migrate ipsec rules to a define so we can specify multiple zones
fix define