ipsecTunnelType 1.3.6.1.4.1.838.3.14.1.4.1.2

The tunnel type. When 'dialinGroup(1)', 'dialinClient(2)' or 'siteToSiteDynamic(4)' is specified, ISAKMP is responsible for SA creation. Otherwise, when 'siteToSiteStatic(2)' is specified, SAs must be configured manually. This definition implies that all dial-in tunnels (and SAs created for them) are always dynamic. Tunnels of type 'dialinGroup(1)' are created by the administrator and are read-write. They have a range of remote client addresses. When a dial-in client connects within the remote client range of a parent tunnel, a read-only 'dialinClient(2)' tunnel is dynamically created.