The docs on this are pretty vague,
what operation, if any, should be done automatically at IPsec startup. add loads a connection without starting it. route loads a connection and installs kernel traps. If traffic is detected between leftsubnet and rightsubnet, a connection is established. start loads a connection and brings it up immediately. ignore ignores the connection. This is equal to deleting a connection from the config file. Relevant only locally, other end need not agree on it.
What does it mean to load a connection without starting it vs bringing it up immediately? Can anyone provide a simple example?