This OCTET STRING, up to 256 bytes, is described as an inbound ESP key used by this Manual Crypto Map, the secret used to decrypt and verify ESP-protected packets arriving from the peer. An admin enters this to match exactly what the peer has configured as its outbound ESP key, since ESP decryption fails immediately on any mismatch. For example, an admin restoring a manual ESP tunnel after a key rotation would update this field with the new key value coordinated out-of-band with the peer.