You've appear to have uncommented documentation. ..read what it says. You need to put that sort of stuff into the virtual server config (ie in the authorize section of the inner tunnel) as the online documentation is telling you :) alan