Configuring tunnel policies