  <varlistentry>
  <term><emphasis remap='B'>phase2</emphasis></term>
  <listitem>
<para>Sets the type of SA that will be produced. Valid options are:
<emphasis remap='B'>esp</emphasis> for encryption (the default),
<emphasis remap='B'>ah</emphasis> for authentication only.
</para>
<para>
The very first IPsec designs called for use of AH plus ESP to offer authentication, integrity and confidentiality. That dual protocol
use was a significant burden, so ESP was extended to offer all three services, and AH remained as an auth/integ. The old mode of
<emphasis remap='B'>ah+esp</emphasis> is no longer supported in compliance with RFC 8221 Section 4. Additionally, AH does not play
well with NATs, so it is strongly recommended to use ESP with the null cipher if you require unencrypted authenticated transport.
</para>
  </listitem>
  </varlistentry>
