conn private-or-clear
        # Prefer IPsec, allow cleartext 
        rightrsasigkey=%cert
	leftrsasigkey=%cert
        right=%opportunisticgroup
        rightca=%same
        left=%defaultroute
        leftcert=CENTOS-171
        leftid=%fromcert
	rightid=%fromcert
        narrowing=yes
        ikev2=insist
        auto=ondemand
	authby=rsasig