add restrict-nsa config