FIXME:

IPsec transport mode

        HOST-A ================ HOST-B
        (A)                     (B)

        IKE negotiation: A <--> B
        phase 1 ID payloads: <anything, anything>
        SA addresses: A <--> B
        outgoing packet: IP(A->B)
        phase 2 ID payloads: none, or <A, B>

        HOST-A's policy:
                spdadd A B any -P out ipsec ah/transport//require;
                spdadd B A any -P in ipsec ah/transport//require;

        HOST-B's policy:
                spdadd B A any -P out ipsec ah/transport//require;
                spdadd A B any -P in ipsec ah/transport//require;

        both racoon.conf:
                no particular twists