Use counters on ipsec tunnel interfaces