<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="24" lastModified="1261881957" id="root">
  <Library id="sysid99" name="Deleted Objects" comment="" ro="False"/>
  <Library id="id6821X7237" color="#FFFFFF" name="new_cluster_test" comment="" ro="False">
    <ObjectGroup id="id6822X7237" name="Objects" comment="" ro="False">
      <ObjectGroup id="id6823X7237" name="Addresses" comment="" ro="False"/>
      <ObjectGroup id="id6824X7237" name="DNS Names" comment="" ro="False"/>
      <ObjectGroup id="id6825X7237" name="Address Tables" comment="" ro="False"/>
      <ObjectGroup id="id6826X7237" name="Groups" comment="" ro="False"/>
      <ObjectGroup id="id6827X7237" name="Hosts" comment="" ro="False"/>
      <ObjectGroup id="id6828X7237" name="Networks" comment="" ro="False"/>
      <ObjectGroup id="id6829X7237" name="Address Ranges" comment="" ro="False"/>
    </ObjectGroup>
    <ServiceGroup id="id6830X7237" name="Services" comment="" ro="False">
      <ServiceGroup id="id6831X7237" name="Groups" comment="" ro="False"/>
      <ServiceGroup id="id6832X7237" name="ICMP" comment="" ro="False"/>
      <ServiceGroup id="id6833X7237" name="IP" comment="" ro="False"/>
      <ServiceGroup id="id6834X7237" name="TCP" comment="" ro="False"/>
      <ServiceGroup id="id6835X7237" name="UDP" comment="" ro="False"/>
      <ServiceGroup id="id6836X7237" name="Users" comment="" ro="False"/>
      <ServiceGroup id="id6837X7237" name="Custom" comment="" ro="False"/>
      <ServiceGroup id="id6838X7237" name="TagServices" comment="" ro="False"/>
    </ServiceGroup>
    <ObjectGroup id="id6839X7237" name="Firewalls" comment="" ro="False">
      <Firewall id="id6844X7237" host_OS="linux24" inactive="False" lastCompiled="1261336030" lastInstalled="0" lastModified="1261881917" platform="iptables" version="1.4.3" name="linux-1" comment="Similar to fw 1, but the firewall is used as DHCP and DNS server for internal network.&#10;This firewall has two interfaces. Eth0 faces outside and has a dynamic address; eth1 faces inside.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH. The firewall can send DNS queries to servers out on the Internet. Another rule permits DNS queries from internal network to the firewall. Special rules permit DHCP requests from internal network and replies sent by the firewall." ro="False">
        <NAT id="id6886X7237" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <RuleSetOptions/>
        </NAT>
        <Policy id="id6870X7237" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <RuleSetOptions/>
        </Policy>
        <Policy id="id6872X7237" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
          <PolicyRule id="id6873X7237" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="block with hashlimit  10/sec">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="connlimit_masklen">0</Option>
              <Option name="connlimit_value">0</Option>
              <Option name="firewall_is_part_of_any_and_networks">False</Option>
              <Option name="hashlimit_burst">0</Option>
              <Option name="hashlimit_dstlimit">False</Option>
              <Option name="hashlimit_expire">0</Option>
              <Option name="hashlimit_gcinterval">0</Option>
              <Option name="hashlimit_max">0</Option>
              <Option name="hashlimit_mode_dstip">False</Option>
              <Option name="hashlimit_mode_dstport">False</Option>
              <Option name="hashlimit_mode_srcip">False</Option>
              <Option name="hashlimit_mode_srcport">False</Option>
              <Option name="hashlimit_name"/>
              <Option name="hashlimit_size">0</Option>
              <Option name="hashlimit_suffix">/second</Option>
              <Option name="hashlimit_value">10</Option>
              <Option name="limit_burst">0</Option>
              <Option name="limit_suffix"/>
              <Option name="limit_value">0</Option>
              <Option name="log_level"/>
              <Option name="log_prefix"/>
              <Option name="pf_classify_str"/>
              <Option name="stateless">True</Option>
              <Option name="ulog_nlgroup">1</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <RuleSetOptions/>
        </Policy>
        <Routing id="id6888X7237" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <RuleSetOptions/>
        </Routing>
        <Interface id="id6852X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
          <IPv4 id="id6855X7237" name="linux-1:eth0:ip" comment="" ro="False" address="192.168.1.1" netmask="255.255.255.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6857X7237" dedicated_failover="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
          <IPv4 id="id6860X7237" name="linux-1:eth1:ip-1" comment="" ro="False" address="192.168.2.1" netmask="255.255.255.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6862X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
          <IPv4 id="id6865X7237" name="linux-1:lo:ip-1" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6867X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="eth2" comment="" ro="False">
          <InterfaceOptions>
            <Option name="type">ethernet</Option>
          </InterfaceOptions>
        </Interface>
        <Management address="192.168.2.1">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">True</Option>
          <Option name="accept_new_tcp_with_no_syn">True</Option>
          <Option name="action_on_reject"/>
          <Option name="activationCmd"/>
          <Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
          <Option name="admUser"/>
          <Option name="altAddress"/>
          <Option name="bridging_fw">False</Option>
          <Option name="check_shading">False</Option>
          <Option name="clamp_mss_to_mtu">False</Option>
          <Option name="classify_mark_terminating">False</Option>
          <Option name="cmdline"/>
          <Option name="compiler"/>
          <Option name="configure_bonding_interfaces">False</Option>
          <Option name="configure_bridge_interfaces">False</Option>
          <Option name="configure_interfaces">True</Option>
          <Option name="configure_vlan_interfaces">False</Option>
          <Option name="debug">False</Option>
          <Option name="drop_invalid">False</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="epilog_script"/>
          <Option name="firewall_dir">/etc/rc.d/</Option>
          <Option name="firewall_is_part_of_any_and_networks">True</Option>
          <Option name="flush_and_set_default_policy">True</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="ignore_empty_groups">False</Option>
          <Option name="ipt_mangle_only_rulesets"/>
          <Option name="ipv4_6_order">ipv4_first</Option>
          <Option name="limit_suffix"/>
          <Option name="limit_value">0</Option>
          <Option name="linux24_accept_redirects"/>
          <Option name="linux24_accept_source_route"/>
          <Option name="linux24_conntrack_hashsize">1000</Option>
          <Option name="linux24_conntrack_max">1000</Option>
          <Option name="linux24_conntrack_tcp_be_liberal">1</Option>
          <Option name="linux24_icmp_echo_ignore_all"/>
          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
          <Option name="linux24_ip_dynaddr"/>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="linux24_ipv6_forward"/>
          <Option name="linux24_log_martians"/>
          <Option name="linux24_path_brctl"/>
          <Option name="linux24_path_ifenslave"/>
          <Option name="linux24_path_ip"/>
          <Option name="linux24_path_ip6tables"/>
          <Option name="linux24_path_ip6tables_restore"/>
          <Option name="linux24_path_iptables"/>
          <Option name="linux24_path_iptables_restore"/>
          <Option name="linux24_path_logger"/>
          <Option name="linux24_path_lsmod"/>
          <Option name="linux24_path_modprobe"/>
          <Option name="linux24_path_vconfig"/>
          <Option name="linux24_rp_filter"/>
          <Option name="linux24_tcp_ecn"/>
          <Option name="linux24_tcp_fack"/>
          <Option name="linux24_tcp_fin_timeout">0</Option>
          <Option name="linux24_tcp_keepalive_interval">0</Option>
          <Option name="linux24_tcp_sack"/>
          <Option name="linux24_tcp_syncookies"/>
          <Option name="linux24_tcp_timestamps"/>
          <Option name="linux24_tcp_window_scaling">1</Option>
          <Option name="load_modules">True</Option>
          <Option name="local_nat">False</Option>
          <Option name="log_all">False</Option>
          <Option name="log_invalid">False</Option>
          <Option name="log_ip_opt">False</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="log_tcp_opt">False</Option>
          <Option name="log_tcp_seq">False</Option>
          <Option name="loopback_interface">lo</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">True</Option>
          <Option name="mgmt_addr"/>
          <Option name="mgmt_ssh">False</Option>
          <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="output_file"/>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="prolog_place">top</Option>
          <Option name="prolog_script"/>
          <Option name="scpArgs"/>
          <Option name="script_name_on_firewall">rc.firewall.local</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="sshArgs"/>
          <Option name="ulog_cprange">0</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="ulog_qthreshold">1</Option>
          <Option name="use_ULOG">False</Option>
          <Option name="use_iptables_restore">False</Option>
          <Option name="use_numeric_log_levels">False</Option>
          <Option name="verify_interfaces">True</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall id="id6897X7237" host_OS="linux24" inactive="False" lastCompiled="1261336030" lastInstalled="0" lastModified="1261881942" platform="iptables" version="1.4.3" name="linux-2" comment="Similar to fw 1, but the firewall is used as DHCP and DNS server for internal network. &#10;This firewall has two interfaces. Eth0 faces outside and has a dynamic address; eth1 faces inside.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH. The firewall can send DNS queries to servers out on the Internet. Another rule permits DNS queries from internal network to the firewall. Special rules permit DHCP requests from internal network and replies sent by the firewall." ro="False">
        <NAT id="id7064X7237" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <NATRule id="id7065X7237" disabled="False" group="" position="0" action="Translate" comment="">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="sysid0"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="id6905X7237"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <ItfInb neg="False">
              <ObjectRef ref="sysid0"/>
            </ItfInb>
            <ItfOutb neg="False">
              <ObjectRef ref="sysid0"/>
            </ItfOutb>
            <NATRuleOptions/>
          </NATRule>
          <RuleSetOptions/>
        </NAT>
        <Policy id="id6923X7237" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <PolicyRule id="id6924X7237" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
            <Src neg="False">
              <ObjectRef ref="id6897X7237"/>
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id6905X7237"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id6937X7237" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="True">
              <ObjectRef ref="id6915X7237"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id6949X7237" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network&#10;Also firewall serves DNS for internal&#10;network">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id6897X7237"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id6989X7237" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="DHCP replies">
            <Src neg="False">
              <ObjectRef ref="id6897X7237"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sg-DHCP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id7001X7237" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="Firewall should be able to send&#10;DNS queries to the Internet">
            <Src neg="False">
              <ObjectRef ref="id6897X7237"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id7013X7237" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id6897X7237"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="pf_classify_str"/>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id7025X7237" disabled="False" group="" log="False" position="6" action="Branch" direction="Both" comment="">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="action_on_reject"/>
              <Option name="branch_id">id7050X7237</Option>
              <Option name="classify_str"/>
              <Option name="custom_str"/>
              <Option name="ipf_route_opt_addr"/>
              <Option name="ipf_route_opt_if"/>
              <Option name="ipf_route_option">route_through</Option>
              <Option name="ipfw_classify_method">2</Option>
              <Option name="ipfw_pipe_port_num">0</Option>
              <Option name="ipfw_pipe_queue_num">0</Option>
              <Option name="ipt_branch_in_mangle">False</Option>
              <Option name="ipt_continue">False</Option>
              <Option name="ipt_gw"/>
              <Option name="ipt_iif"/>
              <Option name="ipt_mark_connections">False</Option>
              <Option name="ipt_oif"/>
              <Option name="ipt_tee">False</Option>
              <Option name="pf_classify_str"/>
              <Option name="pf_fastroute">False</Option>
              <Option name="pf_route_load_option">none</Option>
              <Option name="pf_route_opt_addr"/>
              <Option name="pf_route_opt_if"/>
              <Option name="pf_route_option">none</Option>
              <Option name="rule_name_accounting"/>
              <Option name="stateless">True</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule id="id7037X7237" disabled="False" group="" log="True" position="7" action="Continue" direction="Both" comment="">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="classification">False</Option>
              <Option name="pf_classify_str"/>
              <Option name="routing">False</Option>
              <Option name="stateless">False</Option>
              <Option name="tagging">True</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <RuleSetOptions/>
        </Policy>
        <Policy id="id7050X7237" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
          <PolicyRule id="id7051X7237" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="block with hashlimit  20/sec">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="connlimit_masklen">0</Option>
              <Option name="connlimit_value">0</Option>
              <Option name="firewall_is_part_of_any_and_networks">False</Option>
              <Option name="hashlimit_burst">0</Option>
              <Option name="hashlimit_dstlimit">False</Option>
              <Option name="hashlimit_expire">0</Option>
              <Option name="hashlimit_gcinterval">0</Option>
              <Option name="hashlimit_max">0</Option>
              <Option name="hashlimit_mode_dstip">False</Option>
              <Option name="hashlimit_mode_dstport">False</Option>
              <Option name="hashlimit_mode_srcip">False</Option>
              <Option name="hashlimit_mode_srcport">False</Option>
              <Option name="hashlimit_name"/>
              <Option name="hashlimit_size">0</Option>
              <Option name="hashlimit_suffix">/second</Option>
              <Option name="hashlimit_value">20</Option>
              <Option name="limit_burst">0</Option>
              <Option name="limit_suffix"/>
              <Option name="limit_value">0</Option>
              <Option name="log_level"/>
              <Option name="log_prefix"/>
              <Option name="pf_classify_str"/>
              <Option name="stateless">True</Option>
              <Option name="ulog_nlgroup">1</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <RuleSetOptions/>
        </Policy>
        <Routing id="id7080X7237" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
          <RuleSetOptions/>
        </Routing>
        <Interface id="id6905X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
          <IPv4 id="id6908X7237" name="linux-2:eth0:ip-1" comment="" ro="False" address="192.168.1.2" netmask="255.255.255.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6910X7237" dedicated_failover="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
          <IPv4 id="id6913X7237" name="linux-2:eth1:ip-1" comment="" ro="False" address="192.168.2.2" netmask="255.255.255.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6915X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
          <IPv4 id="id6918X7237" name="linux-2:lo:ip-1" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
          <InterfaceOptions/>
        </Interface>
        <Interface id="id6920X7237" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="eth2" comment="" ro="False">
          <InterfaceOptions>
            <Option name="type">ethernet</Option>
          </InterfaceOptions>
        </Interface>
        <Management address="192.168.2.2">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">True</Option>
          <Option name="accept_new_tcp_with_no_syn">True</Option>
          <Option name="action_on_reject"/>
          <Option name="activationCmd"/>
          <Option name="admUser"/>
          <Option name="altAddress"/>
          <Option name="bridging_fw">False</Option>
          <Option name="check_shading">False</Option>
          <Option name="clamp_mss_to_mtu">False</Option>
          <Option name="classify_mark_terminating">False</Option>
          <Option name="cmdline"/>
          <Option name="compiler"/>
          <Option name="configure_bonding_interfaces">False</Option>
          <Option name="configure_bridge_interfaces">False</Option>
          <Option name="configure_interfaces">True</Option>
          <Option name="configure_vlan_interfaces">False</Option>
          <Option name="debug">False</Option>
          <Option name="drop_invalid">False</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="epilog_script"/>
          <Option name="firewall_dir">/etc/rc.d</Option>
          <Option name="firewall_is_part_of_any_and_networks">True</Option>
          <Option name="flush_and_set_default_policy">True</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="ignore_empty_groups">False</Option>
          <Option name="ipt_mangle_only_rulesets"/>
          <Option name="ipv4_6_order">ipv4_first</Option>
          <Option name="limit_suffix"/>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">True</Option>
          <Option name="local_nat">False</Option>
          <Option name="log_all">False</Option>
          <Option name="log_invalid">False</Option>
          <Option name="log_ip_opt">False</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="log_tcp_opt">False</Option>
          <Option name="log_tcp_seq">False</Option>
          <Option name="loopback_interface">lo</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">True</Option>
          <Option name="mgmt_addr"/>
          <Option name="mgmt_ssh">False</Option>
          <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="output_file"/>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="prolog_place">top</Option>
          <Option name="prolog_script"/>
          <Option name="scpArgs"/>
          <Option name="script_name_on_firewall">rc.firewall.local</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="sshArgs"/>
          <Option name="ulog_cprange">0</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="ulog_qthreshold">1</Option>
          <Option name="use_ULOG">False</Option>
          <Option name="use_iptables_restore">False</Option>
          <Option name="use_numeric_log_levels">False</Option>
          <Option name="verify_interfaces">True</Option>
        </FirewallOptions>
      </Firewall>
    </ObjectGroup>
    <ObjectGroup id="id6840X7237" name="Clusters" comment="" ro="False"/>
    <IntervalGroup id="id6841X7237" name="Time" comment="" ro="False"/>
  </Library>
  <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
    <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
    <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
    <AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
    <ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
      <ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
        <Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
      </ObjectGroup>
    </ObjectGroup>
    <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
      <ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
        <TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
        <TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
      </ServiceGroup>
      <ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
        <ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
          <ServiceRef ref="udp-DNS"/>
          <ServiceRef ref="tcp-DNS"/>
        </ServiceGroup>
        <ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
          <ServiceRef ref="udp-bootpc"/>
          <ServiceRef ref="udp-bootps"/>
        </ServiceGroup>
      </ServiceGroup>
      <ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
        <UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
        <UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
        <UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
      </ServiceGroup>
    </ServiceGroup>
  </Library>
</FWObjectDatabase>
