  <varlistentry>
  <term><emphasis remap='B'>xauthfail</emphasis></term>
  <listitem>
<para>When XAUTH support is available, set the failure method desired when authentication has failed.
The currently supported values are <emphasis remap='I'>hard</emphasis> (the default) and
<emphasis remap='I'>soft</emphasis>. A soft failure means the IPsec SA is allowed to be established,
as if authentication had passed successfully, but the XAUTH_FAILED environment variable will be set
to 1 for the updown script, which can then be used to redirect the user into a walled garden, for example
a payment portal.
</para>
</listitem>
  </varlistentry>
