spdadd 0.0.0.0/0 192.35.169.ZZZ/32 any -P in ipsec esp/tunnel/192.35.169.252-192.35.XXX.YYY/require;
spdadd 192.35.169.ZZZ/32 0.0.0.0/0 any -P out ipsec esp/tunnel/192.35.XXX.YYY-192.35.169.252/require;