description.txt

ipsec vpn

This test sets up east to send a packet to sunset-oe (behind west).

It does so in the clear.  East is configured to do so in the clear, but
accept an oe connection if the peer tries.

West, when dealing with the return packet thinks that it is allowed to
do OE, so it attempts.

East is set up to accept OE, so it negotiates the connection, and the
*return* packet and all subsequent traffic gets encrypted.

Contrast this with clear-02, where the same scenario occurs, but east is
not configured to accept OE for this address, so it will refuse the
connection.