikev1/rw-psk-fqdn/test.conf
diff --git a/testing/tests/rw-psk-ipv4/description.txt b/testing/tests/ikev1/rw-psk-ipv4/description.txt
index b3a0bc192..b3a0bc192 100644
--- a/testing/tests/rw-psk-ipv4/description.txt
+++ b/testing/tests/ikev1/rw-psk-ipv4/description.txt
diff --git a/testing/tests/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/rw-psk-ipv4/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-ipv4/evaltest.dat
diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf
index 2c0227b7a..8e27a9ecd 100755
--- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
index 69313b289..69313b289 100644
--- a/testing/tests/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf
index a75d4e222..f8ce5569c 100755
--- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
index a8e367950..a8e367950 100644
--- a/testing/tests/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/rw-psk-ipv4/posttest.dat b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/rw-psk-ipv4/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-ipv4/pretest.dat b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat
index dbf03f552..dbf03f552 100644
--- a/testing/tests/rw-psk-ipv4/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-ipv4/pretest.dat
diff --git a/testing/tests/rw-psk-ipv4/test.conf b/testing/tests/ikev1/rw-psk-ipv4/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/rw-psk-ipv4/test.conf
+++ b/testing/tests/ikev1/rw-psk-ipv4/test.conf
diff --git a/testing/tests/rw-psk-no-policy/description.txt b/testing/tests/ikev1/rw-psk-no-policy/description.txt
index 0e359414f..0e359414f 100644
--- a/testing/tests/rw-psk-no-policy/description.txt
+++ b/testing/tests/ikev1/rw-psk-no-policy/description.txt
diff --git a/testing/tests/rw-psk-no-policy/evaltest.dat b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat
index a28377dbd..a28377dbd 100644
--- a/testing/tests/rw-psk-no-policy/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-no-policy/evaltest.dat
diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf
index 413eff762..c62605bd0 100755
--- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets
index 1b721dc58..1b721dc58 100644
--- a/testing/tests/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf
index ac63abdc9..4584e1408 100755
--- a/testing/tests/rw-psk-no-policy/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-no-policy/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-rsa-no-policy/posttest.dat b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/rw-rsa-no-policy/posttest.dat
+++ b/testing/tests/ikev1/rw-psk-no-policy/posttest.dat
diff --git a/testing/tests/rw-psk-no-policy/pretest.dat b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat
index 3a7804ddd..3a7804ddd 100644
--- a/testing/tests/rw-psk-no-policy/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-no-policy/pretest.dat
diff --git a/testing/tests/rw-psk-no-policy/test.conf b/testing/tests/ikev1/rw-psk-no-policy/test.conf
index f622c18b7..f622c18b7 100644
--- a/testing/tests/rw-psk-no-policy/test.conf
+++ b/testing/tests/ikev1/rw-psk-no-policy/test.conf
diff --git a/testing/tests/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt
index b99a8e5b3..b99a8e5b3 100644
--- a/testing/tests/rw-psk-rsa-mixed/description.txt
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/description.txt
diff --git a/testing/tests/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat
index 9e1354121..9e1354121 100644
--- a/testing/tests/rw-psk-rsa-mixed/evaltest.dat
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/evaltest.dat
diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf
index 69e13b538..b142c75bb 100755
--- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets
index 1b721dc58..1b721dc58 100644
--- a/testing/tests/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf
index b23248b5b..5916d8fd8 100755
--- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,8 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets
index fd33507a7..fd33507a7 100644
--- a/testing/tests/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/wildcards/posttest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat
index ed530f6d9..ed530f6d9 100644
--- a/testing/tests/wildcards/posttest.dat
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/posttest.dat
diff --git a/testing/tests/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat
index 35797b589..35797b589 100644
--- a/testing/tests/rw-psk-rsa-mixed/pretest.dat
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/pretest.dat
diff --git a/testing/tests/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf
index 699b88e88..699b88e88 100644
--- a/testing/tests/rw-psk-rsa-mixed/test.conf
+++ b/testing/tests/ikev1/rw-psk-rsa-mixed/test.conf
diff --git a/testing/tests/rw-rsa-no-policy/description.txt b/testing/tests/ikev1/rw-rsa-no-policy/description.txt
index c3336b769..c3336b769 100644
--- a/testing/tests/rw-rsa-no-policy/description.txt
+++ b/testing/tests/ikev1/rw-rsa-no-policy/description.txt
diff --git a/testing/tests/rw-rsa-no-policy/evaltest.dat b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat
index 188b7bbb5..188b7bbb5 100644
--- a/testing/tests/rw-rsa-no-policy/evaltest.dat
+++ b/testing/tests/ikev1/rw-rsa-no-policy/evaltest.dat
diff --git a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf
index b9318c058..2abe3c147 100755
--- a/testing/tests/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.conf
@@ -1,7 +1,5 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 
diff --git a/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..e8c151f05
--- /dev/null
+++ b/testing/tests/ikev1/rw-rsa-no-policy/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
diff --git a/testing/tests/xauth-rsa-fail/posttest.dat b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/xauth-rsa-fail/posttest.dat
+++ b/testing/tests/ikev1/rw-rsa-no-policy/posttest.dat
diff --git a/testing/tests/rw-rsa-no-policy/pretest.dat b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat
index 0d2a0dd1f..0d2a0dd1f 100644
--- a/testing/tests/rw-rsa-no-policy/pretest.dat
+++ b/testing/tests/ikev1/rw-rsa-no-policy/pretest.dat
diff --git a/testing/tests/rw-rsa-no-policy/test.conf b/testing/tests/ikev1/rw-rsa-no-policy/test.conf
index f622c18b7..f622c18b7 100644
--- a/testing/tests/rw-rsa-no-policy/test.conf
+++ b/testing/tests/ikev1/rw-rsa-no-policy/test.conf
diff --git a/testing/tests/self-signed/description.txt b/testing/tests/ikev1/self-signed/description.txt
index 2d7bfc2bf..2d7bfc2bf 100644
--- a/testing/tests/self-signed/description.txt
+++ b/testing/tests/ikev1/self-signed/description.txt
diff --git a/testing/tests/default-keys/evaltest.dat b/testing/tests/ikev1/self-signed/evaltest.dat
index f190d7066..f190d7066 100644
--- a/testing/tests/default-keys/evaltest.dat
+++ b/testing/tests/ikev1/self-signed/evaltest.dat
diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf
index fcf7a1754..93ea3a80e 100755
--- a/testing/tests/self-signed/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=0
 	strictcrlpolicy=no
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets
index 167d743df..167d743df 100644
--- a/testing/tests/self-signed/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/self-signed/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables
index 13ad3063f..13ad3063f 100755
--- a/testing/tests/self-signed/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf
index 7d7f42b06..98b0030d8 100755
--- a/testing/tests/self-signed/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=0
 	strictcrlpolicy=no
 	nocrsend=yes
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 	keyingtries=1
 
 conn carol
-	left=192.168.0.1
+	left=PH_IP_MOON
 	leftnexthop=%direct
 	leftcert=moonCert.der
 	leftid=@moon.strongswan.org
diff --git a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets
index b9ec17dbc..b9ec17dbc 100644
--- a/testing/tests/self-signed/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf
index b84f3e131..b84f3e131 100644
--- a/testing/tests/self-signed/hosts/moon/etc/scepclient.conf
+++ b/testing/tests/ikev1/self-signed/hosts/moon/etc/scepclient.conf
diff --git a/testing/tests/self-signed/posttest.dat b/testing/tests/ikev1/self-signed/posttest.dat
index 52b48b9ef..8cada5e7e 100644
--- a/testing/tests/self-signed/posttest.dat
+++ b/testing/tests/ikev1/self-signed/posttest.dat
@@ -1,5 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/self-signed/pretest.dat b/testing/tests/ikev1/self-signed/pretest.dat
index a7cddf677..a7cddf677 100644
--- a/testing/tests/self-signed/pretest.dat
+++ b/testing/tests/ikev1/self-signed/pretest.dat
diff --git a/testing/tests/self-signed/test.conf b/testing/tests/ikev1/self-signed/test.conf
index 0baa48d90..0baa48d90 100644
--- a/testing/tests/self-signed/test.conf
+++ b/testing/tests/ikev1/self-signed/test.conf
diff --git a/testing/tests/starter-also-loop/description.txt b/testing/tests/ikev1/starter-also-loop/description.txt
index 7451f4e12..7451f4e12 100644
--- a/testing/tests/starter-also-loop/description.txt
+++ b/testing/tests/ikev1/starter-also-loop/description.txt
diff --git a/testing/tests/starter-also-loop/evaltest.dat b/testing/tests/ikev1/starter-also-loop/evaltest.dat
index 161772f8e..161772f8e 100644
--- a/testing/tests/starter-also-loop/evaltest.dat
+++ b/testing/tests/ikev1/starter-also-loop/evaltest.dat
diff --git a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf
index e1d210253..b58d1deb7 100755
--- a/testing/tests/starter-also-loop/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/starter-also-loop/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -30,7 +29,7 @@ conn rw
 	auto=add
 
 conn moon
-	left=192.168.0.1
+	left=PH_IP_MOON
         leftnexthop=%direct
         leftcert=moonCert.pem
         leftid=@moon.strongswan.org
@@ -41,7 +40,7 @@ conn moon-net
 	leftsubnet=10.1.0.0/16
 
 conn sun
-	right=192.168.0.2
+	right=PH_IP_SUN
 	rightid=@sun.strongswan.org
 
 conn sun-net
diff --git a/testing/tests/starter-also-loop/posttest.dat b/testing/tests/ikev1/starter-also-loop/posttest.dat
index e69de29bb..e69de29bb 100644
--- a/testing/tests/starter-also-loop/posttest.dat
+++ b/testing/tests/ikev1/starter-also-loop/posttest.dat
diff --git a/testing/tests/starter-also-loop/pretest.dat b/testing/tests/ikev1/starter-also-loop/pretest.dat
index b135b12c3..b135b12c3 100644
--- a/testing/tests/starter-also-loop/pretest.dat
+++ b/testing/tests/ikev1/starter-also-loop/pretest.dat
diff --git a/testing/tests/starter-also-loop/test.conf b/testing/tests/ikev1/starter-also-loop/test.conf
index e7735308f..e7735308f 100644
--- a/testing/tests/starter-also-loop/test.conf
+++ b/testing/tests/ikev1/starter-also-loop/test.conf
diff --git a/testing/tests/starter-also/description.txt b/testing/tests/ikev1/starter-also/description.txt
index 3d4ff7dbf..3d4ff7dbf 100644
--- a/testing/tests/starter-also/description.txt
+++ b/testing/tests/ikev1/starter-also/description.txt
diff --git a/testing/tests/starter-also/evaltest.dat b/testing/tests/ikev1/starter-also/evaltest.dat
index c7657801e..c7657801e 100644
--- a/testing/tests/starter-also/evaltest.dat
+++ b/testing/tests/ikev1/starter-also/evaltest.dat
diff --git a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf
index 74d009cfa..09f3bb94d 100755
--- a/testing/tests/starter-also/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/starter-also/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -30,7 +29,7 @@ conn rw
 	auto=add
 
 conn moon
-	left=192.168.0.1
+	left=PH_IP_MOON
         leftnexthop=%direct
         leftcert=moonCert.pem
         leftid=@moon.strongswan.org
@@ -40,7 +39,7 @@ conn moon-net
 	leftsubnet=10.1.0.0/16
 
 conn sun
-	right=192.168.0.2
+	right=PH_IP_SUN
 	rightid=@sun.strongswan.org
 
 conn sun-net
diff --git a/testing/tests/ikev1/starter-also/posttest.dat b/testing/tests/ikev1/starter-also/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev1/starter-also/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/starter-also/pretest.dat b/testing/tests/ikev1/starter-also/pretest.dat
index 4f96e61df..4f96e61df 100644
--- a/testing/tests/starter-also/pretest.dat
+++ b/testing/tests/ikev1/starter-also/pretest.dat
diff --git a/testing/tests/starter-also/test.conf b/testing/tests/ikev1/starter-also/test.conf
index 9cd583b16..9cd583b16 100644
--- a/testing/tests/starter-also/test.conf
+++ b/testing/tests/ikev1/starter-also/test.conf
diff --git a/testing/tests/starter-includes/description.txt b/testing/tests/ikev1/starter-includes/description.txt
index 6a05c0cca..6a05c0cca 100644
--- a/testing/tests/starter-includes/description.txt
+++ b/testing/tests/ikev1/starter-includes/description.txt
diff --git a/testing/tests/mode-config-swapped/evaltest.dat b/testing/tests/ikev1/starter-includes/evaltest.dat
index 7de32d681..7de32d681 100644
--- a/testing/tests/mode-config-swapped/evaltest.dat
+++ b/testing/tests/ikev1/starter-includes/evaltest.dat
diff --git a/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..2fd734579
--- /dev/null
+++ b/testing/tests/ikev1/starter-includes/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftsourceip=%modeconfig
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+
+
+
diff --git a/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..128c4aa29
--- /dev/null
+++ b/testing/tests/ikev1/starter-includes/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_DAVE
+	leftsourceip=%modeconfig
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+
+
+
diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf
index aa9116252..4e7bfc1b4 100755
--- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.conf
@@ -1,10 +1,9 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 include /etc/ipsec.connections
diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections
index 7cd938628..7cd938628 100644
--- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.connections
+++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.connections
diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host
index e84e5cdc6..acf753cc0 100755
--- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.host
+++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.host
@@ -3,7 +3,7 @@
 conn %default
 	left=PH_IP_MOON
 	leftsubnet=10.1.0.0/16
-	leftsourceip=PH_IP1_MOON
+	leftsourceip=PH_IP_MOON1
 	leftnexthop=%direct
 	leftcert=moonCert.pem
 	leftid=@moon.strongswan.org
diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol
index 9212a9e96..84bedfef6 100644
--- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol
+++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.carol
@@ -3,6 +3,6 @@
 conn rw-carol
 	right=%any
 	rightid=carol@strongswan.org
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 	auto=add
 
diff --git a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave
index 482d15a21..ee021c9be 100644
--- a/testing/tests/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave
+++ b/testing/tests/ikev1/starter-includes/hosts/moon/etc/ipsec.peers/ipsec.dave
@@ -3,6 +3,6 @@
 conn rw-dave
 	right=%any
 	rightid=dave@strongswan.org
-	rightsourceip=PH_IP1_DAVE
+	rightsourceip=PH_IP_DAVE1
 	auto=add
 
diff --git a/testing/tests/starter-includes/posttest.dat b/testing/tests/ikev1/starter-includes/posttest.dat
index 121aa8aea..ebf7525ef 100644
--- a/testing/tests/starter-includes/posttest.dat
+++ b/testing/tests/ikev1/starter-includes/posttest.dat
@@ -1,13 +1,10 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
 moon::/etc/init.d/iptables stop 2> /dev/null
 carol::/etc/init.d/iptables stop 2> /dev/null
 dave::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0
-dave::ip addr del PH_IP1_DAVE/32 dev eth0
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
 moon::rm /etc/ipsec.connections /etc/ipsec.host
 moon::rm -r /etc/ipsec.peers
diff --git a/testing/tests/starter-includes/pretest.dat b/testing/tests/ikev1/starter-includes/pretest.dat
index 0af79a6d2..b034a0c03 100644
--- a/testing/tests/starter-includes/pretest.dat
+++ b/testing/tests/ikev1/starter-includes/pretest.dat
@@ -8,3 +8,4 @@ moon::ipsec start --debug-all
 carol::sleep 2
 carol::ipsec up home
 dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/starter-includes/test.conf b/testing/tests/ikev1/starter-includes/test.conf
index 1a8f2a4e0..1a8f2a4e0 100644
--- a/testing/tests/starter-includes/test.conf
+++ b/testing/tests/ikev1/starter-includes/test.conf
diff --git a/testing/tests/strong-certs/description.txt b/testing/tests/ikev1/strong-certs/description.txt
index 22b58668d..22b58668d 100644
--- a/testing/tests/strong-certs/description.txt
+++ b/testing/tests/ikev1/strong-certs/description.txt
diff --git a/testing/tests/strong-certs/evaltest.dat b/testing/tests/ikev1/strong-certs/evaltest.dat
index 2fe4de76f..2fe4de76f 100644
--- a/testing/tests/strong-certs/evaltest.dat
+++ b/testing/tests/ikev1/strong-certs/evaltest.dat
diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf
index 6ab379636..81d1ae8b6 100755
--- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	strictcrlpolicy=no
 	crlcheckinterval=180
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem
index d4b532323..d4b532323 100644
--- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem
diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem
index f719e4455..f719e4455 100644
--- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.d/private/carolKey.pem
diff --git a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets
index fac55d63b..fac55d63b 100644
--- a/testing/tests/strong-certs/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/strong-certs/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf
index 90cee47c2..468be8afb 100755
--- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	strictcrlpolicy=no
 	crlcheckinterval=180
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem
index 73088cd1d..73088cd1d 100644
--- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem
diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem
index a4a8a4f22..a4a8a4f22 100644
--- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.d/private/daveKey.pem
diff --git a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets
index 9031f323a..9031f323a 100644
--- a/testing/tests/strong-certs/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev1/strong-certs/hosts/dave/etc/ipsec.secrets
diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf
index 76c89aa6b..7aed142a4 100755
--- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	strictcrlpolicy=no
 	crlcheckinterval=180
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem
index 307f4953e..307f4953e 100644
--- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem
diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem
index 58ddc1525..58ddc1525 100644
--- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem
+++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.d/private/moonKey.pem
diff --git a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets
index e86d6aa5c..e86d6aa5c 100644
--- a/testing/tests/strong-certs/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/strong-certs/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/strong-certs/posttest.dat b/testing/tests/ikev1/strong-certs/posttest.dat
index 12b540b53..fc0fbeb38 100644
--- a/testing/tests/strong-certs/posttest.dat
+++ b/testing/tests/ikev1/strong-certs/posttest.dat
@@ -1,6 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/strong-certs/pretest.dat b/testing/tests/ikev1/strong-certs/pretest.dat
index de51ccdfa..de51ccdfa 100644
--- a/testing/tests/strong-certs/pretest.dat
+++ b/testing/tests/ikev1/strong-certs/pretest.dat
diff --git a/testing/tests/strong-certs/test.conf b/testing/tests/ikev1/strong-certs/test.conf
index 70416826e..70416826e 100644
--- a/testing/tests/strong-certs/test.conf
+++ b/testing/tests/ikev1/strong-certs/test.conf
diff --git a/testing/tests/virtual-ip-swapped/description.txt b/testing/tests/ikev1/virtual-ip-swapped/description.txt
index 230906c5d..230906c5d 100644
--- a/testing/tests/virtual-ip-swapped/description.txt
+++ b/testing/tests/ikev1/virtual-ip-swapped/description.txt
diff --git a/testing/tests/virtual-ip-swapped/evaltest.dat b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat
index bf3965727..23e109838 100644
--- a/testing/tests/virtual-ip-swapped/evaltest.dat
+++ b/testing/tests/ikev1/virtual-ip-swapped/evaltest.dat
@@ -1,8 +1,8 @@
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
-moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
 moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
 alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf
index 0e239b707..f4f2dedd0 100755
--- a/testing/tests/virtual-ip-swapped/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 
 conn home
 	right=PH_IP_CAROL
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 	rightnexthop=%direct
 	rightcert=carolCert.pem
 	rightid=carol@strongswan.org
diff --git a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf
index db6effbac..de7f07eb9 100755
--- a/testing/tests/virtual-ip-swapped/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/virtual-ip-swapped/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 
 conn rw
 	right=PH_IP_MOON
-	rightsourceip=PH_IP1_MOON
+	rightsourceip=PH_IP_MOON1
 	rightnexthop=%direct
 	rightcert=moonCert.pem
 	rightid=@moon.strongswan.org
diff --git a/testing/tests/ikev1/virtual-ip-swapped/posttest.dat b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat
new file mode 100644
index 000000000..2116e86e0
--- /dev/null
+++ b/testing/tests/ikev1/virtual-ip-swapped/posttest.dat
@@ -0,0 +1,5 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
diff --git a/testing/tests/virtual-ip/pretest.dat b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat
index 4fe0ee90b..4fe0ee90b 100644
--- a/testing/tests/virtual-ip/pretest.dat
+++ b/testing/tests/ikev1/virtual-ip-swapped/pretest.dat
diff --git a/testing/tests/virtual-ip-swapped/test.conf b/testing/tests/ikev1/virtual-ip-swapped/test.conf
index f106524e2..f106524e2 100644
--- a/testing/tests/virtual-ip-swapped/test.conf
+++ b/testing/tests/ikev1/virtual-ip-swapped/test.conf
diff --git a/testing/tests/virtual-ip/description.txt b/testing/tests/ikev1/virtual-ip/description.txt
index 4ec6021ea..4ec6021ea 100644
--- a/testing/tests/virtual-ip/description.txt
+++ b/testing/tests/ikev1/virtual-ip/description.txt
diff --git a/testing/tests/virtual-ip/evaltest.dat b/testing/tests/ikev1/virtual-ip/evaltest.dat
index bf3965727..23e109838 100644
--- a/testing/tests/virtual-ip/evaltest.dat
+++ b/testing/tests/ikev1/virtual-ip/evaltest.dat
@@ -1,8 +1,8 @@
 carol::ipsec status::home.*STATE_QUICK_I2.*IPsec SA established::YES
 moon::ipsec status::rw.*STATE_QUICK_R2.*IPsec SA established::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
-carol::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
-moon::ping -c 1 PH_IP1_CAROL::64 bytes from PH_IP1_CAROL: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+moon::ping -c 1 PH_IP_CAROL1::64 bytes from PH_IP_CAROL1: icmp_seq=1::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
 moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
 alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
diff --git a/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..a863df33e
--- /dev/null
+++ b/testing/tests/ikev1/virtual-ip/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftsourceip=PH_IP_CAROL1
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+
+
+
diff --git a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf
index 1cd8aab25..c0310692a 100755
--- a/testing/tests/virtual-ip/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/virtual-ip/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -15,7 +14,7 @@ conn %default
 
 conn rw
 	left=PH_IP_MOON
-	leftsourceip=PH_IP1_MOON
+	leftsourceip=PH_IP_MOON1
 	leftnexthop=%direct
 	leftcert=moonCert.pem
 	leftid=@moon.strongswan.org
diff --git a/testing/tests/ikev1/virtual-ip/posttest.dat b/testing/tests/ikev1/virtual-ip/posttest.dat
new file mode 100644
index 000000000..2116e86e0
--- /dev/null
+++ b/testing/tests/ikev1/virtual-ip/posttest.dat
@@ -0,0 +1,5 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
diff --git a/testing/tests/rw-cert/pretest.dat b/testing/tests/ikev1/virtual-ip/pretest.dat
index bd68efb0b..0b2ae8d2b 100644
--- a/testing/tests/rw-cert/pretest.dat
+++ b/testing/tests/ikev1/virtual-ip/pretest.dat
@@ -2,5 +2,6 @@ moon::/etc/init.d/iptables start 2> /dev/null
 carol::/etc/init.d/iptables start 2> /dev/null
 carol::ipsec start
 moon::ipsec start
-sleep 2
+carol::sleep 2
 carol::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/virtual-ip/test.conf b/testing/tests/ikev1/virtual-ip/test.conf
index f106524e2..f106524e2 100644
--- a/testing/tests/virtual-ip/test.conf
+++ b/testing/tests/ikev1/virtual-ip/test.conf
diff --git a/testing/tests/wildcards/description.txt b/testing/tests/ikev1/wildcards/description.txt
index e485f7066..e485f7066 100644
--- a/testing/tests/wildcards/description.txt
+++ b/testing/tests/ikev1/wildcards/description.txt
diff --git a/testing/tests/wildcards/evaltest.dat b/testing/tests/ikev1/wildcards/evaltest.dat
index cbc94b75a..cbc94b75a 100644
--- a/testing/tests/wildcards/evaltest.dat
+++ b/testing/tests/ikev1/wildcards/evaltest.dat
diff --git a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf
index de179c565..d6d32a39d 100755
--- a/testing/tests/wildcards/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/wildcards/hosts/carol/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf
index 2fb6a301e..6156fadba 100755
--- a/testing/tests/wildcards/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/wildcards/hosts/dave/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf
index ee7bc8115..162e22c43 100755
--- a/testing/tests/wildcards/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/wildcards/hosts/moon/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -22,10 +21,9 @@ conn alice
 	right=%any
 	rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*"
 	auto=add
-	
+
 conn venus
 	leftsubnet=PH_IP_VENUS/32
 	right=%any
 	rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*"
 	auto=add
-	
diff --git a/testing/tests/ikev1/wildcards/posttest.dat b/testing/tests/ikev1/wildcards/posttest.dat
new file mode 100644
index 000000000..ed530f6d9
--- /dev/null
+++ b/testing/tests/ikev1/wildcards/posttest.dat
@@ -0,0 +1,3 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
diff --git a/testing/tests/wildcards/pretest.dat b/testing/tests/ikev1/wildcards/pretest.dat
index 67c50c2ef..67c50c2ef 100644
--- a/testing/tests/wildcards/pretest.dat
+++ b/testing/tests/ikev1/wildcards/pretest.dat
diff --git a/testing/tests/wildcards/test.conf b/testing/tests/ikev1/wildcards/test.conf
index 08e5cc145..08e5cc145 100644
--- a/testing/tests/wildcards/test.conf
+++ b/testing/tests/ikev1/wildcards/test.conf
diff --git a/testing/tests/wlan/description.txt b/testing/tests/ikev1/wlan/description.txt
index e018148bd..e018148bd 100644
--- a/testing/tests/wlan/description.txt
+++ b/testing/tests/ikev1/wlan/description.txt
diff --git a/testing/tests/wlan/evaltest.dat b/testing/tests/ikev1/wlan/evaltest.dat
index 1936c93a3..079ac4429 100644
--- a/testing/tests/wlan/evaltest.dat
+++ b/testing/tests/ikev1/wlan/evaltest.dat
@@ -3,7 +3,7 @@ venus::ipsec status::wlan.*STATE_QUICK_I2.*IPsec SA established::YES
 moon::ipsec status::alice.*STATE_QUICK_R2.*IPsec SA established::YES
 moon::ipsec status::venus.*STATE_QUICK_R2.*IPsec SA established::YES
 alice::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_VENUS: icmp_seq=1::YES
-alice::ping -c 1 PH_IP1_MOON::64 bytes from PH_IP1_MOON: icmp_seq=1::YES
+alice::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
 alice::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_seq=1::YES
 alice::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
 venus::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
diff --git a/testing/tests/wlan/hosts/alice/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables
index 86a76e2db..86a76e2db 100755
--- a/testing/tests/wlan/hosts/alice/etc/init.d/iptables
+++ b/testing/tests/ikev1/wlan/hosts/alice/etc/init.d/iptables
diff --git a/testing/tests/wlan/hosts/alice/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf
index a658e4fe8..665ce592f 100755
--- a/testing/tests/wlan/hosts/alice/etc/ipsec.conf
+++ b/testing/tests/ikev1/wlan/hosts/alice/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -30,7 +29,7 @@ conn wlan
 	leftcert=aliceCert.pem
 	leftid=alice@strongswan.org
 	leftfirewall=yes
-	right=PH_IP1_MOON
+	right=PH_IP_MOON1
 	rightid=@moon.strongswan.org
 	rightsubnet=0.0.0.0/0
 	auto=add
diff --git a/testing/tests/wlan/hosts/moon/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables
index e95ef44c6..e95ef44c6 100755
--- a/testing/tests/wlan/hosts/moon/etc/init.d/iptables
+++ b/testing/tests/ikev1/wlan/hosts/moon/etc/init.d/iptables
diff --git a/testing/tests/wlan/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf
index f873479e8..44f980422 100755
--- a/testing/tests/wlan/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/wlan/hosts/moon/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -27,7 +26,7 @@ conn venus
 	auto=add
 
 conn wlan
-        left=PH_IP1_MOON
+        left=PH_IP_MOON1
 	leftnexthop=%direct
 	leftsubnet=0.0.0.0/0
 	leftcert=moonCert.pem
diff --git a/testing/tests/wlan/hosts/venus/etc/init.d/iptables b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables
index 6f95e7576..6f95e7576 100755
--- a/testing/tests/wlan/hosts/venus/etc/init.d/iptables
+++ b/testing/tests/ikev1/wlan/hosts/venus/etc/init.d/iptables
diff --git a/testing/tests/wlan/hosts/venus/etc/ipsec.conf b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf
index 742c1dbce..5d861548d 100755
--- a/testing/tests/wlan/hosts/venus/etc/ipsec.conf
+++ b/testing/tests/ikev1/wlan/hosts/venus/etc/ipsec.conf
@@ -1,12 +1,11 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
 	nat_traversal=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -30,7 +29,7 @@ conn wlan
 	leftcert=venusCert.pem
 	leftid=@venus.strongswan.org
 	leftfirewall=yes
-	right=PH_IP1_MOON
+	right=PH_IP_MOON1
 	rightid=@moon.strongswan.org
 	rightsubnet=0.0.0.0/0
 	auto=add
diff --git a/testing/tests/wlan/posttest.dat b/testing/tests/ikev1/wlan/posttest.dat
index cc873d1ff..6bd2379d8 100644
--- a/testing/tests/wlan/posttest.dat
+++ b/testing/tests/ikev1/wlan/posttest.dat
@@ -1,10 +1,8 @@
-alice::iptables -v -n -L
-venus::iptables -v -n -L
 moon::iptables -t nat -v -n -L POSTROUTING
-moon::iptables -v -n -L
 moon::ipsec stop
 alice::ipsec stop
 venus::ipsec stop
 alice::/etc/init.d/iptables stop 2> /dev/null
 venus::/etc/init.d/iptables stop 2> /dev/null
 moon::/etc/init.d/iptables stop 2> /dev/null
+moon::conntrack -F
diff --git a/testing/tests/wlan/pretest.dat b/testing/tests/ikev1/wlan/pretest.dat
index de4a6ad31..de4a6ad31 100644
--- a/testing/tests/wlan/pretest.dat
+++ b/testing/tests/ikev1/wlan/pretest.dat
diff --git a/testing/tests/wlan/test.conf b/testing/tests/ikev1/wlan/test.conf
index b141c4f1b..b141c4f1b 100644
--- a/testing/tests/wlan/test.conf
+++ b/testing/tests/ikev1/wlan/test.conf
diff --git a/testing/tests/xauth-psk-mode-config/description.txt b/testing/tests/ikev1/xauth-psk-mode-config/description.txt
index 9abe6298c..9abe6298c 100644
--- a/testing/tests/xauth-psk-mode-config/description.txt
+++ b/testing/tests/ikev1/xauth-psk-mode-config/description.txt
diff --git a/testing/tests/xauth-psk-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat
index 15dd054a0..15dd054a0 100644
--- a/testing/tests/xauth-psk-mode-config/evaltest.dat
+++ b/testing/tests/ikev1/xauth-psk-mode-config/evaltest.dat
diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf
index ff1628fb0..3fd0ebf85 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets
index 70ea1dab6..70ea1dab6 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf
index 65c8d534e..8d20a5d20 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets
index 0690d9cde..0690d9cde 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/dave/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf
index 1e543b2fe..66f705e79 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -22,8 +23,8 @@ conn %default
 
 conn carol
 	rightid=carol@strongswan.org
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 
 conn dave
 	rightid=dave@strongswan.org
-	rightsourceip=PH_IP1_DAVE
+	rightsourceip=PH_IP_DAVE1
diff --git a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets
index 1ea69f998..1ea69f998 100644
--- a/testing/tests/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk-mode-config/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat
new file mode 100644
index 000000000..42fa8359b
--- /dev/null
+++ b/testing/tests/ikev1/xauth-psk-mode-config/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
diff --git a/testing/tests/xauth-psk-mode-config/pretest.dat b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat
index 95a6be131..95a6be131 100644
--- a/testing/tests/xauth-psk-mode-config/pretest.dat
+++ b/testing/tests/ikev1/xauth-psk-mode-config/pretest.dat
diff --git a/testing/tests/xauth-psk-mode-config/test.conf b/testing/tests/ikev1/xauth-psk-mode-config/test.conf
index 75510b295..75510b295 100644
--- a/testing/tests/xauth-psk-mode-config/test.conf
+++ b/testing/tests/ikev1/xauth-psk-mode-config/test.conf
diff --git a/testing/tests/xauth-psk/description.txt b/testing/tests/ikev1/xauth-psk/description.txt
index 0ac2043c2..0ac2043c2 100644
--- a/testing/tests/xauth-psk/description.txt
+++ b/testing/tests/ikev1/xauth-psk/description.txt
diff --git a/testing/tests/xauth-psk/evaltest.dat b/testing/tests/ikev1/xauth-psk/evaltest.dat
index e1dc6b5b0..e1dc6b5b0 100644
--- a/testing/tests/xauth-psk/evaltest.dat
+++ b/testing/tests/ikev1/xauth-psk/evaltest.dat
diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf
index b9af32c65..3e8ddf0fe 100644
--- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets
index 70ea1dab6..70ea1dab6 100644
--- a/testing/tests/xauth-psk/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf
index f392a3e66..9aee88cfe 100644
--- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets
index 0690d9cde..0690d9cde 100644
--- a/testing/tests/xauth-psk/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk/hosts/dave/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf
index 4c423b017..dfaa44521 100644
--- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets
index 047d6c235..047d6c235 100644
--- a/testing/tests/xauth-psk/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-psk/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk-mode-config/posttest.dat b/testing/tests/ikev1/xauth-psk/posttest.dat
index 530cfc7b9..7cebd7f25 100644
--- a/testing/tests/xauth-psk-mode-config/posttest.dat
+++ b/testing/tests/ikev1/xauth-psk/posttest.dat
@@ -1,6 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/xauth-psk/pretest.dat b/testing/tests/ikev1/xauth-psk/pretest.dat
index 95a6be131..95a6be131 100644
--- a/testing/tests/xauth-psk/pretest.dat
+++ b/testing/tests/ikev1/xauth-psk/pretest.dat
diff --git a/testing/tests/xauth-psk/test.conf b/testing/tests/ikev1/xauth-psk/test.conf
index 70416826e..70416826e 100644
--- a/testing/tests/xauth-psk/test.conf
+++ b/testing/tests/ikev1/xauth-psk/test.conf
diff --git a/testing/tests/xauth-rsa-fail/description.txt b/testing/tests/ikev1/xauth-rsa-fail/description.txt
index 83e9d2726..83e9d2726 100644
--- a/testing/tests/xauth-rsa-fail/description.txt
+++ b/testing/tests/ikev1/xauth-rsa-fail/description.txt
diff --git a/testing/tests/xauth-rsa-fail/evaltest.dat b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat
index 0bcef388d..0bcef388d 100644
--- a/testing/tests/xauth-rsa-fail/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa-fail/evaltest.dat
diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf
index bfee72421..d49bc1490 100755
--- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets
index 24506be09..24506be09 100644
--- a/testing/tests/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf
index f7cf06fae..6a48cf6ee 100755
--- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets
index a18e885f8..a18e885f8 100644
--- a/testing/tests/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-fail/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat
index c6d6235f9..c6d6235f9 100644
--- a/testing/tests/xauth-rsa-nosecret/posttest.dat
+++ b/testing/tests/ikev1/xauth-rsa-fail/posttest.dat
diff --git a/testing/tests/xauth-rsa-fail/pretest.dat b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat
index 1b8fc3b79..1b8fc3b79 100644
--- a/testing/tests/xauth-rsa-fail/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa-fail/pretest.dat
diff --git a/testing/tests/xauth-rsa-fail/test.conf b/testing/tests/ikev1/xauth-rsa-fail/test.conf
index 5442565f8..5442565f8 100644
--- a/testing/tests/xauth-rsa-fail/test.conf
+++ b/testing/tests/ikev1/xauth-rsa-fail/test.conf
diff --git a/testing/tests/xauth-rsa-mode-config/description.txt b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt
index aa2b31542..aa2b31542 100644
--- a/testing/tests/xauth-rsa-mode-config/description.txt
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/description.txt
diff --git a/testing/tests/xauth-rsa-mode-config/evaltest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat
index 15dd054a0..15dd054a0 100644
--- a/testing/tests/xauth-rsa-mode-config/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/evaltest.dat
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf
index 751c2a29d..90539650f 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets
index 48fd260c1..48fd260c1 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf
index c97e815df..19618145d 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets
index 14f088501..14f088501 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/dave/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf
index e3b2219c4..eccdc2b70 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug="control"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -23,8 +24,8 @@ conn %default
 
 conn rw-carol
 	rightid=carol@strongswan.org
-	rightsourceip=PH_IP1_CAROL
+	rightsourceip=PH_IP_CAROL1
 
 conn rw-dave
 	rightid=dave@strongswan.org
-	rightsourceip=PH_IP1_DAVE
+	rightsourceip=PH_IP_DAVE1
diff --git a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets
index 8d41919fc..8d41919fc 100644
--- a/testing/tests/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat
new file mode 100644
index 000000000..42fa8359b
--- /dev/null
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+carol::ip addr del PH_IP_CAROL1/32 dev eth0
+dave::ip addr del PH_IP_DAVE1/32 dev eth0
diff --git a/testing/tests/xauth-rsa-mode-config/pretest.dat b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat
index 78e2d57f8..78e2d57f8 100644
--- a/testing/tests/xauth-rsa-mode-config/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/pretest.dat
diff --git a/testing/tests/xauth-rsa-mode-config/test.conf b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf
index 75510b295..75510b295 100644
--- a/testing/tests/xauth-rsa-mode-config/test.conf
+++ b/testing/tests/ikev1/xauth-rsa-mode-config/test.conf
diff --git a/testing/tests/xauth-rsa-nosecret/description.txt b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt
index ffbb47c04..ffbb47c04 100644
--- a/testing/tests/xauth-rsa-nosecret/description.txt
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/description.txt
diff --git a/testing/tests/xauth-rsa-nosecret/evaltest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat
index ddbb3ae2d..ddbb3ae2d 100644
--- a/testing/tests/xauth-rsa-nosecret/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/evaltest.dat
diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf
index bfee72421..d49bc1490 100755
--- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets
index 6a2aea811..6a2aea811 100644
--- a/testing/tests/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf
index f7cf06fae..6a48cf6ee 100755
--- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets
index a18e885f8..a18e885f8 100644
--- a/testing/tests/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ike-alg-strict/pretest.dat b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat
index f5aa989fe..f5aa989fe 100644
--- a/testing/tests/ike-alg-strict/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/pretest.dat
diff --git a/testing/tests/xauth-rsa-nosecret/test.conf b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf
index 5442565f8..5442565f8 100644
--- a/testing/tests/xauth-rsa-nosecret/test.conf
+++ b/testing/tests/ikev1/xauth-rsa-nosecret/test.conf
diff --git a/testing/tests/xauth-rsa/description.txt b/testing/tests/ikev1/xauth-rsa/description.txt
index 0cdaba1c5..0cdaba1c5 100644
--- a/testing/tests/xauth-rsa/description.txt
+++ b/testing/tests/ikev1/xauth-rsa/description.txt
diff --git a/testing/tests/xauth-rsa/evaltest.dat b/testing/tests/ikev1/xauth-rsa/evaltest.dat
index e1dc6b5b0..e1dc6b5b0 100644
--- a/testing/tests/xauth-rsa/evaltest.dat
+++ b/testing/tests/ikev1/xauth-rsa/evaltest.dat
diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf
index bfee72421..d49bc1490 100644
--- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets
index 48fd260c1..48fd260c1 100644
--- a/testing/tests/xauth-rsa/hosts/carol/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa/hosts/carol/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf
index 0f34a209a..5c1de3372 100644
--- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.conf
@@ -4,6 +4,7 @@ config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets
index 14f088501..14f088501 100644
--- a/testing/tests/xauth-rsa/hosts/dave/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa/hosts/dave/etc/ipsec.secrets
diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf
index f7cf06fae..a997fb73f 100644
--- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.conf
+++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.conf
@@ -1,9 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
 config setup
-	plutodebug=control
+	plutodebug="control"
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
diff --git a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets
index 8d41919fc..8d41919fc 100644
--- a/testing/tests/xauth-rsa/hosts/moon/etc/ipsec.secrets
+++ b/testing/tests/ikev1/xauth-rsa/hosts/moon/etc/ipsec.secrets
diff --git a/testing/tests/xauth-psk/posttest.dat b/testing/tests/ikev1/xauth-rsa/posttest.dat
index 530cfc7b9..7cebd7f25 100644
--- a/testing/tests/xauth-psk/posttest.dat
+++ b/testing/tests/ikev1/xauth-rsa/posttest.dat
@@ -1,6 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/xauth-rsa/pretest.dat b/testing/tests/ikev1/xauth-rsa/pretest.dat
index 78e2d57f8..78e2d57f8 100644
--- a/testing/tests/xauth-rsa/pretest.dat
+++ b/testing/tests/ikev1/xauth-rsa/pretest.dat
diff --git a/testing/tests/xauth-rsa/test.conf b/testing/tests/ikev1/xauth-rsa/test.conf
index 70416826e..70416826e 100644
--- a/testing/tests/xauth-rsa/test.conf
+++ b/testing/tests/ikev1/xauth-rsa/test.conf
diff --git a/testing/tests/ikev2/config-payload-swapped/description.txt b/testing/tests/ikev2/config-payload-swapped/description.txt
new file mode 100644
index 000000000..2160e6b92
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/description.txt
@@ -0,0 +1,3 @@
+Same scenario as test <a href="../config-payload/"><b>mode-config</b></a> but with
+swapped end definitions:  <b>right</b> denotes the <b>local</b> side whereas
+<b>left</b> stands for the <b>remote</b> peer.
diff --git a/testing/tests/ikev2/config-payload-swapped/evaltest.dat b/testing/tests/ikev2/config-payload-swapped/evaltest.dat
new file mode 100644
index 000000000..40cb4339b
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/evaltest.dat
@@ -0,0 +1,20 @@
+carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
+carol::ip addr list dev eth0::PH_IP_CAROL1::YES
+carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES
+carol::ipsec status::home.*INSTALLED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
+dave::ip addr list dev eth0::PH_IP_DAVE1::YES
+dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES
+dave::ipsec status::home.*INSTALLED::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::ipsec status::rw-carol.*INSTALLED::YES
+moon::ipsec status::rw-dave.*INSTALLED::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
+alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..6e2cbd153
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	right=PH_IP_CAROL
+	rightsourceip=%config
+	rightnexthop=%direct
+	rightcert=carolCert.pem
+	rightid=carol@strongswan.org
+	rightfirewall=yes
+	righthostaccess=yes
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..f148757db
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	right=PH_IP_DAVE
+	rightsourceip=%config
+	rightnexthop=%direct
+	rightcert=daveCert.pem
+	rightid=dave@strongswan.org
+	rightfirewall=yes
+	righthostaccess=yes
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf
index 98cdaab7a..5cb49cfc8 100755
--- a/testing/tests/esp-ah-tunnel/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/config-payload-swapped/hosts/moon/etc/ipsec.conf
@@ -1,28 +1,32 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
-	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	plutostart=no
 
 conn %default
 	ikelifetime=60m
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
-	auth=ah
-	ike=aes128-sha
-	esp=aes128-sha1
-
-conn home
-	left=PH_IP_CAROL
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	leftfirewall=yes
+	keyexchange=ikev2
 	right=PH_IP_MOON
 	rightsubnet=10.1.0.0/16
+	rightsourceip=PH_IP_MOON1
+	rightnexthop=%direct
+	rightcert=moonCert.pem
 	rightid=@moon.strongswan.org
+	rightfirewall=yes
+
+conn rw-carol
+	left=%any
+	leftid=carol@strongswan.org
+	leftsourceip=PH_IP_CAROL1
+	auto=add
+
+conn rw-dave
+	left=%any
+	leftid=dave@strongswan.org
+	leftsourceip=PH_IP_DAVE1
 	auto=add
diff --git a/testing/tests/xauth-rsa-mode-config/posttest.dat b/testing/tests/ikev2/config-payload-swapped/posttest.dat
index 530cfc7b9..7cebd7f25 100644
--- a/testing/tests/xauth-rsa-mode-config/posttest.dat
+++ b/testing/tests/ikev2/config-payload-swapped/posttest.dat
@@ -1,6 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/ikev2/config-payload-swapped/pretest.dat b/testing/tests/ikev2/config-payload-swapped/pretest.dat
new file mode 100644
index 000000000..014e80517
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/pretest.dat
@@ -0,0 +1,10 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+carol::ipsec start
+dave::ipsec start
+moon::ipsec start
+carol::sleep 2 
+carol::ipsec up home
+dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/ikev2/config-payload-swapped/test.conf b/testing/tests/ikev2/config-payload-swapped/test.conf
new file mode 100644
index 000000000..1a8f2a4e0
--- /dev/null
+++ b/testing/tests/ikev2/config-payload-swapped/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon alice"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/config-payload/description.txt b/testing/tests/ikev2/config-payload/description.txt
new file mode 100644
index 000000000..7690e7dce
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/description.txt
@@ -0,0 +1,7 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each to gateway <b>moon</b>.
+Both <b>carol</b> and <b>dave</b> request a <b>virtual IP</b> via the IKEv2 configuration payload
+by using the <b>leftsourceip=%config</b> parameter. <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test the
+tunnels, <b>carol</b> and <b>dave</b> then ping the client <b>alice</b> behind the gateway
+<b>moon</b>. The source IP addresses of the two pings will be the virtual IPs <b>carol1</b>
+and <b>dave1</b>, respectively.
diff --git a/testing/tests/ikev2/config-payload/evaltest.dat b/testing/tests/ikev2/config-payload/evaltest.dat
new file mode 100644
index 000000000..40cb4339b
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/evaltest.dat
@@ -0,0 +1,20 @@
+carol::cat /var/log/daemon.log::installing new virtual IP PH_IP_CAROL1::YES
+carol::ip addr list dev eth0::PH_IP_CAROL1::YES
+carol::ip route list dev eth0::10.1.0.0/16.*src PH_IP_CAROL1::YES
+carol::ipsec status::home.*INSTALLED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::cat /var/log/daemon.log::installing new virtual IP PH_IP_DAVE1::YES
+dave::ip addr list dev eth0::PH_IP_DAVE1::YES
+dave::ip route list dev eth0::10.1.0.0/16.*src PH_IP_DAVE1::YES
+dave::ipsec status::home.*INSTALLED::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::ipsec status::rw-carol.*INSTALLED::YES
+moon::ipsec status::rw-dave.*INSTALLED::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+alice::tcpdump::IP carol1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > carol1.strongswan.org: ICMP echo reply::YES
+alice::tcpdump::IP dave1.strongswan.org > alice.strongswan.org: ICMP echo request::YES
+alice::tcpdump::IP alice.strongswan.org > dave1.strongswan.org: ICMP echo reply::YES
diff --git a/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..4ea2b22f7
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftsourceip=%config
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..dad3f3440
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_DAVE
+	leftsourceip=%config
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a4c4b3553
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,32 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftsourceip=PH_IP_MOON1
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+
+conn rw-carol
+	right=%any
+	rightid=carol@strongswan.org
+	rightsourceip=PH_IP_CAROL1
+	auto=add
+
+conn rw-dave
+	right=%any
+	rightid=dave@strongswan.org
+	rightsourceip=PH_IP_DAVE1
+	auto=add
diff --git a/testing/tests/xauth-rsa/posttest.dat b/testing/tests/ikev2/config-payload/posttest.dat
index 530cfc7b9..7cebd7f25 100644
--- a/testing/tests/xauth-rsa/posttest.dat
+++ b/testing/tests/ikev2/config-payload/posttest.dat
@@ -1,6 +1,3 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
diff --git a/testing/tests/ikev2/config-payload/pretest.dat b/testing/tests/ikev2/config-payload/pretest.dat
new file mode 100644
index 000000000..014e80517
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/pretest.dat
@@ -0,0 +1,10 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+carol::ipsec start
+dave::ipsec start
+moon::ipsec start
+carol::sleep 2 
+carol::ipsec up home
+dave::ipsec up home
+carol::sleep 1
diff --git a/testing/tests/ikev2/config-payload/test.conf b/testing/tests/ikev2/config-payload/test.conf
new file mode 100644
index 000000000..1a8f2a4e0
--- /dev/null
+++ b/testing/tests/ikev2/config-payload/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon alice"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/crl-from-cache/description.txt b/testing/tests/ikev2/crl-from-cache/description.txt
new file mode 100644
index 000000000..17866f572
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/description.txt
@@ -0,0 +1,5 @@
+By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. When <b>carol</b> initiates
+an IPsec connection to <b>moon</b>, both VPN endpoints find a cached CRL in
+their <b>/etc/ipsec.d/crls/</b> directories which allows them to immediately verify
+the certificate received from their peer.
diff --git a/testing/tests/ikev2/crl-from-cache/evaltest.dat b/testing/tests/ikev2/crl-from-cache/evaltest.dat
new file mode 100644
index 000000000..9aa53fb64
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/evaltest.dat
@@ -0,0 +1,8 @@
+moon::cat /var/log/daemon.log::loading crl file::YES
+carol::cat /var/log/daemon.log::loading crl file::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
+moon::cat /var/log/auth.log::written crl file::NO
+carol::cat /var/log/auth.log::written crl file::NO
+moon::ipsec listcrls:: ok::YES
+carol::ipsec listcrls:: ok::YES
diff --git a/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..cea581bc2
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..fe2179885
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/crl-from-cache/posttest.dat b/testing/tests/ikev2/crl-from-cache/posttest.dat
new file mode 100644
index 000000000..be17847c1
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::rm /etc/ipsec.d/crls/*
+carol::rm /etc/ipsec.d/crls/*
diff --git a/testing/tests/ikev2/crl-from-cache/pretest.dat b/testing/tests/ikev2/crl-from-cache/pretest.dat
new file mode 100644
index 000000000..acdb265ed
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/pretest.dat
@@ -0,0 +1,8 @@
+moon::wget -q http://crl.strongswan.org/strongswan.crl
+moon::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
+carol::wget -q http://crl.strongswan.org/strongswan.crl
+carol::mv strongswan.crl /etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/crl-from-cache/test.conf b/testing/tests/ikev2/crl-from-cache/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/crl-from-cache/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-ldap/description.txt b/testing/tests/ikev2/crl-ldap/description.txt
new file mode 100644
index 000000000..d7ed591cc
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/description.txt
@@ -0,0 +1,6 @@
+By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. Thus when <b>carol</b> initiates
+the connection and only an expired CRL cache file in <b>/etc/ipsec.d/crls</b> is
+availabl, an ldap fetch to get the CRL from the LDAP server <b>winnetou</b> is
+successfully started and the IKE authentication completes. The new CRL is again
+cached locally as a file in <b>/etc/ipsec.d/crls</b> due to the <b>cachecrls=yes</b> option.
diff --git a/testing/tests/ikev2/crl-ldap/evaltest.dat b/testing/tests/ikev2/crl-ldap/evaltest.dat
new file mode 100644
index 000000000..05e818e21
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/evaltest.dat
@@ -0,0 +1,12 @@
+moon::cat /var/log/daemon.log::loading crl file::YES
+carol::cat /var/log/daemon.log::loading crl file::YES
+moon::cat /var/log/daemon.log::crl is stale::YES
+carol::cat /var/log/daemon.log::crl is stale::YES
+moon::cat /var/log/daemon.log::sending ldap request::YES
+carol::cat /var/log/daemon.log::sending ldap request::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
+moon::cat /var/log/daemon.log::written crl file::YES
+carol::cat /var/log/daemon.log::written crl file::YES
+moon::ipsec listcrls:: ok::YES
+carol::ipsec listcrls:: ok::YES
diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables
new file mode 100755
index 000000000..571459bae
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/init.d/iptables
@@ -0,0 +1,73 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+	before net
+	need logger
+}
+
+start() {
+	ebegin "Starting firewall"
+
+	# default policy is DROP
+	/sbin/iptables -P INPUT DROP
+	/sbin/iptables -P OUTPUT DROP
+	/sbin/iptables -P FORWARD DROP
+
+	# allow esp
+	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+	# allow IKE
+	iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+	# allow ldap crl fetch from winnetou
+	iptables -A INPUT  -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
+
+	# allow ssh
+	iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+	
+			if [ $a == nat ]; then
+				/sbin/iptables -t nat -P PREROUTING ACCEPT
+				/sbin/iptables -t nat -P POSTROUTING ACCEPT
+				/sbin/iptables -t nat -P OUTPUT ACCEPT
+			elif [ $a == mangle ]; then
+				/sbin/iptables -t mangle -P PREROUTING ACCEPT
+				/sbin/iptables -t mangle -P INPUT ACCEPT
+				/sbin/iptables -t mangle -P FORWARD ACCEPT
+				/sbin/iptables -t mangle -P OUTPUT ACCEPT
+				/sbin/iptables -t mangle -P POSTROUTING ACCEPT
+			elif [ $a == filter ]; then
+				/sbin/iptables -t filter -P INPUT ACCEPT
+				/sbin/iptables -t filter -P FORWARD ACCEPT
+				/sbin/iptables -t filter -P OUTPUT ACCEPT
+			fi
+		done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+		done;
+        eend $?
+	start
+}
+
diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..8b37ec6b8
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,31 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	crluri="ldap://ldap.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	auto=add
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=2
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
diff --git a/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
new file mode 100644
index 000000000..75e8b0959
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/carol/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables
new file mode 100755
index 000000000..8de514a2e
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/init.d/iptables
@@ -0,0 +1,76 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+	before net
+	need logger
+}
+
+start() {
+	ebegin "Starting firewall"
+
+	# enable IP forwarding
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+	
+	# default policy is DROP
+	/sbin/iptables -P INPUT DROP
+	/sbin/iptables -P OUTPUT DROP
+	/sbin/iptables -P FORWARD DROP
+
+	# allow esp
+	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+	# allow IKE
+	iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+	# allow ldap crl fetch from winnetou
+	iptables -A INPUT  -i eth0 -p tcp --sport 389 -s PH_IP_WINNETOU -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p tcp --dport 389 -d PH_IP_WINNETOU -j ACCEPT
+
+	# allow ssh
+	iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+	
+			if [ $a == nat ]; then
+				/sbin/iptables -t nat -P PREROUTING ACCEPT
+				/sbin/iptables -t nat -P POSTROUTING ACCEPT
+				/sbin/iptables -t nat -P OUTPUT ACCEPT
+			elif [ $a == mangle ]; then
+				/sbin/iptables -t mangle -P PREROUTING ACCEPT
+				/sbin/iptables -t mangle -P INPUT ACCEPT
+				/sbin/iptables -t mangle -P FORWARD ACCEPT
+				/sbin/iptables -t mangle -P OUTPUT ACCEPT
+				/sbin/iptables -t mangle -P POSTROUTING ACCEPT
+			elif [ $a == filter ]; then
+				/sbin/iptables -t filter -P INPUT ACCEPT
+				/sbin/iptables -t filter -P FORWARD ACCEPT
+				/sbin/iptables -t filter -P OUTPUT ACCEPT
+			fi
+		done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+		done;
+        eend $?
+	start
+}
+
diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..3b1fbabb8
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	crluri="ldap://ldap1.strongswan.org/cn=strongSwan Root CA, o=Linux strongSwan, c=CH?certificateRevocationList"
+	auto=add
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=2
+	keyexchange=ikev2
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
new file mode 100644
index 000000000..75e8b0959
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/hosts/moon/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl
diff --git a/testing/tests/ikev2/crl-ldap/posttest.dat b/testing/tests/ikev2/crl-ldap/posttest.dat
new file mode 100644
index 000000000..bddd87424
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/posttest.dat
@@ -0,0 +1,7 @@
+moon::ipsec stop
+carol::ipsec stop
+winnetou::/etc/init.d/slapd stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+moon::rm /etc/ipsec.d/crls/*
+carol::rm /etc/ipsec.d/crls/*
diff --git a/testing/tests/ikev2/crl-ldap/pretest.dat b/testing/tests/ikev2/crl-ldap/pretest.dat
new file mode 100644
index 000000000..64fa8116b
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/pretest.dat
@@ -0,0 +1,8 @@
+winnetou::/etc/init.d/slapd start
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
+carol::sleep 3 
diff --git a/testing/tests/ikev2/crl-ldap/test.conf b/testing/tests/ikev2/crl-ldap/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/crl-ldap/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-revoked/description.txt b/testing/tests/ikev2/crl-revoked/description.txt
new file mode 100644
index 000000000..b39c59c97
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/description.txt
@@ -0,0 +1,4 @@
+By setting <b>strictcrlpolicy=yes</b> a <b>strict CRL policy</b> is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The remote host <b>carol</b>
+initiates the connection and presents a certificate that has been revoked by the
+current CRL causing the IKE negotiation to fail. 
diff --git a/testing/tests/ikev2/crl-revoked/evaltest.dat b/testing/tests/ikev2/crl-revoked/evaltest.dat
new file mode 100644
index 000000000..3d6cf72bb
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/evaltest.dat
@@ -0,0 +1,6 @@
+moon::cat /var/log/daemon.log::certificate was revoked::YES
+moon::cat /var/log/daemon.log::end entity certificate is not trusted::YES
+carol::cat /var/log/daemon.log::AUTHENTICATION_FAILED::YES
+moon::ipsec listcrls:: ok::YES
+moon::ipsec status::rw.*ESTABLISHED::NO
+carol::ipsec status::home.*ESTABLISHED::NO
diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..29b3c2a65
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolRevokedCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
new file mode 100644
index 000000000..5b742fc9e
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/certs/carolRevokedCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV
+mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo
+5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv
+VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN
+IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5
+K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC
+MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9
+OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
+EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
+d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
+b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB
+56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM
+2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q
+O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL
+LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3
+wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N
+9IcgYi5x
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
new file mode 100644
index 000000000..8aefcc5a6
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.d/private/carolRevokedKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn
+hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb
+v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7
+HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx
+vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE
+UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU
+WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf
+OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu
+og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2
+MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/
+khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx
+uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07
+a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt
+7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+
+rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y
+ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf
+IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi
+CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3
+baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R
+TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP
+r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i
+jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH
+46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva
+o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa
+9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA==
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..8e31be4cb
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolRevokedKey.pem
diff --git a/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a1a9587dd
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/crl-revoked/posttest.dat b/testing/tests/ikev2/crl-revoked/posttest.dat
new file mode 100644
index 000000000..d742e8410
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+carol::rm /etc/ipsec.d/private/*
+carol::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/crl-revoked/pretest.dat b/testing/tests/ikev2/crl-revoked/pretest.dat
new file mode 100644
index 000000000..8984dcbcf
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 1 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/crl-revoked/test.conf b/testing/tests/ikev2/crl-revoked/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/crl-revoked/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-strict/description.txt b/testing/tests/ikev2/crl-strict/description.txt
new file mode 100644
index 000000000..b2b70906f
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/description.txt
@@ -0,0 +1,2 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict CRL policy</b> is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/crl-strict/evaltest.dat b/testing/tests/ikev2/crl-strict/evaltest.dat
new file mode 100644
index 000000000..ac70750c5
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/evaltest.dat
@@ -0,0 +1,4 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+moon::ipsec listcrls:: ok::YES
+carol::ipsec listcrls:: ok::YES
diff --git a/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..52e5c291d
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+
+conn home
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a9f6a4bb4
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,34 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+
+conn net-net
+	leftsubnet=10.1.0.0/16
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	rightid=@sun.strongswan.org
+	auto=add
+        
+conn host-host
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	auto=add
+
+conn rw
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/crl-strict/posttest.dat b/testing/tests/ikev2/crl-strict/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/crl-strict/pretest.dat b/testing/tests/ikev2/crl-strict/pretest.dat
new file mode 100644
index 000000000..8984dcbcf
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 1 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/crl-strict/test.conf b/testing/tests/ikev2/crl-strict/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/crl-strict/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/crl-to-cache/description.txt b/testing/tests/ikev2/crl-to-cache/description.txt
new file mode 100644
index 000000000..9f542e73d
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/description.txt
@@ -0,0 +1,6 @@
+By setting <b>cachecrls=yes</b> in ipsec.conf, a copy of the CRL fetched
+via http from the web server <b>winnetou</b> is saved locally in the
+directory <b>/etc/ipsec.d/crls</b> on both the roadwarrior <b>carol</b>
+and the gateway <b>moon</b> when the IPsec connection is set up. The
+<b>subjectKeyIdentifier</b> of the issuing CA plus the suffix <b>.crl</b>
+is used as a unique filename for the cached CRL. 
diff --git a/testing/tests/ikev2/crl-to-cache/evaltest.dat b/testing/tests/ikev2/crl-to-cache/evaltest.dat
new file mode 100644
index 000000000..14edd946f
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/evaltest.dat
@@ -0,0 +1,4 @@
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
+moon::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
+carol::cat /var/log/daemon.log::written crl file.*/etc/ipsec.d/crls/5da7dd700651327ee7b66db3b5e5e060ea2e4def.crl::YES
diff --git a/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..cea581bc2
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..fe2179885
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	cachecrls=yes
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/crl-to-cache/posttest.dat b/testing/tests/ikev2/crl-to-cache/posttest.dat
new file mode 100644
index 000000000..be17847c1
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::rm /etc/ipsec.d/crls/*
+carol::rm /etc/ipsec.d/crls/*
diff --git a/testing/tests/ocsp-strict/pretest.dat b/testing/tests/ikev2/crl-to-cache/pretest.dat
index d5516fd3b..d92333d86 100644
--- a/testing/tests/ocsp-strict/pretest.dat
+++ b/testing/tests/ikev2/crl-to-cache/pretest.dat
@@ -1,4 +1,3 @@
-winnetou::/etc/openssl/start-ocsp
 moon::ipsec start
 carol::ipsec start
 carol::sleep 2
diff --git a/testing/tests/ikev2/crl-to-cache/test.conf b/testing/tests/ikev2/crl-to-cache/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/crl-to-cache/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/default-keys/description.txt b/testing/tests/ikev2/default-keys/description.txt
new file mode 100644
index 000000000..639e909da
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/description.txt
@@ -0,0 +1,8 @@
+Because of the missing <b>/etc/ipsec.secrets</b> file, roadwarrior <b>carol</b>
+and gateway <b>moon</b> each automatically generate a PKCS#1 RSA private key
+and a self-signed X.509 certificate. Because the UML testing environment does
+not offer enough entropy, the non-blocking /dev/urandom device is used in place
+of /dev/random for generating the random primes.
+<p>
+The self-signed certificates are then distributed to the peers via scp
+and are used to set up a road warrior connection initiated by <b>carol</b> 
diff --git a/testing/tests/ikev2/default-keys/evaltest.dat b/testing/tests/ikev2/default-keys/evaltest.dat
new file mode 100644
index 000000000..2c1e11c97
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/evaltest.dat
@@ -0,0 +1,7 @@
+carol::cat /var/log/auth.log::scepclient::YES
+moon::cat /var/log/auth.log::scepclient::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+moon::ipsec statusall::carol.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..a4668d9ae
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=selfCert.der
+	leftsendcert=never
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightcert=peerCert.der
+	rightsendcert=never
+	auto=add
diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables
new file mode 100755
index 000000000..13ad3063f
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/init.d/iptables
@@ -0,0 +1,78 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+opts="start stop reload"
+
+depend() {
+	before net
+	need logger
+}
+
+start() {
+	ebegin "Starting firewall"
+
+	# enable IP forwarding
+	echo 1 > /proc/sys/net/ipv4/ip_forward
+	
+	# default policy is DROP
+	/sbin/iptables -P INPUT DROP
+	/sbin/iptables -P OUTPUT DROP
+	/sbin/iptables -P FORWARD DROP
+
+	# allow esp
+	iptables -A INPUT  -i eth0 -p 50 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
+
+	# allow IKE
+	iptables -A INPUT  -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
+
+	# allow crl fetch from winnetou
+	iptables -A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+	iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+	# allow ssh
+	iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
+	iptables -A INPUT  -p tcp --sport 22 -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+	iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
+
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+	
+			if [ $a == nat ]; then
+				/sbin/iptables -t nat -P PREROUTING ACCEPT
+				/sbin/iptables -t nat -P POSTROUTING ACCEPT
+				/sbin/iptables -t nat -P OUTPUT ACCEPT
+			elif [ $a == mangle ]; then
+				/sbin/iptables -t mangle -P PREROUTING ACCEPT
+				/sbin/iptables -t mangle -P INPUT ACCEPT
+				/sbin/iptables -t mangle -P FORWARD ACCEPT
+				/sbin/iptables -t mangle -P OUTPUT ACCEPT
+				/sbin/iptables -t mangle -P POSTROUTING ACCEPT
+			elif [ $a == filter ]; then
+				/sbin/iptables -t filter -P INPUT ACCEPT
+				/sbin/iptables -t filter -P FORWARD ACCEPT
+				/sbin/iptables -t filter -P OUTPUT ACCEPT
+			fi
+		done
+	eend $?
+}
+
+reload() {
+	ebegin "Flushing firewall"
+		for a in `cat /proc/net/ip_tables_names`; do
+			/sbin/iptables -F -t $a
+			/sbin/iptables -X -t $a
+		done;
+        eend $?
+	start
+}
+
diff --git a/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..b6a0e4990
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn carol
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=selfCert.der
+	leftsendcert=never
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	rightcert=peerCert.der
+	rightsendcert=never
+	auto=add
diff --git a/testing/tests/ikev2/default-keys/posttest.dat b/testing/tests/ikev2/default-keys/posttest.dat
new file mode 100644
index 000000000..8cada5e7e
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/posttest.dat
@@ -0,0 +1,8 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+carol::rm /etc/ipsec.d/private/*
+carol::rm /etc/ipsec.d/certs/*
+moon::rm /etc/ipsec.d/private/*
+moon::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/default-keys/pretest.dat b/testing/tests/ikev2/default-keys/pretest.dat
new file mode 100644
index 000000000..fe68be4b5
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/pretest.dat
@@ -0,0 +1,18 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+carol::rm /etc/ipsec.secrets
+carol::rm /etc/ipsec.d/private/*
+carol::rm /etc/ipsec.d/certs/*
+carol::rm /etc/ipsec.d/cacerts/*
+carol::ipsec start
+moon::rm /etc/ipsec.secrets
+moon::rm /etc/ipsec.d/private/*
+moon::rm /etc/ipsec.d/certs/*
+moon::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+moon::sleep 3 
+moon::scp /etc/ipsec.d/certs/selfCert.der carol:/etc/ipsec.d/certs/peerCert.der
+moon::scp carol:/etc/ipsec.d/certs/selfCert.der /etc/ipsec.d/certs/peerCert.der
+moon::ipsec reload 
+carol::ipsec reload 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/default-keys/test.conf b/testing/tests/ikev2/default-keys/test.conf
new file mode 100644
index 000000000..0baa48d90
--- /dev/null
+++ b/testing/tests/ikev2/default-keys/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/double-nat-net/description.txt b/testing/tests/ikev2/double-nat-net/description.txt
new file mode 100644
index 000000000..ff09155f6
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/description.txt
@@ -0,0 +1,7 @@
+The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a
+tunnel to the subnet hiding behind the NAT router <b>sun</b>. All IKE and ESP traffic
+directed to the router <b>sun</b> is forwarded to the VPN gateway <b>bob</b>
+using destination NAT.  UDP encapsulation is used to traverse the NAT routers.
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that
+let pass the tunneled traffic. In order to test the double NAT-ed IPsec
+tunnel <b>alice</b> pings the inner IP address of the router <b>sun</b>.
diff --git a/testing/tests/ikev2/double-nat-net/evaltest.dat b/testing/tests/ikev2/double-nat-net/evaltest.dat
new file mode 100644
index 000000000..aa69dabfa
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/evaltest.dat
@@ -0,0 +1,5 @@
+alice::ipsec statusall::nat-t.*INSTALLED::YES
+bob::ipsec statusall::nat-t.*INSTALLED::YES
+alice::ping -c 1 PH_IP_SUN1::64 bytes from PH_IP_SUN1: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..c8aa460cf
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+		
+conn nat-t
+	left=%defaultroute
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=bob@strongswan.org
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf
new file mode 100755
index 000000000..f0c5b6f15
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/hosts/bob/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%defaultroute
+	leftsubnet=10.2.0.0/16
+	leftcert=bobCert.pem
+	leftid=bob@strongswan.org
+	leftfirewall=yes
+	right=%any
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/double-nat-net/posttest.dat b/testing/tests/ikev2/double-nat-net/posttest.dat
new file mode 100644
index 000000000..484297418
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/posttest.dat
@@ -0,0 +1,9 @@
+bob::ipsec stop
+alice::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+bob::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+sun::iptables -t nat -F
+moon::conntrack -F
+sun::conntrack -F
+sun::ip route del 10.1.0.0/16 via PH_IP_BOB
diff --git a/testing/tests/ikev2/double-nat-net/pretest.dat b/testing/tests/ikev2/double-nat-net/pretest.dat
new file mode 100644
index 000000000..41b69aed6
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/pretest.dat
@@ -0,0 +1,15 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+bob::/etc/init.d/iptables start 2> /dev/null
+bob::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
+sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB
+sun::ip route add 10.1.0.0/16 via PH_IP_BOB
+alice::ipsec start
+bob::ipsec start
+alice::sleep 2
+alice::ipsec up nat-t
+alice::sleep 1
diff --git a/testing/tests/ikev2/double-nat-net/test.conf b/testing/tests/ikev2/double-nat-net/test.conf
new file mode 100644
index 000000000..1ca2ffe5a
--- /dev/null
+++ b/testing/tests/ikev2/double-nat-net/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev2/double-nat/description.txt b/testing/tests/ikev2/double-nat/description.txt
new file mode 100644
index 000000000..ce7de0e56
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/description.txt
@@ -0,0 +1,5 @@
+The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to
+the peer <b>bob</b> hiding behind the NAT router <b>sun</b>. UDP encapsulation is used to
+traverse the NAT routers. <b>leftfirewall=yes</b> automatically inserts iptables-based
+firewall rules that let pass the tunneled traffic. In order to test the double NAT-ed IPsec
+tunnel <b>alice</b> pings <b>bob</b>.
diff --git a/testing/tests/ikev2/double-nat/evaltest.dat b/testing/tests/ikev2/double-nat/evaltest.dat
new file mode 100644
index 000000000..77deea2a7
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/evaltest.dat
@@ -0,0 +1,5 @@
+alice::ipsec statusall::nat-t.*INSTALLED::YES
+bob::ipsec statusall::nat-t.*INSTALLED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..26830f390
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+		
+conn nat-t
+	left=%defaultroute
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=bob@strongswan.org
+	rightsubnet=PH_IP_BOB/32
+	auto=add
diff --git a/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf
new file mode 100755
index 000000000..b4a24cb1f
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/hosts/bob/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%defaultroute
+	leftcert=bobCert.pem
+	leftid=bob@strongswan.org
+	leftfirewall=yes
+	right=%any
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/double-nat/posttest.dat b/testing/tests/ikev2/double-nat/posttest.dat
new file mode 100644
index 000000000..5d39e406d
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/posttest.dat
@@ -0,0 +1,8 @@
+bob::ipsec stop
+alice::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+bob::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+sun::iptables -t nat -F
+moon::conntrack -F
+sun::conntrack -F
diff --git a/testing/tests/ikev2/double-nat/pretest.dat b/testing/tests/ikev2/double-nat/pretest.dat
new file mode 100644
index 000000000..10ba6d735
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/pretest.dat
@@ -0,0 +1,13 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+bob::/etc/init.d/iptables start 2> /dev/null
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
+sun::iptables -t nat -A PREROUTING -i eth0 -s PH_IP_MOON -p udp -j DNAT --to-destination PH_IP_BOB
+alice::ipsec start
+bob::ipsec start
+alice::sleep 2
+alice::ipsec up nat-t
+alice::sleep 1
diff --git a/testing/tests/ikev2/double-nat/test.conf b/testing/tests/ikev2/double-nat/test.conf
new file mode 100644
index 000000000..1ca2ffe5a
--- /dev/null
+++ b/testing/tests/ikev2/double-nat/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev2/dpd-clear/description.txt b/testing/tests/ikev2/dpd-clear/description.txt
new file mode 100644
index 000000000..7f62dc576
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/description.txt
@@ -0,0 +1,5 @@
+The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway <b>moon</b>
+which in turn activates <b>Dead Peer Detection</b> (DPD) with a polling interval of 10 s.
+When the network connectivity between <b>carol</b> and <b>moon</b> is forcefully disrupted,
+<b>moon</b> clears the connection after 4 unsuccessful retransmits.
+
diff --git a/testing/tests/ikev2/dpd-clear/evaltest.dat b/testing/tests/ikev2/dpd-clear/evaltest.dat
new file mode 100644
index 000000000..86c0227bd
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/evaltest.dat
@@ -0,0 +1,6 @@
+carol::ipsec statusall::home.*INSTALLED::YES
+carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
+moon::sleep 180::no output expected::NO
+moon::cat /var/log/daemon.log::sending DPD request::YES
+moon::cat /var/log/daemon.log::retransmit.*of request::YES
+moon::cat /var/log/daemon.log::giving up after 5 retransmits::YES
diff --git a/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..e5d9ad476
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..97b5411bd
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	leftnexthop=%direct
+	keyexchange=ikev2
+	dpdaction=clear
+	dpddelay=10
+
+conn rw
+	left=PH_IP_MOON
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	rightid=carol@strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/dpd-clear/posttest.dat b/testing/tests/ikev2/dpd-clear/posttest.dat
new file mode 100644
index 000000000..931db4272
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/posttest.dat
@@ -0,0 +1,3 @@
+carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/dpd-clear/pretest.dat b/testing/tests/ikev2/dpd-clear/pretest.dat
new file mode 100644
index 000000000..14ed95322
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/dpd-clear/test.conf b/testing/tests/ikev2/dpd-clear/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/dpd-clear/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dpd-hold/description.txt b/testing/tests/ikev2/dpd-hold/description.txt
new file mode 100644
index 000000000..405e67cb9
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/description.txt
@@ -0,0 +1,7 @@
+The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway
+<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a
+polling interval of 10 s. When the network connectivity between <b>carol</b>
+and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b>
+clears the connection after 4 unsuccessful retransmits whereas <b>carol</b>
+also takes down the connection but installs a route which triggers when
+<b>carol</b> sends a ping to client <b>alice</b> behind gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/dpd-hold/evaltest.dat b/testing/tests/ikev2/dpd-hold/evaltest.dat
new file mode 100644
index 000000000..2cf063762
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/evaltest.dat
@@ -0,0 +1,14 @@
+carol::ipsec statusall::home.*INSTALLED::YES
+moon::ipsec statusall::rw.*INSTALLED::YES
+moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
+carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
+carol::sleep 180::no output expected::NO
+carol::cat /var/log/daemon.log::sending DPD request::YES
+carol::cat /var/log/daemon.log::retransmit.*of request::YES
+carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES
+carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
+moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
+carol::ping -c 1 PH_IP_ALICE::trigger route::NO
+carol::sleep 2::no output expected::NO
+carol::ipsec statusall::home.*INSTALLED::YES
+moon::ipsec statusall::rw.*INSTALLED::YES
diff --git a/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..dff90e563
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	dpdaction=hold
+	dpddelay=10
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..97b5411bd
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	leftnexthop=%direct
+	keyexchange=ikev2
+	dpdaction=clear
+	dpddelay=10
+
+conn rw
+	left=PH_IP_MOON
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	rightid=carol@strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/dpd-hold/posttest.dat b/testing/tests/ikev2/dpd-hold/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/dpd-hold/pretest.dat b/testing/tests/ikev2/dpd-hold/pretest.dat
new file mode 100644
index 000000000..14ed95322
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/dpd-hold/test.conf b/testing/tests/ikev2/dpd-hold/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/dpd-hold/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/dpd-restart/description.txt b/testing/tests/ikev2/dpd-restart/description.txt
new file mode 100644
index 000000000..410d3d636
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/description.txt
@@ -0,0 +1,7 @@
+The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway
+<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a
+polling interval of 10 s. When the network connectivity between <b>carol</b>
+and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b>
+clears the connection after 4 unsuccessful retransmits whereas <b>carol</b>
+also takes down the connection but immediately tries to reconnect which succeeds
+as soon as the connection becomes available again.
diff --git a/testing/tests/ikev2/dpd-restart/evaltest.dat b/testing/tests/ikev2/dpd-restart/evaltest.dat
new file mode 100644
index 000000000..28edd4823
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/evaltest.dat
@@ -0,0 +1,13 @@
+carol::ipsec statusall::home.*INSTALLED::YES
+moon::ipsec statusall::rw.*INSTALLED::YES
+moon::iptables -A INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
+carol::iptables -A INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
+carol::sleep 180::no output expected::NO
+carol::cat /var/log/daemon.log::sending DPD request::YES
+carol::cat /var/log/daemon.log::retransmit.*of request::YES
+carol::cat /var/log/daemon.log::giving up after 5 retransmits::YES
+carol::iptables -D INPUT -i eth0 -s PH_IP_MOON -j DROP::no output expected::NO
+moon::iptables -D INPUT -i eth0 -s PH_IP_CAROL -j DROP::no output expected::NO
+carol::sleep 10::no output expected::NO
+carol::ipsec statusall::home.*INSTALLED::YES
+moon::ipsec statusall::rw.*INSTALLED::YES
diff --git a/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..7c5b88a2c
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	dpdaction=restart
+	dpddelay=10
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..97b5411bd
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	leftnexthop=%direct
+	keyexchange=ikev2
+	dpdaction=clear
+	dpddelay=10
+
+conn rw
+	left=PH_IP_MOON
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	rightid=carol@strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/dpd-restart/posttest.dat b/testing/tests/ikev2/dpd-restart/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/dpd-restart/pretest.dat b/testing/tests/ikev2/dpd-restart/pretest.dat
new file mode 100644
index 000000000..14ed95322
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2 
+carol::ipsec up home
diff --git a/testing/tests/ikev2/dpd-restart/test.conf b/testing/tests/ikev2/dpd-restart/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/dpd-restart/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/host2host-cert/description.txt b/testing/tests/ikev2/host2host-cert/description.txt
new file mode 100644
index 000000000..6be21bf8f
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/description.txt
@@ -0,0 +1,4 @@
+A connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
+The authentication is based on X.509 certificates. <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test the host-to-host tunnel <b>moon</b> pings <b>sun</b>.
diff --git a/testing/tests/ikev2/host2host-cert/evaltest.dat b/testing/tests/ikev2/host2host-cert/evaltest.dat
new file mode 100644
index 000000000..8d5d8167a
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec statusall::host-host.*ESTABLISHED::YES
+sun::ipsec statusall::host-host.*ESTABLISHED::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..2d41690cc
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..7ffbf64ac
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	left=PH_IP_SUN
+	leftnexthop=%direct
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/host2host-cert/posttest.dat b/testing/tests/ikev2/host2host-cert/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/host2host-cert/pretest.dat b/testing/tests/ikev2/host2host-cert/pretest.dat
new file mode 100644
index 000000000..1fa70177c
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 1 
+moon::ipsec up host-host
diff --git a/testing/tests/ikev2/host2host-cert/test.conf b/testing/tests/ikev2/host2host-cert/test.conf
new file mode 100644
index 000000000..305a67316
--- /dev/null
+++ b/testing/tests/ikev2/host2host-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon winnetou sun"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/host2host-swapped/description.txt b/testing/tests/ikev2/host2host-swapped/description.txt
new file mode 100644
index 000000000..34cfe43cc
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/description.txt
@@ -0,0 +1,3 @@
+Same scenario as test <a href="../host2host-cert/"><b>host2host-cert</b></a> but with
+swapped end definitions:  <b>right</b> denotes the <b>local</b> side whereas
+<b>left</b> stands for the <b>remote</b> peer.
diff --git a/testing/tests/ikev2/host2host-swapped/evaltest.dat b/testing/tests/ikev2/host2host-swapped/evaltest.dat
new file mode 100644
index 000000000..8d5d8167a
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec statusall::host-host.*ESTABLISHED::YES
+sun::ipsec statusall::host-host.*ESTABLISHED::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..0c3dd7abe
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	right=PH_IP_MOON
+	rightnexthop=%direct
+	rightcert=moonCert.pem
+	rightid=@moon.strongswan.org
+	rightfirewall=yes
+	left=PH_IP_SUN
+	leftid=@sun.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..bd510cc73
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	right=PH_IP_SUN
+	rightnexthop=%direct
+	rightcert=sunCert.pem
+	rightid=@sun.strongswan.org
+	rightfirewall=yes
+	left=PH_IP_MOON
+	leftid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/host2host-swapped/posttest.dat b/testing/tests/ikev2/host2host-swapped/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/host2host-swapped/pretest.dat b/testing/tests/ikev2/host2host-swapped/pretest.dat
new file mode 100644
index 000000000..1fa70177c
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 1 
+moon::ipsec up host-host
diff --git a/testing/tests/ikev2/host2host-swapped/test.conf b/testing/tests/ikev2/host2host-swapped/test.conf
new file mode 100644
index 000000000..305a67316
--- /dev/null
+++ b/testing/tests/ikev2/host2host-swapped/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon winnetou sun"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/host2host-transport/description.txt b/testing/tests/ikev2/host2host-transport/description.txt
new file mode 100644
index 000000000..fe3482c96
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/description.txt
@@ -0,0 +1,4 @@
+An IPsec <b>transport-mode</b> connection between the hosts <b>moon</b> and <b>sun</b> is
+successfully set up. <b>leftfirewall=yes</b> automatically inserts iptables-based firewall
+rules that let pass the decrypted IP packets. In order to test the host-to-host connection
+<b>moon</b> pings <b>sun</b>.
diff --git a/testing/tests/ikev2/host2host-transport/evaltest.dat b/testing/tests/ikev2/host2host-transport/evaltest.dat
new file mode 100644
index 000000000..a46e4e4e4
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES
+sun::ipsec status::host-host.*INSTALLED.*TRANSPORT::YES
+moon::ping -c 1 PH_IP_SUN::64 bytes from PH_IP_SUN: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..f957e5fb3
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	type=transport
+	auto=add
diff --git a/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..52b605024
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn host-host
+	left=PH_IP_SUN
+	leftnexthop=%direct
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	type=transport
+	auto=add
diff --git a/testing/tests/ikev2/host2host-transport/posttest.dat b/testing/tests/ikev2/host2host-transport/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/host2host-transport/pretest.dat b/testing/tests/ikev2/host2host-transport/pretest.dat
new file mode 100644
index 000000000..e2d98f2eb
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 2
+moon::ipsec up host-host
diff --git a/testing/tests/ikev2/host2host-transport/test.conf b/testing/tests/ikev2/host2host-transport/test.conf
new file mode 100644
index 000000000..cf2e704fd
--- /dev/null
+++ b/testing/tests/ikev2/host2host-transport/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon winnetou sun"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/nat-double-snat/description.txt b/testing/tests/ikev2/nat-double-snat/description.txt
new file mode 100644
index 000000000..e0708898b
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/description.txt
@@ -0,0 +1,6 @@
+The roadwarrior <b>alice</b> sets up a connection to host <b>bob</b> using IKEv2. The hosts
+sit behind NAT router <b>moon</b> (SNAT) and <b>sun</b> (SNAT) respectively.
+UDP encapsulation is used to traverse the NAT router.
+The authentication is based on locally loaded <b>X.509 certificates</b>.
+In order to test the tunnel the NAT-ed host <b>alice</b> pings the host
+<b>bob</b>.
diff --git a/testing/tests/ikev2/nat-double-snat/evaltest.dat b/testing/tests/ikev2/nat-double-snat/evaltest.dat
new file mode 100644
index 000000000..7a3dede42
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/evaltest.dat
@@ -0,0 +1,5 @@
+bob::ipsec statusall::rw-alice.*ESTABLISHED::YES
+alice::ipsec statusall::home.*ESTABLISHED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdumpcount::IP moon.strongswan.org.* > bob.strongswan.org.ipsec-nat-t: UDP::2
+moon::tcpdumpcount::IP bob.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::2
diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf
new file mode 100644
index 000000000..30a067bc9
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,16 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn home
+	left=PH_IP_ALICE
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	right=PH_IP_BOB
+	rightcert=bobCert.pem
+	rightid=bob@strongswan.org
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem
new file mode 100644
index 000000000..199d3eee2
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/hosts/alice/etc/ipsec.d/certs/bobCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHjCCAwagAwIBAgIBBjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjUzNFoXDTA5MDkwOTExMjUzNFowWDELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMRswGQYDVQQDFBJib2JAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDAJaejS3/lJfQHgw0nzvotgSQS8ey/6tvbx7s5RsWY
+27x9K5xd44aPrvP2Qpyq34IXRY6uPlIqeUTQN7EKpLrWCxMOT36x5N0Co9J5UWRB
+fJC141D+8+1RwJ9/baEIecpCvb0GfDOX0GXN5ltcJk82hZjE4y1yHC1FN7V3zdRg
+xmloupPuon+X3bTmyMQ93NKkg48CQGtqtfwQ0MqPiOWu8MBhdztfOyu6aW3EgviF
+ithLc02SeNzlpqB3M8GDfX+mr3OVDhhhC2OI+VRlZzz7KxJ13DUR2KkvLZR8Ak4E
+5lRjkUnTYd/f3OQYxfjC8idUmj5ojR6Fb0x1tsV/glzXAgMBAAGjggEEMIIBADAJ
+BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQUaLN5EPOkOkVU3J1Ud0sl
++27OOHswbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ
+BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz
+dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHQYDVR0RBBYwFIESYm9iQHN0cm9uZ3N3YW4u
+b3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcv
+c3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEEBQADggEBAIyQLLxdeO8clplzRW9z
+TRR3J0zSedvi2XlIZ/XCsv0ZVfoBLLWcDp3QrxNiVZXvXXtzjPsDs+DAveZF9LGq
+0tIw1uT3JorbgNNrmWvxBvJoQTtSw4LQBuV7vF27jrposx3Hi5qtUXUDS6wVnDUI
+5iORqsrddnoDuMN+Jt7oRcvKfYSNwTV+m0ZAHdB5a/ARWO5UILOrxEA/N72NcDYN
+NdAd+bLaB38SbkSbh1xj/AGnrHxdJBF4h4mx4btc9gtBSh+dwBHOsn4TheqJ6bbw
+7FlXBowQDCJIswKNhWfnIepQlM1KEzmq5YX43uZO2b7amRaIKqy2vNE7+UNFYBpE
+Mto=
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf
new file mode 100644
index 000000000..eaec3d642
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn %default
+	left=PH_IP_BOB
+	leftcert=bobCert.pem
+	leftid=bob@strongswan.org
+	leftsubnet=10.2.0.10/32
+	keyexchange=ikev2
+	
+conn rw-alice
+	right=%any
+	rightcert=aliceCert.pem
+	rightid=alice@strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem
new file mode 100644
index 000000000..e99ae8ec7
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/hosts/bob/etc/ipsec.d/certs/aliceCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
+MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
+GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
+FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
+6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
+v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
+KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
+A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
+60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
+A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
+cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
+2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
+AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
+D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
+CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
+6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
+JGhV
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-double-snat/posttest.dat b/testing/tests/ikev2/nat-double-snat/posttest.dat
new file mode 100644
index 000000000..8ad7df96c
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/posttest.dat
@@ -0,0 +1,8 @@
+alice::ipsec stop
+bob::ipsec stop
+alice::rm /etc/ipsec.d/certs/*
+bob::rm /etc/ipsec.d/certs/*
+moon::route del -net 10.2.0.0/16
+sun::route del -net 10.1.0.0/16
+moon::iptables -t nat -F
+sun::iptables -t nat -F
diff --git a/testing/tests/ikev2/nat-double-snat/pretest.dat b/testing/tests/ikev2/nat-double-snat/pretest.dat
new file mode 100644
index 000000000..da1d43c4e
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/pretest.dat
@@ -0,0 +1,11 @@
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+sun::route add -net 10.1.0.0/16 gw PH_IP_MOON
+sun::iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/24 -p udp -j SNAT --to-source PH_IP_SUN1:4024-4100
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::route add -net 10.2.0.0/16 gw PH_IP_SUN
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+bob::ipsec start
+alice::ipsec start
+alice::sleep 1
+alice::ipsec up home
+alice::sleep 1 
diff --git a/testing/tests/ikev2/nat-double-snat/test.conf b/testing/tests/ikev2/nat-double-snat/test.conf
new file mode 100644
index 000000000..1ca2ffe5a
--- /dev/null
+++ b/testing/tests/ikev2/nat-double-snat/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice bob"
diff --git a/testing/tests/ikev2/nat-one-rw/description.txt b/testing/tests/ikev2/nat-one-rw/description.txt
new file mode 100644
index 000000000..c3b9bb820
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/description.txt
@@ -0,0 +1,5 @@
+The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a tunnel to
+gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
+the tunneled traffic. In order to test the tunnel, the NAT-ed host <b>alice</b> pings the
+client <b>bob</b> behind the gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/nat-one-rw/evaltest.dat b/testing/tests/ikev2/nat-one-rw/evaltest.dat
new file mode 100644
index 000000000..7395e5571
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/evaltest.dat
@@ -0,0 +1,5 @@
+alice::ipsec statusall::nat-t.*INSTALLED::YES
+sun::ipsec statusall::nat-t.*INSTALLED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..8db43213f
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%defaultroute
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..a2c168601
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,35 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+
+conn net-net
+	leftsubnet=10.2.0.0/16
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+conn host-host
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	auto=add
+
+conn nat-t
+	leftsubnet=10.2.0.0/16
+	right=%any
+	rightsubnet=10.1.0.10/32
+	auto=add
diff --git a/testing/tests/ikev2/nat-one-rw/posttest.dat b/testing/tests/ikev2/nat-one-rw/posttest.dat
new file mode 100644
index 000000000..cd0d4df25
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/posttest.dat
@@ -0,0 +1,6 @@
+alice::ipsec stop
+sun::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-one-rw/pretest.dat b/testing/tests/ikev2/nat-one-rw/pretest.dat
new file mode 100644
index 000000000..ebd0c19e2
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/pretest.dat
@@ -0,0 +1,11 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+alice::ipsec start
+sun::ipsec start
+alice::sleep 4
+alice::ipsec up nat-t
+alice::sleep 1 
+
diff --git a/testing/tests/ikev2/nat-one-rw/test.conf b/testing/tests/ikev2/nat-one-rw/test.conf
new file mode 100644
index 000000000..d84149aaf
--- /dev/null
+++ b/testing/tests/ikev2/nat-one-rw/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/nat-pf/description.txt b/testing/tests/ikev2/nat-pf/description.txt
new file mode 100644
index 000000000..bb38af458
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/description.txt
@@ -0,0 +1,4 @@
+The roadwarrior <b>carol</b> sets up a connection to host <b>alice</b> sitting behind the NAT router <b>moon</b>
+using IKEv2. Port Forwarding is used to publish host <b>alice</b>. UDP encapsulation is used to traverse the NAT router.
+The authentication is based on locally loaded <b>X.509 certificates</b>.
+In order to test the tunnel the roadwarrior <b>carol</b> pings the host <b>alice</b>.
diff --git a/testing/tests/ikev2/nat-pf/evaltest.dat b/testing/tests/ikev2/nat-pf/evaltest.dat
new file mode 100644
index 000000000..4d2950521
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/evaltest.dat
@@ -0,0 +1,5 @@
+alice::ipsec statusall::rw-carol.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdumpcount::IP carol.strongswan.org.* > moon.strongswan.org.ipsec-nat-t: UDP::2
+moon::tcpdumpcount::IP moon.strongswan.org.ipsec-nat-t > carol.strongswan.org.*: UDP::2
diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf
new file mode 100644
index 000000000..836379494
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,19 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn %default
+	left=PH_IP_ALICE
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	leftsubnet=10.1.0.10/32
+	keyexchange=ikev2
+	
+conn rw-carol
+	right=%any
+	rightcert=carolCert.pem
+	rightid=carol@strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem
new file mode 100644
index 000000000..8492fbd45
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/hosts/alice/etc/ipsec.d/certs/carolCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEIjCCAwqgAwIBAgIBCjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA1MDEwMTIxNDMxOFoXDTA5MTIzMTIxNDMxOFowWjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBALgbhJIECOCGyNJ4060un/wBuJ6MQjthK5CAEPgX
+T/lvZynoSxhfuW5geDCCxQes6dZPeb6wJS4F5fH3qJoLM+Z4n13rZlCEyyMBkcFl
+vK0aNFY+ARs0m7arUX8B7Pfi9N6WHTYgO4XpeBHLJrZQz9AU0V3S0rce/WVuVjii
+S/cJhrgSi7rl87Qo1jYOA9P06BZQLj0dFNcWWrGpKp/hXvBF1OSP9b15jsgMlCCW
+LJqXmLVKDtKgDPLJZR19mILhgcHvaxxD7craL9GR4QmWLb0m84oAIIwaw+0npZJM
+YDMMeYeOtcepCWCmRy+XmsqcWu4rtNCu05W1RsXjYZEKBjcCAwEAAaOCAQYwggEC
+MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRVNeym66J5uu+IfxhD
+j9InsWdG0TBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
+EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
+d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
+b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQCxMEp+Zdclc0aI
+U+jO3TmL81gcwea0BUucjZfDyvCSkDXcXidOez+l/vUueGC7Bqq1ukDF8cpVgGtM
+2HPxM97ZSLPInMgWIeLq3uX8iTtIo05EYqRasJxBIAkY9o6ja6v6z0CZqjSbi2WE
+HrHkFrkOTrRi7deGzbAAhWVjOnAfzSxBaujkdUxb6jGBc2F5qpAeVSbE+sAxzmSd
+hRyF3tUUwl4yabBzmoedJzlQ4anqg0G14QScBxgXkq032gKuzNVVxWRp6OFannKG
+C1INvsBWYtN62wjXlXXhM/M4sBFhmPpftVb+Amgr1jSspTX2dQsNqhI/WtNvLmfK
+omBYfxqp
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf
new file mode 100644
index 000000000..52345af7c
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,17 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn home
+	left=PH_IP_CAROL
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightcert=aliceCert.pem
+	rightid=alice@strongswan.org
+	rightsubnet=10.1.0.0/24
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem
new file mode 100644
index 000000000..e99ae8ec7
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/hosts/carol/etc/ipsec.d/certs/aliceCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
+MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
+GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
+FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
+6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
+v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
+KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
+A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
+60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
+A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
+cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
+2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
+AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
+D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
+CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
+6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
+JGhV
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-pf/posttest.dat b/testing/tests/ikev2/nat-pf/posttest.dat
new file mode 100644
index 000000000..bed4ae1b7
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/posttest.dat
@@ -0,0 +1,5 @@
+carol::ipsec stop
+alice::ipsec stop
+carol::rm /etc/ipsec.d/certs/*
+alice::rm /etc/ipsec.d/certs/*
+moon::iptables -t nat -F
diff --git a/testing/tests/ikev2/nat-pf/pretest.dat b/testing/tests/ikev2/nat-pf/pretest.dat
new file mode 100644
index 000000000..fdb3de711
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/pretest.dat
@@ -0,0 +1,7 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -m multiport -t nat -A PREROUTING -i eth0 -p udp --dports 500,4500 -j DNAT --to 10.1.0.10
+alice::ipsec start
+carol::ipsec start
+carol::sleep 1
+carol::ipsec up home
+carol::sleep 1 
diff --git a/testing/tests/ikev2/nat-pf/test.conf b/testing/tests/ikev2/nat-pf/test.conf
new file mode 100644
index 000000000..21bece8e6
--- /dev/null
+++ b/testing/tests/ikev2/nat-pf/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice carol"
diff --git a/testing/tests/ikev2/nat-portswitch/description.txt b/testing/tests/ikev2/nat-portswitch/description.txt
new file mode 100644
index 000000000..93b779ee1
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/description.txt
@@ -0,0 +1,6 @@
+The roadwarrior <b>alice</b> sitting behind the NAT router <b>moon</b> sets up a connection 
+to gateway <b>sun</b> using IKEv2. UDP encapsulation is used to traverse the NAT router.
+The authentication is based on locally loaded <b>X.509 certificates</b>.
+After the IPsec Setup NAT router moon "crashes" (i.e. flushes its conntrack
+table) and with the next dpd sent from <b>alice</b> a dynamical address update
+should occur in gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/nat-portswitch/evaltest.dat b/testing/tests/ikev2/nat-portswitch/evaltest.dat
new file mode 100644
index 000000000..75b01a551
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/evaltest.dat
@@ -0,0 +1,10 @@
+sun::ipsec statusall::rw-alice.*ESTABLISHED::YES
+alice::ipsec statusall::home.*ESTABLISHED::YES
+moon::cmd::iptables -t nat -F::YES
+moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:3024-3100::YES
+moon::cmd::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:4000-4100::YES
+moon::cmd::conntrack -F::YES
+alice::cmd::sleep 75::YES
+bob::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP, length: 132::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP, length: 132::YES
diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf
new file mode 100644
index 000000000..cd9de533a
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,17 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn home
+	left=PH_IP_ALICE
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	right=PH_IP_SUN
+	rightcert=sunCert.pem
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem
new file mode 100644
index 000000000..e7825e3db
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/hosts/alice/etc/ipsec.d/certs/sunCert.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z
+dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8
+foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS
+Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC
+AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe
+zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n
+HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G
+N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd
+p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT
+EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB
+ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg
+KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq
+hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i
+ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP
+Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S
+5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE
+JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk
+Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA==
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf
new file mode 100644
index 000000000..a7722142f
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn %default
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+	keyexchange=ikev2
+	
+conn rw-alice
+	right=%any
+	rightcert=aliceCert.pem
+	rightid=alice@strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem
new file mode 100644
index 000000000..e99ae8ec7
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/hosts/sun/etc/ipsec.d/certs/aliceCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
+MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
+GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
+FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
+6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
+v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
+KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
+A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
+60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
+A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
+cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
+2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
+AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
+D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
+CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
+6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
+JGhV
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-portswitch/posttest.dat b/testing/tests/ikev2/nat-portswitch/posttest.dat
new file mode 100644
index 000000000..3b9f53e9b
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/posttest.dat
@@ -0,0 +1,6 @@
+sun::ipsec stop
+alice::ipsec stop
+sun::rm /etc/ipsec.d/certs/*
+alice::rm /etc/ipsec.d/certs/*
+moon::iptables -t nat -F
+moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-portswitch/pretest.dat b/testing/tests/ikev2/nat-portswitch/pretest.dat
new file mode 100644
index 000000000..17cc4b070
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/pretest.dat
@@ -0,0 +1,9 @@
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+sun::ipsec start
+alice::ipsec start
+alice::sleep 1
+alice::ipsec up home
+alice::sleep 1 
diff --git a/testing/tests/ikev2/nat-portswitch/test.conf b/testing/tests/ikev2/nat-portswitch/test.conf
new file mode 100644
index 000000000..d84149aaf
--- /dev/null
+++ b/testing/tests/ikev2/nat-portswitch/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice sun"
diff --git a/testing/tests/ikev2/nat-rw-mixed/description.txt b/testing/tests/ikev2/nat-rw-mixed/description.txt
new file mode 100644
index 000000000..511a1a874
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> 
+set up a connection to gateway <b>sun</b>. <b>alice</b> uses the IKEv2 key exchange protocol 
+whereas <b>venus</b> negotiates the connection via the IKEv1 protocol.
+UDP encapsulation is used to traverse the NAT router.
+In order to test the tunnel the NAT-ed hosts <b>alice</b> and <b>venus</b> ping the client
+<b>bob</b> behind the gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/nat-rw-mixed/evaltest.dat b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat
new file mode 100644
index 000000000..685c1b43f
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/evaltest.dat
@@ -0,0 +1,9 @@
+sun::ipsec statusall::rw-alice.*ESTABLISHED::YES
+sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES
+sun::ipsec status::nat-t.*@venus.strongswan.org::YES
+alice::ipsec statusall::home.*ESTABLISHED::YES
+sun::ipsec status::nat-t.*STATE_QUICK_R2.*IPsec SA established::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf
new file mode 100644
index 000000000..cd9de533a
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,17 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutostart=no
+
+conn home
+	left=PH_IP_ALICE
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	right=PH_IP_SUN
+	rightcert=sunCert.pem
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem
new file mode 100644
index 000000000..e7825e3db
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/hosts/alice/etc/ipsec.d/certs/sunCert.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIECzCCAvOgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMTU1M1oXDTA5MDkwOTExMTU1M1owRTELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN1bi5z
+dHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOQ8
+foB9h5BZ92gA5JkQTJNuoF6FAzoq91Gh7To27/g74p01+SUnsSaBfPmNfGp4avdS
+Ewy2dWMA/7uj0Dbe8MEKssNztp0JQubp2s7n8mrrQLGsqB6YAS09l75XDjS3yqTC
+AtH1kD4zAl/j/AyeQBuLR4CyJEmC/rqD3/a+pr42CaljuFBgBRpCTUpU4mlslZSe
+zv9wu61PwTFxb8VDlBHUd/lwkXThKgU3uEhWRxLahpSldEGmiTTmx30k/XbOMF2n
+HObEHt5EY9uWRGGbj81ZRWiNk0dNtbpneUHv/NvdWLc591M8cEGEQdWW2XTVbL2G
+N67q8hdzGgIvb7QJPMcCAwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+AgOoMB0GA1UdDgQWBBQ9xLkyCBbyQmRet0vvV1Fg6z5q2DBtBgNVHSMEZjBkgBRd
+p91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoT
+EExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIB
+ADAdBgNVHREEFjAUghJzdW4uc3Ryb25nc3dhbi5vcmcwOQYDVR0fBDIwMDAuoCyg
+KoYoaHR0cDovL2NybC5zdHJvbmdzd2FuLm9yZy9zdHJvbmdzd2FuLmNybDANBgkq
+hkiG9w0BAQQFAAOCAQEAGQQroiAa0SwwhJprGd7OM+rfBJAGbsa3DPzFCfHX1R7i
+ZyDs9aph1DK+IgUa377Ev1U7oB0EldpmOoJJugCjtNLfpW3t1RXBERL/QfpO2+VP
+Wt3SfZ0Oq48jiqB1MVLMZRPCICZEQjT4sJ3HYs5ZuucuvoxeMx3rQ4HxUtHtMD3S
+5JNMwFFiOXAjyIyrTlb7YuRJTT5hE+Rms8GUQ5Xnt7zKZ7yfoSLFzy0/cLFPdQvE
+JA7w8crODCZpDgEKVHVyUWuyt1O46N3ydUfDcnKJoQ9HWHm3xCbDex5MHTnvm1lk
+Stx71CGM7TE6VPy028UlrSw0JqEwCVwstei2cMzwgA==
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf
new file mode 100644
index 000000000..b85bd607b
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,31 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+version	2.0	# conforms to second version of ipsec.conf specification
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180	
+	nat_traversal=yes
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+
+conn rw-alice
+	right=%any
+	rightcert=aliceCert.pem
+	rightid=alice@strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
+
+conn nat-t
+	leftsubnet=10.2.0.0/16
+	right=%any
+	rightsubnetwithin=10.1.0.0/16
+	keyexchange=ikev1
+	auto=add
diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem
new file mode 100644
index 000000000..e99ae8ec7
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/aliceCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBBTANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjQzOVoXDTA5MDkwOTExMjQzOVowVzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
+MR0wGwYDVQQDFBRhbGljZUBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBAK7FyvkE18/oujCaTd8GXBNOH+Cvoy0ibJ8j2sNsBrer
+GS1lgxRs8zaVfK9fosadu0UZeWIHsOKkew5469sPvkKK2SGGH+pu+x+xO/vuaEG4
+FlkAu8iGFWLQycLt6BJfcqw7FT8rwNuD18XXBXmP7hRavi/TEElbVYHbO7lm8T5W
+6hTr/sYddiSB7X9/ba7JBy6lxmBcUAx5bjiiHLaW/llefkqyhc6dw5nvPZ2DchvH
+v/HWvLF9bsvxbBkHU0/z/CEsRuMBI7EPEL4rx3UqmuCUAqiMJTS3IrDaIlfJOLWc
+KlbsnE6hHpwmt9oDB9iWBY9WeZUSAtJGFw4b7FCZvQ0CAwEAAaOCAQYwggECMAkG
+A1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBRZmh0JtiNTjBsQsfD7ECNa
+60iG2jBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTELMAkG
+A1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMTEnN0
+cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRhbGljZUBzdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQADdQIlJkFtmHEjtuyo
+2aIcrsUx98FtvVgB7RpQB8JZlly7UEjvX0CIIvW/7Al5/8h9s1rhrRffX7nXQKAQ
+AmPnvD2Pp47obDnHqm/L109S1fcL5BiPN1AlgsseUBwzdqBpyRncPXZoAuBh/BU5
+D/1Dip0hXgB/X6+QymSzRJoSKfpeXVICj1kYH1nIkn0YXthYF3BTrCheCzBlKn0S
+CixbCUYsUjtSqld0nG76jyGb/gnWntNettH+RXWe1gm6qREJwfEFdeYviTqx2Uxi
+6sBKG/XjNAcMArXb7V6w0YAwCyjwCl49B+mLZaFH+9izzBJ7NyVqhH8ToB1gt0re
+JGhV
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem
new file mode 100644
index 000000000..25a6941b0
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/hosts/sun/etc/ipsec.d/certs/venusCert.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEDzCCAvegAwIBAgIBBDANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMTgyNloXDTA5MDkwOTExMTgyNlowRzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xHTAbBgNVBAMTFHZlbnVz
+LnN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+mlQ2s9J7bw73onkw0ZwwcM2JDJuU3KmmuzETlmLdtg7m8yFCdhoDg6cxrsIvPAWy
+Gs++1e+1qzy7LTnNHckaHHFwJQf0JoIGE1bbUrJidX8B1T3sDdvZFbyfmQTWSEyJ
+thrdqdPS92VJW/9XQOPeEhudIHr+NtWQfCm3OQFKDXGCEkHOjpVNHn3BPUiL99ON
+FiLZX3gZy6vTERpEE8ga66fHtpM3RJfIxYoUQUdRw8iIa8iOvRGtJa/MfOWX6L/H
+wquRv3SuCl4iMSph7e/VE+z5xx3OyKSAki914DgRFnQITKjyGxw1lORlDQlZy2w/
+nu0BAbXS1pb/2AiF8jDpbQIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADALBgNVHQ8E
+BAMCA6gwHQYDVR0OBBYEFEqPlXBYJh1knX0Q61HMcn9LOZ6sMG0GA1UdIwRmMGSA
+FF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYDVQQGEwJDSDEZMBcGA1UE
+ChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBSb290IENB
+ggEAMB8GA1UdEQQYMBaCFHZlbnVzLnN0cm9uZ3N3YW4ub3JnMDkGA1UdHwQyMDAw
+LqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbi5jcmww
+DQYJKoZIhvcNAQEEBQADggEBAEx3kXh2Z5CMH+tX6cJPyi6gSeOgXy7NBiNsEdXN
+rwGp4DwN6uiSog4EYZJA203oqE3eaoYdBXKiOGvjW4vyigvpDr8H+MeW2HsNuMKX
+PFpY4NucV0fJlzFhtkp31zTLHNESCgTqNIwGj+CbN0rxhHGE6502krnu+C12nJ7B
+fdMzml1RmVp4JlZC5yfiTy0F2s/aH+8xQ2x509UoD+boNM9GR+IlWS2dDypISGid
+hbM4rpiMLBj2riWD8HiuljkKQ6LemBXeZQXuIPlusl7cH/synNkHk8iiALM8xfGh
+wTEmdo5Tp5sDI3cj3LVvhcsTxjiOA81her1F0itlxpEA/gA=
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/nat-rw-mixed/posttest.dat b/testing/tests/ikev2/nat-rw-mixed/posttest.dat
new file mode 100644
index 000000000..0a8ce2bbc
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/posttest.dat
@@ -0,0 +1,6 @@
+sun::ipsec stop
+alice::ipsec stop
+venus::ipsec stop
+sun::rm /etc/ipsec.d/certs/*
+alice::rm /etc/ipsec.d/certs/*
+moon::iptables -t nat -F
diff --git a/testing/tests/ikev2/nat-rw-mixed/pretest.dat b/testing/tests/ikev2/nat-rw-mixed/pretest.dat
new file mode 100644
index 000000000..d2c5c7df2
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/pretest.dat
@@ -0,0 +1,11 @@
+sun::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+sun::ipsec start
+alice::ipsec start
+venus::ipsec start
+alice::sleep 1
+venus::ipsec up nat-t
+alice::ipsec up home
+alice::sleep 1 
diff --git a/testing/tests/ikev2/nat-rw-mixed/test.conf b/testing/tests/ikev2/nat-rw-mixed/test.conf
new file mode 100644
index 000000000..84317fd70
--- /dev/null
+++ b/testing/tests/ikev2/nat-rw-mixed/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/nat-two-rw-psk/description.txt b/testing/tests/ikev2/nat-two-rw-psk/description.txt
new file mode 100644
index 000000000..c74897d9a
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
+tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
+Both roadwarriors share the same Pre-Shared Key (PSK) with the gateway <b>sun</b>.
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
+the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
+ping the client <b>bob</b> behind the gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat
new file mode 100644
index 000000000..2cab168f0
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/evaltest.dat
@@ -0,0 +1,9 @@
+alice::ipsec statusall::nat-t.*INSTALLED::YES
+venus::ipsec statusall::nat-t.*INSTALLED::YES
+sun::ipsec statusall::nat-t.*INSTALLED::YES
+sun::ipsec status::nat-t.*\[PH_IP_ALICE\]::YES
+sun::ipsec status::nat-t.*\[PH_IP_VENUS\]::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..e0ccbb812
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,19 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+		
+conn nat-t
+	left=%defaultroute
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets
new file mode 100644
index 000000000..d61e3eb48
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/alice/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..c76e7ce92
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,21 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+	
+conn nat-t
+	left=PH_IP_SUN
+	leftsubnet=10.2.0.0/16
+	leftfirewall=yes
+	leftnexthop=%direct
+	right=%any
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets
new file mode 100644
index 000000000..5f2955503
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/sun/etc/ipsec.secrets
@@ -0,0 +1,5 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+PH_IP_ALICE : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+
+PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf
new file mode 100755
index 000000000..e0ccbb812
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.conf
@@ -0,0 +1,19 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+		
+conn nat-t
+	left=%defaultroute
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets
new file mode 100644
index 000000000..9cd66b1df
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/hosts/venus/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+PH_IP_VENUS : PSK 0s8PjpI8z+Ym5A9zPvh7+opyyV9NcZp8Br
diff --git a/testing/tests/ikev2/nat-two-rw-psk/posttest.dat b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat
new file mode 100644
index 000000000..52572ece8
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/posttest.dat
@@ -0,0 +1,8 @@
+sun::ipsec stop
+alice::ipsec stop
+venus::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-two-rw-psk/pretest.dat b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat
new file mode 100644
index 000000000..5e23259bb
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/pretest.dat
@@ -0,0 +1,17 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+venus::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+alice::rm /etc/ipsec.d/cacerts/*
+venus::rm /etc/ipsec.d/cacerts/*
+sun::rm /etc/ipsec.d/cacerts/*
+alice::ipsec start
+venus::ipsec start
+sun::ipsec start
+alice::sleep 2 
+alice::ipsec up nat-t
+venus::sleep 2 
+venus::ipsec up nat-t
+venus::sleep 2
diff --git a/testing/tests/ikev2/nat-two-rw-psk/test.conf b/testing/tests/ikev2/nat-two-rw-psk/test.conf
new file mode 100644
index 000000000..84317fd70
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw-psk/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/nat-two-rw/description.txt b/testing/tests/ikev2/nat-two-rw/description.txt
new file mode 100644
index 000000000..dcf4b94bd
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/description.txt
@@ -0,0 +1,5 @@
+The roadwarriors <b>alice</b> and <b>venus</b> sitting behind the NAT router <b>moon</b> set up
+tunnels to gateway <b>sun</b>. UDP encapsulation is used to traverse the NAT router.
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass
+the tunneled traffic. In order to test the tunnel, the NAT-ed hosts <b>alice</b> and <b>venus</b>
+ping the client <b>bob</b> behind the gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/nat-two-rw/evaltest.dat b/testing/tests/ikev2/nat-two-rw/evaltest.dat
new file mode 100644
index 000000000..28d5b5289
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/evaltest.dat
@@ -0,0 +1,9 @@
+alice::ipsec statusall::nat-t.*INSTALLED::YES
+venus::ipsec statusall::nat-t.*INSTALLED::YES
+sun::ipsec statusall::nat-t.*INSTALLED::YES
+sun::ipsec status::alice@strongswan.org::YES
+sun::ipsec status::@venus.strongswan.org::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+venus::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.ipsec-nat-t: UDP::YES
+moon::tcpdump::IP sun.strongswan.org.ipsec-nat-t > moon.strongswan.org.*: UDP::YES
diff --git a/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf
new file mode 100755
index 000000000..3da2fcf86
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/hosts/alice/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+		
+conn nat-t
+	left=%defaultroute
+	leftcert=aliceCert.pem
+	leftid=alice@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..d8b426318
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,35 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+
+conn net-net
+	leftsubnet=10.2.0.0/16
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
+
+conn host-host
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	auto=add
+
+conn nat-t
+	leftsubnet=10.2.0.0/16
+	right=%any
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf
new file mode 100755
index 000000000..3a70b3434
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/hosts/venus/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn nat-t
+	left=%defaultroute
+	leftcert=venusCert.pem
+	leftid=@venus.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/nat-two-rw/posttest.dat b/testing/tests/ikev2/nat-two-rw/posttest.dat
new file mode 100644
index 000000000..52572ece8
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/posttest.dat
@@ -0,0 +1,8 @@
+sun::ipsec stop
+alice::ipsec stop
+venus::ipsec stop
+alice::/etc/init.d/iptables stop 2> /dev/null
+venus::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
+moon::iptables -t nat -F
+moon::conntrack -F
diff --git a/testing/tests/ikev2/nat-two-rw/pretest.dat b/testing/tests/ikev2/nat-two-rw/pretest.dat
new file mode 100644
index 000000000..e365ff5c5
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/pretest.dat
@@ -0,0 +1,14 @@
+alice::/etc/init.d/iptables start 2> /dev/null
+venus::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1024-1100
+moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
+alice::ipsec start
+venus::ipsec start
+sun::ipsec start
+alice::sleep 2 
+alice::ipsec up nat-t
+venus::sleep 2 
+venus::ipsec up nat-t
+venus::sleep 2
diff --git a/testing/tests/ikev2/nat-two-rw/test.conf b/testing/tests/ikev2/nat-two-rw/test.conf
new file mode 100644
index 000000000..84317fd70
--- /dev/null
+++ b/testing/tests/ikev2/nat-two-rw/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="alice venus sun"
diff --git a/testing/tests/ikev2/net2net-cert/description.txt b/testing/tests/ikev2/net2net-cert/description.txt
new file mode 100644
index 000000000..7eea9192f
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/description.txt
@@ -0,0 +1,6 @@
+A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
+The authentication is based on <b>X.509 certificates</b>. Upon the successful
+establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
+pings client <b>bob</b> located behind gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/net2net-cert/evaltest.dat b/testing/tests/ikev2/net2net-cert/evaltest.dat
new file mode 100644
index 000000000..e67c39a08
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec statusall::net-net.*ESTABLISHED::YES
+sun::ipsec statusall::net-net.*ESTABLISHED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..e86ed4f72
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn net-net 
+	left=PH_IP_MOON
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightid=@sun.strongswan.org
+	rightsubnet=10.2.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..ea55d2edb
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+        keyingtries=1
+	keyexchange=ikev2
+
+conn net-net 
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/net2net-cert/posttest.dat b/testing/tests/ikev2/net2net-cert/posttest.dat
new file mode 100644
index 000000000..a4c96e10f
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/posttest.dat
@@ -0,0 +1,5 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
+
diff --git a/testing/tests/ikev2/net2net-cert/pretest.dat b/testing/tests/ikev2/net2net-cert/pretest.dat
new file mode 100644
index 000000000..2d7a78acb
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 1 
+moon::ipsec up net-net
diff --git a/testing/tests/ikev2/net2net-cert/test.conf b/testing/tests/ikev2/net2net-cert/test.conf
new file mode 100644
index 000000000..d9a61590f
--- /dev/null
+++ b/testing/tests/ikev2/net2net-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-psk/description.txt b/testing/tests/ikev2/net2net-psk/description.txt
new file mode 100644
index 000000000..02cddbb83
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/description.txt
@@ -0,0 +1,6 @@
+A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
+The authentication is based on <b>Preshared Keys</b> (PSK). Upon the successful
+establishment of the IPsec tunnel, <b>leftfirewall=yes</b> automatically
+inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
+pings client <b>bob</b> located behind gateway <b>sun</b>.
diff --git a/testing/tests/ikev2/net2net-psk/evaltest.dat b/testing/tests/ikev2/net2net-psk/evaltest.dat
new file mode 100644
index 000000000..e67c39a08
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec statusall::net-net.*ESTABLISHED::YES
+sun::ipsec statusall::net-net.*ESTABLISHED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..da51fa46a
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	authby=secret
+	keyexchange=ikev2
+	
+conn net-net
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftid=@moon.strongswan.org
+	leftnexthop=%direct
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	rightid=@sun.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..cbdddfb18
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,12 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+
+@moon.strongswan.org %any : PSK 0x45a30759df97dc26a15b88ff 
+
+@sun.strongswan.org : PSK "This is a strong password"  
+
+: PSK 'My "home" is my "castle"!'
+
+192.168.0.1 : PSK   "Andi's home"
+
diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..bea0eeb08
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	authby=secret
+	keyexchange=ikev2
+	
+conn net-net
+	left=PH_IP_SUN
+	leftsubnet=10.2.0.0/16
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+	leftnexthop=%direct
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets
new file mode 100644
index 000000000..be95c4d99
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/hosts/sun/etc/ipsec.secrets
@@ -0,0 +1,7 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+@moon.strongswan.org @sun.strongswan.org : PSK 0sv+NkxY9LLZvwj4qCC2o/gGrWDF2d21jL
+
+
+
+
diff --git a/testing/tests/ikev2/net2net-psk/posttest.dat b/testing/tests/ikev2/net2net-psk/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/net2net-psk/pretest.dat b/testing/tests/ikev2/net2net-psk/pretest.dat
new file mode 100644
index 000000000..976a196db
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/pretest.dat
@@ -0,0 +1,8 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::rm /etc/ipsec.d/cacerts/*
+sun::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+sun::ipsec start
+moon::sleep 1 
+moon::ipsec up net-net
diff --git a/testing/tests/ikev2/net2net-psk/test.conf b/testing/tests/ikev2/net2net-psk/test.conf
new file mode 100644
index 000000000..f74d0f7d6
--- /dev/null
+++ b/testing/tests/ikev2/net2net-psk/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-route/description.txt b/testing/tests/ikev2/net2net-route/description.txt
new file mode 100644
index 000000000..323f09555
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/description.txt
@@ -0,0 +1,9 @@
+A tunnel that will connect the subnets behind the gateways <b>moon</b>
+and <b>sun</b>, respectively, is preconfigured by installing a %trap eroute
+on gateway <b>moon</b> by means of the setting <b>auto=route</b> in ipsec.conf.
+A subsequent ping issued by client <b>alice</b> behind gateway <b>moon</b> to
+<b>bob</b> located behind gateway <b>sun</b> triggers the %trap eroute and
+leads to the automatic establishment of the subnet-to-subnet tunnel.
+<p>
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules
+that let pass the tunneled traffic.
diff --git a/testing/tests/ikev2/net2net-route/evaltest.dat b/testing/tests/ikev2/net2net-route/evaltest.dat
new file mode 100644
index 000000000..d5350467e
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/evaltest.dat
@@ -0,0 +1,6 @@
+moon::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES
+moon::ipsec statusall::net-net.*INSTALLED::YES
+sun::ipsec statusall::net-net.*INSTALLED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..8b8548815
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	leftnexthop=%direct
+	keyexchange=ikev2
+
+conn net-net
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	rightid=@sun.strongswan.org
+	auto=route
diff --git a/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..ea55d2edb
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+        keyingtries=1
+	keyexchange=ikev2
+
+conn net-net 
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/net2net-route/posttest.dat b/testing/tests/ikev2/net2net-route/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/net2net-route/pretest.dat b/testing/tests/ikev2/net2net-route/pretest.dat
new file mode 100644
index 000000000..2eef7de19
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+sun::ipsec start
+moon::sleep 2 
+alice::ping -c 10 PH_IP_BOB
diff --git a/testing/tests/ikev2/net2net-route/test.conf b/testing/tests/ikev2/net2net-route/test.conf
new file mode 100644
index 000000000..d9a61590f
--- /dev/null
+++ b/testing/tests/ikev2/net2net-route/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/net2net-start/description.txt b/testing/tests/ikev2/net2net-start/description.txt
new file mode 100644
index 000000000..f5320685e
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/description.txt
@@ -0,0 +1,8 @@
+A tunnel connecting the subnets behind the gateways <b>moon</b> and <b>sun</b>,
+respectively, is automatically established by means of the setting
+<b>auto=start</b> in ipsec.conf. The connection is tested by client <b>alice</b>
+behind gateway <b>moon</b> pinging the client <b>bob</b> located behind
+gateway <b>sun</b>.
+<p>
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules
+that let pass the tunneled traffic.
diff --git a/testing/tests/ikev2/net2net-start/evaltest.dat b/testing/tests/ikev2/net2net-start/evaltest.dat
new file mode 100644
index 000000000..244dec5bf
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec statusall::net-net.*INSTALLED::YES
+sun::ipsec statusall::net-net.*INSTALLED::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_seq=1::YES
+sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
+sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..091871e49
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn net-net
+	left=PH_IP_MOON
+	leftsubnet=10.1.0.0/16
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP_SUN
+	rightsubnet=10.2.0.0/16
+	rightid=@sun.strongswan.org
+	auto=start
diff --git a/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..b2e41894c
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,25 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+        keyingtries=1
+	keyexchange=ikev2
+
+conn net-net 
+	left=PH_IP_SUN
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftsubnet=10.2.0.0/16
+	leftnexthop=%direct
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/net2net-start/posttest.dat b/testing/tests/ikev2/net2net-start/posttest.dat
new file mode 100644
index 000000000..5a9150bc8
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/net2net-start/pretest.dat b/testing/tests/ikev2/net2net-start/pretest.dat
new file mode 100644
index 000000000..6e41d5245
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/pretest.dat
@@ -0,0 +1,6 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+sun::/etc/init.d/iptables start 2> /dev/null
+sun::ipsec start
+sun::sleep 2
+moon::ipsec start
+alice::sleep 3 
diff --git a/testing/tests/ikev2/net2net-start/test.conf b/testing/tests/ikev2/net2net-start/test.conf
new file mode 100644
index 000000000..d9a61590f
--- /dev/null
+++ b/testing/tests/ikev2/net2net-start/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon winnetou sun bob"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b.png"
+ 
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ikev2/ocsp-local-cert/description.txt b/testing/tests/ikev2/ocsp-local-cert/description.txt
new file mode 100644
index 000000000..61f7d9957
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/description.txt
@@ -0,0 +1,9 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
+is checked via the OCSP server <b>winnetou</b> which possesses a <b>self-signed</b>
+OCSP signer certificate that must be imported locally by the peers into 
+<b>/etc/ipsec.d/ocspcerts/</b>.  A strongswan <b>ca</b> section in ipsec.conf
+defines an <b>OCSP URI</b> pointing to <b>winnetou</b>.
+<p>
+<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
+the status of both certificates is <b>good</b>.
diff --git a/testing/tests/ikev2/ocsp-local-cert/evaltest.dat b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat
new file mode 100644
index 000000000..6b849b811
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/evaltest.dat
@@ -0,0 +1,8 @@
+moon::cat /var/log/daemon.log::received valid http response::YES
+carol::cat /var/log/daemon.log::received valid http response::YES
+moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+moon::cat /var/log/daemon.log::certificate is good::YES
+carol::cat /var/log/daemon.log::certificate is good::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..0209111ba
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem
new file mode 100644
index 000000000..77f5bde52
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/carol/etc/ipsec.d/ocspcerts/ocspCert-self.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ
+IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu
+Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT
+AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl
+bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y
+ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM
+BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828
+P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD
+mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ
+DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb
+UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr
+4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW
+BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt
+rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0
+cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww
+GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw
+FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
+BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ
+9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI
+zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V
+14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL
+lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v
+1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg==
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..21b48ef0c
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem
new file mode 100644
index 000000000..77f5bde52
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/moon/etc/ipsec.d/ocspcerts/ocspCert-self.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEbjCCA1agAwIBAgIJALN2wqyLTIzfMA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQ
+IFNlbGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2Fu
+Lm9yZzAeFw0wNzAzMTQxMjM0MDNaFw0xMjAzMTIxMjM0MDNaMGsxCzAJBgNVBAYT
+AkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMSMwIQYDVQQLExpPQ1NQIFNl
+bGYtU2lnbmVkIEF1dGhvcml0eTEcMBoGA1UEAxMTb2NzcC5zdHJvbmdzd2FuLm9y
+ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMgSOFeDdWxYKGPUSUhM
+BFAELGmHKfg2R25aWlE8ju//I0ByaoIsm8BPapSiiiwTdho/JPP44/nvHcDQu828
+P3uY5XbSPZpiiBgFoo8BC2/Y/rxY/skjEzqoHEXjg/vO1bA0tqjVn5a0jpkai7pD
+mUyBrmn1ArOjhR/HAupCHsIb7sAL+IEXByMcZQK6bvNL9PMTYI1T72+t/9cZAAEJ
+DfEhyJZMxQKgmT1SNzLwyszy1M1HF95D59gBok4PaRWWsLdwzplfTKh61CeGCYqb
+UP3qpMKrJ8Y7uv+e1vVzuYbJg5DR+bF1IGIc9QRyJlTkhZco+zTCQYxpvsNO18yr
+4qcCAwEAAaOCARMwggEPMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgECMB0GA1UdDgQW
+BBQHqEiJbwUSQJDtrfhopkda0nXrLTCBnQYDVR0jBIGVMIGSgBQHqEiJbwUSQJDt
+rfhopkda0nXrLaFvpG0wazELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0
+cm9uZ1N3YW4xIzAhBgNVBAsTGk9DU1AgU2VsZi1TaWduZWQgQXV0aG9yaXR5MRww
+GgYDVQQDExNvY3NwLnN0cm9uZ3N3YW4ub3JnggkAs3bCrItMjN8wHgYDVR0RBBcw
+FYITb2NzcC5zdHJvbmdzd2FuLm9yZzAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCTAN
+BgkqhkiG9w0BAQUFAAOCAQEAi//I0DOlUXNHxzLuuxyr6k5gO55zMCmHUcVfjVFZ
+9e+UpLLFZY+qbxOfzVLpKyDch6dKDIA/H+SzX1GZ+uW4FFQ1wYlHcK1Sio9hOgqI
+zeWdY5uHF6iERVYgOU/xp0+0LS5l4ezCvOKVkYJEFWe2eyn9rd4PGLW4/lTQiK1V
+14YzPyAhB7n8Sln5LBxAeY7U7Y8jEMLXZ+VF21mjH2sxZzWV/qWZdNWVUNaLZTYL
+lTqyzqsk40v5BTrjSvAWHN+c1WzydMvatFDzghlPnvR8dufRN2bnlj10J8sizn+v
+1iDtM6uYi8+Yn26yMGjCP+RYW+bwKQ927Gr43UkqqGsbCg==
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
new file mode 100755
index 000000000..dda793f44
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+                      -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
+		      -resp_no_certs -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/tests/ikev2/ocsp-local-cert/posttest.dat b/testing/tests/ikev2/ocsp-local-cert/posttest.dat
new file mode 100644
index 000000000..0c05c16a1
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::rm /etc/ipsec.d/ocspcerts/*
+carol::rm /etc/ipsec.d/ocspcerts/*
diff --git a/testing/tests/ikev2/ocsp-local-cert/pretest.dat b/testing/tests/ikev2/ocsp-local-cert/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-local-cert/test.conf b/testing/tests/ikev2/ocsp-local-cert/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-local-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-multi-level/description.txt b/testing/tests/ikev2/ocsp-multi-level/description.txt
new file mode 100644
index 000000000..cd0ecf162
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/description.txt
@@ -0,0 +1,10 @@
+The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and
+<b>venus</b> by means of two different Intermediate CAs. Access to
+<b>alice</b> is granted to users presenting a certificate issued by the Research CA
+whereas <b>venus</b> can only be reached with a certificate issued by the
+Sales CA. The roadwarriors <b>carol</b> and <b>dave</b> have certificates from
+the Research CA and Sales CA, respectively. Therefore <b>carol</b> can access
+<b>alice</b> and <b>dave</b> can reach <b>venus</b>.
+<p>
+By setting <b>strictcrlpolicy=yes</b>, the certificate status from the strongSwan, Research and
+Sales OCSP servers must be fetched first, before the connection setups can be successfully completed.
diff --git a/testing/tests/ikev2/ocsp-multi-level/evaltest.dat b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat
new file mode 100644
index 000000000..911c209a5
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec listocspcerts::altNames.*ocsp.*strongswan.org::YES
+carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+dave::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+moon::cat /var/log/daemon.log::certificate is good::YES
+carol::cat /var/log/daemon.log::certificate is good::YES
+dave::cat /var/log/daemon.log::certificate is good::YES
+moon::ipsec status::ESTABLISHED.*carol::YES
+moon::ipsec status::ESTABLISHED.*dave::YES
+carol::ipsec status::alice.*ESTABLISHED::YES
+dave::ipsec status::venus.*ESTABLISHED::YES
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..89a4f2ce9
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,31 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+
+conn alice
+	rightsubnet=PH_IP_ALICE/32
+	auto=add
+	
+conn venus
+	rightsubnet=PH_IP_VENUS/32
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem
new file mode 100644
index 000000000..2990d6a12
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/certs/carolCert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIELDCCAxSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjERMA8GA1UECxMIUmVzZWFyY2gxFDAS
+BgNVBAMTC1Jlc2VhcmNoIENBMB4XDTA1MDMyMzA3MDQyM1oXDTEwMDMyMjA3MDQy
+M1owWjELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAP
+BgNVBAsTCFJlc2VhcmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM+oTiV7lCh1ID41edDUgUjR
+dZwEMPBAM1xDqoxJxIJpug8UIuuUL0TvQnZ4Z5fa/9QNNCkQ7FDh8ZcR+TT8x0mO
+dYYA73mMQic0n4O57F+s/lESKvIoN+vIDR3rGJBv9rYztS4ODE+DJl9XK9TtId5u
+57jfXu/k3IYl5GeQ3f+ic2l2Ola70t70Op6cFDZIhOCjs2xWw2yqGdPWODaN/Enw
+5fOLv/om+7HHB4KgPGv4p4ohWIUCo2XK597Ii+jB2MdOUlG83/1aX7+M+IeYVwjI
+hzWjwRQfMz0AQha0HYN4cvrZ7stUluMxewsCROCBzcGQYTZxYU4FjR8nhH4ApYMC
+AwEAAaOCAQQwggEAMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSL
+qNn96rsWg0kOJY/cyXD2JpnPIjBtBgNVHSMEZjBkgBTndfCg8q0gzc1gI8zHyA8p
+891UIKFJpEcwRTELMAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3
+YW4xGzAZBgNVBAMTEnN0cm9uZ1N3YW4gUm9vdCBDQYIBDDAfBgNVHREEGDAWgRRj
+YXJvbEBzdHJvbmdzd2FuLm9yZzA3BgNVHR8EMDAuMCygKqAohiZodHRwOi8vY3Js
+LnN0cm9uZ3N3YW4ub3JnL3Jlc2VhcmNoLmNybDANBgkqhkiG9w0BAQUFAAOCAQEA
+FNPepmta0ac9TWe7Gl31fKkuf6ZiQftMwx/uq6PoX9PBVGeooktJMo+EiROQhL3N
+Zomtl2nLfxYruXPHa7YaMWyv4+3NkV9p7jseC1K/2lCXipY4Vp8u14hqlRLCTejp
+7uC/0+628e+qXlCm8wafDb9/JXzQar7rADhoLp7gJKI2PKMAzLUP2xZVzY5zx57G
++OCR/ZXonVeAPy9/0g9N8uQzJEXOVZYMjsoRra9rdlvnY1DgDoAK7QvJMC4VzENm
+wKmz2rPrBlKaEcivubg7dwPMGNmb3f7F7w0HHuRbQd5Y0nDfEWBKCp0bVx1GLc7/
+MWjwPJs52qVJ3Ph++EF6bw==
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem
new file mode 100644
index 000000000..b91f9bf81
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.d/private/carolKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAz6hOJXuUKHUgPjV50NSBSNF1nAQw8EAzXEOqjEnEgmm6DxQi
+65QvRO9Cdnhnl9r/1A00KRDsUOHxlxH5NPzHSY51hgDveYxCJzSfg7nsX6z+URIq
+8ig368gNHesYkG/2tjO1Lg4MT4MmX1cr1O0h3m7nuN9e7+TchiXkZ5Dd/6JzaXY6
+VrvS3vQ6npwUNkiE4KOzbFbDbKoZ09Y4No38SfDl84u/+ib7sccHgqA8a/iniiFY
+hQKjZcrn3siL6MHYx05SUbzf/Vpfv4z4h5hXCMiHNaPBFB8zPQBCFrQdg3hy+tnu
+y1SW4zF7CwJE4IHNwZBhNnFhTgWNHyeEfgClgwIDAQABAoIBAHXoftbRoIKIXtJz
+0sM8plwOctUvnAoOqhsNYN1fVXEnTzoYmOtirKRbpkVWgJu9Ad4J0UAwF76lTGQX
+FIV9sjqV5S09grxlY3qXaquE+i4pMA4gXro5E+eRI8GFJ+F7cX5rRcjsuRi8wyEH
+gh/YtY5zMqfKTUGxlXWmNlaH70WilianuMPNXwaKgyBGcfZdheyUggM0rYEJrG1Z
+PZqNo0JKfeI4htpENDp0k1xJ9lCjIqdNw0ZjBi+pL6hF5PYaPjlVC2yn5CzRaT1D
+nUeKUK+SVES4sPrEQtaOlk86uZC4pIz5IlEoSvaw/Yo3Gk1sQKIQMMh1crhHd0El
+U831KwECgYEA7fQY+aFk3fHabwgf9gjuPKgwetVQ8jNDWUiSqffHUC0AQfKZQQsF
+mXJeSRZomPCWG3DRz1EcqXr9f82bN295I0CI6foXZgKUmjed7Bohc0HvUqNOi2qm
+MdbdWBOaH4RBzi1fAENJZnprmq65jQ/tkfCwqIz4KaLt+8xiWmU2h6ECgYEA32gB
+UbCzs1LoJC03uGHqZFRWK/YNKOKBUw58XCnzPTA+34UupI88lPj8LD269tDtruRy
+G7wt4HjayPKtK430nKAl01IXq6ULBTByu3KrCOm/gTAycVMj4ZimTn7Qu9jyv4Lz
+Ka3rBQxB+yQWfn27dc7U+EBsA7PT53NR6Zl8CqMCgYALJYod93+AHho7ZUgKAHUY
+hlBvEJsQHXKkNhAYwjCmAtWmQTUIpPmILKFaDyCrOWnusyRA7+3FyqshV4JT4Hbu
+PdGsFDkQYEKRztUpADhc69PILTo6sa5DW2tW+uQXYdyrSdjPbFd943Iy9sheYUah
+tYKxApmFacp4JyTcUy1wwQKBgA44xLy6jvX/dR+4cS+frBgu9j1eMIBFyw3Kgkgr
+s3xVserww4NeSvEA2KzIUTqdGkRj7o+tbw43I1ZffH6lTskZuM63DyKyIv11lBgy
+uIicuMA0nUFxlXsrCIs+r3MF4I4oe+pPVALCQQEHzxbGUkSxogUbtMSXkgnN4Y0J
+ZEgZAoGAfo0nv/IeKi0KkKiPTQSGVWGAQyCpGE0UQ2RYYToT84kjXs+LrVGFH2lu
+LJvyYnSnM7eKqCFKh+kLQ3bezum56y5XTyAEipTmu7Lhp0CiVjSdnu+0QykmhKsx
+Z17Ut2ryGKOXySnlMNual4eCLq98o0iOcYPq08V6x33dhK7Z3kU=
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..fac55d63b
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey.pem
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..45b6efcc8
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,31 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+	
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+
+conn alice
+	rightsubnet=PH_IP_ALICE/32
+	auto=add
+	
+conn venus
+	rightsubnet=PH_IP_VENUS/32
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem
new file mode 100644
index 000000000..b76032480
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/certs/daveCert.pem
@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEHDCCAwSgAwIBAgIBATANBgkqhkiG9w0BAQUFADBLMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEOMAwGA1UECxMFU2FsZXMxETAPBgNV
+BAMTCFNhbGVzIENBMB4XDTA1MDMyMzA3MTAxN1oXDTEwMDMyMjA3MTAxN1owVjEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsT
+BVNhbGVzMRwwGgYDVQQDFBNkYXZlQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GS
+zZwo/q4AE4v6OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+
+1V42Qkh61VJW1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJN
+P3p8wUpfwReImAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1+
++eTSMvLXSkQeujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSP
+aSRhuz0gubuMpr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABo4H/MIH8
+MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBSCy57rUdNRbytUkRGY
+GjmjvXfIszBtBgNVHSMEZjBkgBRfmxNG+SByyADViLWnTC6X6guTKKFJpEcwRTEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
+EnN0cm9uZ1N3YW4gUm9vdCBDQYIBDTAeBgNVHREEFzAVgRNkYXZlQHN0cm9uZ3N3
+YW4ub3JnMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v
+cmcvc2FsZXMuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQB+BknSxFKaDhbRVobOAU2P
+p9cirkVCitoZrvK2QIS/7WRoqy85RQ+zorJb3jyTxQl4Pu9Qrap9Zn0H8GQXGlQw
+ZJqdDqRaIa4nCc57qP5DsuQKIQRxc1QMCiWyIRAESn+r8IbxLbjvEd7ZXNsieip6
+Q15uUZldjTveHVi89i9oFWS1nWo4SV+tJaEqPBvsTZZKBPAEu6+7lRzbJ4ukzRsA
+DjuvmaPNUTyf21fD66I4sgrwgxoPhZ7r6qsqISJ5f0EzTXgYNi1yk/TXoAaot3c/
+Gu5+iyO/espV6kPADSOzPSFwsGHYG4kXi1VY0Z7x6UnjQSdEelOBplJ5XYDzEn4+
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem
new file mode 100644
index 000000000..022436de4
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/dave/etc/ipsec.d/private/daveKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAyqAR0itGIuSt/RR8IHjFTLH/lywprmHUw0GSzZwo/q4AE4v6
+OeWRG3JUUg44K40yBwr7zvcsLztRTfbNqlt7o+Hjpo3kz0AMwDo+1V42Qkh61VJW
+1P0NQvkgjiQn+ElSMg1u3uiYCIMAhYMYo2ZMKxHXxRqjU79AVuJNP3p8wUpfwReI
+mAy3/n685YbSzWcbPqCfjRH/YrnYS8Ga7m/QzdNfrtxhAWAGow1++eTSMvLXSkQe
+ujU6OCJNOPUNB3nnJ1IoZrQm8wNP8Y5B5HzvOSyFEvNuHFc63gSPaSRhuz0gubuM
+pr1d9Rgjny8JgsfCEbOktlKwnbFeSB8AAgVMjwIDAQABAoIBAHKaRFoVpa6Ynpu0
+mVwYUqdFSaVsEgsSRC9HiEuIllsteNeVZSqX4BGhAXYDmttvGauIF9IAVNpF939c
+JwjCg1S2r3aFbLOXq16R0vYFOjUVH3xF/NysX3LQywv6AS1Z8wZiOKIU9eBij8nz
+0tygQFZf2iUeIuB8HFzH1B8iHSuI7qn6hh1Y9Zgx4kWYL9I+WYefbR906xveHVGq
+8VrgHtBAn1WeWg7FoN1VURW0s1bxkiWtpF9x9OMmwK4qR8HSCilss59V1eJrAAR0
+3FGdWwbbGg9hW0adnyDCtoaYW3r0WcXwqklyas4C+dClOpUInn8kZisoghQYT92u
+U2QeDzECgYEA5Rv7+rP9HX1pNd9NQwOyIHztv4jfx60gybioogtCeRZUwPQ3GtXJ
+Q0ouBxCVLdyCImIKcvd2q2b9HZE8tvOHBA/YxofH4miEN5GWA4aL+LcGrxIbxPWs
+MEkxgQwsyK7lWH47fG7eW86LMx0VikFXS1EeeZZS3f3Avaww1uRtXecCgYEA4mhS
+sAClZamGVWQ7VXCHuS4xHn/gPA4TCyoR5l9g9pwregGKxsROQVIFQCDMd9eTtS6B
+oqoUTHdg0TlujHVUojdwHtgDaqDMTk+RXD9qy2Wob9HQVBlIwgijoLb+OjwdoAj7
+1OQx8FmMjAlMmlyJ50e1FnbNJFEJ1EMgV5QxtxkCgYEArdUeyehYy1BFTJ/CIm+i
+bm37gdDbYchlUUivgkuiwvcDlWd2jADbdRfKdofJeIOPpYDXxsUmIATDVfTFqVZ7
+AcT4SCHrskh00SjANqqWdz5/bsQBl96DKBvQ2MYhEJ9K2mrkvZPtWKENEtolZsIO
+9tF0mvJIq7CF1iPY5qNoq88CgYEAoZhELErJwl3U+22my7ydopZNiK9MpJCHFxjX
+3c2Fr36XqWUgX+4MzKJ2DOdcCM1dJ5wh+q/Z/RnXiH2tYaL83SskY19aUOij6eDw
+px68YqAUMHtYbi39uD/iSftSSM5PdsHyvGiDHEFOB0U735Dc/K45mecBVEJi+ZVP
+qDKlqUECgYA1DcGOWM3P3XdB7zKy47LcankMtFZozEOLTUdGJRlmWrLdcRlZPKjt
+/ALripehesp1++VtmttWQJX7uI3gveD07/tSKeMHmIoKappjRTrcaA7Pa5+z/xS/
+UhRmZUFOJwNLzy3jdv5f2c/5SIz6o4Ae3I+Zb+IapHL+lBv146/I5g==
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..98a0e9b81
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,44 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+ca research
+	cacert=researchCert.pem
+	ocspuri=http://ocsp.strongswan.org:8881
+	auto=add
+
+ca sales
+	cacert=salesCert.pem
+	ocspuri=http://ocsp.strongswan.org:8882
+	auto=add
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+
+conn alice
+	leftsubnet=PH_IP_ALICE/32
+	right=%any
+	rightca="C=CH, O=Linux strongSwan, OU=Research, CN=Research CA"
+	auto=add
+	
+conn venus
+	leftsubnet=PH_IP_VENUS/32
+	right=%any
+	rightca="C=CH, O=Linux strongSwan, OU=Sales, CN=Sales CA"
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
new file mode 100644
index 000000000..154cff654
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDwTCCAqmgAwIBAgIBDzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA1MDYyMTE5NTgwNloXDTEwMDYyMDE5NTgwNlowUTELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMRQwEgYDVQQDEwtSZXNlYXJjaCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBALY5sjqm4AdbWKc/T7JahWpy9xtdPbHngBN6lbnpYaHfrxnGsvmD
+FCFZHCd7egRqQ/AuJHHcEv3DUdfJWWAypVnUvdlcp58hBjpxfTPXP9IDBxzQaQyU
+zsExIGWOVUY2e7xJ5BKBnXVkok3htY4Hr1GdqNh+3LEmbegJBngTRSRx4PKJ54FO
+/b78LUzB+rMxrzxw/lnI8jEmAtKlugQ7c9auMeFCz+NmlSfnSoWhHN5qm+0iNKy0
+C+25IuE8Nq+i3jtBiI8BwBqHY3u2IuflUh9Nc9d/R6vGsRPMHs30X1Ha/m0Ug494
++wwqwfEBZRjzxMmMF/1SG4I1E3TDOJ3srjkCAwEAAaOBrzCBrDAPBgNVHRMBAf8E
+BTADAQH/MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQU53XwoPKtIM3NYCPMx8gPKfPd
+VCAwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNV
+BAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJv
+bmdTd2FuIFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEEBQADggEBAHArS2trQnBoMVcg
+Br3HV78wYsa1MNAQCBAPhKMMd6EziO4FTwgNgecbKXpObX6ErFDgjtVTcLOMTvNX
+fvZoNuPpdcitlgcWjfxZafNbj6j9ClE/rMbGDO64NLhdXuPVkbmic6yXRwGZpTuq
+3CKgTguLvhzIEM47yfonXKaaJcKVPI7nYRZdlJmD4VflYrSUpzB361dCaPpl0AYa
+0zz1+jfBBvlyic/tf+cCngV3f+GlJ4ntZ3gvRjyysHRmYpWBD7xcA8mJzgUiMyi1
+IKeNzydp+tnLfxwetfA/8ptc346me7RktAaASqO9vpS/N78eXyJRthZTKEf/OqVW
+Tfcyi+M=
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
new file mode 100644
index 000000000..e50477872
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDuzCCAqOgAwIBAgIBDTANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA1MDMyMzA2MjkxNloXDTE0MDMyMTA2MjkxNlowSzELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDjAMBgNVBAsTBVNhbGVz
+MREwDwYDVQQDEwhTYWxlcyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMJOTSaZjDe5UR+hJbodcE40WBxWm+r0FiD+FLc2c0hH/QcWm1Xfqnc9qaPP
+GoxO2BfwXgFEHfOdQzHGuthhsvdMPkmWP1Z3uDrwscqrmLyq4JI87exSen1ggmCV
+Eib55T4fNxrTIGJaoe6Jn9v9ZwG2B+Ur3nFA/wdckSdqJxc6XL9DKcRk3TxZtv9S
+uDftE9G787O6PJSyfyUYhldz1EZe5PTsUoAbBJ0DDXJx3562kDtfQdwezat0LAyO
+sVabYq/0G/fBZwLLer4qGF2+3CsvP7jNXnhRYeSv2+4i2mAjgbBRI1A3iqoU3Nq1
+vPAqzrekOI/RV9Hre9L1r8X1dIECAwEAAaOBrzCBrDAPBgNVHRMBAf8EBTADAQH/
+MAsGA1UdDwQEAwIBBjAdBgNVHQ4EFgQUX5sTRvkgcsgA1Yi1p0wul+oLkygwbQYD
+VR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJBgNVBAYTAkNI
+MRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJzdHJvbmdTd2Fu
+IFJvb3QgQ0GCAQAwDQYJKoZIhvcNAQEFBQADggEBAJ7j3X20Q8ICJ2e+iUCpVUIV
+8RudUeHt9qjSXalohuxxhegL5vu7I9Gx0H56RE4glOjLMCb1xqVZ55Odxx14pHaZ
+9iMnQFpgzi96exYAmBKYCHl4IFix2hrTqTWSJhEO+o+PXnQTgcfG43GQepk0qAQr
+iZZy8OWiUhHSJQLJtTMm4rnYjgPn+sLwx7hCPDZpHTZocETDars7wTiVkodCbeEU
+uKahAbq4b6MvvC3+7quvwoEpAEStT7+Yml+QuK/jKmhjX0hcQcw4ZWi+m32RjUAv
+xDJGEvBqV2hyrzRqwh4lVNJEBba5X+QB3N6a0So6BENaJrUM3v8EDaS2KLUWyu0=
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-multi-level/posttest.dat b/testing/tests/ikev2/ocsp-multi-level/posttest.dat
new file mode 100644
index 000000000..1646d5ed2
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/posttest.dat
@@ -0,0 +1,5 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::rm /etc/ipsec.d/cacerts/*
+
diff --git a/testing/tests/ikev2/ocsp-multi-level/pretest.dat b/testing/tests/ikev2/ocsp-multi-level/pretest.dat
new file mode 100644
index 000000000..f15265e32
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/pretest.dat
@@ -0,0 +1,7 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+carol::ipsec start
+dave::ipsec start
+moon::ipsec start
+carol::sleep 2
+carol::ipsec up alice
+dave::ipsec up venus
diff --git a/testing/tests/ikev2/ocsp-multi-level/test.conf b/testing/tests/ikev2/ocsp-multi-level/test.conf
new file mode 100644
index 000000000..08e5cc145
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-multi-level/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/ocsp-revoked/description.txt b/testing/tests/ikev2/ocsp-revoked/description.txt
new file mode 100644
index 000000000..73d072549
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/description.txt
@@ -0,0 +1,9 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
+is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate
+issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b>
+extended key usage flag. A strongswan <b>ca</b> section in ipsec.conf defines an
+<b>OCSP URI</b> pointing to <b>winnetou</b>.
+<p>
+<b>carol</b> tries to initiate an IPsec connection to <b>moon</b> but fails 
+because <b>carol</b>'s certificate has been <b>revoked</b>.
diff --git a/testing/tests/ikev2/ocsp-revoked/evaltest.dat b/testing/tests/ikev2/ocsp-revoked/evaltest.dat
new file mode 100644
index 000000000..eacb70c40
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/evaltest.dat
@@ -0,0 +1,7 @@
+moon::cat /var/log/daemon.log::received valid http response::YES
+moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
+moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED notify error::YES
+moon::ipsec status::rw.*ESTABLISHED::NO
+carol::ipsec status::home.*ESTABLISHED::NO
+
diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..be15f6ec5
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert-revoked.pem
+	leftid=carol@strongswan.org
+
+conn home
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem
new file mode 100644
index 000000000..5b742fc9e
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/certs/carolCert-revoked.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEIjCCAwqgAwIBAgIBBzANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA0MDkxMDExMjU0OFoXDTA5MDkwOTExMjU0OFowWjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xETAPBgNVBAsTCFJlc2Vh
+cmNoMR0wGwYDVQQDFBRjYXJvbEBzdHJvbmdzd2FuLm9yZzCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAM5413q1B2EF3spcYD1u0ce9AtIHdxmU3+1E0hqV
+mLqpIQtyp4SLbrRunxpoVUuEpHWXgLb3C/ljjlKCMWWmhw4wja1rBTjMNJLPj6Bo
+5Qn4Oeuqm7/kLHPGbveQGtcSsJCk6iLqFTbq0wsji5Ogq7kmjWgQv0nM2jpofHLv
+VOAtWVSj+x2b3OHdl/WpgTgTw1HHjYo7/NOkARdTcZ2/wxxM3z1Abp9iylc45GLN
+IL/OzHkT8b5pdokdMvVijz8IslkkewJYXrVQaCNMZg/ydlXOOAEKz0YqnvXQaYs5
+K+s8XvQ2RFCr5oO0fRT2VbiI9TgHnbcnfUi25iHl6txsXg0CAwEAAaOCAQYwggEC
+MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMB0GA1UdDgQWBBTbA2TH3ca8tgCGkYy9
+OV/MqUTHAzBtBgNVHSMEZjBkgBRdp91wBlEyfue2bbO15eBg6i5N76FJpEcwRTEL
+MAkGA1UEBhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xGzAZBgNVBAMT
+EnN0cm9uZ1N3YW4gUm9vdCBDQYIBADAfBgNVHREEGDAWgRRjYXJvbEBzdHJvbmdz
+d2FuLm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4u
+b3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBAUAA4IBAQC9acuCUPEBOrWB
+56vS8N9bksQwv/XcYIFYqV73kFBAzOPLX2a9igFGvBPdCxFu/t8JCswzE6to4LFM
+2+6Z2QJf442CLPcJKxITahrjJXSxGbzMlmaDvZ5wFCJAlyin+yuInpTwl8rMZe/Q
+O5JeJjzGDgWJtnGdkLUk/l2r6sZ/Cmk5rZpuO0hcUHVztMLQYPzqTpuMvC5p4JzL
+LWGWhKRhJs53NmxXXodck/ZgaqiTWuQFYlbamJRvzVBfX7c1SWHRJvxSSOPKGIg3
+wphkO2naj/SQD+BNuWTRmZ9YCiLOQ64ybLpJzRZISETdqtLBPKsIqosUZwkxlR1N
+9IcgYi5x
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem
new file mode 100644
index 000000000..8aefcc5a6
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.d/private/carolKey-revoked.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAznjXerUHYQXeylxgPW7Rx70C0gd3GZTf7UTSGpWYuqkhC3Kn
+hItutG6fGmhVS4SkdZeAtvcL+WOOUoIxZaaHDjCNrWsFOMw0ks+PoGjlCfg566qb
+v+Qsc8Zu95Aa1xKwkKTqIuoVNurTCyOLk6CruSaNaBC/SczaOmh8cu9U4C1ZVKP7
+HZvc4d2X9amBOBPDUceNijv806QBF1Nxnb/DHEzfPUBun2LKVzjkYs0gv87MeRPx
+vml2iR0y9WKPPwiyWSR7AlhetVBoI0xmD/J2Vc44AQrPRiqe9dBpizkr6zxe9DZE
+UKvmg7R9FPZVuIj1OAedtyd9SLbmIeXq3GxeDQIDAQABAoIBAAUdyXko8z3cP2EU
+WO4syNYCQQejV7gykDn48pvmCRrXBhKajLwkGGIwO5ET9MkiSFEBqBbgmFNdvDEf
+OMokDkSzv08Ez+RQax0YN57p+oL8u7KzT5i5tsBHsog/8epSdD2hWIv08QGjYAdu
+og7OdHLqGabyg0r44I+B91OBysCjU51rDdkhz59AmURdEIJV5xhuGojFM68jaNm2
+MUxDfDuCsRIydjAP0VTUTAUxD4/S5I+jt/GK9aRsEeRH9Q3011iTGMR9viAUBhq/
+khkWNltg9lkOqO7LpnNku4sSv3v4CWge7/T+4RR2vZgv1oSs4ox2UKYoqIqiYIfx
+uUcnqQECgYEA+LPiRMoXvlssQWlaFc2k4xga0efs+mWeLglDdc3R3fBEibP/AU07
+a576AgvUJtkI50/WNGKT73O+VtxcXn/N646m/8OtqNXuVKKjsxxNOZEKdO8aOdbt
+7lM5WepNiQeaKAFudUxpUiZQx8LCKSsNDiJZKWBu6xAG2O5X32VMZvUCgYEA1Ie+
+rNa490PSC1ym7WbmdAjvGmSOn2GOBfO7BECsPZstccU7D5pZl/89fTfn1TDKP49Y
+ScVOuFz7f/u6UJpb/WzI71RXEQOdojLWmF2HDx5osRi3hXEJa20fbPq6DQXCJ8pf
+IF37AEqAY4UNSNic0Cw+rGHdWPQhDNXhFWpdu7kCgYEAmv4oNmyoDXbuhrlsbggi
+CXE9TbG3a3mm8dPOGf2yHBmf7R2i/6GtNW33Kw1KIwfBV77WpQEGZwWACsv8ONx3
+baUSiHTfpkfk5xQQ5w/tRMISfTuB4agD0jJFnLa7qXl2ZhY2S53aSVsdntDOhi+R
+TEy1umah2Za8Xbd0RgHwcn0CgYEAl9Hgg9dfikMIaNVm6W/4cCtxoojy2Sf3LIlP
+r1oDsH6JmBwsdJjuJ4ZNhoXJNqID2COuDgTEly7U+jf4gFvEGuT7JPw6tgy/Ln7i
+jTVCpaozX08oykpVUEhDirYQ8fyLFaGbEqQQCcUusej59G/IlW0F2F6QoFrEwUaH
+46R4EQECgYBEZ7edMkj3dmJH1wxQjp5GJNbrJkS8IKvzza0mDTJdz33CgEX9Oyva
+o2iEkDVpvj2SEy28ewt22IRptWKH/3bQfxSCcRV6JFNt3+LongMshRYqq1leqrKa
+9fnQVtfTIbIVXwjTZap6BL8R66OeFtexsSFRfDF/8P4n2oF4zmn4qA==
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..22f06e662
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey-revoked.pem
diff --git a/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..21b48ef0c
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-revoked/posttest.dat b/testing/tests/ikev2/ocsp-revoked/posttest.dat
new file mode 100644
index 000000000..d742e8410
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+carol::rm /etc/ipsec.d/private/*
+carol::rm /etc/ipsec.d/certs/*
diff --git a/testing/tests/ikev2/ocsp-revoked/pretest.dat b/testing/tests/ikev2/ocsp-revoked/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-revoked/test.conf b/testing/tests/ikev2/ocsp-revoked/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-revoked/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-root-cert/description.txt b/testing/tests/ikev2/ocsp-root-cert/description.txt
new file mode 100644
index 000000000..9574aa5b1
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/description.txt
@@ -0,0 +1,8 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
+is checked via the OCSP server <b>winnetou</b> which uses the <b>strongSwan CA</b>'s
+private key to sign OCSP responses. A <b>strongswan ca</b> section in ipsec.conf
+defines an <b>OCSP URI</b> pointing to <b>winnetou</b>.
+<p>
+<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
+the status of both certificates is <b>good</b>.
diff --git a/testing/tests/ikev2/ocsp-root-cert/evaltest.dat b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat
new file mode 100644
index 000000000..a3a1df194
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/evaltest.dat
@@ -0,0 +1,6 @@
+moon::cat /var/log/daemon.log::received valid http response::YES
+carol::cat /var/log/daemon.log::received valid http response::YES
+moon::cat /var/log/daemon.log::certificate is good::YES
+carol::cat /var/log/daemon.log::certificate is good::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..0209111ba
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..21b48ef0c
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
new file mode 100755
index 000000000..e998b6ad0
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+                      -rkey strongswanKey.pem -rsigner strongswanCert.pem \
+		      -resp_no_certs -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/tests/ikev2/ocsp-root-cert/posttest.dat b/testing/tests/ikev2/ocsp-root-cert/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/ocsp-root-cert/pretest.dat b/testing/tests/ikev2/ocsp-root-cert/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-root-cert/test.conf b/testing/tests/ikev2/ocsp-root-cert/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-root-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-signer-cert/description.txt b/testing/tests/ikev2/ocsp-signer-cert/description.txt
new file mode 100644
index 000000000..492a9882b
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/description.txt
@@ -0,0 +1,10 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
+is checked via the OCSP server <b>winnetou</b> which possesses an OCSP signer certificate
+issued by the strongSwan CA. This certificate contains an <b>OCSPSigning</b>
+extended key usage flag. <b>carol</b>'s certificate includes an <b>OCSP URI</b>
+in an authority information access extension pointing to <b>winnetou</b>. 
+Therefore no special ca section information is needed in ipsec.conf.
+<p>
+<b>carol</b> can successfully initiate an IPsec connection to <b>moon</b> since
+the status of both certificates is <b>good</b>.
diff --git a/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat
new file mode 100644
index 000000000..4a8ffd412
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/evaltest.dat
@@ -0,0 +1,13 @@
+moon::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES
+carol::ipsec listcainfos::ocspuris.*http://ocsp.strongswan.org::YES
+moon::cat /var/log/daemon.log::received valid http response::YES
+carol::cat /var/log/daemon.log::received valid http response::YES
+moon::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
+carol::cat /var/log/daemon.log::received ocsp signer certificate is trusted::YES
+moon::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+carol::ipsec listocspcerts::altNames.*ocsp.strongswan.org::YES
+moon::cat /var/log/daemon.log::certificate is good::YES
+carol::cat /var/log/daemon.log::certificate is good::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
+
diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..f49fa9204
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert-ocsp.pem
+	leftid=carol@strongswan.org
+
+conn home
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem
new file mode 100644
index 000000000..aeca7e1db
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax
+HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5
+vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8
+G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J
+5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt
+kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If
+pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD
+VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ
+2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD
+VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry
+b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u
+b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry
+b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0
+cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc
+1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj
+o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc
+ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8
+pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s
+pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1
+/xsH+BXYZtKJbYjlnyc8
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem
new file mode 100644
index 000000000..603f071d0
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX
+3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2
+uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl
+vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR
+QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/
+QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm
+LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT
+nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI
+UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL
+maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ
+hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0
+UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ
+wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2
+kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx
+OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN
+Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo
+nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE
+Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp
++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi
+syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi
+OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb
+sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S
+VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J
+P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG
+SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo=
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..a89065443
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey-ocsp.pem
diff --git a/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a8a9f1e30
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-signer-cert/posttest.dat b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat
new file mode 100644
index 000000000..220bc2c1d
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+carol::rm /etc/ipsec.d/certs/*
+carol::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/ocsp-signer-cert/pretest.dat b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-signer-cert/test.conf b/testing/tests/ikev2/ocsp-signer-cert/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-signer-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/description.txt b/testing/tests/ikev2/ocsp-timeouts-good/description.txt
new file mode 100644
index 000000000..9ee5db95b
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/description.txt
@@ -0,0 +1,10 @@
+This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a>
+and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching
+by adding an ocspuri2 in <b>moon</b>'s strongswan ca section that cannot be resolved by
+<b>DNS</b> and an ocspuri2 in <b>carol</b>'s strongswan ca section on which no
+OCSP server is listening. Thanks to timeouts the connection can nevertheless
+be established successfully by contacting a valid OCSP URI contained in
+<b>carol</b>'s certificate.
+<p>
+As an additional test the OCSP response is delayed by 5 seconds in order to check
+the correct handling of retransmitted IKE_AUTH messages.
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat
new file mode 100644
index 000000000..4c4059810
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/evaltest.dat
@@ -0,0 +1,9 @@
+moon::cat /var/log/daemon.log::http post request using libcurl failed::YES
+carol::cat /var/log/daemon.log::http post request using libcurl failed::YES
+moon::cat /var/log/daemon.log::received valid http response::YES
+carol::cat /var/log/daemon.log::received valid http response::YES
+moon::cat /var/log/daemon.log::certificate is good::YES
+carol::cat /var/log/daemon.log::certificate is good::YES
+moon::ipsec status::rw.*ESTABLISHED::YES
+carol::ipsec status::home.*ESTABLISHED::YES
+
diff --git a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf
index 6d0aee86a..b53de16e4 100755
--- a/testing/tests/multi-level-ca-revoked/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.conf
@@ -1,20 +1,24 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
-	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=yes
+	plutostart=no
 
+ca strongswan-ca
+	cacert=strongswanCert.pem
+        ocspuri2=http://bob.strongswan.org:8800
+	auto=add
+			
 conn %default
+	keyexchange=ikev2
 	ikelifetime=60m
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
 	left=PH_IP_CAROL
 	leftnexthop=%direct
-	leftcert=carolCert.pem
+	leftcert=carolCert-ocsp.pem
 	leftid=carol@strongswan.org
 
 conn home
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem
new file mode 100644
index 000000000..aeca7e1db
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/certs/carolCert-ocsp.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEWzCCA0OgAwIBAgIBEzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA3MDIyNTA3NTg1N1oXDTEyMDIyNDA3NTg1N1owVjELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xDTALBgNVBAsTBE9DU1Ax
+HTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5
+vVZX3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8
+G7M2uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J
+5rRlvXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+Kdt
+kkCRQYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0If
+pPr/QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABo4IBQzCCAT8wCQYD
+VR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFDRTWKccFIi95BslK3U92mIQ
+2rWGMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQswCQYD
+VQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ry
+b25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3YW4u
+b3JnMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAYYfaHR0cDovL29jc3Auc3Ry
+b25nc3dhbi5vcmc6ODg4MDA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0
+cm9uZ3N3YW4ub3JnL3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAc
+1bBYLYcc+js3UsHVk7W17Nr/qoNFzQZJ5Er3RjhNAgzAX1wOTrNgKXztwZde1Alj
+o05ZLXUFkB4coQwl7xo7I3EMJPUmSdHoyYyG7c7AgfcL/wwnzz4rWQl74WIZjySc
+ON0Ny9vrzbVboktYof/9Yp/+HgeKopfsaIiuNCAwmAWxiYqvDmlxxn16oOXeJFV8
+pFzZMirQ5l7QRD9iuabOdcnBp8ASH+5AbD4KjFQjo5RBVg92LwOkJo3Pf1twI57s
+pObrcM4JbHVohDornYQYfr9ymkMxJbqqkEgD8oIip0NFSbziam4ZkwgUlRIMUMU1
+/xsH+BXYZtKJbYjlnyc8
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem
new file mode 100644
index 000000000..603f071d0
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.d/private/carolKey-ocsp.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAyO4WxrPomcQSspX+ZnPit3t+tzYE/wi1E8rH3h5aO3e5vVZX
+3YxNvBqge2RPB3oQHrWwWT8vKmqzZNjJUx4bRIqd1JdTRI7L0f6XJHjnrRv8G7M2
+uHe+JbHQKPRT7IefJ4PZ1FEA8SCwKfWs5vk1/w/cabM6DVzzjtWTV9DXKD6J5rRl
+vXtJDbhAvI2w8pCC1Gt6H8qjVSb7ItJ+SD3BlW3tq3nBsYFJRL24TyQg+KdtkkCR
+QYirog29q+J59SErjolse59dte+MhNTv+SnVFgpQE9IGEo6yaKMAWLSTv0IfpPr/
+QaEV9rcsYFmR3RtHc+QaaP0hvDAPMaKdhQMIUwIDAQABAoIBAFTGd5+gmpv96TGm
+LW8Gp/poRX+BcDw2bUgLf6aMwd9jVV+4RVw5bTbXOSy2ls19x71dRSlyijDoUgZT
+nSXPhwu1PIBM1JoRcZeJRjXiOUWFkCoTxBuykeyPiFcvNxWN5y2h6M822iHie9FI
+UYomTYzvIT0LnIu00yJJpGAhwhW9BcL+Mo9lfWmhv4I1hXC9RTqZZ4rjPojDeFvL
+maZNCk3kX2pxIJ1kG41/PJjg3JD2uEVrvV7SRuOknM+7f3SDtY60/Wnqx8dfBtjJ
+hEdIxG+XXEOafdqwEPmmM++6V76uD8Rs1eFrrI4rfK6/H2PjppJCYtQeryug0q+0
+UN2u00kCgYEA5qJOcDSzb7CQAi58yYicYc3ShEbaL75V7G5rlnFg4/G1axU19hXQ
+wEPDf87So9hnVroCMewjyDiNgI/OyYK2cv1TABUGAEFAHPzj99jtBT0/R0kX+Jd2
+kPwCU4/T2cHrezwNobrJf010JAvwc52b+U3lWtHxBWeq5KALUVT+BhcCgYEA3wdx
+OwVxTf+OBOBcxPPGUcfsKbf9uVTcXFLNRSBbjzRIOR/bIVgUQaBXem2fJJTm1mWN
+Yl/U14G5orv9693GKgE5IDAMMrDF7mOsX808o3pcXM04MTAyGmQEDDEO8tgmWzWo
+nrYzxe9uBR1tej9IsiEPlD9ZLtWix9C2uV7EcSUCgYBKOrDuMjgSWYxv91BYeOyE
+Gf+IbVlqBmOXPg7Ik+MwWioetevxMSJHz0eLyiBHda4E3sc4FB2MIo+AckiG2Ngp
++FiPbTTKPjYJXmds7NeUWRsVsXPSocUactG43VC9BEnrFu/4Pqr9mwsnUuRoAbEi
+syx/Z5SgPbZl8RDTc3xyrwKBgBFpB1HQLvQjyvZefV9ymDyyGqF3F3tsQHeEjzmi
+OQOI1UqATh7gPVSSK8IG5LF6XjrGWq8fRAI+wjsN6diLy3hj+A2nMoySeCEP7tjb
+sKwiVSt5abWNSZv9ysMY4U3bycK9AZjCKHB/LFuB3JX6crZVFl5AQ7oAO2DVzi3S
+VAtxAoGALzFZH7o1ZvVJGa23dW7p96G5vgop6Ulp2DLz4Qg6NYIeatZhwX3lls2J
+P7ZxmHiECC7zR67xwv5QKjKfg6t/sOKU/bsyp6c3hOWQjcFbWU3AwlO1TeVX9TMG
+SmPYcKM+KQ969qKD3aP9MQ+t4FERvlQcBAr0Qun3quN2i3eDkDo=
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..a89065443
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey-ocsp.pem
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..f3b19d292
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri2=http://ocsp2.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
new file mode 100755
index 000000000..92aa920aa
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+cd /etc/openssl
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+# simulate a delayed response
+sleep 5 
+
+/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+                      -rkey ocspKey.pem -rsigner ocspCert.pem \
+		      -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat
new file mode 100644
index 000000000..220bc2c1d
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+carol::rm /etc/ipsec.d/certs/*
+carol::rm /etc/ipsec.d/private/*
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-timeouts-good/test.conf b/testing/tests/ikev2/ocsp-timeouts-good/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-good/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt
new file mode 100644
index 000000000..d17534b1b
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/description.txt
@@ -0,0 +1,7 @@
+This scenario is based on <a href="../ocsp-signer-cert">ikev2/ocsp-signer-cert</a>
+and tests the timeouts of the <b>libcurl</b> library used for http-based OCSP fetching
+by adding an ocspuri1 in <b>moon</b>'s strongswan ca section on which no OCSP
+server is listening and an ocspuri2 that cannot be resolved by <b>DNS</b>.
+Since the certificate status is <b>unknown</b> the connection setup is aborted by
+<b>moon</b> with an <b>AUTHORIZATION_FAILED</b> notification sent to <b>carol</b>.
+
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat
new file mode 100644
index 000000000..c9c09a72f
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/evaltest.dat
@@ -0,0 +1,6 @@
+moon::cat /var/log/daemon.log::http post request using libcurl failed::YES
+moon::cat /var/log/daemon.log::certificate status unknown::YES
+carol::cat /var/log/daemon.log::received AUTHENTICATION_FAILED::YES
+moon::ipsec status::rw.*ESTABLISHED::NO
+carol::ipsec status::home.*ESTABLISHED::NO
+
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..cdc1560ae
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri1=http://bob.strongswan.org:8800
+        ocspuri2=http://ocsp2.strongswan.org:8880
+	auto=add
+			
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+
+conn home
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..e759d1d79
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	crlcheckinterval=180
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri1=http://bob.strongswan.org:8800
+	ocspuri2=http://ocsp2.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat
new file mode 100644
index 000000000..cf72480d4
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::iptables -F OUTPUT
+carol::iptables -F OUTPUT
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat
new file mode 100644
index 000000000..7d9d600ff
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/pretest.dat
@@ -0,0 +1,6 @@
+moon::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP
+carol::iptables -I OUTPUT -d PH_IP_WINNETOU -p tcp --dport 80 -j DROP
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-timeouts-unknown/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/description.txt b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt
new file mode 100644
index 000000000..f581dd319
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/description.txt
@@ -0,0 +1,9 @@
+By setting <b>strictcrlpolicy=yes</b>, a <b>strict</b> CRL policy is enforced on
+both roadwarrior <b>carol</b> and gateway <b>moon</b>. The online certificate status
+is checked via the OCSP server <b>winnetou</b> which is sending its <b>self-signed</b>
+OCSP signer certificate. A strongswan <b>ca</b> section in ipsec.conf
+defines an <b>OCSP URI</b> pointing to <b>winnetou</b>.
+<p>
+<b>carol</b> cannot successfully initiate an IPsec connection to <b>moon</b> since
+the self-signed certificate contained in the OCSP response will not be
+accepted by <b>moon</b>.
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat
new file mode 100644
index 000000000..a0b6d681f
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/evaltest.dat
@@ -0,0 +1,5 @@
+moon::cat /var/log/daemon.log::received valid http response::YES
+moon::cat /var/log/daemon.log::received ocsp signer certificate is not trusted - rejected::YES
+moon::cat /var/log/daemon.log::certificate status unknown::YES
+moon::ipsec status::rw.*ESTABLISHED::NO
+carol::ipsec status::home.*ESTABLISHED::NO
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..3c685a839
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,27 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..e2fabe0f5
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=yes
+	plutostart=no
+
+ca strongswan-ca
+	cacert=strongswanCert.pem
+	ocspuri=http://ocsp.strongswan.org:8880
+	auto=add
+
+conn %default
+	keyexchange=ikev2
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
new file mode 100755
index 000000000..20c4b2a22
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/hosts/winnetou/etc/openssl/ocsp/ocsp.cgi
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+cd /etc/openssl
+
+echo "Content-type: application/ocsp-response"
+echo ""
+
+/usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
+                      -rkey ocspKey-self.pem -rsigner ocspCert-self.pem \
+		      -nmin 5 \
+		      -reqin /dev/stdin -respout /dev/stdout
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat
new file mode 100644
index 000000000..c6d6235f9
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+carol::ipsec stop
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat
new file mode 100644
index 000000000..d92333d86
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home
diff --git a/testing/tests/ikev2/ocsp-untrusted-cert/test.conf b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf
new file mode 100644
index 000000000..2b240d895
--- /dev/null
+++ b/testing/tests/ikev2/ocsp-untrusted-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/protoport-dual/description.txt b/testing/tests/ikev2/protoport-dual/description.txt
new file mode 100644
index 000000000..7bed8b959
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/description.txt
@@ -0,0 +1,6 @@
+Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels 
+between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are
+defined. The first IPsec SA is restricted to ICMP packets and the second
+covers TCP-based SSH connections. The established tunnels are tested
+by <b>carol</b> by first pinging <b>alice</b> behind <b>moon</b> and
+then setting up an SSH session to the same client.
diff --git a/testing/tests/ikev2/protoport-dual/evaltest.dat b/testing/tests/ikev2/protoport-dual/evaltest.dat
new file mode 100644
index 000000000..bd24b911c
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/evaltest.dat
@@ -0,0 +1,9 @@
+carol::ipsec statusall::home-icmp.*INSTALLED::YES
+carol::ipsec statusall::home-ssh.*INSTALLED::YES
+moon::ipsec statusall::rw-icmp.*INSTALLED::YES
+moon::ipsec statusall::rw-ssh.*INSTALLED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq=1::YES
+carol::ssh -o ConnectTimeout=5 PH_IP_ALICE hostname::alice::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf
index 598997b45..eda0ddf38 100755
--- a/testing/tests/mode-config/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ikev2/protoport-dual/hosts/carol/etc/ipsec.conf
@@ -1,21 +1,17 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
-	plutodebug=control
-	crlcheckinterval=180
+        crlcheckinterval=180
 	strictcrlpolicy=no
+	plutostart=no
 
 conn %default
 	ikelifetime=60m
 	keylife=20m
 	rekeymargin=3m
 	keyingtries=1
-
-conn home
+	keyexchange=ikev2
 	left=PH_IP_CAROL
-	leftsourceip=%modeconfig
 	leftnexthop=%direct
 	leftcert=carolCert.pem
 	leftid=carol@strongswan.org
@@ -24,7 +20,11 @@ conn home
 	rightsubnet=10.1.0.0/16
 	rightid=@moon.strongswan.org
 	auto=add
-
-
-
-
+	
+conn home-icmp
+	leftprotoport=icmp
+	rightprotoport=icmp
+
+conn home-ssh
+	leftprotoport=tcp
+	rightprotoport=tcp/ssh
diff --git a/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..0bc03380b
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
+
+conn rw-icmp
+	lefthostaccess=yes
+	leftprotoport=icmp
+	rightprotoport=icmp
+
+conn rw-ssh
+	leftprotoport=tcp/ssh
+	rightprotoport=tcp
diff --git a/testing/tests/ikev2/protoport-dual/posttest.dat b/testing/tests/ikev2/protoport-dual/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/protoport-dual/pretest.dat b/testing/tests/ikev2/protoport-dual/pretest.dat
new file mode 100644
index 000000000..d3d0061c3
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/pretest.dat
@@ -0,0 +1,7 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+carol::sleep 2
+carol::ipsec up home-icmp
+carol::ipsec up home-ssh
diff --git a/testing/tests/ikev2/protoport-dual/test.conf b/testing/tests/ikev2/protoport-dual/test.conf
new file mode 100644
index 000000000..9cd583b16
--- /dev/null
+++ b/testing/tests/ikev2/protoport-dual/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/protoport-route/description.txt b/testing/tests/ikev2/protoport-route/description.txt
new file mode 100644
index 000000000..ec7ec69b0
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/description.txt
@@ -0,0 +1,8 @@
+Using the <b>left|rightprotoport</b> selectors, two IPsec tunnels 
+between the roadwarrior <b>carol</b> and the gateway <b>moon</b> are
+defined. The first IPsec SA is restricted to ICMP packets and the second
+covers TCP-based SSH connections. Using <b>add=route</b> %trap
+eroutes for these IPsec SAs are prepared on <b>carol</b>. By sending
+a ping to the client <b>alice</b> behind <b>moon</b>, the ICMP eroute
+is triggered and the corresponding IPsec tunnel is set up. In the same
+way an ssh session to <b>alice</b> over the second IPsec SA is established.
diff --git a/testing/tests/ikev2/protoport-route/evaltest.dat b/testing/tests/ikev2/protoport-route/evaltest.dat
new file mode 100644
index 000000000..d6ce409f5
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/evaltest.dat
@@ -0,0 +1,10 @@
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq::YES
+carol::ping -c 1 PH_IP_MOON1::64 bytes from PH_IP_MOON1: icmp_seq::YES
+carol::ssh PH_IP_ALICE hostname::alice::YES
+carol::cat /var/log/daemon.log::creating acquire job for CHILD_SA::YES
+carol::ipsec statusall::home-icmp.*INSTALLED::YES
+carol::ipsec statusall::home-ssh.*INSTALLED::YES
+moon::ipsec statusall::rw-icmp.*INSTALLED::YES
+moon::ipsec statusall::rw-ssh.*INSTALLED::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..7f4e37bc2
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightid=@moon.strongswan.org
+	auto=route
+	
+conn home-icmp
+	leftprotoport=icmp
+	rightprotoport=icmp
+
+conn home-ssh
+	leftprotoport=tcp
+	rightprotoport=tcp/ssh
diff --git a/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..0bc03380b
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	leftsubnet=10.1.0.0/16
+	right=%any
+	auto=add
+
+conn rw-icmp
+	lefthostaccess=yes
+	leftprotoport=icmp
+	rightprotoport=icmp
+
+conn rw-ssh
+	leftprotoport=tcp/ssh
+	rightprotoport=tcp
diff --git a/testing/tests/ikev2/protoport-route/posttest.dat b/testing/tests/ikev2/protoport-route/posttest.dat
new file mode 100644
index 000000000..94a400606
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/posttest.dat
@@ -0,0 +1,4 @@
+moon::ipsec stop
+carol::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/protoport-route/pretest.dat b/testing/tests/ikev2/protoport-route/pretest.dat
new file mode 100644
index 000000000..0aded0f4d
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/pretest.dat
@@ -0,0 +1,8 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+carol::sleep 1
+carol::ssh PH_IP_ALICE hostname
+carol::ping -c 1 PH_IP_ALICE > /dev/null
+carol::sleep 2
diff --git a/testing/tests/ikev2/protoport-route/test.conf b/testing/tests/ikev2/protoport-route/test.conf
new file mode 100644
index 000000000..9cd583b16
--- /dev/null
+++ b/testing/tests/ikev2/protoport-route/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol"
diff --git a/testing/tests/ikev2/rw-cert/description.txt b/testing/tests/ikev2/rw-cert/description.txt
new file mode 100644
index 000000000..15b3822b5
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
+Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
+automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
+the client <b>alice</b> behind the gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/rw-cert/evaltest.dat b/testing/tests/ikev2/rw-cert/evaltest.dat
new file mode 100644
index 000000000..06a0f8cda
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..e5d9ad476
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..3c0014965
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..b8bc990cd
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/rw-cert/posttest.dat b/testing/tests/ikev2/rw-cert/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-cert/pretest.dat b/testing/tests/ikev2/rw-cert/pretest.dat
new file mode 100644
index 000000000..42e9d7c24
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/pretest.dat
@@ -0,0 +1,9 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-cert/test.conf b/testing/tests/ikev2/rw-cert/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-cert/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-fqdn/description.txt b/testing/tests/ikev2/rw-psk-fqdn/description.txt
new file mode 100644
index 000000000..d4a7c3878
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b>
+and fully qualified domain names. Upon the successful establishment of the IPsec tunnels,
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that
+let pass the tunneled traffic. In order to test both tunnel and firewall, both
+<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat
new file mode 100644
index 000000000..06a0f8cda
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..9a5087fff
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..47e31ca21
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..7b6e448b3
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..f6c1a22ef
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a6270a67e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,21 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..e6c7420c9
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,5 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-fqdn/posttest.dat b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-psk-fqdn/pretest.dat b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat
new file mode 100644
index 000000000..282b2aec0
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/pretest.dat
@@ -0,0 +1,12 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::rm /etc/ipsec.d/cacerts/*
+carol::rm /etc/ipsec.d/cacerts/*
+dave::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-psk-fqdn/test.conf b/testing/tests/ikev2/rw-psk-fqdn/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-fqdn/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-ipv4/description.txt b/testing/tests/ikev2/rw-psk-ipv4/description.txt
new file mode 100644
index 000000000..4eb66c540
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b>
+and IPv4 addresses. Upon the successful establishment of the IPsec tunnels,
+<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that
+let pass the tunneled traffic. In order to test both tunnel and firewall, both
+<b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat
new file mode 100644
index 000000000..06a0f8cda
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..0e3fe6962
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..18a074472
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..368c3c6fb
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,21 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..e989540e9
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+192.168.0.200  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..c38a2a59b
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,20 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..ab3fb129b
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,5 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+192.168.0.100 : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+
+192.168.0.200 : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-ipv4/posttest.dat b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-psk-ipv4/pretest.dat b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat
new file mode 100644
index 000000000..282b2aec0
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/pretest.dat
@@ -0,0 +1,12 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::rm /etc/ipsec.d/cacerts/*
+carol::rm /etc/ipsec.d/cacerts/*
+dave::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-psk-ipv4/test.conf b/testing/tests/ikev2/rw-psk-ipv4/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-ipv4/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-no-idr/description.txt b/testing/tests/ikev2/rw-psk-no-idr/description.txt
new file mode 100644
index 000000000..51286f123
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The authentication is based on distinct <b>pre-shared keys</b>
+and fully qualified domain names. By setting the wildcard <b>rightid=@*.strongswan.org</b>
+on <b>carol</b> and <b>dave</b>, no <b>IDr</b> payloads are sent by the roadwarriors.
+In order to test the tunnel,
+both <b>carol</b> and <b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat
new file mode 100644
index 000000000..06a0f8cda
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..b23046668
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@*.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..47e31ca21
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..66734b543
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@*.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..f6c1a22ef
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..a6270a67e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,21 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..e6c7420c9
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,5 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-no-idr/posttest.dat b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-psk-no-idr/pretest.dat b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat
new file mode 100644
index 000000000..282b2aec0
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/pretest.dat
@@ -0,0 +1,12 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::rm /etc/ipsec.d/cacerts/*
+carol::rm /etc/ipsec.d/cacerts/*
+dave::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-psk-no-idr/test.conf b/testing/tests/ikev2/rw-psk-no-idr/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-no-idr/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt
new file mode 100644
index 000000000..f190cae4b
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/description.txt
@@ -0,0 +1,6 @@
+The roadwarriors <b>carol</b> and <b>dave</b> each set up a connection to gateway <b>moon</b>.
+<b>carol</b>'s authentication is based on a Pre-Shared Key (<b>PSK</b>) whereas <b>dave</b>'s
+is based on an RSA signature (<b>RSASIG</b>). Gateway <b>moon</b> supports both authentication modes
+and selects the correct roadwarrior connection definition based on the gateway ID
+requested by the roadwarrior.
+
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat
new file mode 100644
index 000000000..f7f9dc51d
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/evaltest.dat
@@ -0,0 +1,15 @@
+moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES
+moon::cat /var/log/daemon.log::authentication of 'PH_IP_MOON' (myself) with pre-shared key::YES
+moon::ipsec statusall::rw-psk.*INSTALLED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with RSA signature successful::YES
+moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES
+moon::ipsec statusall::rw-rsasig.*INSTALLED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..10eeee9c1
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightsubnet=10.1.0.0/16
+	rightsendcert=never
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..47e31ca21
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..ac99ac66c
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+        crlcheckinterval=180
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	keyexchange=ikev2
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..7419be98a
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+        left=PH_IP_MOON
+	leftnexthop=%direct
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+        right=%any
+
+conn rw-rsasig
+	authby=rsasig
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	auto=add
+
+conn rw-psk
+	authby=secret
+	leftid=PH_IP_MOON
+	auto=add
+
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..508d3a941
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,7 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA moonKey.pem
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat
new file mode 100644
index 000000000..e48d11e42
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/pretest.dat
@@ -0,0 +1,10 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+carol::rm /etc/ipsec.d/cacerts/*
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-mixed/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/description.txt b/testing/tests/ikev2/rw-psk-rsa-split/description.txt
new file mode 100644
index 000000000..b601deea8
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/description.txt
@@ -0,0 +1,8 @@
+The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
+to gateway <b>moon</b>. The roadwarriors' authentication is based on
+<ib>Pre-Shared Keys</b> (PSK) whereas the gateway uses an <b>RSA signature</b>
+(RSASIG) certified by an X.509 certificate.
+Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
+automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
+In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
+the client <b>alice</b> behind the gateway <b>moon</b>.
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat
new file mode 100644
index 000000000..c0fd8b16b
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/evaltest.dat
@@ -0,0 +1,12 @@
+moon::cat /var/log/daemon.log::authentication of 'carol@strongswan.org' with pre-shared key successful::YES
+moon::cat /var/log/daemon.log::authentication of 'dave@strongswan.org' with pre-shared key successful::YES
+moon::cat /var/log/daemon.log::authentication of '@moon.strongswan.org' (myself) with RSA signature::YES
+moon::ipsec statusall::rw.*INSTALLED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..6a8253dc4
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..47e31ca21
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..3c9e9a009
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	authby=secret
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..f6c1a22ef
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..b62ab4156
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,22 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	rightsendcert=never
+	auto=add
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..508d3a941
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,7 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA moonKey.pem
+
+carol@strongswan.org : PSK 0sFpZAZqEN6Ti9sqt4ZP5EWcqx
+
+dave@strongswan.org  : PSK 0sjVzONCF02ncsgiSlmIXeqhGN
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat
new file mode 100644
index 000000000..7cebd7f25
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/posttest.dat
@@ -0,0 +1,6 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat
new file mode 100644
index 000000000..42e9d7c24
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/pretest.dat
@@ -0,0 +1,9 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
diff --git a/testing/tests/ikev2/rw-psk-rsa-split/test.conf b/testing/tests/ikev2/rw-psk-rsa-split/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/rw-psk-rsa-split/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/strong-keys-certs/description.txt b/testing/tests/ikev2/strong-keys-certs/description.txt
new file mode 100644
index 000000000..9d0ca5528
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/description.txt
@@ -0,0 +1,7 @@
+This scenario is derived from <a href="../rw-cert"><b>ikev2/rw-cert</b></a>.
+The gateway <b>moon</b> uses a 2048 bit RSA private key protected by <b>AES-128</b>
+encryption whereas the roadwarriors <b>carol</b> and <b>dave</b> have an
+<b>AES-192</b> and <b>AES-256</b> envelope, respectively. 
+The X.509 certificate of the gateway <b>moon</b> uses a <b>SHA-256</b> hash in
+its signature whereas the certificates of the roadwarriors <b>carol</b>
+and <b>dave</b> use <b>SHA-384</b> and <b>SHA-512</b>, respectively.
diff --git a/testing/tests/ikev2/strong-keys-certs/evaltest.dat b/testing/tests/ikev2/strong-keys-certs/evaltest.dat
new file mode 100644
index 000000000..06a0f8cda
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/evaltest.dat
@@ -0,0 +1,10 @@
+moon::ipsec statusall::rw.*ESTABLISHED::YES
+carol::ipsec statusall::home.*ESTABLISHED::YES
+dave::ipsec statusall::home.*ESTABLISHED::YES
+carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+dave::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
+moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
+moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
+moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
+
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..4ddd99280
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert-sha384.pem
+	leftid=carol@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem
new file mode 100644
index 000000000..d4b532323
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/certs/carolCert-sha384.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEITCCAwmgAwIBAgIBETANBgkqhkiG9w0BAQwFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA2MTAwODEyMTI1MFoXDTExMTAwNzEyMTI1MFowWTELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0z
+ODQxHTAbBgNVBAMUFGNhcm9sQHN0cm9uZ3N3YW4ub3JnMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAtCwjB6Yni4jSTbPJ4GX0kM06nr2tDBdU0PH6dZra
+IXNaNiBthBNPNDeCYAQDG/ouwuywAJ6L2Lt0GYEhJSwfXMm87fYSG8qRP+C/nlKz
+3fCfsuZ8yOAo5NAp2kgvbFVdB5cMeOtid21UqUvDxkncjFRDgpERtrjSthalUFYu
+ObIcSMPdlcDho73jzq6zVK5XDJ4l1LHUQLbS4SzyrphCYKekTIoDy3YwRUys6Pdm
+4QlFBIXuBwOYHjclvVu0HQVNSM4nWAJd+204KUm/+8neO0kn1Yakv9yoa47o3KGP
+3XjtmcgY9SqBbuF+8yDcZQ7+5zUBjc0J+d8txdPoIjLi7wIDAQABo4IBBjCCAQIw
+CQYDVR0TBAIwADALBgNVHQ8EBAMCA6gwHQYDVR0OBBYEFIUlEfDm3V0eDmRrpIvj
+4FiPpGlpMG0GA1UdIwRmMGSAFF2n3XAGUTJ+57Zts7Xl4GDqLk3voUmkRzBFMQsw
+CQYDVQQGEwJDSDEZMBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMS
+c3Ryb25nU3dhbiBSb290IENBggEAMB8GA1UdEQQYMBaBFGNhcm9sQHN0cm9uZ3N3
+YW4ub3JnMDkGA1UdHwQyMDAwLqAsoCqGKGh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5v
+cmcvc3Ryb25nc3dhbi5jcmwwDQYJKoZIhvcNAQEMBQADggEBAL5ZmFmy8lW4Vdwq
+hWB6qTtLLa1wwCvTXwbV9V+F8dK39AvHj6CHFqTiFhAbGIq/Ryt9cg2XGy1TDjVj
+hQEua7mjp8XH2j2NLY2SiFTMjchbHmMylFk2FrHy2ZnmlRCiH83TAw+EnUWsQKj+
+gL+7Of9SpiaaIblrl+aCiBVktRuXcFSaxjYWTVXOeTCwnxQdF2SNtUKDoCuVPk1J
+XCrs86mj575xL/FGjyN4SVbjTEZ4lm1emxrf/RblZOhCKp7mUic8KyP0kf7o6X8E
+MXXjq9fDQVrSDG/q62uhZu7CyInnBpWnoUKiMImSxRn/cs0r7RUspC5DtJyhE33Y
+DW2BzIc=
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem
new file mode 100644
index 000000000..979740525
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.d/private/carolKey-aes192.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-192-CBC,3127472197F76F3E81FF26DCD894FE6F
+
+ixCdabns1DD2EVjOUQYbxes+mSU6WmfUnRPBthTw1K3X7/jYEVRrApZlPoRxfitg
+7aHdqsV70elT48ucP4z410jupq80OI5/3I31zHiqDpmUNXr0ZGs69dC2g01op98Q
+IWfbHygALh0PDjhczHWhDBOx+gJDN58qgMfCI2hUDqpcYD9gvEpkkdM/R3Ggwgiq
+f+HBD4rQHcpvuKCPIOBVAR/4cXE3D8pcls3FJALwNGf03yIm24hEG2mTz5cDIVTw
+m0Bjk5Hbiym4LBreUoVQUF04wDXsuDtz7m1IPkw4GsYpeiomqRyAs7bKUJhbKwaK
+/l2MKoQ06Ofx0kc20CG7/qoboiqUgDEOsNd/qdMVOXcqinONW2v2T8+mEi/iLZDJ
+B6WXoV15PBkHXfaKeA66oFfF8EqggF4gLoPwekz1jvz5hbeTNYCiuFsMV9ntTxoE
+opohFNBvY2ZbJUmmkecgSJcmmByR2cahukh91PjssfZUjMOJjoTpuB3OXF9J6g9U
+RKWYxgcyT1n0e0MbYxe4TXHxxUDa5UBkquELQ2gcmJDO5GFuXF40mcvcz3Bse6I7
+GTRvhSL3hmRvbODE3JVI2dISHJ60Fethjxo5JNmCuBqnSkc2KPvsS7ulqANMnnNE
+5u2g9RMAtYKfkwscLY8zByouCZTS2pAI+LQd/eTm3/TAZWDJx/Z2UA5peFm2At4n
+aerRYP20TeaAI4tcnqsrOpBj0ouphgkGUTGAbBhjR3c2rSoOHxmjQXJOAc59vjgG
+zBl2F9M1xtjuTFZxFLMbnx15W1l5rmhZmSTdDY8C5ePBcjn6umxl6QdwvPjbkMIL
+MoeyM6w1Eqweg+m25CFOCWrFnglZNM6lcsR3X88oz+gzmHOs/VtAQn7vCA2Ukc5m
+RuLro/1juBjMrXd63Mqvxml/0lcSrXH1/ZiTdrdakU5rHNk9554tSL14rBSD86tQ
+u7unnobiXTmE0l/fDVuRYzW/Y8GGEr5S2t7SOuNFnU+tXTdavftJD0D7F8v4/bTf
+ObDe5qJ/7Y7X/8i6L+va1cm5rXNDI1qrBgwmNv7FbY1G0qBIP80ie7FbcsCpXauE
+T5HWTOdJX+xpTVCHXnBriMhlFHXAIKUVdAZqbzgRFWPCOYpzpztgny4l83qP0OLw
+vYxvU7RSGFAamRz05t3vHXy3X8n7JulleE8laBFpwx9Xq/bEAkwwmZq1Y6tbksae
+4G9aJ6Tdr4SA7BsH+FrtLtwFUkzgmKg+MqDGXamFSx0rvhksl3u67tMpGh0Il8KS
+xGfpPXRKaeQwZ18AA1xfPVl01Ajuxhnmmr/ng8WR+DfBpx7uK3lSpUX37Gh06DP5
+Of9oPHpc+Z0Asx/k6XWYGP9G15azUXP5ejebl19QQdZex/wP0MkKNlZ/BH0xJO+a
+FLOkg4OhtTppIA0dOhj/v/WCLC+pdl+78pBOQO7dpuJeYrcVvhiQKMhEJdYiYLXY
+ZcbN+E0Ta8I9fX1D6qgIEhL0NOczEYT9kYYQZJf2LW9k+dxICPV/0hEjaRNyMrei
+C9ZP1k9cEhNMSVRVV2jm2PhOW3nvOFUNkG8OIfFhCri8dXWaGVS/DMb18rpSoB+B
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets
new file mode 100644
index 000000000..4c9a601ca
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/carol/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA carolKey-aes192.pem "ITP/H4lSHqGpUGmCpgNDklbzTNV+swjA"
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..2b5407387
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,24 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn home
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert-sha512.pem
+	leftid=dave@strongswan.org
+	leftfirewall=yes
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+	rightsubnet=10.1.0.0/16
+	auto=add
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem
new file mode 100644
index 000000000..73088cd1d
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/certs/daveCert-sha512.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBEjANBgkqhkiG9w0BAQ0FADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA2MTAwODEyMjExMloXDTExMTAwNzEyMjExMlowWDELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS01
+MTIxHDAaBgNVBAMUE2RhdmVAc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDL4+PsltDM0QCCS08tkefhll5Q0nb2VEdRZotBIdt6
+XEY1kmDlw0yQOp0XUznnIhcrxXpKeWpLqJdbo56jSxMaUB3Mod1u+aKvVhCgkOT8
+uQa7gIdcNMuXnfnch7yYYS6YxVfzdr/qXBxmVYNbR9sXy48vAD6glZLEVjDITHJO
+a6tEVSrAOMyeuA9XTYJiGw5loj63YbUr6Ikp6W9SncPCtfX6G2Amk38MTuITu93W
+Pd/bGB06ra6gmMQGAhXuGs14n3QZfQz9PWTp9TPsQNqQZdEjQyNdfeAKtPuz5jnO
+cnZuhvVR0q4sxWuy64vkyZ57luTZAXyxdInBeBOp7sC3AgMBAAGjggEFMIIBATAJ
+BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0wvMMeoe59mocM/RiYnD
+iw9NUm0wbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ
+BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz
+dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYETZGF2ZUBzdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBDQUAA4IBAQC/uKe2O9elbSFgpKP5
+7ZjJrCkYu493iH/PDm5G4D76q6WkRvZDqTgGDSIrXrt1xRLIsVJES+HERxfED0DB
+yXNe22p1jR8iZdCesZxmEsKYyLh9XmeixKCfnLvStWCVs0+vqwhJlIkyEAveZ4HR
+Yq121khdmCDDUugpjEl/nU7CLvCRVgFrlhDm1QLs2rYqxwQrJ2SH4/1W0YRdkY2R
+vKZ2ngjLBNjBfXWNXSOpEAG367nVam5lFAepUC0wZTshyCUXt1NzClTnxWABm6M6
+x2Qwg4D6Qt5iXSjR8+DGVh+LaBL/alQi1YYcjkxufdFHnko294c0HsZcTZ3KRghk
+ue1F
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem
new file mode 100644
index 000000000..e2a1ccb26
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.d/private/daveKey-aes256.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,088DA49D259D5876324277FE7C38F22B
+
+fChe2r3NjWQnfK3tFIUHtrnYsU+CzbGKmWE1T8ARaLeVC7XtPN99odBYTBOzJj98
+REHk41NWHlVjcY+2ACedniTsQcvuuN3bMHGvyikQeLmg7tc54pQrc85BHfdGrU49
+5Bzhxn29kqY33Dt2aeAMyP3k/b5HyZlCGuQUJx71uPsaEl1so5QE0aIBLaCutIUz
+zZcAAa6ahFhw2oOcU2kj8ACGzXrJvBhVU97/yZTdfqrTJauoPXL/WQ+ScfMBhQ0x
+vaJbaVy8On1SXTMH2K1ehszjpeFTeRVgndkWuUipwm/xlyzoubs8L4BhJZNzV23r
+04ZGYxwSQ0rZBEt+TqopVpc/iMx/vg33P8PHrI45DeoztvjHpD6Fgj5Yh2kGgU5R
+cKD1ejgX3FMwTSI5xumUi8mQ+N2pUIK9polS146dpQRoM8F9hsXkYoK/l9Em5jJA
+V4vBBbVr6E9G0fVyHboqIzAHgFiC3xnCvVC/Cnyit4zD7D0E86pktR0y4Imtxten
+3WUV4rNAVkLR0D5Hoslk9nsqEaOxDBzUVU/zfG8GXItpWQgug5sb6RjcrK0b4Fit
+iHsEO5qLZ09cM+1hoddgibUQd0G+iZDPfPc++SCdZVjcvdSOOtcUCJwQGjOdGi9U
+I30gjh1Vtql67CnykRmk38duTFFNpL3zLNGfiA+kUeHDr0C4zeD2NsK4v/4nLAO1
+OWSYYFGrhbU5C96q3rgczdh+TurgIhM+ktBUJ/7yYV2eTRlRT35Wk03O7STBLinV
+jaXuDBOKb/NAYgA+xtOeBqd1c4cSdOxJEv80G9hhXxxNgf1W1OHDNY6+qXhnLZJU
+o1kbF6QNI+R+ip8643GwdLEcz5s49V7x53TDcCGnW2TwzVVHvj+63u5RPcfu8b9e
+gz0ey++z6OWvEIt/7NiTzA0dZdmiNLY24uHDHvQ5XmMs4XVM1r5wSFXvs/tDuUpK
+/a9zMbr12RDsObVcXXr07FD5Zyh/y2mBEB7xRFXKk5tt++Hvlzbgqxypgq9t5+m8
+PBddV4GarMuZw8bRjMHJ2CVY1VyRGIx+StsHehVMWdfzZTm/Uizq/yPaxqbQE8wY
+Vcm6wgYRekAga6I9XsHZ0TBfKtfZqXf0kXX0A+ymQYbfyUm2MqWV5avOKtBRIqcW
+B9jCKxah7rjQNlI7vzwZ/whePHU2sL4D23aGGZa373Ql2CmB3AetxYtkRGTSILw9
+aT+ZNgh+BGq6lcdlyks29fFuWRlE+NyJIAwmIVEisZGFijFe5WXBhKWsvEt2JT1v
+3qW9lMimOgpkClroPSdb9gQMt1yXDR6z1ty+B41kgy5qSxUiL8z8EUCWPEBPrz5+
++3KGi1cU5BsfptnkFYCSnVSyRxARh310mruQ2Mb6ipIXX95ejQPSskz5P4u26Olt
+UHyS0lgDc8hZTwJUchE5wqj4bAJs12mKbIbapjYv83OAEW8ybGz8R6QVMp3pAad3
+O2WGef6evGrbGKHI6ACMEHaz8fP8GIMjhbJkPxsXYGRsHbUsqYcSmew3EYW51qSA
+xMhrzZ6e9ow4PYDuNnUc4bFeV0BIVl6kH7KscT1LBtJVJkXDDoddxFiEhcRjOLDr
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets
new file mode 100644
index 000000000..b4b1c6249
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/dave/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA daveKey-aes256.pem "MeFnDN7VUbj+qU/bkgRIFvbCketIk2wrrs5Ii8297N2v"
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..9c0a14c9b
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,23 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn rw
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert-sha256.pem
+	leftid=@moon.strongswan.org
+	leftsubnet=10.1.0.0/16
+	leftfirewall=yes
+	right=%any
+	auto=add
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem
new file mode 100644
index 000000000..307f4953e
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/certs/moonCert-sha256.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEHzCCAwegAwIBAgIBEDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJDSDEZ
+MBcGA1UEChMQTGludXggc3Ryb25nU3dhbjEbMBkGA1UEAxMSc3Ryb25nU3dhbiBS
+b290IENBMB4XDTA2MTAwODEwNTgxMVoXDTExMTAwNzEwNTgxMVowWDELMAkGA1UE
+BhMCQ0gxGTAXBgNVBAoTEExpbnV4IHN0cm9uZ1N3YW4xEDAOBgNVBAsTB1NIQS0y
+NTYxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5vcmcwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDzXHm8D8sY1lmX7o1KK0jt/M+UzAI2Ifpx7nAqoviH
+XQIPe56BOAm4zHhEIlojEMFd1nncplXvDDGjuV/2F0KK1bFxbNtom88Ix1jrRWtk
+FLopYwj3ERC2970OhNO3nuPLrnEAzj6k3XPGMTA3drGnpRf162f7mHAdmYIRXtWm
+mfaecs4wGFs8BFGdeDfo6SPhQXZSBwZqjzQxvk1PA7E1qifgR5IGNZkNQRQ9IZD0
+86xzjmZgg5DaJcQKw45elpiVKQN6OkdWTngR3uUBfseWNeRGP5UxCUbDnPijWUbA
+6ZAdEfFXLgSpSoXHLNttvGg+SWm0kgKTpHYWYhvpflKNAgMBAAGjggEFMIIBATAJ
+BgNVHRMEAjAAMAsGA1UdDwQEAwIDqDAdBgNVHQ4EFgQU0gL3aEo/H8c/Ld/GkBTb
+W9Ma+nUwbQYDVR0jBGYwZIAUXafdcAZRMn7ntm2zteXgYOouTe+hSaRHMEUxCzAJ
+BgNVBAYTAkNIMRkwFwYDVQQKExBMaW51eCBzdHJvbmdTd2FuMRswGQYDVQQDExJz
+dHJvbmdTd2FuIFJvb3QgQ0GCAQAwHgYDVR0RBBcwFYITbW9vbi5zdHJvbmdzd2Fu
+Lm9yZzA5BgNVHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLnN0cm9uZ3N3YW4ub3Jn
+L3N0cm9uZ3N3YW4uY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCItzRn3TNWUzczBd8z
+MtdPEsRl5Oi4fV3UecQxhjxAmJDLsEZT5I4uNa1XoLkJm6jVdSL7k+bjzjmpNJ1H
+uL49cqia2yTdGP4IU0K8dTGaflg3ccaLLGGXTWU/NtgdI1o6yuZTwb6a9ZL7wWZT
+x21BAsvyPTzCpUS1yCK4bFeYOxOYDphUGcwb0JTuRxx2/710b+p64BYiCfVkQJxT
+eF1ZtjSW6nJgzMRg5n2zNpdrdXMMCPI6Nl7V6wxbs3Cphmz5qx3lijwi7nZt+jE5
+qK5gphph1MkKIhnA7MF66KEcx5Rknao68yLBBDIA/AISZ3bCIj8R1SGgl/tMYfep
+sbRF
+-----END CERTIFICATE-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem
new file mode 100644
index 000000000..bc9ed38c8
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.d/private/moonKey-aes128.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,381AA672F615E55CD044FB981754FDA6
+
+whvkSUJ2sAIH4EOu8vT9LHcKKKG6W9hl/hO++/awU2AVtHn6mYlkkAqDRJiOZbbT
+vo0ndy+0B0tCoTyKZbiMRNc6bzHPNgS17cVa2wXrzzMo64xRcElzdN14L8UGA7Cc
+Wu3aD0zmzawU9uRZjaQ4qA46FPz/S9/REImZ02QSALIzZJSIIDoUbznBitaHYFve
+eLl7e/0vMS/s03FaRNKrVhids3Z3q7lQoF/z5BzBaKNBaDYDLhMeScjNF6QZnDUe
+k+++/l54pozl+RvQI6RljPhOzutIC5D627zfordITsBRYEhv6KPShy673H4McaRz
+tx2zkflsDyPWDWmRLxA0GfD5jQvbS7aZU1R3iyi/TDXacHXlR92bzVu4AHZClOSn
+fypT1h2YnUQOMMw9XlVKklHCWvgpWbVmjiBbnsIh1WjORLgSielrGP/iXVemgzEI
+kaTErf7B7sx1pIMyQ8IFdniFryUSuGDvOV4Dt/PZhxh2oKIBIaVYwrl3jQvYlyNv
+vpBD6MU2wXU4iP7kt9SN63RjzQoYk7TA7f9JlfXlBrjjwSjPYB1R+MoEfovvEr4j
+PHghYnwtwZ4Ok3kR+zxR/M37iJ252IDkOwTuqEXWQMlOlxIeESlh1OYKVLptZwgB
+0mFzzx4JapkHP34c4ntsFc3AbUh8uSt67zLJ7JDFhSQ6ltNu1/92nOjXh5tzwGvo
+ak5lrUpi2zrgyxSgF7fxOxjXr604f7yxOcoWfXQd354dUXdxrMZigh3ajwsGwXxh
+o5Zv+EVXaIpnHnUYmupJwrKQR1ffdVCPlvys99/BlGnvsBzLx+hmut1pjnFwQCPf
+aj8Z3NhSdWspQiUzWm+DXpqPKt+4CL5mdxcjyye9ATOPf+30iuY25WvwelT4rgGt
+NS0iVMJSHnPVMlcibCwVtCl8hvjzq2TYHGo6cCKDaYJ4+Hy6MjgNrHA011HkJ9iC
+P4Ysyq04/OiFPrl0RS+om29By+4/O+w1t0HpuZIFTm6oRg7zWcXtDWkfrhu9WY7e
+m7FI8O2f3ezPoMbiRJmdEi0RFsgyqkTdQLOUUF1ad5ZHEAVghsgvaPG5aRLhXQin
+gqNvHlDmpekOTDLbEn9cyDf5po45LrUgGOBp6DK+AGb6SymjonNxczlG/eNYHtch
+AXBdz5A/n6uP1DXfmGVyI6kZKU+Fotsly5Iov6SLcEicLcfA2oKHK6AIJL+IWGGL
+kkShWx0Dv/2UbEkKDjFl36Z0oD5wSW6fyYeslD4IFCjXwkdgWd7l4nreisW9YTl/
+PdnVOBq6yQxfK0WlAxfGzAabmknIXkSE/BlTb5y8q92U3tR3YFLFQ1hPaSPIokIu
+Op51DMXOfrbnd1iBrybduktdljoxlcAGmg5Dfz+s9fdkESQfw6oNOP5cHxfctAy9
+k21dKvkI/PqWkgwVv94wX8bWx0LgC0aV3F62qM+Y7/r5N4ZsD76GY7VFIFeSoPKx
+Fn9yZOl8JzszvlWNtG7G6DwBL+ZyHS0rM7UEyTwWp8mLasEO96V6dYxD8LqWNbo4
+hY/6xsZOtNDsPdW/Os7MBD+Wf2fL/gzrD7QJyqcy41K8Oxhn2W+Aso3s9DnJ4eSt
+-----END RSA PRIVATE KEY-----
diff --git a/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets
new file mode 100644
index 000000000..9d298e183
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/hosts/moon/etc/ipsec.secrets
@@ -0,0 +1,3 @@
+# /etc/ipsec.secrets - strongSwan IPsec secrets file
+
+: RSA moonKey-aes128.pem "gOQHdrSWeFuiZtYPetWuyzHW"
diff --git a/testing/tests/ikev2/strong-keys-certs/posttest.dat b/testing/tests/ikev2/strong-keys-certs/posttest.dat
new file mode 100644
index 000000000..9ccbaa1c2
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/posttest.dat
@@ -0,0 +1,13 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
+moon::/etc/init.d/iptables stop 2> /dev/null
+carol::/etc/init.d/iptables stop 2> /dev/null
+dave::/etc/init.d/iptables stop 2> /dev/null
+moon::rm /etc/ipsec.d/private/*
+carol::rm /etc/ipsec.d/private/*
+dave::rm /etc/ipsec.d/private/*
+moon::rm /etc/ipsec.d/certs/*
+carol::rm /etc/ipsec.d/certs/*
+dave::rm /etc/ipsec.d/certs/*
+
diff --git a/testing/tests/ikev2/strong-keys-certs/pretest.dat b/testing/tests/ikev2/strong-keys-certs/pretest.dat
new file mode 100644
index 000000000..de51ccdfa
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/pretest.dat
@@ -0,0 +1,10 @@
+moon::/etc/init.d/iptables start 2> /dev/null
+carol::/etc/init.d/iptables start 2> /dev/null
+dave::/etc/init.d/iptables start 2> /dev/null
+moon::ipsec start
+carol::ipsec start
+dave::ipsec start
+carol::sleep 1
+carol::ipsec up home
+dave::ipsec up home
+carol::sleep 1 
diff --git a/testing/tests/ikev2/strong-keys-certs/test.conf b/testing/tests/ikev2/strong-keys-certs/test.conf
new file mode 100644
index 000000000..70416826e
--- /dev/null
+++ b/testing/tests/ikev2/strong-keys-certs/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="moon"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ikev2/wildcards/description.txt b/testing/tests/ikev2/wildcards/description.txt
new file mode 100644
index 000000000..e485f7066
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/description.txt
@@ -0,0 +1,8 @@
+The VPN gateway <b>moon</b> controls the access to the hosts <b>alice</b> and
+<b>venus</b> by means of wildcard parameters that must match the subject
+<b>Distinguished Name</b> contained in the peer's X.509 certificate. Access to
+<b>alice</b> is granted for DNs containing a OU=Research field whereas <b>venus</b>
+can only be reached with a DN containing OU=Accounting. The roadwarriors
+<b>carol</b> and <b>dave</b> belong to the departments 'Research' and 'Accounting',
+respectively. Therefore <b>carol</b> can access <b>alice</b> and <b>dave</b>
+can reach <b>venus</b>.
diff --git a/testing/tests/ikev2/wildcards/evaltest.dat b/testing/tests/ikev2/wildcards/evaltest.dat
new file mode 100644
index 000000000..2bc83eacd
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/evaltest.dat
@@ -0,0 +1,8 @@
+carol::ipsec status::alice.*PH_IP_CAROL.*PH_IP_ALICE::YES
+moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_CAROL::YES
+carol::ipsec status::venus.*PH_IP_CAROL.*PH_IP_VENUS::NO
+moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_CAROL::NO
+dave::ipsec status::venus.*PH_IP_DAVE.*PH_IP_VENUS::YES
+moon::ipsec status::venus.*PH_IP_VENUS.*PH_IP_DAVE::YES
+dave::ipsec status::alice.*PH_IP_DAVE.*PH_IP_ALICE::NO
+moon::ipsec status::alice.*PH_IP_ALICE.*PH_IP_DAVE::NO
diff --git a/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf
new file mode 100755
index 000000000..59d41eb27
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/hosts/carol/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_CAROL
+	leftnexthop=%direct
+	leftcert=carolCert.pem
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+
+conn alice
+	rightsubnet=PH_IP_ALICE/32
+	auto=add
+	
+conn venus
+	rightsubnet=PH_IP_VENUS/32
+	auto=add
diff --git a/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf
new file mode 100755
index 000000000..81e86e823
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/hosts/dave/etc/ipsec.conf
@@ -0,0 +1,26 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_DAVE
+	leftnexthop=%direct
+	leftcert=daveCert.pem
+	right=PH_IP_MOON
+	rightid=@moon.strongswan.org
+
+conn alice
+	rightsubnet=PH_IP_ALICE/32
+	auto=add
+	
+conn venus
+	rightsubnet=PH_IP_VENUS/32
+	auto=add
diff --git a/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..366e1fa9a
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+        crlcheckinterval=180
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+	left=PH_IP_MOON
+	leftnexthop=%direct
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+
+conn alice
+	leftsubnet=PH_IP_ALICE/32
+	right=%any
+	rightid="C=CH, O=Linux strongSwan, OU=Research, CN=*"
+	auto=add
+	
+conn venus
+	leftsubnet=PH_IP_VENUS/32
+	right=%any
+	rightid="C=CH, O=Linux strongSwan, OU=Accounting, CN=*"
+	auto=add
+	
diff --git a/testing/tests/ikev2/wildcards/posttest.dat b/testing/tests/ikev2/wildcards/posttest.dat
new file mode 100644
index 000000000..ed530f6d9
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/posttest.dat
@@ -0,0 +1,3 @@
+moon::ipsec stop
+carol::ipsec stop
+dave::ipsec stop
diff --git a/testing/tests/ikev2/wildcards/pretest.dat b/testing/tests/ikev2/wildcards/pretest.dat
new file mode 100644
index 000000000..e3da87520
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/pretest.dat
@@ -0,0 +1,9 @@
+moon::echo 1 > /proc/sys/net/ipv4/ip_forward
+carol::ipsec start
+dave::ipsec start
+moon::ipsec start
+carol::sleep 1 
+carol::ipsec up alice
+carol::ipsec up venus
+dave::ipsec up venus
+dave::ipsec up alice
diff --git a/testing/tests/ikev2/wildcards/test.conf b/testing/tests/ikev2/wildcards/test.conf
new file mode 100644
index 000000000..08e5cc145
--- /dev/null
+++ b/testing/tests/ikev2/wildcards/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="alice venus moon carol winnetou dave"
+
+# Corresponding block diagram
+#
+DIAGRAM="a-v-m-c-w-d.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS=""
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon carol dave"
diff --git a/testing/tests/ipv6/host2host-ikev1/description.txt b/testing/tests/ipv6/host2host-ikev1/description.txt
new file mode 100644
index 000000000..c59b32acb
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/description.txt
@@ -0,0 +1,3 @@
+An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
+The authentication is based on X.509 certificates. In order to test the host-to-host tunnel
+<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command.
diff --git a/testing/tests/ipv6/host2host-ikev1/evaltest.dat b/testing/tests/ipv6/host2host-ikev1/evaltest.dat
new file mode 100644
index 000000000..62fc85953
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec status::host-host.*STATE_QUICK_I2.*IPsec SA established::YES
+sun::ipsec status::host-host.*STATE_QUICK_R2.*IPsec SA established::YES
+moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..9499140c5
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,30 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	plutodebug=control
+	crlcheckinterval=180
+	strictcrlpolicy=no
+	charonstart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+
+conn net-net
+	also=host-host
+	leftsubnet=fec1::0/16
+	rightsubnet=fec2::0/16
+
+conn host-host
+	left=PH_IP6_MOON
+	leftnexthop=0::0
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP6_SUN
+	rightnexthop=0::0
+	rightid=@sun.strongswan.org
+	auto=add
+
diff --git a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf
index 58e2f1e5b..c64904a6e 100755
--- a/testing/tests/req-pkcs10/hosts/carol/etc/ipsec.conf
+++ b/testing/tests/ipv6/host2host-ikev1/hosts/sun/etc/ipsec.conf
@@ -1,11 +1,10 @@
 # /etc/ipsec.conf - strongSwan IPsec configuration file
 
-version	2.0	# conforms to second version of ipsec.conf specification
-
 config setup
 	plutodebug=control
 	crlcheckinterval=180
 	strictcrlpolicy=no
+	charonstart=no
 
 conn %default
 	ikelifetime=60m
@@ -13,17 +12,18 @@ conn %default
 	rekeymargin=3m
 	keyingtries=1
 
-conn home
-	left=PH_IP_CAROL
-	leftnexthop=%direct
-	leftcert=myCert.pem
-	leftid=carol@strongswan.org
+conn net-net
+	also=host-host
+	leftsubnet=fec2::0/16
+	rightsubnet=fec1::0/16
+
+conn host-host
+	left=PH_IP6_SUN
+	leftnexthop=0::0
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
 	leftfirewall=yes
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
+	right=PH_IP6_MOON
+	rightnexthop=0::0
 	rightid=@moon.strongswan.org
 	auto=add
-
-
-
-
diff --git a/testing/tests/ipv6/host2host-ikev1/posttest.dat b/testing/tests/ipv6/host2host-ikev1/posttest.dat
new file mode 100644
index 000000000..dff181797
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+sun::ipsec stop
diff --git a/testing/tests/ipv6/host2host-ikev1/pretest.dat b/testing/tests/ipv6/host2host-ikev1/pretest.dat
new file mode 100644
index 000000000..4707af077
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+sun::ipsec start
+moon::sleep 2 
+moon::ipsec up host-host
diff --git a/testing/tests/ipv6/host2host-ikev1/test.conf b/testing/tests/ipv6/host2host-ikev1/test.conf
new file mode 100644
index 000000000..cf2e704fd
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev1/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon winnetou sun"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/ipv6/host2host-ikev2/description.txt b/testing/tests/ipv6/host2host-ikev2/description.txt
new file mode 100644
index 000000000..c59b32acb
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/description.txt
@@ -0,0 +1,3 @@
+An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
+The authentication is based on X.509 certificates. In order to test the host-to-host tunnel
+<b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command.
diff --git a/testing/tests/ipv6/host2host-ikev2/evaltest.dat b/testing/tests/ipv6/host2host-ikev2/evaltest.dat
new file mode 100644
index 000000000..8b5ee4f6c
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/evaltest.dat
@@ -0,0 +1,5 @@
+moon::ipsec status::host-host.*ESTABLISHED::YES
+sun::ipsec status::ESTABLISHED::YES
+moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES
diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf
new file mode 100755
index 000000000..44c85068e
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/hosts/moon/etc/ipsec.conf
@@ -0,0 +1,29 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn net-net
+	also=host-host
+	leftsubnet=fec1::0/16
+	rightsubnet=fec2::0/16
+
+conn host-host
+	left=PH_IP6_MOON
+	leftnexthop=0::0
+	leftcert=moonCert.pem
+	leftid=@moon.strongswan.org
+	leftfirewall=yes
+	right=PH_IP6_SUN
+	rightnexthop=0::0
+	rightid=@sun.strongswan.org
+	auto=add
+
diff --git a/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf
new file mode 100755
index 000000000..8b3858b30
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/hosts/sun/etc/ipsec.conf
@@ -0,0 +1,28 @@
+# /etc/ipsec.conf - strongSwan IPsec configuration file
+
+config setup
+	strictcrlpolicy=no
+	plutostart=no
+
+conn %default
+	ikelifetime=60m
+	keylife=20m
+	rekeymargin=3m
+	keyingtries=1
+	keyexchange=ikev2
+
+conn net-net
+	also=host-host
+	leftsubnet=fec2::0/16
+	rightsubnet=fec1::0/16
+
+conn host-host
+	left=PH_IP6_SUN
+	leftnexthop=0::0
+	leftcert=sunCert.pem
+	leftid=@sun.strongswan.org
+	leftfirewall=yes
+	right=PH_IP6_MOON
+	rightnexthop=0::0
+	rightid=@moon.strongswan.org
+	auto=add
diff --git a/testing/tests/ipv6/host2host-ikev2/posttest.dat b/testing/tests/ipv6/host2host-ikev2/posttest.dat
new file mode 100644
index 000000000..dff181797
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/posttest.dat
@@ -0,0 +1,2 @@
+moon::ipsec stop
+sun::ipsec stop
diff --git a/testing/tests/ipv6/host2host-ikev2/pretest.dat b/testing/tests/ipv6/host2host-ikev2/pretest.dat
new file mode 100644
index 000000000..4707af077
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/pretest.dat
@@ -0,0 +1,4 @@
+moon::ipsec start
+sun::ipsec start
+moon::sleep 2 
+moon::ipsec up host-host
diff --git a/testing/tests/ipv6/host2host-ikev2/test.conf b/testing/tests/ipv6/host2host-ikev2/test.conf
new file mode 100644
index 000000000..cf2e704fd
--- /dev/null
+++ b/testing/tests/ipv6/host2host-ikev2/test.conf
@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# UML instances used for this test
+
+# All UML instances that are required for this test
+#
+UMLHOSTS="moon winnetou sun"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s.png"
+
+# UML instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# UML instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
diff --git a/testing/tests/mode-config-push/posttest.dat b/testing/tests/mode-config-push/posttest.dat
deleted file mode 100644
index 932b319a7..000000000
--- a/testing/tests/mode-config-push/posttest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0
-dave::ip addr del PH_IP1_DAVE/32 dev eth0
diff --git a/testing/tests/mode-config-swapped/posttest.dat b/testing/tests/mode-config-swapped/posttest.dat
deleted file mode 100644
index 932b319a7..000000000
--- a/testing/tests/mode-config-swapped/posttest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0
-dave::ip addr del PH_IP1_DAVE/32 dev eth0
diff --git a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf b/testing/tests/mode-config/hosts/dave/etc/ipsec.conf
deleted file mode 100755
index da601389c..000000000
--- a/testing/tests/mode-config/hosts/dave/etc/ipsec.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug=control
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-
-conn home
-	left=PH_IP_DAVE
-	leftsourceip=%modeconfig
-	leftnexthop=%direct
-	leftcert=daveCert.pem
-	leftid=dave@strongswan.org
-	leftfirewall=yes
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
-
-
-
-
diff --git a/testing/tests/mode-config/posttest.dat b/testing/tests/mode-config/posttest.dat
deleted file mode 100644
index 932b319a7..000000000
--- a/testing/tests/mode-config/posttest.dat
+++ /dev/null
@@ -1,11 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-dave::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-dave::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-dave::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0
-dave::ip addr del PH_IP1_DAVE/32 dev eth0
diff --git a/testing/tests/net2net-psk/posttest.dat b/testing/tests/net2net-psk/posttest.dat
deleted file mode 100644
index 52979508d..000000000
--- a/testing/tests/net2net-psk/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
-moon::ipsec stop
-sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-route/posttest.dat b/testing/tests/net2net-route/posttest.dat
deleted file mode 100644
index 52979508d..000000000
--- a/testing/tests/net2net-route/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
-moon::ipsec stop
-sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-rsa/posttest.dat b/testing/tests/net2net-rsa/posttest.dat
deleted file mode 100644
index 52979508d..000000000
--- a/testing/tests/net2net-rsa/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
-moon::ipsec stop
-sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/net2net-start/posttest.dat b/testing/tests/net2net-start/posttest.dat
deleted file mode 100644
index 52979508d..000000000
--- a/testing/tests/net2net-start/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-sun::iptables -v -n -L
-moon::ipsec stop
-sun::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-sun::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/protoport-route/posttest.dat b/testing/tests/protoport-route/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/protoport-route/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-cert/posttest.dat b/testing/tests/rw-cert/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/rw-cert/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-fqdn-named/posttest.dat b/testing/tests/rw-psk-fqdn-named/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/rw-psk-fqdn-named/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-fqdn/posttest.dat b/testing/tests/rw-psk-fqdn/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/rw-psk-fqdn/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/rw-psk-ipv4/posttest.dat b/testing/tests/rw-psk-ipv4/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/rw-psk-ipv4/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/starter-also/posttest.dat b/testing/tests/starter-also/posttest.dat
deleted file mode 100644
index 26848212b..000000000
--- a/testing/tests/starter-also/posttest.dat
+++ /dev/null
@@ -1,6 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
diff --git a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf b/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf
deleted file mode 100755
index 598997b45..000000000
--- a/testing/tests/starter-includes/hosts/carol/etc/ipsec.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug=control
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-
-conn home
-	left=PH_IP_CAROL
-	leftsourceip=%modeconfig
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	leftfirewall=yes
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
-
-
-
-
diff --git a/testing/tests/virtual-ip-swapped/posttest.dat b/testing/tests/virtual-ip-swapped/posttest.dat
deleted file mode 100644
index ac5c7dd82..000000000
--- a/testing/tests/virtual-ip-swapped/posttest.dat
+++ /dev/null
@@ -1,7 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0
diff --git a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf b/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf
deleted file mode 100755
index 2f1170a6b..000000000
--- a/testing/tests/virtual-ip/hosts/carol/etc/ipsec.conf
+++ /dev/null
@@ -1,30 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-version	2.0	# conforms to second version of ipsec.conf specification
-
-config setup
-	plutodebug=control
-	crlcheckinterval=180
-	strictcrlpolicy=no
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-
-conn home
-	left=PH_IP_CAROL
-	leftsourceip=PH_IP1_CAROL
-	leftnexthop=%direct
-	leftcert=carolCert.pem
-	leftid=carol@strongswan.org
-	leftfirewall=yes
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	rightid=@moon.strongswan.org
-	auto=add
-
-
-
-
diff --git a/testing/tests/virtual-ip/posttest.dat b/testing/tests/virtual-ip/posttest.dat
deleted file mode 100644
index ac5c7dd82..000000000
--- a/testing/tests/virtual-ip/posttest.dat
+++ /dev/null
@@ -1,7 +0,0 @@
-moon::iptables -v -n -L
-carol::iptables -v -n -L
-moon::ipsec stop
-carol::ipsec stop
-moon::/etc/init.d/iptables stop 2> /dev/null
-carol::/etc/init.d/iptables stop 2> /dev/null
-carol::ip addr del PH_IP1_CAROL/32 dev eth0