Parts 1 and 2 built increasingly good answers to the same question: how do you get an IPsec tunnel out