# policy > All packets are IPIP encapsulated in tunnel mode, and their new IP header's src-address and dst-address are set to sa-src-address and sa-dst-address values of this policy. If you do not use tunnel mode (i.e., you use... ----------- ## ip/ipsec/policy **Type:** Directory :::info Policy order is important. It works similarly to firewall filters where policies are executed from top to bottom (priority parameter is removed). All packets are IPIP encapsulated in tunnel mode, and their new IP header's src-address and dst-address are set to sa-src-address and sa-dst-address values of this policy. If you do not use tunnel mode (i.e., you use transport mode), then only packets whose source and destination addresses are the same as sa-src-address and sa-dst-address can be processed by this policy. Transport mode can only work with packets that originate at and are destined for IPsec peers (hosts that established security associations). To encrypt traffic between networks (or a network and a host) you have to use tunnel mode. ::: Whether the item is a template to assign for dynamic peers. Whether the item is included in the backup. Whether the item is disabled. Whether the item was created dynamically. Whether this policy is invalid - the possible cause is a duplicate policy with the same src-address and dst-address. Whether the item is currently active. Whether the item is the default. Name of the peer on which the policy applies.c Whether to use tunnel mode. Policy group name. Source address or network to be matched in packets. Applicable when tunnel mode (`tunnel=yes`) or template (`template=yes`) is used. Source port. Destination address or network to be matched in packets. Applicable when tunnel mode (`tunnel=yes`) or template (`template=yes`) is used. Destination port. IP protocol number or name. Action to take for matching traffic. - `none` - pass the packet unchanged. - `discard` - drop the packet. - `encrypt` - apply transformations specified in this policy and its SA. Specifies what to do if some of the SAs for this policy cannot be found: - `use` - skip this transform, do not drop the packet, and do not acquire SA from IKE daemon; - `require` - drop the packet and acquire SA; - `unique` - drop the packet and acquire a unique SA that is only used with this particular policy. It is used in setups where multiple clients can sit behind one public IP address (clients behind NAT). Specifies what combination of Authentication Header and Encapsulating Security Payload protocols you want to apply to matched traffic. endpoint address endpoint address Proposal template name. Whether this policy is a template. The interface through which the SA is established. Number of phase 2 exchanges. Current phase 2 state.