FIXME:

IPsec tunnel mode

        HOST-A --- Gateway-A =========== Gateway-B --- HOST-B
        (A)        (GA)                  (GB)          (B)

        IKE negotiation: GA <--> GB
        phase 2 ID payloads: <anything, anything>
                IDs should reflect GA and GB's authenticity.
        SA addresses: GA <--> GB
        outgoing packet: IP(GA->GB)
        phase 2 ID payloads: A, B

        Gateway-A's policy:
                spdadd A B any -P out ipsec esp/tunnel/GA-GB/require;
                spdadd B A any -P in ipsec esp/tunnel/GB-GA/require;

        Gateway-B's policy:
                spdadd B A any -P out ipsec esp/tunnel/GB-GA/require;
                spdadd A B any -P in ipsec esp/tunnel/GA-GB/require;

        both racoon.conf:
                no particular twists