Therefore, these two parameters are required for uniquely specifying a tunnel. Other parameters such as cryptographic algorithm, authentication algorithm, keys, and lifetime can be specified or defaults can be used. The decision to use IBM tunnels, manual tunnels, or, for AIX versions 4.3.2 and later, IKE tunnels, depends on the tunnel support of the remote end and the type of key management desired. They also take advantage of the new IETF ESP and AH header types and support anti-replay protection. If the remote end does not support IBM tunnels, or uses one of the algorithms requiring manual tunnels, manual tunnels should be used.
Manual tunnels ensure interoperability with a large number of hosts.
Because the keys are static and difficult to change and may be cumbersome to update, they are not as secure. Manual tunnels may be used between a host running AIX Version 4.3 and any other machine running IP Security and having a common set of cryptographic and authentication algorithms. This is a base subset that works with almost all implementations of IP Security. When setting up manual or IBM tunnels, the procedure depends on whether you are setting up the first host of the tunnel or setting up the second host, which must have parameters matching the first host's setup. When setting up the first host, the keys may be autogenerated, and the algorithms can be defaulted.