  <varlistentry>
  <term><emphasis remap='B'>phase2</emphasis></term>
  <listitem>
<para>Sets the type of SA that will be produced. Valid options are:
<emphasis remap='B'>esp</emphasis> for encryption (the default), 
<emphasis remap='B'>ah</emphasis> for authentication only.
</para>
<para>
The very first IPsec designs called for use of AH plus ESP to offer authentication, integrity and confidentiality. That dual protocol
use was a significant burden, so ESP was extended to offer all three services, and AH remained as an auth/integ. Only broken configurations (often used with racoon) require the strange double authentication using <emphasis remap='B'>ah+esp</emphasis>. Additionally, AH does not play well with NATs, so it is strongly recommended to use ESP with the null cipher if you require unencrypted authenticated transport.
</para>
  </listitem>
  </varlistentry>
