  <varlistentry>
  <term><emphasis remap='B'>encapsulation</emphasis></term>
  <listitem>
<para>
In some cases, for example when ESP packets are filtered or when a broken
IPsec peer does not properly recognise NAT, it can be useful to force
RFC-3948 encapsulation. In other cases, where IKE is NAT'ed but ESP
packets can or should flow without encapsulation, it can be useful
to ignore the NAT-Traversal auto-detection.
<emphasis remap='B'>encapsulation=yes</emphasis> forces the NAT detection
code to lie and tell the remote peer that RFC-3948 encapsulation (ESP in
port 4500 packets) is required.
<emphasis remap='B'>encapsulation=no</emphasis> ignores the NAT detection
causing ESP packets to send send without encapsulation.
The default value of <emphasis remap='B'>encapsulation=auto</emphasis> follows
the regular outcome of the NAT auto-detection code performed in IKE. This
option replaced the obsoleted forceencaps option.
</para>
  </listitem>
  </varlistentry>

