Various VPNs use the esp, gre protocols, also remember isakmp (udp port 500 for key exchange)
pass quick inet proto esp pass quick inet proto udp to port isakmp ## udp port 500 for key exchange pass quick proto gre
Note: Your context may require more restrictive criteria
4.8 News Flash: enc is now cloneable, you can have more than one