Configuring a tunnel policy