For compatibility, must not use ah-sha-hmac for IPSec policy