net/ice/base: fix switch rule for IPsec