The private-or-clear group will attempt OpportunisticEncryption to destinations listed in /etc/ipsec.d/policies/private-or-clear. Should OpportunisticEncryption not be possible, cleartext will be sent.
/etc/ipsec.d/policies/private-or-clear
