anchor.diff:  
   [[admin-guide-ipsec-prerequisites]]
   === Step 1: Prerequisites
  -Ensure that the *libreswan* package, version 3.19 or later, is installed
  -on cluster hosts. Only version 3.19 and later includes the necessary
  -opportunistic group functionality that allows hosts to be configured without
  -knowledge of every other host in the cluster.
  +Ensure that the *libreswan* package, version 3.15 or later, is installed
  +on cluster hosts. If opportunistic group functionality is required then
  +*libreswan* version 3.19 or later is required. At this time *libreswan*
  +3.15 is the latest version supported on Red Hat Enterprise Linux 7.
  +
  +link:../install_config/configuring_sdn.html[Configure the SDN] MTU to allow
  +space for the IPSec header. In the configuration described here IPSec requires
  +62 bytes. If the cluster is operating on an ethernet network with an MTU of
  +1500 then the SDN MTU should be 1388, to allow for the overhead of IPSec and
  +the SDN encapsulation.
   
   [[admin-guide-ipsec-certificates]]
   === Step 2: Certificates
  
positive.code: Additional hosts and subnets may be added to this file, which will result in
  all traffic to these hosts and subnets being unencrypted.
  
  . Restart the *libreswan* service to load the new configuration and policies,
  and begin encrypting:
  +
  ----
  systemctl restart ipsec
  ----
  
  [[admin-guide-ipsec-troubleshooting]]
  
negative.code: Now that the necessary certificates are imported into the *libreswan*
  certificate database, create a policy that uses them to secure communication
  between hosts in your cluster.
  
  If using *libreswan* 3.19 or later then opportunistic group configuration is
  recommended. Otherwise explicit connections are required
  
  ==== Opportunistic Group Configuration
  
  The following configuration creates two *libreswan* connections. The first
  encrypts traffic using the {product-title} certificates, while the second
  