IPsec Mode to establish CHILD_SA with.

• tunnel negotiates the CHILD_SA in IPsec Tunnel Mode,
• whereas transport uses IPsec Transport Mode.
• transport_proxy signifying the special Mobile IPv6 Transport Proxy Mode.
• beet is the Bound End to End Tunnel mixture mode, working with fixed inner addresses without the need to include them in each packet.
• Both transport and beet modes are subject to mode negotiation; tunnel mode is negotiated if the preferred mode is not available.
• pass and drop are used to install shunt policies which explicitly bypass the defined traffic from IPsec processing or drop it, respectively

ESP proposals to offer for the CHILD_SA

Whether to copy the DF bit to the outer IPv4 header in tunnel mode

Whether to copy the ECN (Explicit Congestion Notification) header field to/from the outer IP header in tunnel mode

Enable hardware offload for this CHILD_SA, if supported by the IPsec implementation

Whether to copy the DSCP (Differentiated Services Field Codepoint) header field to/from the outer IP header in tunnel mode

AH proposals to offer for the CHILD_SA

Action to perform after loading the configuration.

• The default of none loads the connection only, which then can be manually initiated or used as a responder configuration.
• The value trap installs a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
• The value start initiates the connection actively.
• Since version 5.9.6 two modes above can be combined with trap|start, to immediately initiate a connection for which trap policies have been installed