It intended for practical use only beyond the capabilities of 'ipsec auto' and 'ipsec manual'. For now, (981127) that includes extruded subnets.
Note: Be warned that once a route(8) is set via an ipsec? device, packets without an eroute(8) that are sent to that device will be dropped on the floor.
	hmask=255.255.255.255
	nmask0=0.0.0.0
	nmask16=255.255.0.0
	nmask24=255.255.255.0
	nmask28=255.255.255.240
	nmask29=255.255.255.248
	local_public_ip=207.236.55.216
	local_public_nexthop=207.236.55.1
	local_public_bcast=207.236.55.255
	local_public_nmask=$nmask24
	local_private_net=192.168.2.0
	local_private_nmask=$nmask24
	remote_public_ip=209.157.90.146
	remote_private_net=209.157.90.160
	remote_private_nmask=$nmask29
	ext_private_ip=209.157.90.198
	ext_private_net=209.157.90.192
	ext_private_bcast=209.157.90.199
	ext_private_nmask=$nmask29
	default_net=0.0.0.0
	default_bcast=255.255.255.255
	default_nmask=$nmask0
	ipsecdev=ipsec1
	aliasdev=eth0:1
	physdev=eth2
	enckey8=0x0123456789abcdef
	enckey24=0x0123456789abcdef0123456789abcdef0123456789abcdef
	authkey16=0x0123456789abcdef0123456789abcdef
	authkey20=0x0123456789abcdef0123456789abcdef01234567
    
    
	depmod -a	# only if klips is compiled as a module
	modprobe ipsec	# only if klips is compiled as a module
	ipsec tncfg --attach --virtual $ipsecdev --physical $physdev
	ifconfig $ipsecdev $local_public_ip \
		broadcast $local_public_bcast \
		netmask $local_public_nmask
    
    
	ipsec tncfg --detach --virtual $ipsecdev
	ifconfig $ipsecdev down
	rmmod ipsec	# only if klips is compiled as a module
    
    Warning: Each of the Setup scripts first deletes the route for the destinations it
    needs to protect, if it exists.  When the route gets deleted with the deletion
    of the protected connection, that route will no longer exist.  This route must be
    put back manually, or reboot the network configuration if it was installed automatically.
    Assumptions: Both machines have had networking set up and can pass packets.
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
	        gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    Assumptions: Any subnets have been set up and all machines can see the internet.
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun \
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
  
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun\
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $local_private_net/$local_private_nmask \
		--dst $remote_private_net/$remote_private_nmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $remote_private_net
	route add -net $remote_private_net netmask $remote_private_nmask \
		dev $ipsecdev gw $local_public_nexthop
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	route del $remote_private_net
	ipsec eroute --del --src $local_private_net/$local_private_nmask \
		--dst $remote_private_net/$remote_private_nmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto esp --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto tun --del
    
  Assumptions: All machines are set up to see each other and the internet.
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun \
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_private_net/$remote_private_nmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $remote_private_net
	route add -net $remote_private_net netmask $remote_private_nmask \
		dev $ipsecdev gw $local_public_nexthop
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_private_net
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_private_net/$remote_private_nmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun \
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $local_private_net/$local_private_nmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_private_net/$local_private_nmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
  Note: The ipfwadm command serves to knock a hole in the existing masquerading setup.
Assumptions: The masqueraded subnet has been set up and all machines can see the internet.
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun \
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $local_private_net/$local_private_nmask \
		--dst $remote_private_net/$remote_private_nmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $remote_private_net
	route add -net $remote_private_net netmask $remote_private_nmask \
		dev $ipsecdev gw $local_public_nexthop
	ipfwadm -F -i accept -S $local_private_net/$local_private_nmask \
		-D $remote_private_net/$remote_private_nmask
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	ipfwadm -F -d accept -S $local_private_net/$local_private_nmask \
		-D $remote_private_net/$remote_private_nmask
	route del $remote_private_net
	ipsec eroute --del --src $local_private_net/$local_private_nmask \
		--dst $remote_private_net/$remote_private_nmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
  Assumptions: A masqueraded subnet has been set up and all machines can see the internet. Each machine on the extruded subnet will need to route all packets to the remote subnet (in this case the entire internet) via the I/F (direct or aliased) that has been configured with an extruded valid internet address.
	# set up superimposed valid internet subnet with interface aliases
	ifconfig $aliasdev $ext_private_ip broadcast $ext_private_bcast \
		netmask $ext_private_nmask
	route add -net $ext_private_net netmask $ext_private_nmask \
		dev $aliasdev
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --ip4 \
		--src $local_public_ip --dst $remote_public_ip
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec spigrp $remote_public_ip 0x223 tun \
		$remote_public_ip 0x225 esp
	ipsec eroute --add --src $ext_private_net/$ext_private_nmask \
		--dst $default_net/$default_nmask \
		--edst $remote_public_ip --spi 0x223 --proto tun
	route del $default_net
	route add -net $default_net netmask $default_nmask \
		dev $ipsecdev gw $local_public_nexthop
	ipfwadm -F -i accept -S $ext_private_net/$ext_private_nmask \
		-D $default_net/$default_nmask
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	ipfwadm -F -d accept -S $ext_private_net/$ext_private_nmask \
		-D $default_net/$default_nmask
	route del $default_net
	ipsec eroute --del --src $ext_private_net/$ext_private_nmask \
		--dst $default_net/$default_nmask
	ipsec spi --edst $remote_public_ip --spi 0x223 --proto tun --del
	# return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
  Assumptions: Both machines have had networking set up and can pass packets.
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto ah \
		--ah hmac-md5-96 \
		--authkey $authkey16
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto ah
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto ah \
		--ah hmac-md5-96 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto ah --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto ah --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto ah \
		--ah hmac-sha1-96 \
		--authkey $authkey20
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto ah
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto ah \
		--ah hmac-sha1-96 \
		--authkey $authkey20
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto ah --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto ah --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp null-md5-96 \
		--authkey $authkey20
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp null-md5-96 \
		--authkey $authkey20
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-md5-96 \
		--enckey $enckey24 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des \
		--enckey $enckey24
	ipsec spi --edst $remote_public_ip --spi 0x226 --proto ah \
		--ah hmac-md5-96 \
		--authkey $authkey16
	ipsec spigrp $local_public_ip 0x225 esp\
		$local_public_ip 0x226 ah
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des \
		--enckey $enckey24
	ipsec spi --edst $local_public_ip --spi 0x236 --proto ah \
		--ah hmac-md5-96 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp des-md5-96 \
		--enckey $enckey8 \
		--authkey $authkey16
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp des-md5-96 \
		--enckey $enckey8 \
		--authkey $authkey16
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	# forward path
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp \
		--esp 3des-sha1-96 \
		--enckey $enckey24 \
		--authkey $authkey20
	ipsec eroute --add --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask \
		--edst $remote_public_ip --spi 0x225 --proto esp
	route del $remote_public_ip
	route add -host $remote_public_ip dev $ipsecdev \
		gw $local_public_nexthop
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp \
		--esp 3des-sha1-96 \
		--enckey $enckey24 \
		--authkey $authkey20
    
    
	# forward path
	route del $remote_public_ip
	ipsec eroute --del --src $local_public_ip/$hmask \
		--dst $remote_public_ip/$hmask
	ipsec spi --edst $remote_public_ip --spi 0x225 --proto esp --del
	# Return path
	ipsec spi --edst $local_public_ip --spi 0x235 --proto esp --del
    
    
	cat /proc/net/ipsec_*