openbsd ipsec.conf: flow vs ike keyword
 

Hello,
Is the following statement correct?:

An 'ike' statement in ipsec.conf handles the establishment of security association between two endpoints via isakmpd, whereas 'flow' only establishes the endpoints-- the SA must be created manually via other means.

If not, please correct my understand of IPSEC/ipsec.conf...