  <varlistentry>
  <term><emphasis remap='B'>global-redirect</emphasis></term>
  <listitem>
<para>Whether to send requests for the remote peer to redirect IKE/IPsec SA's during IKE_SA_INIT. Valid options are
	<emphasis remap='B'>no</emphasis> (the default), <emphasis remap='B'>yes</emphasis> and <emphasis remap='B'>auto</emphasis>, where auto means
	that the requests will be sent if DDoS mode is active (see <emphasis remap='B'>ddos-mode</emphasis>). If set, the option <emphasis remap='B'>global-redirect-to=</emphasis> must 	also be set to indicate where to redirect peers to. For specific connection redirection after IKE SA authentication, see the <emphasis remap='B'>send-redirect=</emphasis> and
	<emphasis remap='B'>redirect-to=</emphasis> options. This configuration can be changed at runtime via the <emphasis remap='I'>ipsec whack --global-redirect</emphasis> command.
</para>
  </listitem>
  </varlistentry>
  <varlistentry>
  <term><emphasis remap='B'>global-redirect-to</emphasis></term>
  <listitem>
<para>Where to send remote peers to via the <emphasis remap='B'>global-redirect</emphasis> option. This can be a list, or a single entry, of IP addresses or hostnames (FQDNs).
	If there is a list of entries, they must be separated with comma's. One specified entry means all peers will be redirected
	to it, while multiple specified entries means peers will be evenly distributed across the specified servers. This configuration can be changed at runtime via the <emphasis remap='I'>ipsec whack --global-redirect-to</emphasis> command.
</para>
  </listitem>
  </varlistentry>
