had to reboot a box to fix it

tsa/howto/ipsec.mdwn

@@ -197,6 +197,14 @@ recipe fixed that:
 The first run "failed" (as in, Puppet returned a non-zero status
 because it performed changes) but another run "succeeded").
 
+Finally, never forget to "*try to turn it off and on again*". Simply
+rebooting the box can sometimes do wonders:
+
+    reboot
+
+In my case, it seems the configuration wasn't being re-read by
+strongswan and rebooting the machine fixed it.
+
 Traffic inspection
 ------------------