private subnet behind the left participant, expressed as network/netmask (actually, any form acceptable to ipsec_ttosubnet(3)); if omitted, essentially assumed to be left/32, signifying that the left end of the connection goes to the left participant only
