The CSS's do not have SPAN ports in the traditional sense. They do have an ethernet management port that is non-routable, but I think that's as close as your going to get to anything like a SPAN port. Your best bet is to either set up a VLAN for ma...
You should probably clarify what exactly you mean when you say "policy". To most people within the security area, a policy means a written standard by which an organization relies upon to setup a security infrastructure, of which VPN is a part of. ...