| # | |
| # drop all packets without IP security options | |
| # | |
| block in all | |
| pass in all with opt sec | |
| # | |
| # only allow packets in and out on le1 which are top secret | |
| # | |
| block out on le1 all | |
| pass out on le1 all with opt sec-class topsecret | |
| block in on le1 all | |
| pass in on le1 all with opt sec-class topsecret |