This object specifies the fast-route protection method requested for this dynamic tunnel -- none, link-protect, or node-protect -- and, as the description notes, cannot be modified once the tunnel entry has been created. The choice determines the actual scope of failure this tunnel can survive: node-protect covers a full router failure along the path, while link-protect only covers the failure of a single link, and because this can't be changed later, upgrading protection scope requires recreating the tunnel entirely. For example, choosing node-protect(3) for a tunnel crossing a router with known marginal power redundancy provides protection against that router failing outright, not merely the link connecting to it.