Cisco ASA: preliminary support for tunnel-group commands