---

connections {
    site-to-site {
        local_addrs  = 192.168.1.2
        remote_addrs = 192.168.1.1

        local {
            auth = pubkey
            certs = serverB.crt
            id = serverB.alt.local
        }
        remote {
            auth = pubkey
            id = serverA.alt.local
        }
        children {
            site-to-site {
                local_ts  = 10.20.20.0/24
                remote_ts = 10.10.10.0/24
                start_action = start
                esp_proposals = aes256-sha256
            }
        }
        version = 2
        proposals = aes256-sha256-modp2048
    }
}