# destination network without peer in flow must fail
flow from 1.1.1.1 to { 2.2.2.2 3.3.3.0/24 }