fix inner-tunnel policy