diff --git a/roles/kni/templates/kni.conf.j2 b/roles/kni/templates/kni.conf.j2
index af5ee96..d9395db 100644
--- a/roles/kni/templates/kni.conf.j2
+++ b/roles/kni/templates/kni.conf.j2
@@ -11,7 +11,8 @@ deploy_mode = normal
 tun_name = tun_kni
 src_mac_addr = 00:0e:c6:d6:72:c1
 dst_mac_addr = fe:65:b7:03:50:bd
-
+{% if run_as_tun_mode %}
+{% else %}
 [tfe0]
 enabled = 1
 dev_eth_symbol = {{ nic_to_tfe.tfe0.name }}
@@ -26,7 +27,7 @@ ip_addr = 192.168.100.3
 enabled = 1
 dev_eth_symbol = {{ nic_to_tfe.tfe2.name }}
 ip_addr = 192.168.100.4
-
+{% endif %}
 [tfe_cmsg_receiver]
 listen_eth = {{ nic_inner_ctrl.name }}
 listen_port = 2475
diff --git a/roles/sapp/tasks/main.yml b/roles/sapp/tasks/main.yml
index 288ead5..131d5b1 100644
--- a/roles/sapp/tasks/main.yml
+++ b/roles/sapp/tasks/main.yml
@@ -40,6 +40,13 @@
     dest: /home/mesasoft/sapp_run/tsgconf/main.conf
   tags: template
 
+
+- name: Template the tsgconf/maat.conf
+  template:
+    src: "{{ role_path }}/templates/maat.conf.j2"
+    dest: /home/mesasoft/sapp_run/tsgconf/maat.conf
+  tags: template
+
 - name: "enable sapp"
   systemd:
     name: sapp
diff --git a/roles/sapp/templates/maat.conf.j2 b/roles/sapp/templates/maat.conf.j2
new file mode 100644
index 0000000..f723e36
--- /dev/null
+++ b/roles/sapp/templates/maat.conf.j2
@@ -0,0 +1,30 @@
+[STATIC]
+MAAT_MODE=2
+STAT_SWITCH=1
+PERF_SWITCH=1
+TABLE_INFO=tsgconf/tsg_static_tableinfo.conf
+STAT_FILE=tsg_static_maat.status
+EFFECT_INTERVAL_S=1
+REDIS_IP={{ maat_redis_server.address }}
+REDIS_PORT_NUM=1
+REDIS_PORT=7002
+REDIS_INDEX=0
+JSON_CFG_FILE=tsgconf/tsg_maat.json
+INC_CFG_DIR=tsgrule/inc/index/
+FULL_CFG_DIR=tsgrule/full/index/
+
+[DYNAMIC]
+MAAT_MODE=2
+STAT_SWITCH=1
+PERF_SWITCH=1
+TABLE_INFO=tsgconf/tsg_dynamic_tableinfo.conf
+STAT_FILE=tsg_dynamic_maat.status
+EFFECT_INTERVAL_S=1
+REDIS_IP={{ dynamic_maat_redis_server.address }}
+REDIS_PORT_NUM=1
+REDIS_PORT=7002
+REDIS_INDEX=1
+JSON_CFG_FILE=tsgconf/tsg_maat.json
+INC_CFG_DIR=tsgrule/inc/index/
+FULL_CFG_DIR=tsgrule/full/index/
+
diff --git a/roles/sapp/templates/sapp.toml.j2 b/roles/sapp/templates/sapp.toml.j2
index 6548df4..e31e223 100644
--- a/roles/sapp/templates/sapp.toml.j2
+++ b/roles/sapp/templates/sapp.toml.j2
@@ -9,10 +9,17 @@
 instance_name = "sapp4"
 
 [CPU]
-worker_threads=16
+{% if run_as_tun_mode %}
+worker_threads=1
+{% else %}
+worker_threads={{ sapp.worker_threads }}
+{% endif %}
 ### note, bind_mask, if you do not want to bind thread to special CPU core, keep it empty as []
+{% if run_as_tun_mode %}
+bind_mask=[]
+{% else %}
 bind_mask=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16]
-#bind_mask=[]
+{% endif %}
 
 [PACKET_IO]
 ### note, BSD_packet_filter, if you do not want to set any filter rule, keep it empty as ""
diff --git a/roles/tfe/templates/tfe-env-config.j2 b/roles/tfe/templates/tfe-env-config.j2
index aa4a656..e00dff2 100644
--- a/roles/tfe/templates/tfe-env-config.j2
+++ b/roles/tfe/templates/tfe-env-config.j2
@@ -6,6 +6,6 @@ TFE_LOCAL_IP_DATA_INCOMING=172.16.241.2
 TFE_PEER_IP_DATA_INCOMING=172.16.241.1
 
 {% if run_as_tun_mode %}
-TFE_WATCHDOG_DEVICE=lo
-TFE_WATCHDOG_IP=127.0.0.1
-{% endif %}
\ No newline at end of file
+TFE_WATCHDOG_DEVICE={{ nic_inner_ctrl.name }}
+TFE_WATCHDOG_IP=192.168.100.1
+{% endif %}