update IPSEC section to new config a/b