The private group will be cause OE to be attempted to destinations listed in /etc/ipsec.d/policies/private. If OE is not possible, no packets will flow.
/etc/ipsec.d/policies/private