diff --git a/src/main/java/com/nis/web/controller/BaseController.java b/src/main/java/com/nis/web/controller/BaseController.java
index 83aeeb2d2..0829709b0 100644
--- a/src/main/java/com/nis/web/controller/BaseController.java
+++ b/src/main/java/com/nis/web/controller/BaseController.java
@@ -538,13 +538,22 @@ public class BaseController {
 			params.put("searchCfgId", entry.getCfgId());
 		}
 	}
-	public void checkIpCfg(List<IpCfgTemplate> list) throws ServiceException{
+	public void checkIpCfg(int functionId ,List<IpCfgTemplate> list) throws ServiceException{
 		Properties prop=this.getMsgProp();
 		List<SysDataDictionaryItem>  ipTypeList = DictUtils.getDictList("IP_TYPE");
 		List<SysDataDictionaryItem>  ipPatternList = DictUtils.getDictList("IP_PATTERN");
 		List<SysDataDictionaryItem>  portPatternList = DictUtils.getDictList("PORT_PATTERN");
 		List<SysDataDictionaryItem>  directionList = DictUtils.getDictList("DIRECTION");
 		List<SysDataDictionaryItem>  protocolList = DictUtils.getDictList("PROTOCOL");
+		List<SysDataDictionaryItem>  ipsecProrocolList = DictUtils.getDictList("IPSEC_PROTOCOL");
+		List<SysDataDictionaryItem>  tunnelProrocolList = DictUtils.getDictList("TUNNEL_PROTOCOL");
+		List<SysDataDictionaryItem>  specialFunctionIdList = DictUtils.getDictList("SPECIAL_FUNCTION_ID");
+		String specialItem=null;
+		for(SysDataDictionaryItem sfuncItem:specialFunctionIdList){
+			if(functionId==Integer.parseInt(sfuncItem.getItemCode())){
+				specialItem=sfuncItem.getItemValue();
+			}
+		}
 		StringBuffer msg=new StringBuffer();
 		int line=1;
 		for(IpCfgTemplate value:list){
@@ -661,16 +670,42 @@ public class BaseController {
 			if(protocol==null){
 				errInfo.append(String.format(prop.getProperty("can_not_null"), prop.getProperty("protocol"))+";");
 			}else{
-				boolean has=false;
-				for(SysDataDictionaryItem protocolItem:protocolList){
-					if(Integer.parseInt(protocolItem.getItemCode())==protocol.intValue()){
-						has=true;
-						break;
+				if(specialItem!=null&&("ipsec".equals(specialItem)||"tunnel".equals(specialItem))){
+					if("ipsec".equals(specialItem)){
+						boolean has=false;
+						for(SysDataDictionaryItem protocolItem:ipsecProrocolList){
+							if(Integer.parseInt(protocolItem.getItemCode())==protocol.intValue()){
+								has=true;
+								break;
+							}
+						}
+						if(!has){
+							errInfo.append(String.format(prop.getProperty("is_incorrect"), prop.getProperty("protocol"))+";");
+						}
+					}else if("tunnel".equals(specialItem)){
+						for(SysDataDictionaryItem protocolItem:tunnelProrocolList){
+							if("default".equals(protocolItem.getItemValue())){
+								if(protocol.intValue()!=Integer.parseInt(protocolItem.getItemCode())){
+									errInfo.append(String.format(prop.getProperty("must_be"), prop.getProperty("protocol"),Integer.parseInt(protocolItem.getItemCode()))+";");
+								}
+								break;
+							}
+						}
+						
+					}
+				}else{
+					boolean has=false;
+					for(SysDataDictionaryItem protocolItem:protocolList){
+						if(Integer.parseInt(protocolItem.getItemCode())==protocol.intValue()){
+							has=true;
+							break;
+						}
+					}
+					if(!has){
+						errInfo.append(String.format(prop.getProperty("is_incorrect"), prop.getProperty("protocol"))+";");
 					}
 				}
-				if(!has){
-					errInfo.append(String.format(prop.getProperty("is_incorrect"), prop.getProperty("protocol"))+";");
-				}
+				
 			}
 			//protocol check end
 			// requestId check start
diff --git a/src/main/java/com/nis/web/controller/configuration/CommonController.java b/src/main/java/com/nis/web/controller/configuration/CommonController.java
index 0e5190a47..9e2402ab6 100644
--- a/src/main/java/com/nis/web/controller/configuration/CommonController.java
+++ b/src/main/java/com/nis/web/controller/configuration/CommonController.java
@@ -218,7 +218,7 @@ public class CommonController extends BaseController {
 		try {
 			ImportExcel ei = new ImportExcel(file, 0, 0);
 			List<IpCfgTemplate> list = ei.getDataList(IpCfgTemplate.class);
-			this.checkIpCfg(list);
+			this.checkIpCfg(ipCfg.getFunctionId(),list);
 			List<BaseIpCfg> ipList = new ArrayList<>();
 			Date date=new Date();
 			for(IpCfgTemplate cfg : list){
diff --git a/src/main/resources/messages/message_en.properties b/src/main/resources/messages/message_en.properties
index 39fed64ef..9524663e7 100644
--- a/src/main/resources/messages/message_en.properties
+++ b/src/main/resources/messages/message_en.properties
@@ -721,4 +721,5 @@ must_between=must between %s and %s
 not_number=%s is not a number
 id_not_exists=the id %s of %s is not valid
 num_split_by_comma=%s must be numbers split by comma
+must_be=%s must be %s
 #=============some validation===========
\ No newline at end of file
diff --git a/src/main/resources/messages/message_ru.properties b/src/main/resources/messages/message_ru.properties
index 5d9276714..44cecb765 100644
--- a/src/main/resources/messages/message_ru.properties
+++ b/src/main/resources/messages/message_ru.properties
@@ -705,4 +705,5 @@ must_between=must between %s and %s
 not_number=%s is not a number
 id_not_exists=the id %s of %s is not valid
 num_split_by_comma=%s must be numbers split by comma
+must_be=%s must be %s
 #=============some validation===========
\ No newline at end of file
diff --git a/src/main/resources/messages/message_zh_CN.properties b/src/main/resources/messages/message_zh_CN.properties
index 3e4a92ebe..bc545adad 100644
--- a/src/main/resources/messages/message_zh_CN.properties
+++ b/src/main/resources/messages/message_zh_CN.properties
@@ -815,4 +815,5 @@ id_not_exists=id\u4E3A%s\u7684%s\u4E0D\u5B58\u5728
 id_not_valid=id\u4E3A%s\u7684%s\u65E0\u6548
 num_split_by_comma=%s\u4E3A\u9017\u53F7\u5206\u9694\u7684\u6570\u5B57
 no_data=\u65E0\u76F8\u5173\u6570\u636E
+must_be=%s\u7684\u503C\u5FC5\u987B\u4E3A%s
 #=============region_value,config form title=================
\ No newline at end of file