diff --git a/doc/ChangeLog b/doc/ChangeLog
index 57494dd82..e07b82c64 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,8 @@
+2011-03-31  vadim  <vadim@netcitadel.com>
+
+	* PIXImporterNat.cpp (buildSNATRule): import of PIX/ASA "global"
+	and "nat" commands works.
+
 2011-03-30  vadim  <vadim@netcitadel.com>
 
 	* PIXImporterNat.cpp (buildDNATRule): import of PIX/ASA "static"
diff --git a/src/import/Importer.cpp b/src/import/Importer.cpp
index c575ef1d6..0abf0abb4 100644
--- a/src/import/Importer.cpp
+++ b/src/import/Importer.cpp
@@ -467,7 +467,7 @@ void Importer::newUnidirRuleSet(const string &ruleset_name,
 {
     current_ruleset = getUnidirRuleSet(ruleset_name, ruleset_type);  // creates if new
     current_ruleset->created_from_line_number = getCurrentLineNumber();
-    *logger << "Ruleset: " + ruleset_name + "\n";
+    //*logger << "Ruleset: " + ruleset_name + "\n";
 }
 
 /*
diff --git a/src/import/PIXImporter.cpp b/src/import/PIXImporter.cpp
index 2ea39ce9f..9c0cff962 100644
--- a/src/import/PIXImporter.cpp
+++ b/src/import/PIXImporter.cpp
@@ -65,7 +65,6 @@ using namespace std;
 using namespace libfwbuilder;
 
 
-
 PIXImporter::PIXImporter(FWObject *lib,
                          std::istringstream &input,
                          Logger *log,
@@ -80,6 +79,7 @@ PIXImporter::PIXImporter(FWObject *lib,
 
 PIXImporter::~PIXImporter()
 {
+    global_pools.clear();
 }
 
 /*
@@ -118,12 +118,8 @@ void PIXImporter::clear()
     nat_a = "";
     nat_nm = "";
     nat_acl = "";
-    global_pool_num = "";
-    global_pool_interface = "";
-    global_pool_start = "";
-    global_pool_end = "";
-    global_pool_netmask = "";
 
+    tmp_global_pool = GlobalPool();
 }
 
 /*
diff --git a/src/import/PIXImporter.h b/src/import/PIXImporter.h
index f012d5426..f79c9948b 100644
--- a/src/import/PIXImporter.h
+++ b/src/import/PIXImporter.h
@@ -41,6 +41,30 @@
 #include <QString>
 
 
+struct GlobalPool
+{
+    int num;
+    std::string str_num;
+    std::string interface;
+    std::string start;
+    std::string end;
+    std::string netmask;
+
+    GlobalPool()
+    {
+        num = -1;
+        str_num = "";
+        interface = "";
+        start = "";
+        end = "";
+        netmask = "";
+    }
+
+    GlobalPool& operator=(const GlobalPool &other);
+    std::string toStdString();
+    QString toString();
+};
+
 class PIXImporter : public IOSImporter
 {
     public:
@@ -76,11 +100,8 @@ class PIXImporter : public IOSImporter
     std::string nat_nm;
     std::string nat_acl;
 
-    std::string global_pool_num;
-    std::string global_pool_interface;
-    std::string global_pool_start;
-    std::string global_pool_end;
-    std::string global_pool_netmask;
+    GlobalPool tmp_global_pool;
+    std::map<int, std::list<GlobalPool> > global_pools;
     
     PIXImporter(libfwbuilder::FWObject *lib,
                 std::istringstream &input,
@@ -91,6 +112,8 @@ class PIXImporter : public IOSImporter
     virtual void clear();
 
     void clearTempVars();
+
+    void addGlobalPool();
     
     virtual void run();
 
@@ -98,7 +121,6 @@ class PIXImporter : public IOSImporter
     void pushNATRule();
     void buildDNATRule();
     void buildSNATRule();
-
     virtual void pushRule();
     
     // this method actually adds interfaces to the firewall object
diff --git a/src/import/PIXImporterNat.cpp b/src/import/PIXImporterNat.cpp
index 82294f673..8de3ce038 100644
--- a/src/import/PIXImporterNat.cpp
+++ b/src/import/PIXImporterNat.cpp
@@ -57,39 +57,46 @@ extern int fwbdebug;
 using namespace libfwbuilder;
 using namespace std;
 
-/*
 
-  Variables used to build nat rules
+QString GlobalPool::toString()
+{
+    QString l("number %1, interface %2, address range %3-%4, netmask %5 ");
+    return l.arg(num).arg(interface.c_str())
+        .arg(start.c_str()).arg(end.c_str()).arg(netmask.c_str());
+}
 
-  libfwbuilder::NATRule::NATRuleTypes rule_type;
-  std::string prenat_interface;
-  std::string postnat_interface;
+string GlobalPool::toStdString()
+{
+    return toString().toStdString();
+}
 
-  std::string real_a;
-  std::string real_nm;
-  std::string mapped_a;
-  std::string mapped_nm;
-  std::string real_addr_acl;
-  std::string mapped_port_spec;
-  std::string real_port_spec;
-  std::string static_max_conn;
-  std::string static_max_emb_conn;
+GlobalPool& GlobalPool::operator=(const GlobalPool &other)
+{
+    num = other.num;
+    interface = other.interface;
+    start = other.start;
+    end = other.end;
+    netmask = other.netmask;
+    return *this;
+}
 
-  std::string nat_num;
-  std::string nat_a;
-  std::string nat_nm;
-  std::string nat_acl;
 
-  std::string global_pool_num;
-  std::string global_interface;
-*/
+void PIXImporter::addGlobalPool()
+{
+    bool ok = false;
+    int n;
+    n = QString(tmp_global_pool.str_num.c_str()).toInt(&ok);
+    if (ok)
+    {
+        tmp_global_pool.num = n;
+        global_pools[tmp_global_pool.num].push_back(tmp_global_pool);
+        *logger << "Global address pool: " + tmp_global_pool.toStdString() + "\n";
+    }
+}
 
 void PIXImporter::pushNATRule()
 {
     assert(current_ruleset!=NULL);
-    assert(current_rule!=NULL);
-
-    NATRule *rule = NATRule::cast(current_rule);
 
     switch (rule_type)
     {
@@ -105,10 +112,7 @@ void PIXImporter::pushNATRule()
         assert(rule_type!=NATRule::DNAT && rule_type!=NATRule::SNAT);
     }
 
-    // then add it to the current ruleset
-    current_ruleset->ruleset->add(current_rule);
-
-    addStandardImportComment(current_rule, QString::fromUtf8(rule_comment.c_str()));
+    assert(current_rule!=NULL);
 
     current_rule = NULL;
     rule_comment = "";
@@ -125,6 +129,10 @@ void PIXImporter::pushNATRule()
  */
 void PIXImporter::buildDNATRule()
 {
+    *logger << "Destination translation rule (\"static\" command)\n";
+
+    newNATRule();
+
     NATRule *rule = NATRule::cast(current_rule);
 
     Interface *pre_intf = getInterfaceByLabel(prenat_interface);
@@ -217,10 +225,120 @@ void PIXImporter::buildDNATRule()
     RuleElement *itf_o_re = rule->getItfOutb();
     assert(itf_o_re!=NULL);
     itf_o_re->addRef(pre_intf);
+
+    // add it to the current ruleset
+    current_ruleset->ruleset->add(rule);
+    addStandardImportComment(rule, QString::fromUtf8(rule_comment.c_str()));
 }
 
+/*
+ * SNAT rule. Using rule_type, global_pools, prenat_interface,
+ * nat_num, nat_a, nat_nm, nat_acl, max_conn, max_emb_conn
+ *
+ * Note that there can be multiple global pools with the same number
+ * and same or different interfaces.  In that case we should create
+ * multiple SNAT rules.
+ */
 void PIXImporter::buildSNATRule()
 {
+    *logger << "Source translation rule (\"nat\" command)\n";
+
+    bool ok = false;
+    int pool_num = QString(nat_num.c_str()).toInt(&ok);
+    // Parser matches INT_CONST so it can't be anything but integer...
+    assert (ok);
+
+    foreach(GlobalPool pool, global_pools[pool_num])
+    {
+        if (fwbdebug)
+        {
+            qDebug() << "NAT command num=" << pool_num;
+            qDebug() << "nat_a=" << nat_a.c_str()
+                     << "nat_nm=" << nat_nm.c_str();
+            qDebug() << "Using pool " << pool.toString();
+        }
+
+        Interface *post_intf = getInterfaceByLabel(pool.interface);
+
+        newNATRule();
+
+        NATRule *rule = NATRule::cast(current_rule);
+
+        Interface *pre_intf = getInterfaceByLabel(prenat_interface);
+
+        rule->setAction(NATRule::Translate);
+
+        if ( ! nat_a.empty())
+        {
+            src_a = nat_a;
+            src_nm = nat_nm;
+
+            RuleElement* osrc = rule->getOSrc();
+            assert(osrc!=NULL);
+            FWObject *s = makeSrcObj();
+            if (s) osrc->addRef( s );
+        }
+
+        if ( ! nat_acl.empty())
+        {
+            UnidirectionalRuleSet *rs = all_rulesets[nat_acl];
+            if (rs)
+            {
+                RuleElement* osrc = rule->getOSrc();
+                assert(osrc!=NULL);
+
+                PolicyRule *policy_rule = PolicyRule::cast(
+                    rs->ruleset->getFirstByType(PolicyRule::TYPENAME));
+            
+                if (policy_rule)
+                {
+                    RuleElement *src = policy_rule->getSrc();
+                    for (FWObject::iterator it=src->begin(); it!=src->end(); ++it)
+                    {
+                        FWObject *o = FWReference::getObject(*it);
+                        osrc->addRef(o);
+                    }
+                }
+            }
+        }
+
+        ObjectSignature sig;
+        FWObject *addr = NULL;
+
+        if (pool.start == "interface")
+        {
+            addr = post_intf;
+        } else
+        {
+            if (pool.start == pool.end)
+            {
+                sig.type_name = Address::TYPENAME;
+                sig.address = pool.start.c_str();
+                sig.netmask = pool.netmask.c_str();
+            } else
+            {
+                sig.type_name = AddressRange::TYPENAME;
+                sig.setAddressRangeStart(pool.start.c_str());
+                sig.setAddressRangeEnd(pool.end.c_str());
+            }
+            addr = address_maker->createObject(sig);
+        }
+
+        RuleElement* tsrc = rule->getTSrc();
+        assert(tsrc!=NULL);
+        if (addr) tsrc->addRef( addr );
+
+        RuleElement *itf_i_re = rule->getItfInb();
+        assert(itf_i_re!=NULL);
+        itf_i_re->addRef(post_intf);
+
+        RuleElement *itf_o_re = rule->getItfOutb();
+        assert(itf_o_re!=NULL);
+        itf_o_re->addRef(pre_intf);
+
+        // add it to the current ruleset
+        current_ruleset->ruleset->add(rule);
+        addStandardImportComment(rule, QString::fromUtf8(rule_comment.c_str()));
+    }
 
 }
-
diff --git a/src/parsers/PIXCfgLexer.cpp b/src/parsers/PIXCfgLexer.cpp
index 4659b6fc1..dbbb753fd 100644
--- a/src/parsers/PIXCfgLexer.cpp
+++ b/src/parsers/PIXCfgLexer.cpp
@@ -493,11 +493,11 @@ void PIXCfgLexer::mLINE_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop273;
+			goto _loop275;
 		}
 		
 	}
-	_loop273:;
+	_loop275:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -529,7 +529,7 @@ void PIXCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 2317 "pix.g"
+#line 2327 "pix.g"
 		newline();
 #line 535 "PIXCfgLexer.cpp"
 	}
@@ -555,11 +555,11 @@ void PIXCfgLexer::mCOLON_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop277;
+			goto _loop279;
 		}
 		
 	}
-	_loop277:;
+	_loop279:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -653,7 +653,7 @@ void PIXCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 2312 "pix.g"
+#line 2322 "pix.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
 #line 659 "PIXCfgLexer.cpp"
 	}
@@ -777,10 +777,10 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
 	{
-	bool synPredMatched338 = false;
+	bool synPredMatched340 = false;
 	if (((LA(1) == 0x6f /* 'o' */ ) && (LA(2) == 0x62 /* 'b' */ ) && (LA(3) == 0x6a /* 'j' */ ))) {
-		int _m338 = mark();
-		synPredMatched338 = true;
+		int _m340 = mark();
+		synPredMatched340 = true;
 		inputState->guessing++;
 		try {
 			{
@@ -789,12 +789,12 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}
 		}
 		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched338 = false;
+			synPredMatched340 = false;
 		}
-		rewind(_m338);
+		rewind(_m340);
 		inputState->guessing--;
 	}
-	if ( synPredMatched338 ) {
+	if ( synPredMatched340 ) {
 		{
 		match("object");
 		{
@@ -804,7 +804,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			match("oup");
 			}
 			if ( inputState->guessing==0 ) {
-#line 2369 "pix.g"
+#line 2379 "pix.g"
 				_ttype = OBJECT_GROUP;
 #line 810 "PIXCfgLexer.cpp"
 			}
@@ -812,7 +812,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		else {
 			match("");
 			if ( inputState->guessing==0 ) {
-#line 2371 "pix.g"
+#line 2381 "pix.g"
 				_ttype = OBJECT;
 #line 818 "PIXCfgLexer.cpp"
 			}
@@ -822,15 +822,15 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		}
 	}
 	else {
-		bool synPredMatched328 = false;
+		bool synPredMatched330 = false;
 		if (((_tokenSet_2.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
-			int _m328 = mark();
-			synPredMatched328 = true;
+			int _m330 = mark();
+			synPredMatched330 = true;
 			inputState->guessing++;
 			try {
 				{
 				{ // ( ... )+
-				int _cnt327=0;
+				int _cnt329=0;
 				for (;;) {
 					switch ( LA(1)) {
 					case 0x61 /* 'a' */ :
@@ -859,27 +859,27 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}
 					default:
 					{
-						if ( _cnt327>=1 ) { goto _loop327; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt329>=1 ) { goto _loop329; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					}
-					_cnt327++;
+					_cnt329++;
 				}
-				_loop327:;
+				_loop329:;
 				}  // ( ... )+
 				mCOLON(false);
 				}
 			}
 			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched328 = false;
+				synPredMatched330 = false;
 			}
-			rewind(_m328);
+			rewind(_m330);
 			inputState->guessing--;
 		}
-		if ( synPredMatched328 ) {
+		if ( synPredMatched330 ) {
 			{
 			{
 			{ // ( ... )+
-			int _cnt332=0;
+			int _cnt334=0;
 			for (;;) {
 				switch ( LA(1)) {
 				case 0x61 /* 'a' */ :
@@ -908,15 +908,15 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				}
 				default:
 				{
-					if ( _cnt332>=1 ) { goto _loop332; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt334>=1 ) { goto _loop334; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				}
-				_cnt332++;
+				_cnt334++;
 			}
-			_loop332:;
+			_loop334:;
 			}  // ( ... )+
 			{ // ( ... )+
-			int _cnt336=0;
+			int _cnt338=0;
 			for (;;) {
 				if ((LA(1) == 0x3a /* ':' */ )) {
 					mCOLON(false);
@@ -949,34 +949,34 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						default:
 						{
-							goto _loop335;
+							goto _loop337;
 						}
 						}
 					}
-					_loop335:;
+					_loop337:;
 					} // ( ... )*
 				}
 				else {
-					if ( _cnt336>=1 ) { goto _loop336; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt338>=1 ) { goto _loop338; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				
-				_cnt336++;
+				_cnt338++;
 			}
-			_loop336:;
+			_loop338:;
 			}  // ( ... )+
 			}
 			if ( inputState->guessing==0 ) {
-#line 2362 "pix.g"
+#line 2372 "pix.g"
 				_ttype = IPV6;
 #line 972 "PIXCfgLexer.cpp"
 			}
 			}
 		}
 		else {
-			bool synPredMatched293 = false;
+			bool synPredMatched295 = false;
 			if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true))) {
-				int _m293 = mark();
-				synPredMatched293 = true;
+				int _m295 = mark();
+				synPredMatched295 = true;
 				inputState->guessing++;
 				try {
 					{
@@ -984,36 +984,21 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}
 				}
 				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched293 = false;
+					synPredMatched295 = false;
 				}
-				rewind(_m293);
+				rewind(_m295);
 				inputState->guessing--;
 			}
-			if ( synPredMatched293 ) {
+			if ( synPredMatched295 ) {
 				{
-				bool synPredMatched302 = false;
+				bool synPredMatched304 = false;
 				if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
-					int _m302 = mark();
-					synPredMatched302 = true;
+					int _m304 = mark();
+					synPredMatched304 = true;
 					inputState->guessing++;
 					try {
 						{
 						{ // ( ... )+
-						int _cnt297=0;
-						for (;;) {
-							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-								mDIGIT(false);
-							}
-							else {
-								if ( _cnt297>=1 ) { goto _loop297; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-							}
-							
-							_cnt297++;
-						}
-						_loop297:;
-						}  // ( ... )+
-						mDOT(false);
-						{ // ( ... )+
 						int _cnt299=0;
 						for (;;) {
 							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -1042,32 +1027,32 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						_loop301:;
 						}  // ( ... )+
+						mDOT(false);
+						{ // ( ... )+
+						int _cnt303=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt303>=1 ) { goto _loop303; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt303++;
+						}
+						_loop303:;
+						}  // ( ... )+
 						}
 					}
 					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched302 = false;
+						synPredMatched304 = false;
 					}
-					rewind(_m302);
+					rewind(_m304);
 					inputState->guessing--;
 				}
-				if ( synPredMatched302 ) {
+				if ( synPredMatched304 ) {
 					{
 					{ // ( ... )+
-					int _cnt305=0;
-					for (;;) {
-						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-							mDIGIT(false);
-						}
-						else {
-							if ( _cnt305>=1 ) { goto _loop305; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt305++;
-					}
-					_loop305:;
-					}  // ( ... )+
-					mDOT(false);
-					{ // ( ... )+
 					int _cnt307=0;
 					for (;;) {
 						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -1111,37 +1096,37 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}
 					_loop311:;
 					}  // ( ... )+
+					mDOT(false);
+					{ // ( ... )+
+					int _cnt313=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt313>=1 ) { goto _loop313; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt313++;
+					}
+					_loop313:;
+					}  // ( ... )+
 					}
 					if ( inputState->guessing==0 ) {
-#line 2350 "pix.g"
+#line 2360 "pix.g"
 						_ttype = IPV4;
 #line 1119 "PIXCfgLexer.cpp"
 					}
 				}
 				else {
-					bool synPredMatched317 = false;
+					bool synPredMatched319 = false;
 					if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_4.member(LA(2))) && (_tokenSet_4.member(LA(3))))) {
-						int _m317 = mark();
-						synPredMatched317 = true;
+						int _m319 = mark();
+						synPredMatched319 = true;
 						inputState->guessing++;
 						try {
 							{
 							{ // ( ... )+
-							int _cnt314=0;
-							for (;;) {
-								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-									mDIGIT(false);
-								}
-								else {
-									if ( _cnt314>=1 ) { goto _loop314; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-								}
-								
-								_cnt314++;
-							}
-							_loop314:;
-							}  // ( ... )+
-							mDOT(false);
-							{ // ( ... )+
 							int _cnt316=0;
 							for (;;) {
 								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -1155,32 +1140,32 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 							}
 							_loop316:;
 							}  // ( ... )+
+							mDOT(false);
+							{ // ( ... )+
+							int _cnt318=0;
+							for (;;) {
+								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+									mDIGIT(false);
+								}
+								else {
+									if ( _cnt318>=1 ) { goto _loop318; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								}
+								
+								_cnt318++;
+							}
+							_loop318:;
+							}  // ( ... )+
 							}
 						}
 						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-							synPredMatched317 = false;
+							synPredMatched319 = false;
 						}
-						rewind(_m317);
+						rewind(_m319);
 						inputState->guessing--;
 					}
-					if ( synPredMatched317 ) {
+					if ( synPredMatched319 ) {
 						{
 						{ // ( ... )+
-						int _cnt320=0;
-						for (;;) {
-							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-								mDIGIT(false);
-							}
-							else {
-								if ( _cnt320>=1 ) { goto _loop320; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-							}
-							
-							_cnt320++;
-						}
-						_loop320:;
-						}  // ( ... )+
-						mDOT(false);
-						{ // ( ... )+
 						int _cnt322=0;
 						for (;;) {
 							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -1194,14 +1179,7 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						_loop322:;
 						}  // ( ... )+
-						}
-						if ( inputState->guessing==0 ) {
-#line 2353 "pix.g"
-							_ttype = NUMBER;
-#line 1202 "PIXCfgLexer.cpp"
-						}
-					}
-					else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
+						mDOT(false);
 						{ // ( ... )+
 						int _cnt324=0;
 						for (;;) {
@@ -1216,8 +1194,30 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						_loop324:;
 						}  // ( ... )+
+						}
 						if ( inputState->guessing==0 ) {
-#line 2355 "pix.g"
+#line 2363 "pix.g"
+							_ttype = NUMBER;
+#line 1202 "PIXCfgLexer.cpp"
+						}
+					}
+					else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
+						{ // ( ... )+
+						int _cnt326=0;
+						for (;;) {
+							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+								mDIGIT(false);
+							}
+							else {
+								if ( _cnt326>=1 ) { goto _loop326; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt326++;
+						}
+						_loop326:;
+						}  // ( ... )+
+						if ( inputState->guessing==0 ) {
+#line 2365 "pix.g"
 							_ttype = INT_CONST;
 #line 1223 "PIXCfgLexer.cpp"
 						}
@@ -1472,14 +1472,14 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}
 					default:
 					{
-						goto _loop344;
+						goto _loop346;
 					}
 					}
 				}
-				_loop344:;
+				_loop346:;
 				} // ( ... )*
 				if ( inputState->guessing==0 ) {
-#line 2380 "pix.g"
+#line 2390 "pix.g"
 					_ttype = WORD;
 #line 1485 "PIXCfgLexer.cpp"
 				}
@@ -1523,11 +1523,11 @@ void PIXCfgLexer::mSTRING(bool _createToken) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop347;
+			goto _loop349;
 		}
 		
 	}
-	_loop347:;
+	_loop349:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
diff --git a/src/parsers/PIXCfgParser.cpp b/src/parsers/PIXCfgParser.cpp
index d70830e80..228bf40ec 100644
--- a/src/parsers/PIXCfgParser.cpp
+++ b/src/parsers/PIXCfgParser.cpp
@@ -281,7 +281,7 @@ void PIXCfgParser::version() {
 		match(VERSION_WORD_CAP);
 		match(NUMBER);
 		if ( inputState->guessing==0 ) {
-#line 845 "pix.g"
+#line 836 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->setDiscoveredVersion(LT(0)->getText());
@@ -324,7 +324,7 @@ void PIXCfgParser::hostname() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 855 "pix.g"
+#line 846 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->setHostName( LT(0)->getText() );
@@ -374,7 +374,7 @@ void PIXCfgParser::unknown_ip_command() {
 		match(IP);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 807 "pix.g"
+#line 798 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			
@@ -419,7 +419,7 @@ void PIXCfgParser::intrface() {
 }
 
 void PIXCfgParser::nameif_top_level() {
-#line 1408 "pix.g"
+#line 1399 "pix.g"
 	
 	std::string intf_name, intf_label, sec_level;
 	
@@ -429,24 +429,24 @@ void PIXCfgParser::nameif_top_level() {
 		match(NAMEIF);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 1413 "pix.g"
+#line 1404 "pix.g"
 			intf_name = LT(0)->getText();
 #line 435 "PIXCfgParser.cpp"
 		}
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1414 "pix.g"
+#line 1405 "pix.g"
 			intf_label = LT(0)->getText();
 #line 441 "PIXCfgParser.cpp"
 		}
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 1415 "pix.g"
+#line 1406 "pix.g"
 			sec_level = LT(0)->getText();
 #line 447 "PIXCfgParser.cpp"
 		}
 		if ( inputState->guessing==0 ) {
-#line 1416 "pix.g"
+#line 1407 "pix.g"
 			
 			importer->setInterfaceParametes(intf_name, intf_label, sec_level);
 			*dbg << " NAMEIF: "
@@ -472,7 +472,7 @@ void PIXCfgParser::controller() {
 	try {      // for error handling
 		match(CONTROLLER);
 		if ( inputState->guessing==0 ) {
-#line 1320 "pix.g"
+#line 1311 "pix.g"
 			
 			importer->clearCurrentInterface();
 			consumeUntil(NEWLINE);
@@ -498,7 +498,7 @@ void PIXCfgParser::access_list_commands() {
 		name = LT(1);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 867 "pix.g"
+#line 858 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -546,7 +546,7 @@ void PIXCfgParser::access_list_commands() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 890 "pix.g"
+#line 881 "pix.g"
 			
 			*dbg << LT(0)->getLine() << ":"
 			<< " ACL line end" << std::endl << std::endl;
@@ -569,7 +569,7 @@ void PIXCfgParser::ssh_command() {
 	try {      // for error handling
 		match(SSH);
 		if ( inputState->guessing==0 ) {
-#line 1655 "pix.g"
+#line 1646 "pix.g"
 			
 			importer->clear();
 			
@@ -584,7 +584,7 @@ void PIXCfgParser::ssh_command() {
 			match(INT_CONST);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1660 "pix.g"
+#line 1651 "pix.g"
 				
 				// set ssh timeout here
 				
@@ -612,7 +612,7 @@ void PIXCfgParser::ssh_command() {
 			{
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1670 "pix.g"
+#line 1661 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -621,7 +621,7 @@ void PIXCfgParser::ssh_command() {
 			interface_label();
 			}
 			if ( inputState->guessing==0 ) {
-#line 1675 "pix.g"
+#line 1666 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "ssh_commands_" + intf_label;
@@ -664,7 +664,7 @@ void PIXCfgParser::telnet_command() {
 	try {      // for error handling
 		match(TELNET);
 		if ( inputState->guessing==0 ) {
-#line 1695 "pix.g"
+#line 1686 "pix.g"
 			
 			importer->clear();
 			
@@ -690,7 +690,7 @@ void PIXCfgParser::telnet_command() {
 			{
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1702 "pix.g"
+#line 1693 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -699,7 +699,7 @@ void PIXCfgParser::telnet_command() {
 			interface_label();
 			}
 			if ( inputState->guessing==0 ) {
-#line 1707 "pix.g"
+#line 1698 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "telnet_commands_" + intf_label;
@@ -750,7 +750,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			{
 			match(UNREACHABLE);
 			if ( inputState->guessing==0 ) {
-#line 1736 "pix.g"
+#line 1727 "pix.g"
 				
 				consumeUntil(NEWLINE);
 				
@@ -784,7 +784,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1743 "pix.g"
+#line 1734 "pix.g"
 				
 				importer->clear();
 				
@@ -792,7 +792,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1747 "pix.g"
+#line 1738 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -822,7 +822,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			interface_label();
 			if ( inputState->guessing==0 ) {
-#line 1752 "pix.g"
+#line 1743 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "icmp_commands_" + intf_label;
@@ -864,6 +864,13 @@ void PIXCfgParser::nat_top_level_command() {
 	try {      // for error handling
 		match(NAT);
 		match(OPENING_PAREN);
+		if ( inputState->guessing==0 ) {
+#line 1829 "pix.g"
+			
+			importer->clear();
+			
+#line 873 "PIXCfgParser.cpp"
+		}
 		{
 		if ((LA(1) == WORD || LA(1) == OUTSIDE) && (LA(2) == CLOSING_PAREN)) {
 			nat_old_top_level_command();
@@ -893,27 +900,36 @@ void PIXCfgParser::global_top_level_command() {
 	try {      // for error handling
 		match(GLOBAL);
 		match(OPENING_PAREN);
+		if ( inputState->guessing==0 ) {
+#line 1922 "pix.g"
+			
+			importer->clear();
+			importer->setCurrentLineNumber(LT(0)->getLine());
+			
+#line 910 "PIXCfgParser.cpp"
+		}
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1918 "pix.g"
-			importer->global_pool_interface = LT(0)->getText();
-#line 901 "PIXCfgParser.cpp"
+#line 1927 "pix.g"
+			
+			importer->tmp_global_pool.interface = LT(0)->getText();
+			
+#line 918 "PIXCfgParser.cpp"
 		}
 		match(CLOSING_PAREN);
 		num = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1921 "pix.g"
+#line 1932 "pix.g"
 			
-			importer->clear();
-			importer->setCurrentLineNumber(LT(0)->getLine());
-			importer->global_pool_num = num->getText();
-			*dbg << " global address pool "
-			<< importer->global_pool_num
+			importer->tmp_global_pool.str_num = num->getText();
+			importer->tmp_global_pool.netmask = "255.255.255.255";
+			*dbg << " GLOBAL POOL "
+			<< importer->tmp_global_pool.str_num
 			<< " "
-			<< importer->global_pool_interface;
+			<< importer->tmp_global_pool.interface;
 			
-#line 917 "PIXCfgParser.cpp"
+#line 933 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -935,12 +951,12 @@ void PIXCfgParser::global_top_level_command() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1934 "pix.g"
+#line 1944 "pix.g"
 			
-			importer->global_pool_start = LT(0)->getText();
-			importer->global_pool_end = LT(0)->getText();
+			importer->tmp_global_pool.start = LT(0)->getText();
+			importer->tmp_global_pool.end = LT(0)->getText();
 			
-#line 944 "PIXCfgParser.cpp"
+#line 960 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -949,11 +965,11 @@ void PIXCfgParser::global_top_level_command() {
 			match(MINUS);
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 1942 "pix.g"
+#line 1952 "pix.g"
 				
-				importer->global_pool_end = LT(0)->getText();
+				importer->tmp_global_pool.end = LT(0)->getText();
 				
-#line 957 "PIXCfgParser.cpp"
+#line 973 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -975,11 +991,11 @@ void PIXCfgParser::global_top_level_command() {
 			match(NETMASK);
 			match(IPV4);
 			if ( inputState->guessing==0 ) {
-#line 1951 "pix.g"
+#line 1961 "pix.g"
 				
-				importer->global_pool_netmask = LT(0)->getText();
+				importer->tmp_global_pool.netmask = LT(0)->getText();
 				
-#line 983 "PIXCfgParser.cpp"
+#line 999 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -995,14 +1011,15 @@ void PIXCfgParser::global_top_level_command() {
 		}
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 1957 "pix.g"
+#line 1967 "pix.g"
 			
-			*dbg << " " << importer->global_pool_start
-			<< " " << importer->global_pool_end
-			<< " " << importer->global_pool_netmask
+			importer->addGlobalPool();
+			*dbg << " " << importer->tmp_global_pool.start
+			<< " " << importer->tmp_global_pool.end
+			<< " " << importer->tmp_global_pool.netmask
 			<< std::endl;
 			
-#line 1006 "PIXCfgParser.cpp"
+#line 1023 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1019,38 +1036,37 @@ void PIXCfgParser::static_top_level_command() {
 	
 	try {      // for error handling
 		match(STATIC);
+		match(OPENING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1967 "pix.g"
+#line 1979 "pix.g"
 			
 			importer->clear();
 			
-#line 1028 "PIXCfgParser.cpp"
+#line 1046 "PIXCfgParser.cpp"
 		}
-		match(OPENING_PAREN);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1971 "pix.g"
+#line 1982 "pix.g"
 			importer->prenat_interface = LT(0)->getText();
-#line 1035 "PIXCfgParser.cpp"
+#line 1052 "PIXCfgParser.cpp"
 		}
 		match(COMMA);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1973 "pix.g"
+#line 1984 "pix.g"
 			importer->postnat_interface = LT(0)->getText();
-#line 1042 "PIXCfgParser.cpp"
+#line 1059 "PIXCfgParser.cpp"
 		}
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1975 "pix.g"
+#line 1986 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
-			importer->newNATRule();
 			*dbg << " DNAT rule ";
 			importer->rule_type = libfwbuilder::NATRule::DNAT;
 			
-#line 1054 "PIXCfgParser.cpp"
+#line 1070 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -1075,12 +1091,12 @@ void PIXCfgParser::static_top_level_command() {
 		}
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 1992 "pix.g"
+#line 2002 "pix.g"
 			
 			importer->pushNATRule();
 			*dbg << std::endl;
 			
-#line 1084 "PIXCfgParser.cpp"
+#line 1100 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1106,7 +1122,7 @@ void PIXCfgParser::access_group() {
 		match(INTRFACE);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1811 "pix.g"
+#line 1802 "pix.g"
 			
 			std::string intf_label = LT(0)->getText();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1119,7 +1135,7 @@ void PIXCfgParser::access_group() {
 			<< " " << intf_label
 			<< " " << dir->getText() << std::endl;
 			
-#line 1123 "PIXCfgParser.cpp"
+#line 1139 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1153,12 +1169,12 @@ void PIXCfgParser::certificate() {
 		match(CERTIFICATE);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 837 "pix.g"
+#line 828 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			consumeUntil(QUIT);
 			
-#line 1162 "PIXCfgParser.cpp"
+#line 1178 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1180,7 +1196,7 @@ void PIXCfgParser::quit() {
 			
 			consumeUntil(NEWLINE);
 			
-#line 1184 "PIXCfgParser.cpp"
+#line 1200 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1206,7 +1222,7 @@ void PIXCfgParser::names_section() {
 			"Import of configuration that uses \"names\" "
 			"is not supported at this time");
 			
-#line 1210 "PIXCfgParser.cpp"
+#line 1226 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1265,7 +1281,7 @@ void PIXCfgParser::name_entry() {
 			consumeUntil(NEWLINE);
 			}
 			
-#line 1269 "PIXCfgParser.cpp"
+#line 1285 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1296,7 +1312,7 @@ void PIXCfgParser::named_object_network() {
 			*dbg << name->getLine() << ":"
 			<< " Named Object " << name->getText() << std::endl;
 			
-#line 1300 "PIXCfgParser.cpp"
+#line 1316 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1345,7 +1361,7 @@ void PIXCfgParser::named_object_service() {
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 368 "pix.g"
+#line 359 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1353,7 +1369,7 @@ void PIXCfgParser::named_object_service() {
 			*dbg << name->getLine() << ":"
 			<< " Named Object " << name->getText() << std::endl;
 			
-#line 1357 "PIXCfgParser.cpp"
+#line 1373 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1388,7 +1404,7 @@ void PIXCfgParser::object_group_network() {
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 484 "pix.g"
+#line 475 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1396,7 +1412,7 @@ void PIXCfgParser::object_group_network() {
 			*dbg << name->getLine() << ":"
 			<< " Object Group " << name->getText() << std::endl;
 			
-#line 1400 "PIXCfgParser.cpp"
+#line 1416 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1464,7 +1480,7 @@ void PIXCfgParser::object_group_service() {
 		}
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 706 "pix.g"
+#line 697 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1475,7 +1491,7 @@ void PIXCfgParser::object_group_service() {
 			*dbg << name->getLine() << ":"
 			<< " Object Group " << name->getText() << std::endl;
 			
-#line 1479 "PIXCfgParser.cpp"
+#line 1495 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1510,7 +1526,7 @@ void PIXCfgParser::object_group_protocol() {
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 582 "pix.g"
+#line 573 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1518,7 +1534,7 @@ void PIXCfgParser::object_group_protocol() {
 			*dbg << name->getLine() << ":"
 			<< " Object Group " << name->getText() << std::endl;
 			
-#line 1522 "PIXCfgParser.cpp"
+#line 1538 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )+
 		int _cnt61=0;
@@ -1555,7 +1571,7 @@ void PIXCfgParser::object_group_icmp_8_0() {
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 637 "pix.g"
+#line 628 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1563,7 +1579,7 @@ void PIXCfgParser::object_group_icmp_8_0() {
 			*dbg << name->getLine() << ":"
 			<< " Object Group " << name->getText() << std::endl;
 			
-#line 1567 "PIXCfgParser.cpp"
+#line 1583 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1598,7 +1614,7 @@ void PIXCfgParser::object_group_icmp_8_3() {
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 650 "pix.g"
+#line 641 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1606,7 +1622,7 @@ void PIXCfgParser::object_group_icmp_8_3() {
 			*dbg << name->getLine() << ":"
 			<< " Object Group " << name->getText() << std::endl;
 			
-#line 1610 "PIXCfgParser.cpp"
+#line 1626 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
@@ -1636,11 +1652,11 @@ void PIXCfgParser::crypto() {
 	try {      // for error handling
 		match(CRYPTO);
 		if ( inputState->guessing==0 ) {
-#line 800 "pix.g"
+#line 791 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			
-#line 1644 "PIXCfgParser.cpp"
+#line 1660 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1658,13 +1674,13 @@ void PIXCfgParser::no_commands() {
 	try {      // for error handling
 		match(NO);
 		if ( inputState->guessing==0 ) {
-#line 828 "pix.g"
+#line 819 "pix.g"
 			
 			*dbg << " TOP LEVEL \"NO\" COMMAND: "
 			<< LT(0)->getText() << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 1668 "PIXCfgParser.cpp"
+#line 1684 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1686,7 +1702,7 @@ void PIXCfgParser::timeout_command() {
 			
 			consumeUntil(NEWLINE);
 			
-#line 1690 "PIXCfgParser.cpp"
+#line 1706 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1704,11 +1720,11 @@ void PIXCfgParser::dns_command() {
 	try {      // for error handling
 		match(DNS);
 		if ( inputState->guessing==0 ) {
-#line 821 "pix.g"
+#line 812 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			
-#line 1712 "PIXCfgParser.cpp"
+#line 1728 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1726,11 +1742,11 @@ void PIXCfgParser::unknown_command() {
 	try {      // for error handling
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 814 "pix.g"
+#line 805 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			
-#line 1734 "PIXCfgParser.cpp"
+#line 1750 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1847,13 +1863,14 @@ void PIXCfgParser::named_object_nat() {
 		if ( inputState->guessing==0 ) {
 #line 278 "pix.g"
 			
+			*dbg << "Named object with singleton nat command" << std::endl;
 			importer->addMessageToLog(
 			"Parser warning: "
 			"Import of named objects with \"nat\" command "
 			"is not supported at this time");
 			consumeUntil(NEWLINE);
 			
-#line 1857 "PIXCfgParser.cpp"
+#line 1874 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1871,7 +1888,7 @@ void PIXCfgParser::named_object_description() {
 	try {      // for error handling
 		match(DESCRIPTION);
 		if ( inputState->guessing==0 ) {
-#line 298 "pix.g"
+#line 289 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			*dbg << LT(1)->getLine() << ":";
@@ -1884,7 +1901,7 @@ void PIXCfgParser::named_object_description() {
 			importer->setNamedObjectDescription(descr);
 			*dbg << " DESCRIPTION " << descr << std::endl;
 			
-#line 1888 "PIXCfgParser.cpp"
+#line 1905 "PIXCfgParser.cpp"
 		}
 		match(NEWLINE);
 	}
@@ -1965,7 +1982,7 @@ void PIXCfgParser::range_addr() {
 		match(IPV4);
 		}
 		if ( inputState->guessing==0 ) {
-#line 336 "pix.g"
+#line 327 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->tmp_range_1 = r1->getText();
@@ -1973,13 +1990,13 @@ void PIXCfgParser::range_addr() {
 			importer->commitNamedAddressRangeObject();
 			*dbg << r1->getText() << "/" << r2->getText();
 			
-#line 1977 "PIXCfgParser.cpp"
+#line 1994 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2020,7 +2037,7 @@ void PIXCfgParser::subnet_addr() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 346 "pix.g"
+#line 337 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			if (a)
@@ -2037,13 +2054,13 @@ void PIXCfgParser::subnet_addr() {
 			consumeUntil(NEWLINE);
 			}
 			
-#line 2041 "PIXCfgParser.cpp"
+#line 2058 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2076,7 +2093,7 @@ void PIXCfgParser::single_addr() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 317 "pix.g"
+#line 308 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			if (h)
@@ -2093,13 +2110,13 @@ void PIXCfgParser::single_addr() {
 			consumeUntil(NEWLINE);
 			}
 			
-#line 2097 "PIXCfgParser.cpp"
+#line 2114 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_10);
+			recover(ex,_tokenSet_9);
 		} else {
 			throw;
 		}
@@ -2119,7 +2136,7 @@ void PIXCfgParser::named_object_service_parameters() {
 		else if ((LA(1) == SERVICE) && (LA(2) == TCP || LA(2) == UDP)) {
 			service_tcp_udp();
 		}
-		else if ((LA(1) == SERVICE) && (_tokenSet_11.member(LA(2)))) {
+		else if ((LA(1) == SERVICE) && (_tokenSet_10.member(LA(2)))) {
 			service_other();
 		}
 		else if ((LA(1) == SERVICE) && (LA(2) == WORD)) {
@@ -2138,7 +2155,7 @@ void PIXCfgParser::named_object_service_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_12);
+			recover(ex,_tokenSet_11);
 		} else {
 			throw;
 		}
@@ -2158,11 +2175,11 @@ void PIXCfgParser::service_icmp() {
 			icmp_type = LT(1);
 			match(INT_CONST);
 			if ( inputState->guessing==0 ) {
-#line 400 "pix.g"
+#line 391 "pix.g"
 				
 				importer->icmp_type = LT(0)->getText();
 				
-#line 2166 "PIXCfgParser.cpp"
+#line 2183 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -2188,11 +2205,11 @@ void PIXCfgParser::service_icmp() {
 		{
 			icmp_names();
 			if ( inputState->guessing==0 ) {
-#line 405 "pix.g"
+#line 396 "pix.g"
 				
 				importer->icmp_spec = LT(0)->getText();
 				
-#line 2196 "PIXCfgParser.cpp"
+#line 2213 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -2203,19 +2220,19 @@ void PIXCfgParser::service_icmp() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 409 "pix.g"
+#line 400 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->commitNamedICMPServiceObject();
 			*dbg << "NAMED OBJECT SERVICE ICMP " << LT(0)->getText() << " ";
 			
-#line 2213 "PIXCfgParser.cpp"
+#line 2230 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2246,7 +2263,7 @@ void PIXCfgParser::service_icmp6() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 417 "pix.g"
+#line 408 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->addMessageToLog("Parser warning: "
@@ -2255,13 +2272,13 @@ void PIXCfgParser::service_icmp6() {
 			*dbg << "NAMED OBJECT SERVICE ICMP6 " << LT(0)->getText() << " ";
 			consumeUntil(NEWLINE);
 			
-#line 2259 "PIXCfgParser.cpp"
+#line 2276 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2291,12 +2308,12 @@ void PIXCfgParser::service_tcp_udp() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 428 "pix.g"
+#line 419 "pix.g"
 			
 			importer->protocol = LT(0)->getText();
 			*dbg << "NAMED OBJECT SERVICE " << LT(0)->getText() << " ";
 			
-#line 2300 "PIXCfgParser.cpp"
+#line 2317 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -2344,18 +2361,18 @@ void PIXCfgParser::service_tcp_udp() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 434 "pix.g"
+#line 425 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->commitNamedTCPUDPServiceObject();
 			
-#line 2353 "PIXCfgParser.cpp"
+#line 2370 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2399,20 +2416,20 @@ void PIXCfgParser::service_other() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 453 "pix.g"
+#line 444 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->protocol = LT(0)->getText();
 			importer->commitNamedIPServiceObject();
 			*dbg << "NAMED OBJECT SERVICE " << LT(0)->getText() << " ";
 			
-#line 2410 "PIXCfgParser.cpp"
+#line 2427 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2425,7 +2442,7 @@ void PIXCfgParser::service_unknown() {
 		match(SERVICE);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 468 "pix.g"
+#line 459 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->protocol = "ip";
@@ -2436,13 +2453,13 @@ void PIXCfgParser::service_unknown() {
 			importer->addMessageToLog(err);
 			*dbg << "UNKNOWN SERVICE " << LT(0)->getText() << " ";
 			
-#line 2440 "PIXCfgParser.cpp"
+#line 2457 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2559,7 +2576,7 @@ void PIXCfgParser::icmp_names() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_13);
+			recover(ex,_tokenSet_12);
 		} else {
 			throw;
 		}
@@ -2572,17 +2589,17 @@ void PIXCfgParser::src_port_spec() {
 		match(SOURCE);
 		xoperator();
 		if ( inputState->guessing==0 ) {
-#line 441 "pix.g"
+#line 432 "pix.g"
 			
 			importer->SaveTmpPortToSrc();
 			
-#line 2580 "PIXCfgParser.cpp"
+#line 2597 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_14);
+			recover(ex,_tokenSet_13);
 		} else {
 			throw;
 		}
@@ -2615,17 +2632,17 @@ void PIXCfgParser::dst_port_spec() {
 		}
 		xoperator();
 		if ( inputState->guessing==0 ) {
-#line 447 "pix.g"
+#line 438 "pix.g"
 			
 			importer->SaveTmpPortToDst();
 			
-#line 2623 "PIXCfgParser.cpp"
+#line 2640 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2658,7 +2675,7 @@ void PIXCfgParser::xoperator() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_15);
+			recover(ex,_tokenSet_14);
 		} else {
 			throw;
 		}
@@ -2696,7 +2713,7 @@ void PIXCfgParser::object_group_network_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_16);
+			recover(ex,_tokenSet_15);
 		} else {
 			throw;
 		}
@@ -2708,7 +2725,7 @@ void PIXCfgParser::object_group_description() {
 	try {      // for error handling
 		match(DESCRIPTION);
 		if ( inputState->guessing==0 ) {
-#line 508 "pix.g"
+#line 499 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			*dbg << LT(1)->getLine() << ":";
@@ -2721,13 +2738,13 @@ void PIXCfgParser::object_group_description() {
 			importer->setObjectGroupDescription(descr);
 			*dbg << " DESCRIPTION " << descr << std::endl;
 			
-#line 2725 "PIXCfgParser.cpp"
+#line 2742 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2742,20 +2759,20 @@ void PIXCfgParser::group_object() {
 		name = LT(1);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 523 "pix.g"
+#line 514 "pix.g"
 			
 			importer->clearTempVars();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->addNamedObjectToObjectGroup(name->getText());
 			*dbg << " GROUP MEMBER " << name->getLine() << std::endl;
 			
-#line 2753 "PIXCfgParser.cpp"
+#line 2770 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2773,12 +2790,12 @@ void PIXCfgParser::network_object() {
 	try {      // for error handling
 		match(NETWORK_OBJECT);
 		if ( inputState->guessing==0 ) {
-#line 532 "pix.g"
+#line 523 "pix.g"
 			
 			importer->clearTempVars();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			
-#line 2782 "PIXCfgParser.cpp"
+#line 2799 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -2810,7 +2827,7 @@ void PIXCfgParser::network_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 538 "pix.g"
+#line 529 "pix.g"
 				
 				if (a)
 				{
@@ -2826,7 +2843,7 @@ void PIXCfgParser::network_object() {
 				consumeUntil(NEWLINE);
 				}
 				
-#line 2830 "PIXCfgParser.cpp"
+#line 2847 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -2854,7 +2871,7 @@ void PIXCfgParser::network_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 555 "pix.g"
+#line 546 "pix.g"
 				
 				if (h)
 				{
@@ -2870,7 +2887,7 @@ void PIXCfgParser::network_object() {
 				consumeUntil(NEWLINE);
 				}
 				
-#line 2874 "PIXCfgParser.cpp"
+#line 2891 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -2880,12 +2897,12 @@ void PIXCfgParser::network_object() {
 			name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 572 "pix.g"
+#line 563 "pix.g"
 				
 				importer->addNamedObjectToObjectGroup(name->getText());
 				*dbg << " GROUP MEMBER " << name->getLine() << std::endl;
 				
-#line 2889 "PIXCfgParser.cpp"
+#line 2906 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -2899,7 +2916,7 @@ void PIXCfgParser::network_object() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -2937,7 +2954,7 @@ void PIXCfgParser::object_group_protocol_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_17);
+			recover(ex,_tokenSet_16);
 		} else {
 			throw;
 		}
@@ -2950,12 +2967,12 @@ void PIXCfgParser::protocol_object() {
 	try {      // for error handling
 		match(PROTOCOL_OBJECT);
 		if ( inputState->guessing==0 ) {
-#line 606 "pix.g"
+#line 597 "pix.g"
 			
 			importer->clearTempVars();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			
-#line 2959 "PIXCfgParser.cpp"
+#line 2976 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -3027,14 +3044,14 @@ void PIXCfgParser::protocol_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 612 "pix.g"
+#line 603 "pix.g"
 				
 				importer->setCurrentLineNumber(LT(0)->getLine());
 				importer->protocol = LT(0)->getText();
 				importer->addIPServiceToObjectGroup();
 				*dbg << " GROUP MEMBER " << LT(0)->getText() << " ";
 				
-#line 3038 "PIXCfgParser.cpp"
+#line 3055 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3042,13 +3059,13 @@ void PIXCfgParser::protocol_object() {
 		{
 			match(ICMP6);
 			if ( inputState->guessing==0 ) {
-#line 620 "pix.g"
+#line 611 "pix.g"
 				
 				importer->addMessageToLog(
 				"Parser warning: IPv6 import is not supported. ");
 				consumeUntil(NEWLINE);
 				
-#line 3052 "PIXCfgParser.cpp"
+#line 3069 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3058,12 +3075,12 @@ void PIXCfgParser::protocol_object() {
 			name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 627 "pix.g"
+#line 618 "pix.g"
 				
 				importer->addNamedObjectToObjectGroup(name->getText());
 				*dbg << " GROUP MEMBER " << name->getLine() << std::endl;
 				
-#line 3067 "PIXCfgParser.cpp"
+#line 3084 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3077,7 +3094,7 @@ void PIXCfgParser::protocol_object() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -3115,7 +3132,7 @@ void PIXCfgParser::object_group_icmp_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_18);
+			recover(ex,_tokenSet_17);
 		} else {
 			throw;
 		}
@@ -3129,12 +3146,12 @@ void PIXCfgParser::icmp_object() {
 	try {      // for error handling
 		match(ICMP_OBJECT);
 		if ( inputState->guessing==0 ) {
-#line 674 "pix.g"
+#line 665 "pix.g"
 			
 			importer->clearTempVars();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			
-#line 3138 "PIXCfgParser.cpp"
+#line 3155 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -3166,11 +3183,11 @@ void PIXCfgParser::icmp_object() {
 				icmp_type = LT(1);
 				match(INT_CONST);
 				if ( inputState->guessing==0 ) {
-#line 681 "pix.g"
+#line 672 "pix.g"
 					
 					importer->icmp_type = LT(0)->getText();
 					
-#line 3174 "PIXCfgParser.cpp"
+#line 3191 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -3196,11 +3213,11 @@ void PIXCfgParser::icmp_object() {
 			{
 				icmp_names();
 				if ( inputState->guessing==0 ) {
-#line 686 "pix.g"
+#line 677 "pix.g"
 					
 					importer->icmp_spec = LT(0)->getText();
 					
-#line 3204 "PIXCfgParser.cpp"
+#line 3221 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -3211,12 +3228,12 @@ void PIXCfgParser::icmp_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 690 "pix.g"
+#line 681 "pix.g"
 				
 				importer->addICMPServiceToObjectGroup();
 				*dbg << " SERVICE ICMP " << LT(0)->getText() << " ";
 				
-#line 3220 "PIXCfgParser.cpp"
+#line 3237 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3226,12 +3243,12 @@ void PIXCfgParser::icmp_object() {
 			name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 696 "pix.g"
+#line 687 "pix.g"
 				
 				importer->addNamedObjectToObjectGroup(name->getText());
 				*dbg << " GROUP MEMBER " << name->getLine() << std::endl;
 				
-#line 3235 "PIXCfgParser.cpp"
+#line 3252 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3245,7 +3262,7 @@ void PIXCfgParser::icmp_object() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -3288,7 +3305,7 @@ void PIXCfgParser::object_group_service_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_19);
+			recover(ex,_tokenSet_18);
 		} else {
 			throw;
 		}
@@ -3302,12 +3319,12 @@ void PIXCfgParser::service_object() {
 	try {      // for error handling
 		match(SERVICE_OBJECT);
 		if ( inputState->guessing==0 ) {
-#line 735 "pix.g"
+#line 726 "pix.g"
 			
 			importer->clearTempVars();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			
-#line 3311 "PIXCfgParser.cpp"
+#line 3328 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -3361,14 +3378,14 @@ void PIXCfgParser::service_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 741 "pix.g"
+#line 732 "pix.g"
 				
 				importer->setCurrentLineNumber(LT(0)->getLine());
 				importer->protocol = LT(0)->getText();
 				importer->addIPServiceToObjectGroup();
 				*dbg << " GROUP MEMBER " << LT(0)->getText() << " ";
 				
-#line 3372 "PIXCfgParser.cpp"
+#line 3389 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3400,12 +3417,12 @@ void PIXCfgParser::service_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 749 "pix.g"
+#line 740 "pix.g"
 				
 				importer->protocol = LT(0)->getText();
 				*dbg << " SERVICE TCP/UDP" << LT(0)->getText() << " ";
 				
-#line 3409 "PIXCfgParser.cpp"
+#line 3426 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -3453,11 +3470,11 @@ void PIXCfgParser::service_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 755 "pix.g"
+#line 746 "pix.g"
 				
 				importer->addTCPUDPServiceToObjectGroup();
 				
-#line 3461 "PIXCfgParser.cpp"
+#line 3478 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3471,11 +3488,11 @@ void PIXCfgParser::service_object() {
 				icmp_type = LT(1);
 				match(INT_CONST);
 				if ( inputState->guessing==0 ) {
-#line 762 "pix.g"
+#line 753 "pix.g"
 					
 					importer->icmp_type = LT(0)->getText();
 					
-#line 3479 "PIXCfgParser.cpp"
+#line 3496 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -3501,11 +3518,11 @@ void PIXCfgParser::service_object() {
 			{
 				icmp_names();
 				if ( inputState->guessing==0 ) {
-#line 767 "pix.g"
+#line 758 "pix.g"
 					
 					importer->icmp_spec = LT(0)->getText();
 					
-#line 3509 "PIXCfgParser.cpp"
+#line 3526 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -3516,12 +3533,12 @@ void PIXCfgParser::service_object() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 771 "pix.g"
+#line 762 "pix.g"
 				
 				importer->addICMPServiceToObjectGroup();
 				*dbg << " SERVICE ICMP " << LT(0)->getText() << " ";
 				
-#line 3525 "PIXCfgParser.cpp"
+#line 3542 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3531,12 +3548,12 @@ void PIXCfgParser::service_object() {
 			name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 777 "pix.g"
+#line 768 "pix.g"
 				
 				importer->addNamedObjectToObjectGroup(name->getText());
 				*dbg << " GROUP MEMBER " << name->getLine() << std::endl;
 				
-#line 3540 "PIXCfgParser.cpp"
+#line 3557 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -3550,7 +3567,7 @@ void PIXCfgParser::service_object() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -3558,18 +3575,18 @@ void PIXCfgParser::service_object() {
 }
 
 void PIXCfgParser::port_object() {
-#line 784 "pix.g"
+#line 775 "pix.g"
 	
 	importer->tmp_port_spec = "";
 	importer->tmp_port_spec_2 = "";
 	
-#line 3567 "PIXCfgParser.cpp"
+#line 3584 "PIXCfgParser.cpp"
 	
 	try {      // for error handling
 		match(PORT_OBJECT);
 		xoperator();
 		if ( inputState->guessing==0 ) {
-#line 789 "pix.g"
+#line 780 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			*dbg << " PORT OBJECT TCP/UDP " << LT(0)->getText() << " " << std::endl;
@@ -3577,13 +3594,13 @@ void PIXCfgParser::port_object() {
 			importer->addTCPUDPServiceToObjectGroup();
 			*dbg << std::endl;
 			
-#line 3581 "PIXCfgParser.cpp"
+#line 3598 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -3612,23 +3629,23 @@ void PIXCfgParser::permit_extended() {
 		}
 		match(PERMIT);
 		if ( inputState->guessing==0 ) {
-#line 898 "pix.g"
+#line 889 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newPolicyRule();
 			importer->action = "permit";
 			*dbg << LT(1)->getLine() << ":" << " permit ";
 			
-#line 3623 "PIXCfgParser.cpp"
+#line 3640 "PIXCfgParser.cpp"
 		}
 		rule_extended();
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 905 "pix.g"
+#line 896 "pix.g"
 			
 			importer->pushRule();
 			
-#line 3632 "PIXCfgParser.cpp"
+#line 3649 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -3663,23 +3680,23 @@ void PIXCfgParser::deny_extended() {
 		}
 		match(DENY);
 		if ( inputState->guessing==0 ) {
-#line 911 "pix.g"
+#line 902 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newPolicyRule();
 			importer->action = "deny";
 			*dbg << LT(1)->getLine() << ":" << " deny   ";
 			
-#line 3674 "PIXCfgParser.cpp"
+#line 3691 "PIXCfgParser.cpp"
 		}
 		rule_extended();
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 918 "pix.g"
+#line 909 "pix.g"
 			
 			importer->pushRule();
 			
-#line 3683 "PIXCfgParser.cpp"
+#line 3700 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -3698,23 +3715,23 @@ void PIXCfgParser::permit_standard() {
 		match(STANDARD);
 		match(PERMIT);
 		if ( inputState->guessing==0 ) {
-#line 924 "pix.g"
+#line 915 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newPolicyRule();
 			importer->action = "permit";
 			*dbg << LT(1)->getLine() << ":" << " permit ";
 			
-#line 3709 "PIXCfgParser.cpp"
+#line 3726 "PIXCfgParser.cpp"
 		}
 		rule_standard();
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 931 "pix.g"
+#line 922 "pix.g"
 			
 			importer->pushRule();
 			
-#line 3718 "PIXCfgParser.cpp"
+#line 3735 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -3733,23 +3750,23 @@ void PIXCfgParser::deny_standard() {
 		match(STANDARD);
 		match(DENY);
 		if ( inputState->guessing==0 ) {
-#line 937 "pix.g"
+#line 928 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newPolicyRule();
 			importer->action = "deny";
 			*dbg << LT(1)->getLine() << ":" << " deny   ";
 			
-#line 3744 "PIXCfgParser.cpp"
+#line 3761 "PIXCfgParser.cpp"
 		}
 		rule_standard();
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 944 "pix.g"
+#line 935 "pix.g"
 			
 			importer->pushRule();
 			
-#line 3753 "PIXCfgParser.cpp"
+#line 3770 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -3767,7 +3784,7 @@ void PIXCfgParser::remark() {
 	try {      // for error handling
 		match(REMARK);
 		if ( inputState->guessing==0 ) {
-#line 1793 "pix.g"
+#line 1784 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			*dbg << LT(1)->getLine() << ":";
@@ -3781,7 +3798,7 @@ void PIXCfgParser::remark() {
 			*dbg << " REMARK " << rem << std::endl;
 			//consumeUntil(NEWLINE);
 			
-#line 3785 "PIXCfgParser.cpp"
+#line 3802 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -3821,15 +3838,15 @@ void PIXCfgParser::rule_extended() {
 			ip_protocols();
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 969 "pix.g"
+#line 960 "pix.g"
 				importer->SaveTmpAddrToSrc(); *dbg << "(src) ";
-#line 3827 "PIXCfgParser.cpp"
+#line 3844 "PIXCfgParser.cpp"
 			}
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 970 "pix.g"
+#line 961 "pix.g"
 				importer->SaveTmpAddrToDst(); *dbg << "(dst) ";
-#line 3833 "PIXCfgParser.cpp"
+#line 3850 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -3894,24 +3911,24 @@ void PIXCfgParser::rule_extended() {
 		{
 			match(ICMP);
 			if ( inputState->guessing==0 ) {
-#line 976 "pix.g"
+#line 967 "pix.g"
 				
 				importer->protocol = LT(0)->getText();
 				*dbg << "protocol " << LT(0)->getText() << " ";
 				
-#line 3903 "PIXCfgParser.cpp"
+#line 3920 "PIXCfgParser.cpp"
 			}
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 980 "pix.g"
+#line 971 "pix.g"
 				importer->SaveTmpAddrToSrc(); *dbg << "(src) ";
-#line 3909 "PIXCfgParser.cpp"
+#line 3926 "PIXCfgParser.cpp"
 			}
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 981 "pix.g"
+#line 972 "pix.g"
 				importer->SaveTmpAddrToDst(); *dbg << "(dst) ";
-#line 3915 "PIXCfgParser.cpp"
+#line 3932 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -4025,17 +4042,17 @@ void PIXCfgParser::rule_extended() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 989 "pix.g"
+#line 980 "pix.g"
 			
 			*dbg << std::endl;
 			
-#line 4033 "PIXCfgParser.cpp"
+#line 4050 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -4046,28 +4063,28 @@ void PIXCfgParser::rule_standard() {
 	
 	try {      // for error handling
 		if ( inputState->guessing==0 ) {
-#line 954 "pix.g"
+#line 945 "pix.g"
 			
 			importer->tmp_a = "0.0.0.0";
 			importer->tmp_nm = "0.0.0.0";
 			importer->SaveTmpAddrToSrc();
 			
-#line 4056 "PIXCfgParser.cpp"
+#line 4073 "PIXCfgParser.cpp"
 		}
 		hostaddr_expr();
 		if ( inputState->guessing==0 ) {
-#line 960 "pix.g"
+#line 951 "pix.g"
 			
 			importer->SaveTmpAddrToDst();
 			*dbg << "(dst) " << std::endl;
 			
-#line 4065 "PIXCfgParser.cpp"
+#line 4082 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -4087,13 +4104,13 @@ void PIXCfgParser::hostaddr_expr() {
 			match(INTRFACE);
 			interface_label();
 			if ( inputState->guessing==0 ) {
-#line 1230 "pix.g"
+#line 1221 "pix.g"
 				
 				importer->tmp_a = LT(0)->getText();
 				importer->tmp_nm = "interface";
 				*dbg << "object " << LT(0)->getText() << " ";
 				
-#line 4097 "PIXCfgParser.cpp"
+#line 4114 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4123,13 +4140,13 @@ void PIXCfgParser::hostaddr_expr() {
 			match(WORD);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1237 "pix.g"
+#line 1228 "pix.g"
 				
 				importer->tmp_a = name->getText();
 				importer->tmp_nm = "";
 				*dbg << "object " << name->getText() << " ";
 				
-#line 4133 "PIXCfgParser.cpp"
+#line 4150 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4141,13 +4158,13 @@ void PIXCfgParser::hostaddr_expr() {
 			match(IPV4);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1244 "pix.g"
+#line 1235 "pix.g"
 				
 				importer->tmp_a = h->getText();
 				importer->tmp_nm = "255.255.255.255";
 				*dbg << h->getText() << "/255.255.255.255";
 				
-#line 4151 "PIXCfgParser.cpp"
+#line 4168 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4160,13 +4177,13 @@ void PIXCfgParser::hostaddr_expr() {
 			match(IPV4);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1251 "pix.g"
+#line 1242 "pix.g"
 				
 				importer->tmp_a = a->getText();
 				importer->tmp_nm = m->getText();
 				*dbg << a->getText() << "/" << m->getText();
 				
-#line 4170 "PIXCfgParser.cpp"
+#line 4187 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4174,13 +4191,13 @@ void PIXCfgParser::hostaddr_expr() {
 		{
 			match(ANY);
 			if ( inputState->guessing==0 ) {
-#line 1258 "pix.g"
+#line 1249 "pix.g"
 				
 				importer->tmp_a = "0.0.0.0";
 				importer->tmp_nm = "0.0.0.0";
 				*dbg << "0.0.0.0/0.0.0.0";
 				
-#line 4184 "PIXCfgParser.cpp"
+#line 4201 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4193,7 +4210,7 @@ void PIXCfgParser::hostaddr_expr() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_20);
+			recover(ex,_tokenSet_19);
 		} else {
 			throw;
 		}
@@ -4256,12 +4273,12 @@ void PIXCfgParser::ip_protocols() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1177 "pix.g"
+#line 1168 "pix.g"
 				
 				importer->protocol = LT(0)->getText();
 				*dbg << "protocol " << LT(0)->getText() << " ";
 				
-#line 4265 "PIXCfgParser.cpp"
+#line 4282 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4291,12 +4308,12 @@ void PIXCfgParser::ip_protocols() {
 			match(WORD);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1183 "pix.g"
+#line 1174 "pix.g"
 				
 				importer->protocol = name->getText();
 				*dbg << "protocol " << name->getText() << " ";
 				
-#line 4300 "PIXCfgParser.cpp"
+#line 4317 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4310,7 +4327,7 @@ void PIXCfgParser::ip_protocols() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_21);
+			recover(ex,_tokenSet_20);
 		} else {
 			throw;
 		}
@@ -4325,18 +4342,18 @@ void PIXCfgParser::time_range() {
 		tr_name = LT(1);
 		match(WORD);
 		if ( inputState->guessing==0 ) {
-#line 1310 "pix.g"
+#line 1301 "pix.g"
 			
 			importer->time_range_name = tr_name->getText();
 			*dbg << "time_range " << tr_name->getText() << " ";
 			
-#line 4334 "PIXCfgParser.cpp"
+#line 4351 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_22);
+			recover(ex,_tokenSet_21);
 		} else {
 			throw;
 		}
@@ -4348,18 +4365,18 @@ void PIXCfgParser::fragments() {
 	try {      // for error handling
 		match(FRAGMENTS);
 		if ( inputState->guessing==0 ) {
-#line 1303 "pix.g"
+#line 1294 "pix.g"
 			
 			importer->fragments = true;
 			*dbg << "fragments ";
 			
-#line 4357 "PIXCfgParser.cpp"
+#line 4374 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_23);
+			recover(ex,_tokenSet_22);
 		} else {
 			throw;
 		}
@@ -4388,11 +4405,11 @@ void PIXCfgParser::log() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1269 "pix.g"
+#line 1260 "pix.g"
 			
 			importer->logging = true;
 			
-#line 4396 "PIXCfgParser.cpp"
+#line 4413 "PIXCfgParser.cpp"
 		}
 		{
 		{
@@ -4473,9 +4490,9 @@ void PIXCfgParser::log() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1286 "pix.g"
+#line 1277 "pix.g"
 				importer->log_level = LT(0)->getText();
-#line 4479 "PIXCfgParser.cpp"
+#line 4496 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4499,9 +4516,9 @@ void PIXCfgParser::log() {
 			match(INT_CONST);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1291 "pix.g"
+#line 1282 "pix.g"
 				importer->log_interval = LT(0)->getText();
-#line 4505 "PIXCfgParser.cpp"
+#line 4522 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4517,20 +4534,20 @@ void PIXCfgParser::log() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1294 "pix.g"
+#line 1285 "pix.g"
 			
 			//        if (importer->log_level == "log") importer->log_level = "";
 			//        if (importer->log_interval == "log") importer->log_interval = "";
 			*dbg << "logging level '" << importer->log_level
 			<< "' interval '" << importer->log_interval << "'";
 			
-#line 4528 "PIXCfgParser.cpp"
+#line 4545 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -4553,7 +4570,7 @@ void PIXCfgParser::icmp_spec() {
 			match(INT_CONST);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1193 "pix.g"
+#line 1184 "pix.g"
 				
 				importer->icmp_type = icmp_type->getText();
 				importer->icmp_code = icmp_code->getText();
@@ -4561,7 +4578,7 @@ void PIXCfgParser::icmp_spec() {
 				*dbg << icmp_type->getText() << " "
 				<< icmp_code->getText() << " ";
 				
-#line 4565 "PIXCfgParser.cpp"
+#line 4582 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4587,12 +4604,12 @@ void PIXCfgParser::icmp_spec() {
 		{
 			icmp_names();
 			if ( inputState->guessing==0 ) {
-#line 1202 "pix.g"
+#line 1193 "pix.g"
 				
 				importer->icmp_spec = LT(0)->getText();
 				*dbg << LT(0)->getText() << " ";
 				
-#line 4596 "PIXCfgParser.cpp"
+#line 4613 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -4606,7 +4623,7 @@ void PIXCfgParser::icmp_spec() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_13);
+			recover(ex,_tokenSet_12);
 		} else {
 			throw;
 		}
@@ -4637,22 +4654,22 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 996 "pix.g"
+#line 987 "pix.g"
 			
 			importer->protocol = LT(0)->getText();
 			*dbg << "protocol " << LT(0)->getText() << " ";
 			
-#line 4646 "PIXCfgParser.cpp"
+#line 4663 "PIXCfgParser.cpp"
 		}
 		hostaddr_expr();
 		if ( inputState->guessing==0 ) {
-#line 1000 "pix.g"
+#line 991 "pix.g"
 			importer->SaveTmpAddrToSrc(); *dbg << "(src) ";
-#line 4652 "PIXCfgParser.cpp"
+#line 4669 "PIXCfgParser.cpp"
 		}
 		{
 		bool synPredMatched124 = false;
-		if (((_tokenSet_21.member(LA(1))) && (_tokenSet_24.member(LA(2))))) {
+		if (((_tokenSet_20.member(LA(1))) && (_tokenSet_23.member(LA(2))))) {
 			int _m124 = mark();
 			synPredMatched124 = true;
 			inputState->guessing++;
@@ -4674,34 +4691,34 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 				src_grp_name = LT(1);
 				match(WORD);
 				if ( inputState->guessing==0 ) {
-#line 1010 "pix.g"
+#line 1001 "pix.g"
 					
 					importer->src_port_spec = src_grp_name->getText();
 					*dbg << "src port spec: "
 					<< src_grp_name->getText() << std::endl;
 					
-#line 4684 "PIXCfgParser.cpp"
+#line 4701 "PIXCfgParser.cpp"
 				}
 				hostaddr_expr_1();
 				if ( inputState->guessing==0 ) {
+#line 1009 "pix.g"
+					
+					importer->SaveTmpAddrToDst();
+					*dbg << "(dst) ";
+					
+#line 4710 "PIXCfgParser.cpp"
+				}
+				acl_tcp_udp_dst_port_spec();
+			}
+			else if ((_tokenSet_20.member(LA(1))) && (_tokenSet_23.member(LA(2)))) {
+				hostaddr_expr_2();
+				if ( inputState->guessing==0 ) {
 #line 1018 "pix.g"
 					
 					importer->SaveTmpAddrToDst();
 					*dbg << "(dst) ";
 					
-#line 4693 "PIXCfgParser.cpp"
-				}
-				acl_tcp_udp_dst_port_spec();
-			}
-			else if ((_tokenSet_21.member(LA(1))) && (_tokenSet_24.member(LA(2)))) {
-				hostaddr_expr_2();
-				if ( inputState->guessing==0 ) {
-#line 1027 "pix.g"
-					
-					importer->SaveTmpAddrToDst();
-					*dbg << "(dst) ";
-					
-#line 4705 "PIXCfgParser.cpp"
+#line 4722 "PIXCfgParser.cpp"
 				}
 				acl_tcp_udp_dst_port_spec();
 			}
@@ -4716,10 +4733,10 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 			dst_addr_name = LT(1);
 			match(WORD);
 			{
-			if ((_tokenSet_25.member(LA(1))) && (_tokenSet_26.member(LA(2)))) {
+			if ((_tokenSet_24.member(LA(1))) && (_tokenSet_25.member(LA(2)))) {
 				acl_xoperator_dst();
 			}
-			else if ((_tokenSet_27.member(LA(1))) && (_tokenSet_28.member(LA(2)))) {
+			else if ((_tokenSet_26.member(LA(1))) && (_tokenSet_27.member(LA(2)))) {
 			}
 			else {
 				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -4727,10 +4744,10 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 			
 			}
 			{
-			if ((LA(1) == ESTABLISHED) && (_tokenSet_27.member(LA(2)))) {
+			if ((LA(1) == ESTABLISHED) && (_tokenSet_26.member(LA(2)))) {
 				established();
 			}
-			else if ((_tokenSet_27.member(LA(1))) && (_tokenSet_29.member(LA(2)))) {
+			else if ((_tokenSet_26.member(LA(1))) && (_tokenSet_28.member(LA(2)))) {
 			}
 			else {
 				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -4738,7 +4755,7 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 			
 			}
 			if ( inputState->guessing==0 ) {
-#line 1036 "pix.g"
+#line 1027 "pix.g"
 				
 				// looks like "object foo" at this point can only be dest addr.
 				// (judging by cli prompts on 8.3)
@@ -4747,11 +4764,11 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 				importer->SaveTmpAddrToDst();
 				*dbg << "dst addr object " << dst_addr_name->getText() << " ";
 				
-#line 4751 "PIXCfgParser.cpp"
+#line 4768 "PIXCfgParser.cpp"
 			}
 			acl_tcp_udp_dst_port_spec();
 		}
-		else if ((_tokenSet_30.member(LA(1))) && (_tokenSet_31.member(LA(2)))) {
+		else if ((_tokenSet_29.member(LA(1))) && (_tokenSet_30.member(LA(2)))) {
 			{
 			switch ( LA(1)) {
 			case RANGE:
@@ -4762,11 +4779,11 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 			{
 				xoperator();
 				if ( inputState->guessing==0 ) {
-#line 1050 "pix.g"
+#line 1041 "pix.g"
 					
 					importer->SaveTmpPortToSrc();
 					
-#line 4770 "PIXCfgParser.cpp"
+#line 4787 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -4787,9 +4804,9 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 			}
 			hostaddr_expr_3();
 			if ( inputState->guessing==0 ) {
-#line 1054 "pix.g"
+#line 1045 "pix.g"
 				importer->SaveTmpAddrToDst(); *dbg << "(dst) ";
-#line 4793 "PIXCfgParser.cpp"
+#line 4810 "PIXCfgParser.cpp"
 			}
 			acl_tcp_udp_dst_port_spec();
 		}
@@ -4859,7 +4876,7 @@ void PIXCfgParser::tcp_udp_rule_extended() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -4874,7 +4891,7 @@ void PIXCfgParser::hostaddr_expr_1() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_27);
+			recover(ex,_tokenSet_26);
 		} else {
 			throw;
 		}
@@ -4895,13 +4912,13 @@ void PIXCfgParser::acl_tcp_udp_dst_port_spec() {
 			dst_port_group_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 1072 "pix.g"
+#line 1063 "pix.g"
 				
 				importer->dst_port_spec = dst_port_group_name->getText();
 				*dbg << "dst port spec: "
 				<< dst_port_group_name->getText() << std::endl;
 				
-#line 4905 "PIXCfgParser.cpp"
+#line 4922 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -4933,13 +4950,13 @@ void PIXCfgParser::acl_tcp_udp_dst_port_spec() {
 			dst_port_obj_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 1082 "pix.g"
+#line 1073 "pix.g"
 				
 				importer->dst_port_spec = dst_port_obj_name->getText();
 				*dbg << "dst addr object " << dst_port_obj_name->getText()
 				<< std::endl;
 				
-#line 4943 "PIXCfgParser.cpp"
+#line 4960 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -5035,7 +5052,7 @@ void PIXCfgParser::acl_tcp_udp_dst_port_spec() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_13);
+			recover(ex,_tokenSet_12);
 		} else {
 			throw;
 		}
@@ -5050,7 +5067,7 @@ void PIXCfgParser::hostaddr_expr_2() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_27);
+			recover(ex,_tokenSet_26);
 		} else {
 			throw;
 		}
@@ -5062,17 +5079,17 @@ void PIXCfgParser::acl_xoperator_dst() {
 	try {      // for error handling
 		xoperator();
 		if ( inputState->guessing==0 ) {
-#line 1097 "pix.g"
+#line 1088 "pix.g"
 			
 			importer->SaveTmpPortToDst();
 			
-#line 5070 "PIXCfgParser.cpp"
+#line 5087 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_27);
+			recover(ex,_tokenSet_26);
 		} else {
 			throw;
 		}
@@ -5084,18 +5101,18 @@ void PIXCfgParser::established() {
 	try {      // for error handling
 		match(ESTABLISHED);
 		if ( inputState->guessing==0 ) {
-#line 1166 "pix.g"
+#line 1157 "pix.g"
 			
 			importer->established = true;
 			*dbg << "established ";
 			
-#line 5093 "PIXCfgParser.cpp"
+#line 5110 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_27);
+			recover(ex,_tokenSet_26);
 		} else {
 			throw;
 		}
@@ -5110,7 +5127,7 @@ void PIXCfgParser::hostaddr_expr_3() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_27);
+			recover(ex,_tokenSet_26);
 		} else {
 			throw;
 		}
@@ -5149,19 +5166,19 @@ void PIXCfgParser::single_port_op() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1107 "pix.g"
+#line 1098 "pix.g"
 			
 			importer->tmp_port_op = LT(0)->getText();
 			*dbg << LT(0)->getText() << " ";
 			
-#line 5158 "PIXCfgParser.cpp"
+#line 5175 "PIXCfgParser.cpp"
 		}
 		port_spec();
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_15);
+			recover(ex,_tokenSet_14);
 		} else {
 			throw;
 		}
@@ -5174,18 +5191,18 @@ void PIXCfgParser::port_range() {
 		match(RANGE);
 		pair_of_ports_spec();
 		if ( inputState->guessing==0 ) {
-#line 1122 "pix.g"
+#line 1113 "pix.g"
 			
 			importer->tmp_port_op = "range";
 			*dbg << "range " << importer->tmp_port_spec;
 			
-#line 5183 "PIXCfgParser.cpp"
+#line 5200 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_15);
+			recover(ex,_tokenSet_14);
 		} else {
 			throw;
 		}
@@ -5197,18 +5214,18 @@ void PIXCfgParser::port_spec() {
 	try {      // for error handling
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 1115 "pix.g"
+#line 1106 "pix.g"
 			
 			importer->tmp_port_spec = std::string(" ") + importer->tmp_port_spec_2;
 			*dbg << LT(0)->getText() << " " << importer->tmp_port_spec;
 			
-#line 5206 "PIXCfgParser.cpp"
+#line 5223 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_15);
+			recover(ex,_tokenSet_14);
 		} else {
 			throw;
 		}
@@ -5247,17 +5264,17 @@ void PIXCfgParser::tcp_udp_port_spec() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1146 "pix.g"
+#line 1137 "pix.g"
 			
 			importer->tmp_port_spec_2 = LT(0)->getText();
 			
-#line 5255 "PIXCfgParser.cpp"
+#line 5272 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_32);
+			recover(ex,_tokenSet_31);
 		} else {
 			throw;
 		}
@@ -5268,34 +5285,34 @@ void PIXCfgParser::pair_of_ports_spec() {
 	
 	try {      // for error handling
 		if ( inputState->guessing==0 ) {
-#line 1129 "pix.g"
+#line 1120 "pix.g"
 			
 			importer->tmp_port_spec_2 = "";
 			
-#line 5276 "PIXCfgParser.cpp"
+#line 5293 "PIXCfgParser.cpp"
 		}
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 1133 "pix.g"
+#line 1124 "pix.g"
 			
 			importer->tmp_port_spec += importer->tmp_port_spec_2;
 			
-#line 5284 "PIXCfgParser.cpp"
+#line 5301 "PIXCfgParser.cpp"
 		}
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 1137 "pix.g"
+#line 1128 "pix.g"
 			
 			importer->tmp_port_spec += " ";
 			importer->tmp_port_spec += importer->tmp_port_spec_2;
 			
-#line 5293 "PIXCfgParser.cpp"
+#line 5310 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_15);
+			recover(ex,_tokenSet_14);
 		} else {
 			throw;
 		}
@@ -5347,7 +5364,7 @@ void PIXCfgParser::tcp_udp_port_names() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_32);
+			recover(ex,_tokenSet_31);
 		} else {
 			throw;
 		}
@@ -5377,7 +5394,7 @@ void PIXCfgParser::interface_label() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_33);
+			recover(ex,_tokenSet_32);
 		} else {
 			throw;
 		}
@@ -5392,14 +5409,14 @@ void PIXCfgParser::interface_command_6() {
 		match(WORD);
 		pix6_interface_hw_speed();
 		if ( inputState->guessing==0 ) {
-#line 1374 "pix.g"
+#line 1365 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newInterface( in->getText() );
 			*dbg << in->getLine() << ":"
 			<< " INTRFACE: " << in->getText() << std::endl;
 			
-#line 5403 "PIXCfgParser.cpp"
+#line 5420 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5414,33 +5431,33 @@ void PIXCfgParser::interface_command_6() {
 
 void PIXCfgParser::interface_command_7() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  in = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1382 "pix.g"
+#line 1373 "pix.g"
 	bool have_interface_parameters = false;
-#line 5420 "PIXCfgParser.cpp"
+#line 5437 "PIXCfgParser.cpp"
 	
 	try {      // for error handling
 		in = LT(1);
 		match(WORD);
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 1383 "pix.g"
+#line 1374 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newInterface( in->getText() );
 			*dbg << in->getLine() << ":"
 			<< " INTRFACE: " << in->getText() << std::endl;
 			
-#line 5434 "PIXCfgParser.cpp"
+#line 5451 "PIXCfgParser.cpp"
 		}
 		{
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_34.member(LA(1)))) {
+			if ((_tokenSet_33.member(LA(1)))) {
 				interface_parameters();
 				if ( inputState->guessing==0 ) {
-#line 1390 "pix.g"
+#line 1381 "pix.g"
 					have_interface_parameters = true;
-#line 5444 "PIXCfgParser.cpp"
+#line 5461 "PIXCfgParser.cpp"
 				}
 			}
 			else {
@@ -5469,7 +5486,7 @@ void PIXCfgParser::interface_command_7() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1392 "pix.g"
+#line 1383 "pix.g"
 			
 			if ( ! have_interface_parameters )
 			{
@@ -5478,7 +5495,7 @@ void PIXCfgParser::interface_command_7() {
 			<< " EMPTY INTERFACE " << std::endl;
 			}
 			
-#line 5482 "PIXCfgParser.cpp"
+#line 5499 "PIXCfgParser.cpp"
 		}
 		}
 	}
@@ -5568,11 +5585,11 @@ void PIXCfgParser::interface_parameters() {
 	
 	try {      // for error handling
 		if ( inputState->guessing==0 ) {
-#line 1427 "pix.g"
+#line 1418 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			
-#line 5576 "PIXCfgParser.cpp"
+#line 5593 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -5645,7 +5662,7 @@ void PIXCfgParser::interface_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_35);
+			recover(ex,_tokenSet_34);
 		} else {
 			throw;
 		}
@@ -5680,7 +5697,7 @@ void PIXCfgParser::intf_address() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5695,18 +5712,18 @@ void PIXCfgParser::vlan_interface() {
 		vlan_id = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1453 "pix.g"
+#line 1444 "pix.g"
 			
 			importer->setInterfaceVlanId(vlan_id->getText());
 			*dbg << " VLAN: " << vlan_id->getText() << std::endl;
 			
-#line 5704 "PIXCfgParser.cpp"
+#line 5721 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5721,18 +5738,18 @@ void PIXCfgParser::sec_level() {
 		sec_level = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1505 "pix.g"
+#line 1496 "pix.g"
 			
 			importer->setInterfaceSecurityLevel(sec_level->getText());
 			*dbg << "SEC_LEVEL: " << sec_level->getText() << std::endl;
 			
-#line 5730 "PIXCfgParser.cpp"
+#line 5747 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5745,18 +5762,18 @@ void PIXCfgParser::nameif() {
 		match(NAMEIF);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1524 "pix.g"
+#line 1515 "pix.g"
 			
 			importer->setInterfaceParametes(LT(0)->getText(), "", "");
 			*dbg << " NAMEIF: " << LT(0)->getText() << std::endl;
 			
-#line 5754 "PIXCfgParser.cpp"
+#line 5771 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5768,7 +5785,7 @@ void PIXCfgParser::interface_description() {
 	try {      // for error handling
 		match(DESCRIPTION);
 		if ( inputState->guessing==0 ) {
-#line 1533 "pix.g"
+#line 1524 "pix.g"
 			
 			*dbg << LT(1)->getLine() << ":";
 			std::string descr;
@@ -5781,13 +5798,13 @@ void PIXCfgParser::interface_description() {
 			*dbg << " DESCRIPTION " << descr << std::endl;
 			//consumeUntil(NEWLINE);
 			
-#line 5785 "PIXCfgParser.cpp"
+#line 5802 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5804,18 +5821,18 @@ void PIXCfgParser::switchport() {
 		vlan_num = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1645 "pix.g"
+#line 1636 "pix.g"
 			
 			importer->addMessageToLog("Switch port vlan " + vlan_num->getText());
 			*dbg << "Switch port vlan " <<  vlan_num->getText() << std::endl;
 			
-#line 5813 "PIXCfgParser.cpp"
+#line 5830 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5827,19 +5844,19 @@ void PIXCfgParser::shutdown() {
 	try {      // for error handling
 		match(SHUTDOWN);
 		if ( inputState->guessing==0 ) {
-#line 1548 "pix.g"
+#line 1539 "pix.g"
 			
 			importer->ignoreCurrentInterface();
 			*dbg<< LT(1)->getLine() << ":"
 			<< " INTERFACE SHUTDOWN " << std::endl;
 			
-#line 5837 "PIXCfgParser.cpp"
+#line 5854 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5879,19 +5896,19 @@ void PIXCfgParser::interface_no_commands() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1497 "pix.g"
+#line 1488 "pix.g"
 			
 			*dbg << " INTERFACE \"NO\" COMMAND: "
 			<< LT(0)->getText() << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 5889 "PIXCfgParser.cpp"
+#line 5906 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -5980,19 +5997,19 @@ void PIXCfgParser::unsupported_interface_commands() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1489 "pix.g"
+#line 1480 "pix.g"
 			
 			*dbg << " UNSUPPORTED INTERFACE COMMAND: "
 			<< LT(0)->getText() << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 5990 "PIXCfgParser.cpp"
+#line 6007 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6016,7 +6033,7 @@ void PIXCfgParser::v6_ip_address() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6046,7 +6063,7 @@ void PIXCfgParser::v7_ip_address() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6063,7 +6080,7 @@ void PIXCfgParser::v6_dhcp_address() {
 		dhcp = LT(1);
 		match(DHCP);
 		if ( inputState->guessing==0 ) {
-#line 1583 "pix.g"
+#line 1574 "pix.g"
 			
 			std::string label = lbl->getText();
 			std::string addr = dhcp->getText();
@@ -6074,13 +6091,13 @@ void PIXCfgParser::v6_dhcp_address() {
 			// which we do not support
 			consumeUntil(NEWLINE);
 			
-#line 6078 "PIXCfgParser.cpp"
+#line 6095 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6100,7 +6117,7 @@ void PIXCfgParser::v6_static_address() {
 		m = LT(1);
 		match(IPV4);
 		if ( inputState->guessing==0 ) {
-#line 1596 "pix.g"
+#line 1587 "pix.g"
 			
 			std::string label = lbl->getText();
 			std::string addr = a->getText();
@@ -6111,13 +6128,13 @@ void PIXCfgParser::v6_static_address() {
 			// in case there are some other parameters after address and netmask
 			consumeUntil(NEWLINE);
 			
-#line 6115 "PIXCfgParser.cpp"
+#line 6132 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6131,7 +6148,7 @@ void PIXCfgParser::v7_dhcp_address() {
 		dhcp = LT(1);
 		match(DHCP);
 		if ( inputState->guessing==0 ) {
-#line 1613 "pix.g"
+#line 1604 "pix.g"
 			
 			std::string addr = dhcp->getText();
 			importer->addInterfaceAddress(addr, "");
@@ -6139,13 +6156,13 @@ void PIXCfgParser::v7_dhcp_address() {
 			<< " INTRFACE ADDRESS: " << addr << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 6143 "PIXCfgParser.cpp"
+#line 6160 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6181,7 +6198,7 @@ void PIXCfgParser::v7_static_address() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1624 "pix.g"
+#line 1615 "pix.g"
 			
 			std::string addr = a->getText();
 			std::string netm = m->getText();
@@ -6198,13 +6215,13 @@ void PIXCfgParser::v7_static_address() {
 			}
 			consumeUntil(NEWLINE);
 			
-#line 6202 "PIXCfgParser.cpp"
+#line 6219 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6219,13 +6236,13 @@ void PIXCfgParser::icmp_types_for_icmp_command() {
 		{
 			match(INT_CONST);
 			if ( inputState->guessing==0 ) {
-#line 1772 "pix.g"
+#line 1763 "pix.g"
 				
 				importer->icmp_type = LT(0)->getText();
 				importer->icmp_code = "0";
 				importer->icmp_spec = "";
 				
-#line 6229 "PIXCfgParser.cpp"
+#line 6246 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6263,13 +6280,13 @@ void PIXCfgParser::icmp_types_for_icmp_command() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1779 "pix.g"
+#line 1770 "pix.g"
 				
 				importer->icmp_type = "";
 				importer->icmp_code = "0";
 				importer->icmp_spec = LT(0)->getText();
 				
-#line 6273 "PIXCfgParser.cpp"
+#line 6290 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6282,7 +6299,7 @@ void PIXCfgParser::icmp_types_for_icmp_command() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_36);
+			recover(ex,_tokenSet_35);
 		} else {
 			throw;
 		}
@@ -6294,40 +6311,52 @@ void PIXCfgParser::nat_old_top_level_command() {
 	try {      // for error handling
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1842 "pix.g"
+#line 1837 "pix.g"
+			
 			importer->prenat_interface = LT(0)->getText();
-#line 6300 "PIXCfgParser.cpp"
+			
+#line 6319 "PIXCfgParser.cpp"
 		}
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1844 "pix.g"
+#line 1841 "pix.g"
 			
-			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
-			*dbg << " SNAT rule " << std::endl;
+			*dbg << " SNAT rule ";
 			importer->rule_type = libfwbuilder::NATRule::SNAT;
 			
-			
-#line 6313 "PIXCfgParser.cpp"
+#line 6330 "PIXCfgParser.cpp"
 		}
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1855 "pix.g"
+#line 1850 "pix.g"
 			
 			importer->nat_num = LT(0)->getText();
 			
-#line 6321 "PIXCfgParser.cpp"
+#line 6338 "PIXCfgParser.cpp"
 		}
 		nat_addr_match();
-		nat_command_last_parameters();
+		{ // ( ... )*
+		for (;;) {
+			if ((_tokenSet_36.member(LA(1)))) {
+				nat_command_last_parameters();
+			}
+			else {
+				goto _loop243;
+			}
+			
+		}
+		_loop243:;
+		} // ( ... )*
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 1867 "pix.g"
+#line 1862 "pix.g"
 			
 			importer->pushNATRule();
+			*dbg << std::endl;
 			
-#line 6331 "PIXCfgParser.cpp"
+#line 6360 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6348,11 +6377,11 @@ void PIXCfgParser::nat_new_top_level_command() {
 		interface_label();
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1910 "pix.g"
+#line 1914 "pix.g"
 			
 			consumeUntil(NEWLINE);
 			
-#line 6356 "PIXCfgParser.cpp"
+#line 6385 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6369,18 +6398,47 @@ void PIXCfgParser::nat_addr_match() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  acl_name = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	
 	try {      // for error handling
-		{
 		switch ( LA(1)) {
-		case HOST:
+		case IPV4:
+		case IPV6:
 		{
-			host_addr();
+			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 1875 "pix.g"
+#line 1870 "pix.g"
 				
 				importer->nat_a = importer->tmp_a;
-				importer->nat_nm = importer->tmp_nm;
 				
-#line 6384 "PIXCfgParser.cpp"
+#line 6412 "PIXCfgParser.cpp"
+			}
+			{
+			switch ( LA(1)) {
+			case IPV4:
+			case IPV6:
+			{
+				single_addr();
+				if ( inputState->guessing==0 ) {
+#line 1878 "pix.g"
+					
+					importer->nat_nm = importer->tmp_a;
+					
+#line 6425 "PIXCfgParser.cpp"
+				}
+				break;
+			}
+			case NEWLINE:
+			case INT_CONST:
+			case TCP:
+			case UDP:
+			case DNS:
+			case OUTSIDE:
+			{
+				break;
+			}
+			default:
+			{
+				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+			}
+			}
 			}
 			break;
 		}
@@ -6390,11 +6448,11 @@ void PIXCfgParser::nat_addr_match() {
 			acl_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 1881 "pix.g"
+#line 1884 "pix.g"
 				
 				importer->nat_acl = acl_name->getText();
 				
-#line 6398 "PIXCfgParser.cpp"
+#line 6456 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6403,7 +6461,6 @@ void PIXCfgParser::nat_addr_match() {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
 		}
 		}
-		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
@@ -6484,37 +6541,31 @@ void PIXCfgParser::nat_command_last_parameters() {
 		max_conn = LT(1);
 		match(INT_CONST);
 		{
-		switch ( LA(1)) {
-		case INT_CONST:
-		{
+		if ((LA(1) == INT_CONST) && (_tokenSet_37.member(LA(2)))) {
 			max_emb_conn = LT(1);
 			match(INT_CONST);
-			break;
 		}
-		case NEWLINE:
-		{
-			break;
+		else if ((_tokenSet_37.member(LA(1))) && (_tokenSet_38.member(LA(2)))) {
 		}
-		default:
-		{
+		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
 		}
-		}
+		
 		}
 		if ( inputState->guessing==0 ) {
-#line 1898 "pix.g"
+#line 1902 "pix.g"
 			
 			importer->static_max_conn = max_conn->getText();
 			if (max_emb_conn)
 			importer->static_max_emb_conn = max_emb_conn->getText();
 			
-#line 6512 "PIXCfgParser.cpp"
+#line 6563 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_37);
 		} else {
 			throw;
 		}
@@ -6528,21 +6579,21 @@ void PIXCfgParser::static_starts_with_hostaddr() {
 		static_real_addr_match();
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_38.member(LA(1)))) {
+			if ((_tokenSet_39.member(LA(1)))) {
 				static_command_common_last_parameters();
 			}
 			else {
-				goto _loop258;
+				goto _loop260;
 			}
 			
 		}
-		_loop258:;
+		_loop260:;
 		} // ( ... )*
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6571,50 +6622,50 @@ void PIXCfgParser::static_starts_with_tcp_udp() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 2041 "pix.g"
+#line 2051 "pix.g"
 			
 			importer->protocol = LT(0)->getText();
 			*dbg << " SERVICE TCP/UDP " << LT(0)->getText() << " ";
 			
-#line 6580 "PIXCfgParser.cpp"
+#line 6631 "PIXCfgParser.cpp"
 		}
 		static_mapped_addr_match();
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 2055 "pix.g"
+#line 2065 "pix.g"
 			
 			importer->mapped_port_spec = importer->tmp_port_spec_2;
 			*dbg << "mapped port " << importer->mapped_port_spec << " ";
 			
-#line 6590 "PIXCfgParser.cpp"
+#line 6641 "PIXCfgParser.cpp"
 		}
 		static_real_addr_match();
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 2070 "pix.g"
+#line 2080 "pix.g"
 			
 			importer->real_port_spec = importer->tmp_port_spec_2;
 			*dbg << "real port " << importer->real_port_spec << " ";
 			
-#line 6600 "PIXCfgParser.cpp"
+#line 6651 "PIXCfgParser.cpp"
 		}
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_38.member(LA(1)))) {
+			if ((_tokenSet_39.member(LA(1)))) {
 				static_command_common_last_parameters();
 			}
 			else {
-				goto _loop266;
+				goto _loop268;
 			}
 			
 		}
-		_loop266:;
+		_loop268:;
 		} // ( ... )*
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_9);
+			recover(ex,_tokenSet_8);
 		} else {
 			throw;
 		}
@@ -6631,12 +6682,12 @@ void PIXCfgParser::static_mapped_addr_match() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2012 "pix.g"
+#line 2022 "pix.g"
 				
 				importer->mapped_a = importer->tmp_a;
 				importer->mapped_nm = importer->tmp_nm;
 				
-#line 6640 "PIXCfgParser.cpp"
+#line 6691 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6644,62 +6695,11 @@ void PIXCfgParser::static_mapped_addr_match() {
 		{
 			match(INTRFACE);
 			if ( inputState->guessing==0 ) {
-#line 2018 "pix.g"
+#line 2028 "pix.g"
 				
 				importer->mapped_a = "interface";
 				importer->mapped_nm = "";
 				
-#line 6653 "PIXCfgParser.cpp"
-			}
-			break;
-		}
-		default:
-		{
-			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
-		}
-		}
-		}
-	}
-	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
-		if( inputState->guessing == 0 ) {
-			reportError(ex);
-			recover(ex,_tokenSet_39);
-		} else {
-			throw;
-		}
-	}
-}
-
-void PIXCfgParser::static_real_addr_match() {
-	ANTLR_USE_NAMESPACE(antlr)RefToken  acl_name = ANTLR_USE_NAMESPACE(antlr)nullToken;
-	
-	try {      // for error handling
-		{
-		switch ( LA(1)) {
-		case IPV4:
-		case IPV6:
-		{
-			single_addr();
-			if ( inputState->guessing==0 ) {
-#line 2028 "pix.g"
-				
-				importer->real_a = importer->tmp_a;
-				importer->real_nm = importer->tmp_nm;
-				
-#line 6690 "PIXCfgParser.cpp"
-			}
-			break;
-		}
-		case ACCESS_LIST:
-		{
-			match(ACCESS_LIST);
-			acl_name = LT(1);
-			match(WORD);
-			if ( inputState->guessing==0 ) {
-#line 2034 "pix.g"
-				
-				importer->real_addr_acl = acl_name->getText();
-				
 #line 6704 "PIXCfgParser.cpp"
 			}
 			break;
@@ -6721,6 +6721,57 @@ void PIXCfgParser::static_real_addr_match() {
 	}
 }
 
+void PIXCfgParser::static_real_addr_match() {
+	ANTLR_USE_NAMESPACE(antlr)RefToken  acl_name = ANTLR_USE_NAMESPACE(antlr)nullToken;
+	
+	try {      // for error handling
+		{
+		switch ( LA(1)) {
+		case IPV4:
+		case IPV6:
+		{
+			single_addr();
+			if ( inputState->guessing==0 ) {
+#line 2038 "pix.g"
+				
+				importer->real_a = importer->tmp_a;
+				importer->real_nm = importer->tmp_nm;
+				
+#line 6741 "PIXCfgParser.cpp"
+			}
+			break;
+		}
+		case ACCESS_LIST:
+		{
+			match(ACCESS_LIST);
+			acl_name = LT(1);
+			match(WORD);
+			if ( inputState->guessing==0 ) {
+#line 2044 "pix.g"
+				
+				importer->real_addr_acl = acl_name->getText();
+				
+#line 6755 "PIXCfgParser.cpp"
+			}
+			break;
+		}
+		default:
+		{
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+		}
+		}
+		}
+	}
+	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
+		if( inputState->guessing == 0 ) {
+			reportError(ex);
+			recover(ex,_tokenSet_41);
+		} else {
+			throw;
+		}
+	}
+}
+
 void PIXCfgParser::static_command_common_last_parameters() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  max_conn = ANTLR_USE_NAMESPACE(antlr)nullToken;
@@ -6732,12 +6783,12 @@ void PIXCfgParser::static_command_common_last_parameters() {
 		{
 			match(DNS);
 			if ( inputState->guessing==0 ) {
-#line 2088 "pix.g"
+#line 2098 "pix.g"
 				
 				importer->addMessageToLog(
 				"Warning: 'static' command option 'dns' is not supported");
 				
-#line 6741 "PIXCfgParser.cpp"
+#line 6792 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6745,12 +6796,12 @@ void PIXCfgParser::static_command_common_last_parameters() {
 		{
 			match(NORANDOMSEQ);
 			if ( inputState->guessing==0 ) {
-#line 2094 "pix.g"
+#line 2104 "pix.g"
 				
 				importer->addMessageToLog(
 				"Warning: 'static' command option 'norandomseq' is not supported");
 				
-#line 6754 "PIXCfgParser.cpp"
+#line 6805 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6760,11 +6811,11 @@ void PIXCfgParser::static_command_common_last_parameters() {
 			nm = LT(1);
 			match(IPV4);
 			if ( inputState->guessing==0 ) {
-#line 2100 "pix.g"
+#line 2110 "pix.g"
 				
 				importer->mapped_nm = nm->getText();
 				
-#line 6768 "PIXCfgParser.cpp"
+#line 6819 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6797,11 +6848,11 @@ void PIXCfgParser::static_command_common_last_parameters() {
 			max_conn = LT(1);
 			match(INT_CONST);
 			{
-			if ((LA(1) == INT_CONST) && (_tokenSet_41.member(LA(2)))) {
+			if ((LA(1) == INT_CONST) && (_tokenSet_42.member(LA(2)))) {
 				max_emb_conn = LT(1);
 				match(INT_CONST);
 			}
-			else if ((_tokenSet_41.member(LA(1))) && (_tokenSet_42.member(LA(2)))) {
+			else if ((_tokenSet_42.member(LA(1))) && (_tokenSet_43.member(LA(2)))) {
 			}
 			else {
 				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -6809,13 +6860,13 @@ void PIXCfgParser::static_command_common_last_parameters() {
 			
 			}
 			if ( inputState->guessing==0 ) {
-#line 2106 "pix.g"
+#line 2116 "pix.g"
 				
 				importer->static_max_conn = max_conn->getText();
 				if (max_emb_conn)
 				importer->static_max_emb_conn = max_emb_conn->getText();
 				
-#line 6819 "PIXCfgParser.cpp"
+#line 6870 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6828,7 +6879,7 @@ void PIXCfgParser::static_command_common_last_parameters() {
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		if( inputState->guessing == 0 ) {
 			reportError(ex);
-			recover(ex,_tokenSet_41);
+			recover(ex,_tokenSet_42);
 		} else {
 			throw;
 		}
@@ -7063,68 +7114,65 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_6(_tokenSet_6_dat
 const unsigned long PIXCfgParser::_tokenSet_7_data_[] = { 2415921168UL, 1024UL, 3221225472UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 OBJECT "host" OBJECT_GROUP "interface" "any" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_7(_tokenSet_7_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_8_data_[] = { 16UL, 2097360UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
-// NEWLINE INT_CONST "tcp" "udp" "dns" "outside" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_8(_tokenSet_8_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_9_data_[] = { 16UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_8_data_[] = { 16UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_9(_tokenSet_9_data_,6);
-const unsigned long PIXCfgParser::_tokenSet_10_data_[] = { 67123216UL, 1344274640UL, 1920UL, 65536UL, 46137344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_8(_tokenSet_8_data_,6);
+const unsigned long PIXCfgParser::_tokenSet_9_data_[] = { 67123216UL, 1344274640UL, 1920UL, 65536UL, 46137344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 IPV6 WORD "pptp" INT_CONST "tcp" "udp" "dns" "hostname" 
 // "access-list" "echo" "rip" "ssh" "telnet" "outside" MINUS "netmask" 
 // "norandomseq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_10(_tokenSet_10_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_11_data_[] = { 268419136UL, 16UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_9(_tokenSet_9_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_10_data_[] = { 268419136UL, 16UL, 0UL, 0UL, 0UL, 0UL };
 // "ip" "ah" "eigrp" "esp" "gre" "igmp" "igrp" "ipinip" "ipsec" "nos" "ospf" 
 // "pcp" "pim" "pptp" "snp" INT_CONST 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_11(_tokenSet_11_data_,6);
-const unsigned long PIXCfgParser::_tokenSet_12_data_[] = { 1342187378UL, 1408238604UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_10(_tokenSet_10_data_,6);
+const unsigned long PIXCfgParser::_tokenSet_11_data_[] = { 1342187378UL, 1408238604UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
 // "service" "icmp" OBJECT_GROUP "crypto" "dns" "no" "certificate" "PIX" 
 // "ASA" "hostname" "access-list" "ssh" "telnet" "interface" "controller" 
 // LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT "nat" "global" 
 // "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_12(_tokenSet_12_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_13_data_[] = { 16UL, 0UL, 0UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_11(_tokenSet_11_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_12_data_[] = { 16UL, 0UL, 0UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "log" "log-input" "fragments" "time-range" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_13(_tokenSet_13_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_14_data_[] = { 16UL, 513UL, 120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_12(_tokenSet_12_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_13_data_[] = { 16UL, 513UL, 120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "range" "destination" "eq" "gt" "lt" "neq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_14(_tokenSet_14_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_15_data_[] = { 2415921168UL, 1537UL, 3221227640UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_13(_tokenSet_13_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_14_data_[] = { 2415921168UL, 1537UL, 3221227640UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 OBJECT "host" "range" "destination" OBJECT_GROUP "eq" "gt" 
 // "lt" "neq" "established" "interface" "any" "log" "log-input" "fragments" 
 // "time-range" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_15(_tokenSet_15_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_16_data_[] = { 1342187378UL, 1408244744UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_14(_tokenSet_14_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_15_data_[] = { 1342187378UL, 1408244744UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
 // "icmp" OBJECT_GROUP "group-object" "network-object" "crypto" "dns" "no" 
 // "certificate" "PIX" "ASA" "hostname" "access-list" "ssh" "telnet" "interface" 
 // "controller" LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT 
 // "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_16(_tokenSet_16_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_17_data_[] = { 1342187378UL, 1408257032UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_15(_tokenSet_15_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_16_data_[] = { 1342187378UL, 1408257032UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
 // "icmp" OBJECT_GROUP "group-object" "protocol-object" "crypto" "dns" 
 // "no" "certificate" "PIX" "ASA" "hostname" "access-list" "ssh" "telnet" 
 // "interface" "controller" LINE_COMMENT "exit" "nameif" "access-group" 
 // COLON_COMMENT "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_17(_tokenSet_17_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_18_data_[] = { 1342187378UL, 1408273416UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_16(_tokenSet_16_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_17_data_[] = { 1342187378UL, 1408273416UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
 // "icmp" OBJECT_GROUP "group-object" "icmp-object" "crypto" "dns" "no" 
 // "certificate" "PIX" "ASA" "hostname" "access-list" "ssh" "telnet" "interface" 
 // "controller" LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT 
 // "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_18(_tokenSet_18_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_19_data_[] = { 1342187378UL, 1409027080UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_17(_tokenSet_17_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_18_data_[] = { 1342187378UL, 1409027080UL, 1073743360UL, 33980416UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
 // "icmp" OBJECT_GROUP "group-object" "service-object" "port-object" "crypto" 
 // "dns" "no" "certificate" "PIX" "ASA" "hostname" "access-list" "ssh" 
 // "telnet" "interface" "controller" LINE_COMMENT "exit" "nameif" "access-group" 
 // COLON_COMMENT "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_19(_tokenSet_19_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_20_data_[] = { 2415929360UL, 1041UL, 4294965496UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_18(_tokenSet_18_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_19_data_[] = { 2415929360UL, 1041UL, 4294965496UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 WORD OBJECT "host" "range" INT_CONST OBJECT_GROUP "eq" 
 // "gt" "lt" "neq" "echo" "established" "alternate-address" "conversion-error" 
 // "echo-reply" "information-reply" "information-request" "mask-reply" 
@@ -7132,31 +7180,31 @@ const unsigned long PIXCfgParser::_tokenSet_20_data_[] = { 2415929360UL, 1041UL,
 // "router-solicitation" "source-quench" "time-exceeded" "timestamp-reply" 
 // "timestamp-request" "traceroute" "unreachable" "interface" "any" "log" 
 // "log-input" "fragments" "time-range" "outside" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_20(_tokenSet_20_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_21_data_[] = { 2415921152UL, 1024UL, 3221225472UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_19(_tokenSet_19_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_20_data_[] = { 2415921152UL, 1024UL, 3221225472UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // IPV4 OBJECT "host" OBJECT_GROUP "interface" "any" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_21(_tokenSet_21_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_22_data_[] = { 16UL, 0UL, 0UL, 8195UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_20(_tokenSet_20_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_21_data_[] = { 16UL, 0UL, 0UL, 8195UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "log" "log-input" "fragments" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_22(_tokenSet_22_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_23_data_[] = { 16UL, 0UL, 0UL, 3UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_21(_tokenSet_21_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_22_data_[] = { 16UL, 0UL, 0UL, 3UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "log" "log-input" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_23(_tokenSet_23_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_24_data_[] = { 268445712UL, 1025UL, 2168UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_22(_tokenSet_22_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_23_data_[] = { 268445712UL, 1025UL, 2168UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 WORD OBJECT "range" OBJECT_GROUP "eq" "gt" "lt" "neq" "established" 
 // "log" "log-input" "fragments" "time-range" "outside" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_24(_tokenSet_24_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_25_data_[] = { 0UL, 1UL, 120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_23(_tokenSet_23_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_24_data_[] = { 0UL, 1UL, 120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "range" "eq" "gt" "lt" "neq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_25(_tokenSet_25_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_26_data_[] = { 67117056UL, 268435472UL, 1920UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_24(_tokenSet_24_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_25_data_[] = { 67117056UL, 268435472UL, 1920UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD "pptp" INT_CONST "hostname" "echo" "rip" "ssh" "telnet" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_26(_tokenSet_26_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_27_data_[] = { 268435472UL, 1025UL, 2168UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_25(_tokenSet_25_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_26_data_[] = { 268435472UL, 1025UL, 2168UL, 24579UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE OBJECT "range" OBJECT_GROUP "eq" "gt" "lt" "neq" "established" 
 // "log" "log-input" "fragments" "time-range" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_27(_tokenSet_27_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 335554418UL, 1408238617UL, 1073745912UL, 34013183UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_26(_tokenSet_26_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_27_data_[] = { 335554418UL, 1408238617UL, 1073745912UL, 34013183UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD "pptp" OBJECT 
 // "range" "icmp" INT_CONST OBJECT_GROUP "crypto" "dns" "no" "certificate" 
 // "PIX" "ASA" "hostname" "access-list" "eq" "gt" "lt" "neq" "echo" "rip" 
@@ -7165,8 +7213,8 @@ const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 335554418UL, 14082386
 // "warnings" "disable" "inactive" "interval" "fragments" "time-range" 
 // "controller" LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT 
 // "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_28(_tokenSet_28_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_29_data_[] = { 335554418UL, 1408238616UL, 1073743744UL, 34013183UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_27(_tokenSet_27_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 335554418UL, 1408238616UL, 1073743744UL, 34013183UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD "pptp" OBJECT 
 // "icmp" INT_CONST OBJECT_GROUP "crypto" "dns" "no" "certificate" "PIX" 
 // "ASA" "hostname" "access-list" "echo" "rip" "ssh" "telnet" "interface" 
@@ -7174,23 +7222,23 @@ const unsigned long PIXCfgParser::_tokenSet_29_data_[] = { 335554418UL, 14082386
 // "informational" "notifications" "warnings" "disable" "inactive" "interval" 
 // "fragments" "time-range" "controller" LINE_COMMENT "exit" "nameif" "access-group" 
 // COLON_COMMENT "nat" "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_29(_tokenSet_29_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_30_data_[] = { 2415921152UL, 1025UL, 3221225592UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_28(_tokenSet_28_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_29_data_[] = { 2415921152UL, 1025UL, 3221225592UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // IPV4 OBJECT "host" "range" OBJECT_GROUP "eq" "gt" "lt" "neq" "interface" 
 // "any" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_30(_tokenSet_30_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_31_data_[] = { 335554576UL, 268436497UL, 4088UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_29(_tokenSet_29_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_30_data_[] = { 335554576UL, 268436497UL, 4088UL, 90115UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 WORD "pptp" OBJECT "range" INT_CONST OBJECT_GROUP "hostname" 
 // "eq" "gt" "lt" "neq" "echo" "rip" "ssh" "telnet" "established" "log" 
 // "log-input" "fragments" "time-range" "outside" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_31(_tokenSet_31_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_32_data_[] = { 2483042320UL, 1344276177UL, 3221229560UL, 24579UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_30(_tokenSet_30_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_31_data_[] = { 2483042320UL, 1344276177UL, 3221229560UL, 24579UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 IPV6 WORD "pptp" OBJECT "host" "range" INT_CONST "tcp" 
 // "udp" "destination" OBJECT_GROUP "dns" "hostname" "access-list" "eq" 
 // "gt" "lt" "neq" "echo" "rip" "ssh" "telnet" "established" "interface" 
 // "any" "log" "log-input" "fragments" "time-range" "netmask" "norandomseq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_32(_tokenSet_32_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 2415931250UL, 1408238617UL, 4294967032UL, 34070531UL, 20676608UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_31(_tokenSet_31_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_32_data_[] = { 2415931250UL, 1408238617UL, 4294967032UL, 34070531UL, 20676608UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" IPV4 WORD OBJECT "host" 
 // "range" "icmp" INT_CONST OBJECT_GROUP "crypto" "dns" "no" "certificate" 
 // "PIX" "ASA" "hostname" "access-list" "eq" "gt" "lt" "neq" "echo" "ssh" 
@@ -7202,43 +7250,53 @@ const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 2415931250UL, 1408238
 // "log-input" "fragments" "time-range" "controller" "outside" LINE_COMMENT 
 // "exit" "nameif" "access-group" COLON_COMMENT "nat" CLOSING_PAREN COMMA 
 // "global" "static" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_33(_tokenSet_33_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_34_data_[] = { 1115947072UL, 4194304UL, 256UL, 4261412864UL, 1151UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_32(_tokenSet_32_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 1115947072UL, 4194304UL, 256UL, 4261412864UL, 1151UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "ip" "igmp" "ospf" "pim" "description" "no" "rip" "nameif" "vlan" "speed" 
 // "duplex" "ddns" "forward" "delay" "hold-time" "ipv6" "mac-address" "multicast" 
 // PPPOE "security-level" "shutdown" "switchport" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_34(_tokenSet_34_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_35_data_[] = { 1115947072UL, 4194304UL, 256UL, 4261806080UL, 1151UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_33(_tokenSet_33_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_34_data_[] = { 1115947072UL, 4194304UL, 256UL, 4261806080UL, 1151UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "ip" "igmp" "ospf" "pim" "description" "no" "rip" LINE_COMMENT "exit" 
 // "nameif" "vlan" "speed" "duplex" "ddns" "forward" "delay" "hold-time" 
 // "ipv6" "mac-address" "multicast" PPPOE "security-level" "shutdown" "switchport" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_35(_tokenSet_35_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_36_data_[] = { 8192UL, 0UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_34(_tokenSet_34_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_35_data_[] = { 8192UL, 0UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
 // WORD "outside" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_36(_tokenSet_36_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_37_data_[] = { 0UL, 2097360UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_35(_tokenSet_35_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_36_data_[] = { 0UL, 2097360UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
 // INT_CONST "tcp" "udp" "dns" "outside" 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_36(_tokenSet_36_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_37_data_[] = { 16UL, 2097360UL, 0UL, 65536UL, 0UL, 0UL, 0UL, 0UL };
+// NEWLINE INT_CONST "tcp" "udp" "dns" "outside" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_37(_tokenSet_37_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_38_data_[] = { 0UL, 2097360UL, 0UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
+const unsigned long PIXCfgParser::_tokenSet_38_data_[] = { 3489671026UL, 1408238811UL, 1073743360UL, 34045952UL, 19103744UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// EOF NEWLINE "quit" "ip" "timeout" "names" "name" WORD OBJECT "description" 
+// "host" "range" "subnet" "icmp" INT_CONST "tcp" "udp" OBJECT_GROUP "crypto" 
+// "dns" "no" "certificate" "PIX" "ASA" "hostname" "access-list" "ssh" 
+// "telnet" "interface" "controller" "outside" LINE_COMMENT "exit" "nameif" 
+// "access-group" COLON_COMMENT "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_38(_tokenSet_38_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_39_data_[] = { 67123200UL, 1342177296UL, 1920UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_39_data_[] = { 0UL, 2097360UL, 0UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_39(_tokenSet_39_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_40_data_[] = { 67123200UL, 1342177296UL, 1920UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // IPV4 IPV6 WORD "pptp" INT_CONST "hostname" "access-list" "echo" "rip" 
 // "ssh" "telnet" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_39(_tokenSet_39_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_40_data_[] = { 67117072UL, 270532816UL, 1920UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_40(_tokenSet_40_data_,8);
+const unsigned long PIXCfgParser::_tokenSet_41_data_[] = { 67117072UL, 270532816UL, 1920UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "pptp" INT_CONST "tcp" "udp" "dns" "hostname" "echo" "rip" 
 // "ssh" "telnet" "netmask" "norandomseq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_40(_tokenSet_40_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_41_data_[] = { 16UL, 2097360UL, 0UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// NEWLINE INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_41(_tokenSet_41_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_42_data_[] = { 268447602UL, 1408238808UL, 1073743360UL, 33980416UL, 61046784UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_42_data_[] = { 16UL, 2097360UL, 0UL, 0UL, 41943040UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// NEWLINE INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_42(_tokenSet_42_data_,12);
+const unsigned long PIXCfgParser::_tokenSet_43_data_[] = { 268447602UL, 1408238808UL, 1073743360UL, 33980416UL, 61046784UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "names" "name" IPV4 WORD OBJECT "icmp" 
 // INT_CONST "tcp" "udp" OBJECT_GROUP "crypto" "dns" "no" "certificate" 
 // "PIX" "ASA" "hostname" "access-list" "ssh" "telnet" "interface" "controller" 
 // LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT "nat" "global" 
 // "netmask" "static" "norandomseq" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_42(_tokenSet_42_data_,12);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_43(_tokenSet_43_data_,12);
 
 
diff --git a/src/parsers/PIXCfgParser.hpp b/src/parsers/PIXCfgParser.hpp
index f1bf54abc..1d7567d52 100644
--- a/src/parsers/PIXCfgParser.hpp
+++ b/src/parsers/PIXCfgParser.hpp
@@ -311,6 +311,8 @@ private:
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_41;
 	static const unsigned long _tokenSet_42_data_[];
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_42;
+	static const unsigned long _tokenSet_43_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_43;
 };
 
 #endif /*INC_PIXCfgParser_hpp_*/
diff --git a/src/parsers/pix.g b/src/parsers/pix.g
index ac7170d78..4a500c8c0 100644
--- a/src/parsers/pix.g
+++ b/src/parsers/pix.g
@@ -285,16 +285,6 @@ named_object_nat : nat_top_level_command
         }
     ;
 
-// named_object_nat : NAT OPENING_PAREN interface_label 
-//         {
-//             importer->addMessageToLog(
-//                 "Parser warning: "
-//                 "Import of named objects with \"nat\" command "
-//                 "is not supported at this time");
-//             consumeUntil(NEWLINE);
-//         }
-//     ;
-
 named_object_description : DESCRIPTION 
         {
             importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1836,19 +1826,23 @@ comment : (LINE_COMMENT | COLON_COMMENT) ;
 
 nat_top_level_command : 
         NAT OPENING_PAREN
+        {
+            importer->clear();
+        }
         ( nat_old_top_level_command | nat_new_top_level_command )
     ;
 
 nat_old_top_level_command : 
-        interface_label { importer->prenat_interface = LT(0)->getText(); }
+        interface_label
+        {
+            importer->prenat_interface = LT(0)->getText();
+        }
         CLOSING_PAREN
         {
-            importer->clear();
             importer->setCurrentLineNumber(LT(0)->getLine());
             importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
-            *dbg << " SNAT rule " << std::endl;
+            *dbg << " SNAT rule ";
             importer->rule_type = libfwbuilder::NATRule::SNAT;
-            
         }
 
         //  <0-2147483647>  The <nat_id> of this group of hosts/networks.
@@ -1862,27 +1856,34 @@ nat_old_top_level_command :
 
         nat_addr_match
 
-        nat_command_last_parameters
+        ( nat_command_last_parameters )*
 
         NEWLINE
         {
             importer->pushNATRule();
+            *dbg << std::endl;
         }
     ;
 
 nat_addr_match :
-        (   
-            host_addr   // real
+        single_addr   // real
+        {
+            importer->nat_a = importer->tmp_a;
+        }
+
+        // A.B.C.D  IP netmask to apply to the local IP address
+        // <cr>
+        (
+            single_addr  
             {
-                importer->nat_a = importer->tmp_a;
-                importer->nat_nm = importer->tmp_nm;
+                importer->nat_nm = importer->tmp_a;
             }
-        |
-            ACCESS_LIST acl_name:WORD
-            {
-                importer->nat_acl = acl_name->getText();
-            }
-        )
+        )?
+    |
+        ACCESS_LIST acl_name:WORD
+        {
+            importer->nat_acl = acl_name->getText();
+        }
     ;
 
 nat_command_last_parameters :
@@ -1892,6 +1893,8 @@ nat_command_last_parameters :
         //  outside      Enable Outside NAT
         //  tcp          Configure TCP specific parameters
         //  udp          Configure UDP specific parameters
+        // <cr>
+
         (DNS)?
         (OUTSIDE)?
         (TCP | UDP)?
@@ -1916,32 +1919,38 @@ nat_new_top_level_command :
 global_top_level_command :
         GLOBAL
         OPENING_PAREN 
-        interface_label { importer->global_pool_interface = LT(0)->getText(); }
-        CLOSING_PAREN
-        num:INT_CONST 
         {
             importer->clear();
             importer->setCurrentLineNumber(LT(0)->getLine());
-            importer->global_pool_num = num->getText();
-            *dbg << " global address pool "
-                 << importer->global_pool_num
+        }
+        interface_label
+        {
+            importer->tmp_global_pool.interface = LT(0)->getText();
+        }
+        CLOSING_PAREN
+        num:INT_CONST 
+        {
+            importer->tmp_global_pool.str_num = num->getText();
+            importer->tmp_global_pool.netmask = "255.255.255.255";
+            *dbg << " GLOBAL POOL "
+                 << importer->tmp_global_pool.str_num
                  << " "
-                 << importer->global_pool_interface;
+                 << importer->tmp_global_pool.interface;
         }
 
         // WORD Enter IP address or a range of IP addresses <start_ip>[-<end_ip>]
         // interface  Specifies PAT using the IP address at the interface
         (INTRFACE | single_addr)
         {
-            importer->global_pool_start = LT(0)->getText();
-            importer->global_pool_end = LT(0)->getText();
+            importer->tmp_global_pool.start = LT(0)->getText();
+            importer->tmp_global_pool.end = LT(0)->getText();
         }
 
         (
             MINUS
             single_addr
             {
-                importer->global_pool_end = LT(0)->getText();
+                importer->tmp_global_pool.end = LT(0)->getText();
             }
         )?
 
@@ -1950,25 +1959,26 @@ global_top_level_command :
         (
             NETMASK IPV4
             {
-                importer->global_pool_netmask = LT(0)->getText();
+                importer->tmp_global_pool.netmask = LT(0)->getText();
             }
         )?
 
         NEWLINE
         {
-            *dbg << " " << importer->global_pool_start
-                 << " " << importer->global_pool_end
-                 << " " << importer->global_pool_netmask
+            importer->addGlobalPool();
+            *dbg << " " << importer->tmp_global_pool.start
+                 << " " << importer->tmp_global_pool.end
+                 << " " << importer->tmp_global_pool.netmask
                  << std::endl;
         }
     ;
 
 static_top_level_command :
         STATIC
+        OPENING_PAREN 
         {
             importer->clear();
         }
-        OPENING_PAREN 
         interface_label { importer->prenat_interface = LT(0)->getText(); }
         COMMA
         interface_label { importer->postnat_interface = LT(0)->getText(); }
@@ -1976,7 +1986,6 @@ static_top_level_command :
         {
             importer->setCurrentLineNumber(LT(0)->getLine());
             importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
-            importer->newNATRule();
             *dbg << " DNAT rule ";
             importer->rule_type = libfwbuilder::NATRule::DNAT;
         }
diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.0.output b/src/unit_tests/PIXImporterTest/test_data/asa8.0.output
index 0b397da7e..399fa91f8 100644
--- a/src/unit_tests/PIXImporterTest/test_data/asa8.0.output
+++ b/src/unit_tests/PIXImporterTest/test_data/asa8.0.output
@@ -36,37 +36,20 @@ Object Group (protocol) proto-pptp
 Object Group (protocol) proto-snp
 Object Group (protocol) proto-tcp
 Object Group (protocol) proto-udp
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface Ethernet1 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface Ethernet0 ruleset icmp_commands_inside direction 'in' 
-Ruleset: telnet_commands_inside
 Interface Ethernet0 ruleset telnet_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface Ethernet0 ruleset ssh_commands_inside direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl-object-groups.output b/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl-object-groups.output
index f9d6b3617..8cfd11325 100644
--- a/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl-object-groups.output
+++ b/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl-object-groups.output
@@ -20,30 +20,4 @@ Named object (service) ip2
 Object Group (protocol) pg1
 Object Group (network) src-network-group-1
 Object Group (network) dst-network-group-1
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
 Interface Vlan1 ruleset inside_in direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl.output b/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl.output
index 1c46cde45..b6b766bca 100644
--- a/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl.output
+++ b/src/unit_tests/PIXImporterTest/test_data/asa8.3-acl.output
@@ -20,66 +20,8 @@ Named object (service) ip2
 Object Group (protocol) pg1
 Object Group (network) src-network-group-1
 Object Group (network) dst-network-group-1
-Ruleset: inside_in
 Rule comment: 0 ( global ) 
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
 Rule comment: 3 ( global ) 
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: outside_out
-Ruleset: outside_out
-Ruleset: outside_out
 Interface Vlan1 ruleset inside_in direction 'in' 
 Interface Vlan1 ruleset inside_out direction 'out' 
 Interface Vlan2 ruleset outside_in direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.3-objects-and-groups.output b/src/unit_tests/PIXImporterTest/test_data/asa8.3-objects-and-groups.output
index 23040344e..24eac036f 100644
--- a/src/unit_tests/PIXImporterTest/test_data/asa8.3-objects-and-groups.output
+++ b/src/unit_tests/PIXImporterTest/test_data/asa8.3-objects-and-groups.output
@@ -105,5 +105,4 @@ Object Group (icmp) ig2
 Object Group (icmp) ig3
 Object Group (service) id5102X14531.srv.tcp.0
 Object Group (service) tcp-udp-1
-Ruleset: inside_in
 Interface Vlan1 ruleset inside_in direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/asa8.3.output b/src/unit_tests/PIXImporterTest/test_data/asa8.3.output
index 3743f5191..7fcc43e95 100644
--- a/src/unit_tests/PIXImporterTest/test_data/asa8.3.output
+++ b/src/unit_tests/PIXImporterTest/test_data/asa8.3.output
@@ -37,8 +37,5 @@ Named object (address) internal_subnet_1
 Named object (address) internal_subnet_2
 Named object (address) Internal_net
 Named object (address) hostA:eth0
-Ruleset: outside_acl_in
-Ruleset: ssh_commands_inside
 Interface Vlan1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface Vlan1 ruleset ssh_commands_inside direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/pix6.output b/src/unit_tests/PIXImporterTest/test_data/pix6.output
index 41180d498..66d4ca39b 100644
--- a/src/unit_tests/PIXImporterTest/test_data/pix6.output
+++ b/src/unit_tests/PIXImporterTest/test_data/pix6.output
@@ -10,122 +10,47 @@ Object Group (icmp) outside.id12363X2458.srv.icmp.0
 Object Group (service) outside.id12376X2458.srv.udp.0
 Object Group (service) outside.id12438X2458.srv.tcp.0
 Object Group (service) outside.id12466X2458.srv.tcp.0
-Ruleset: outside_acl_in
 Rule comment: 0 ( ethernet0 ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 3 ( global ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 4 ( global ) 
-Ruleset: outside_acl_in
 Rule comment: fw uses DHCP 
-Ruleset: outside_acl_in
 Rule comment: plus many DHCP requests 
-Ruleset: outside_acl_in
 Rule comment: from cable modem 
-Ruleset: outside_acl_in
 Rule comment: 6 ( global ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 7 ( global ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 10 ( global ) 
-Ruleset: outside_acl_in
 Rule comment: using swatch to automatically 
-Ruleset: outside_acl_in
 Rule comment: block probing ssh connections , so no 
-Ruleset: outside_acl_in
 Rule comment: need to limit 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 11 ( global ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 17 ( global ) 
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
-Ruleset: outside_acl_in
 Rule comment: 19 ( global ) 
-Ruleset: outside_acl_in
 Rule comment: ' catch all' rule 
-Ruleset: outside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 1 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 5 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 6 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 7 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 17 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 18 ( global ) 
-Ruleset: inside_acl_in
-Ruleset: inside_acl_in
 Rule comment: 19 ( global ) 
-Ruleset: inside_acl_in
 Rule comment: ' catch all' rule 
-Ruleset: inside_acl_in
-Ruleset: id12594X2458.0
-Ruleset: id12594X2458.1
-Ruleset: id12594X2458.2
-Ruleset: id12594X2458.3
-Ruleset: id12626X2458.0
-Ruleset: id12626X2458.1
-Ruleset: id12626X2458.2
-Ruleset: id12642X2458.0
-Ruleset: id12656X2458.0
-Ruleset: id12670X2458.0
-Ruleset: id12684X2458.0
-Ruleset: id12743X2458.0
 Interface ethernet0 ruleset outside_acl_in direction 'in' 
 Interface ethernet1 ruleset inside_acl_in direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_outside
 Interface ethernet0 ruleset icmp_commands_outside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: icmp_commands_inside
 Interface ethernet1 ruleset icmp_commands_inside direction 'in' 
-Ruleset: telnet_commands_inside
 Interface ethernet1 ruleset telnet_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface ethernet1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface ethernet1 ruleset ssh_commands_inside direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb
index ab1ce9eef..fe08c6f67 100644
--- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb
+++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1301538587" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1301598505" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -441,78 +441,335 @@
         <IPv4 id="id9" name="h-10.0.0.253" comment="Created during import of  line 80" ro="False" address="10.0.0.253" netmask="255.255.255.255"/>
         <IPv4 id="id10" name="h-10.0.0.254" comment="Created during import of  line 81" ro="False" address="10.0.0.254" netmask="255.255.255.255"/>
         <IPv4 id="id11" name="h-10.1.1.43" comment="Created during import of  line 106" ro="False" address="10.1.1.43" netmask="255.255.255.255"/>
-        <IPv4 id="id12" name="h-10.0.0.16" comment="Created during import of  line 136" ro="False" address="10.0.0.16" netmask="255.255.255.255"/>
-        <IPv4 id="id13" name="h-10.1.1.16" comment="Created during import of  line 136" ro="False" address="10.1.1.16" netmask="255.255.255.255"/>
-        <IPv4 id="id14" name="h-10.0.0.100" comment="Created during import of  line 137" ro="False" address="10.0.0.100" netmask="255.255.255.255"/>
-        <IPv4 id="id15" name="h-10.1.1.100" comment="Created during import of  line 137" ro="False" address="10.1.1.100" netmask="255.255.255.255"/>
-        <IPv4 id="id16" name="h-10.1.1.111" comment="Created during import of  line 138" ro="False" address="10.1.1.111" netmask="255.255.255.255"/>
-        <IPv4 id="id17" name="h-10.5.80.16" comment="Created during import of  line 139" ro="False" address="10.5.80.16" netmask="255.255.255.255"/>
-        <IPv4 id="id18" name="h-10.5.80.200" comment="Created during import of  line 140" ro="False" address="10.5.80.200" netmask="255.255.255.255"/>
-        <IPv4 id="id19" name="h-10.10.1.200" comment="Created during import of  line 140" ro="False" address="10.10.1.200" netmask="255.255.255.255"/>
-        <IPv4 id="id20" name="h-192.0.2.100" comment="Created during import of  line 193" ro="False" address="192.0.2.100" netmask="255.255.255.255"/>
+        <IPv4 id="id12" name="h-192.0.2.10" comment="Created during import of  line 136" ro="False" address="192.0.2.10" netmask="255.255.255.255"/>
+        <IPv4 id="id13" name="h-192.0.2.11" comment="Created during import of  line 137" ro="False" address="192.0.2.11" netmask="255.255.255.255"/>
+        <IPv4 id="id14" name="h-192.0.2.15" comment="Created during import of  line 137" ro="False" address="192.0.2.15" netmask="255.255.255.255"/>
+        <IPv4 id="id15" name="h-192.0.2.128" comment="Created during import of  line 138" ro="False" address="192.0.2.128" netmask="255.255.255.255"/>
+        <IPv4 id="id16" name="h-10.0.0.128" comment="Created during import of  line 139" ro="False" address="10.0.0.128" netmask="255.255.255.255"/>
+        <IPv4 id="id17" name="h-10.1.1.1" comment="Created during import of  line 141" ro="False" address="10.1.1.1" netmask="255.255.255.255"/>
+        <IPv4 id="id18" name="h-255.255.255.255" comment="Created during import of  line 141" ro="False" address="255.255.255.255" netmask="255.255.255.255"/>
+        <IPv4 id="id19" name="h-10.1.1.32" comment="Created during import of  line 142" ro="False" address="10.1.1.32" netmask="255.255.255.255"/>
+        <IPv4 id="id20" name="h-255.255.255.240" comment="Created during import of  line 142" ro="False" address="255.255.255.240" netmask="255.255.255.255"/>
+        <IPv4 id="id21" name="h-10.0.0.16" comment="Created during import of  line 145" ro="False" address="10.0.0.16" netmask="255.255.255.255"/>
+        <IPv4 id="id22" name="h-10.1.1.16" comment="Created during import of  line 145" ro="False" address="10.1.1.16" netmask="255.255.255.255"/>
+        <IPv4 id="id23" name="h-10.0.0.100" comment="Created during import of  line 146" ro="False" address="10.0.0.100" netmask="255.255.255.255"/>
+        <IPv4 id="id24" name="h-10.1.1.100" comment="Created during import of  line 146" ro="False" address="10.1.1.100" netmask="255.255.255.255"/>
+        <IPv4 id="id25" name="h-10.1.1.111" comment="Created during import of  line 147" ro="False" address="10.1.1.111" netmask="255.255.255.255"/>
+        <IPv4 id="id26" name="h-10.5.80.16" comment="Created during import of  line 148" ro="False" address="10.5.80.16" netmask="255.255.255.255"/>
+        <IPv4 id="id27" name="h-10.5.80.200" comment="Created during import of  line 149" ro="False" address="10.5.80.200" netmask="255.255.255.255"/>
+        <IPv4 id="id28" name="h-10.10.1.200" comment="Created during import of  line 149" ro="False" address="10.10.1.200" netmask="255.255.255.255"/>
+        <IPv4 id="id29" name="h-192.0.2.100" comment="Created during import of  line 202" ro="False" address="192.0.2.100" netmask="255.255.255.255"/>
       </ObjectGroup>
-      <ObjectGroup id="id21" name="DNS Names" comment="" ro="False"/>
-      <ObjectGroup id="id22" name="Address Tables" comment="" ro="False"/>
-      <ObjectGroup id="id23" name="Groups" comment="" ro="False">
-        <ObjectGroup id="id24" name="outside.id12051X6282.src.net.0" comment="Created during import of  line 71" ro="False">
+      <ObjectGroup id="id30" name="DNS Names" comment="" ro="False"/>
+      <ObjectGroup id="id31" name="Address Tables" comment="" ro="False"/>
+      <ObjectGroup id="id32" name="Groups" comment="" ro="False">
+        <ObjectGroup id="id33" name="outside.id12051X6282.src.net.0" comment="Created during import of  line 71" ro="False">
           <ObjectRef ref="id3"/>
           <ObjectRef ref="id4"/>
         </ObjectGroup>
-        <ObjectGroup id="id27" name="outside.id12051X6282.src.net.1" comment="Created during import of  line 74" ro="False">
+        <ObjectGroup id="id36" name="outside.id12051X6282.src.net.1" comment="Created during import of  line 74" ro="False">
           <ObjectRef ref="id5"/>
           <ObjectRef ref="id6"/>
           <ObjectRef ref="id7"/>
           <ObjectRef ref="id8"/>
         </ObjectGroup>
-        <ObjectGroup id="id32" name="outside.id12051X6282.src.net.2" comment="Created during import of  line 79" ro="False">
+        <ObjectGroup id="id41" name="outside.id12051X6282.src.net.2" comment="Created during import of  line 79" ro="False">
           <ObjectRef ref="id9"/>
           <ObjectRef ref="id10"/>
         </ObjectGroup>
-        <ObjectGroup id="id35" name="network-zone-inside" comment="Created during import of  line 83" ro="False">
-          <ObjectRef ref="id41"/>
+        <ObjectGroup id="id44" name="network-zone-inside" comment="Created during import of  line 83" ro="False">
+          <ObjectRef ref="id50"/>
         </ObjectGroup>
-        <ObjectGroup id="id37" name="network-zone-dmz20" comment="Created during import of  line 85" ro="False">
-          <ObjectRef ref="id42"/>
+        <ObjectGroup id="id46" name="network-zone-dmz20" comment="Created during import of  line 85" ro="False">
+          <ObjectRef ref="id51"/>
         </ObjectGroup>
       </ObjectGroup>
-      <ObjectGroup id="id39" name="Hosts" comment="" ro="False"/>
-      <ObjectGroup id="id40" name="Networks" comment="" ro="False">
-        <Network id="id41" name="net-10.1.1.0/255.255.255.0" comment="Created during import of  line 84" ro="False" address="10.1.1.0" netmask="255.255.255.0"/>
-        <Network id="id42" name="net-10.0.0.0/255.255.255.0" comment="Created during import of  line 86" ro="False" address="10.0.0.0" netmask="255.255.255.0"/>
-        <Network id="id43" name="net-10.0.0.16/255.255.255.240" comment="Created during import of  line 136" ro="False" address="10.0.0.16" netmask="255.255.255.240"/>
-        <Network id="id44" name="net-10.5.80.16/255.255.255.240" comment="Created during import of  line 139" ro="False" address="10.5.80.16" netmask="255.255.255.240"/>
-        <Network id="id45" name="net-10.1.2.0/255.255.255.0" comment="Created during import of  line 192" ro="False" address="10.1.2.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="id48" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id49" name="Networks" comment="" ro="False">
+        <Network id="id50" name="net-10.1.1.0/255.255.255.0" comment="Created during import of  line 84" ro="False" address="10.1.1.0" netmask="255.255.255.0"/>
+        <Network id="id51" name="net-10.0.0.0/255.255.255.0" comment="Created during import of  line 86" ro="False" address="10.0.0.0" netmask="255.255.255.0"/>
+        <Network id="id52" name="net-192.0.2.128/255.255.255.240" comment="" ro="False" address="192.0.2.128" netmask="255.255.255.240"/>
+        <Network id="id53" name="net-10.0.0.128/255.255.255.240" comment="" ro="False" address="10.0.0.128" netmask="255.255.255.240"/>
+        <Network id="id54" name="net-10.1.1.32/255.255.255.240" comment="Created during import of  line 142" ro="False" address="10.1.1.32" netmask="255.255.255.240"/>
+        <Network id="id55" name="net-10.0.0.16/255.255.255.240" comment="Created during import of  line 145" ro="False" address="10.0.0.16" netmask="255.255.255.240"/>
+        <Network id="id56" name="net-10.5.80.16/255.255.255.240" comment="Created during import of  line 148" ro="False" address="10.5.80.16" netmask="255.255.255.240"/>
+        <Network id="id57" name="net-10.1.2.0/255.255.255.0" comment="Created during import of  line 201" ro="False" address="10.1.2.0" netmask="255.255.255.0"/>
+      </ObjectGroup>
+      <ObjectGroup id="id58" name="Address Ranges" comment="" ro="False">
+        <AddressRange id="id59" name="range-192.0.2.11-192.0.2.15" comment="" ro="False" start_address="192.0.2.11" end_address="192.0.2.15"/>
       </ObjectGroup>
-      <ObjectGroup id="id46" name="Address Ranges" comment="" ro="False"/>
     </ObjectGroup>
-    <ServiceGroup id="id47" name="Services" comment="" ro="False">
-      <ServiceGroup id="id48" name="Groups" comment="" ro="False"/>
-      <ServiceGroup id="id49" name="ICMP" comment="" ro="False"/>
-      <ServiceGroup id="id50" name="IP" comment="" ro="False">
-        <IPService id="id51" any_opt="False" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" rtralt="False" rtralt_value="False" short_fragm="False" ssrr="False" tos="" ts="False" name="ip" comment="Created during import of  line 89" ro="False"/>
+    <ServiceGroup id="id60" name="Services" comment="" ro="False">
+      <ServiceGroup id="id61" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id62" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id63" name="IP" comment="" ro="False">
+        <IPService id="id64" any_opt="False" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" rtralt="False" rtralt_value="False" short_fragm="False" ssrr="False" tos="" ts="False" name="ip" comment="Created during import of  line 89" ro="False"/>
       </ServiceGroup>
-      <ServiceGroup id="id52" name="TCP" comment="" ro="False">
-        <TCPService id="id53" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of  line 106" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
-        <TCPService id="id54" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 139" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
-        <TCPService id="id55" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 8080:8080" comment="Created during import of  line 139" ro="False" src_range_start="0" src_range_end="0" dst_range_start="8080" dst_range_end="8080"/>
-        <TCPService id="id56" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 0:0" comment="Created during import of  line 142" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+      <ServiceGroup id="id65" name="TCP" comment="" ro="False">
+        <TCPService id="id66" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of  line 106" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id67" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 148" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+        <TCPService id="id68" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 8080:8080" comment="Created during import of  line 148" ro="False" src_range_start="0" src_range_end="0" dst_range_start="8080" dst_range_end="8080"/>
+        <TCPService id="id69" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 0:0" comment="Created during import of  line 151" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
       </ServiceGroup>
-      <ServiceGroup id="id57" name="UDP" comment="" ro="False">
-        <UDPService id="id58" name="udp 0:0 / 53:53" comment="Created during import of  line 93" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+      <ServiceGroup id="id70" name="UDP" comment="" ro="False">
+        <UDPService id="id71" name="udp 0:0 / 53:53" comment="Created during import of  line 93" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
       </ServiceGroup>
-      <ServiceGroup id="id59" name="Users" comment="" ro="False"/>
-      <ServiceGroup id="id60" name="Custom" comment="" ro="False"/>
-      <ServiceGroup id="id61" name="TagServices" comment="" ro="False"/>
+      <ServiceGroup id="id72" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id73" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id74" name="TagServices" comment="" ro="False"/>
     </ServiceGroup>
-    <ObjectGroup id="id62" name="Firewalls" comment="" ro="False">
-      <Firewall id="id63" host_OS="pix_os" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pix" version="7.0" name="pix1" comment="Created during import of  line 6" ro="False">
-        <NAT id="id271" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id274" disabled="False" group="" position="0" action="Translate" comment="Created during import of  line 136">
+    <ObjectGroup id="id75" name="Firewalls" comment="" ro="False">
+      <Firewall id="id76" host_OS="pix_os" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pix" version="7.0" name="pix1" comment="Created during import of  line 6" ro="False">
+        <NAT id="id284" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id287" disabled="False" group="" position="0" action="Translate" comment="Created during import of  line 134">
+            <OSrc neg="False">
+              <ObjectRef ref="id50"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id597"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id305" disabled="False" group="" position="1" action="Translate" comment="Created during import of  line 141">
+            <OSrc neg="False">
+              <ObjectRef ref="id17"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id12"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id323" disabled="False" group="" position="2" action="Translate" comment="Created during import of  line 141">
+            <OSrc neg="False">
+              <ObjectRef ref="id17"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id59"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id341" disabled="False" group="" position="3" action="Translate" comment="Created during import of  line 141">
+            <OSrc neg="False">
+              <ObjectRef ref="id17"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id52"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id359" disabled="False" group="" position="4" action="Translate" comment="Created during import of  line 141">
+            <OSrc neg="False">
+              <ObjectRef ref="id17"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id53"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id600"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id377" disabled="False" group="" position="5" action="Translate" comment="Created during import of  line 142">
+            <OSrc neg="False">
+              <ObjectRef ref="id54"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id12"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id395" disabled="False" group="" position="6" action="Translate" comment="Created during import of  line 142">
+            <OSrc neg="False">
+              <ObjectRef ref="id54"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id59"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id413" disabled="False" group="" position="7" action="Translate" comment="Created during import of  line 142">
+            <OSrc neg="False">
+              <ObjectRef ref="id54"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id52"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id597"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id431" disabled="False" group="" position="8" action="Translate" comment="Created during import of  line 142">
+            <OSrc neg="False">
+              <ObjectRef ref="id54"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id53"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <ItfInb neg="False">
+              <ObjectRef ref="id600"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="id603"/>
+            </ItfOutb>
+            <NATRuleOptions/>
+          </NATRule>
+          <NATRule id="id449" disabled="False" group="" position="9" action="Translate" comment="Created during import of  line 145">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id43"/>
+              <ObjectRef ref="id55"/>
             </ODst>
             <OSrv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -521,25 +778,25 @@
               <ObjectRef ref="sysid0"/>
             </TSrc>
             <TDst neg="False">
-              <ObjectRef ref="id13"/>
+              <ObjectRef ref="id22"/>
             </TDst>
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id425"/>
+              <ObjectRef ref="id600"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id292" disabled="False" group="" position="1" action="Translate" comment="Created during import of  line 137">
+          <NATRule id="id467" disabled="False" group="" position="10" action="Translate" comment="Created during import of  line 146">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id14"/>
+              <ObjectRef ref="id23"/>
             </ODst>
             <OSrv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -548,25 +805,25 @@
               <ObjectRef ref="sysid0"/>
             </TSrc>
             <TDst neg="False">
-              <ObjectRef ref="id15"/>
+              <ObjectRef ref="id24"/>
             </TDst>
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id425"/>
+              <ObjectRef ref="id600"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id310" disabled="False" group="" position="2" action="Translate" comment="Created during import of  line 138">
+          <NATRule id="id485" disabled="False" group="" position="11" action="Translate" comment="Created during import of  line 147">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id425"/>
+              <ObjectRef ref="id600"/>
             </ODst>
             <OSrv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -575,82 +832,82 @@
               <ObjectRef ref="sysid0"/>
             </TSrc>
             <TDst neg="False">
-              <ObjectRef ref="id16"/>
+              <ObjectRef ref="id25"/>
             </TDst>
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id425"/>
+              <ObjectRef ref="id600"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id328" disabled="False" group="" position="3" action="Translate" comment="Created during import of  line 139">
+          <NATRule id="id503" disabled="False" group="" position="12" action="Translate" comment="Created during import of  line 148">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id44"/>
+              <ObjectRef ref="id56"/>
             </ODst>
             <OSrv neg="False">
-              <ServiceRef ref="id54"/>
+              <ServiceRef ref="id67"/>
             </OSrv>
             <TSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </TSrc>
             <TDst neg="False">
-              <ObjectRef ref="id13"/>
+              <ObjectRef ref="id22"/>
             </TDst>
             <TSrv neg="False">
-              <ServiceRef ref="id55"/>
+              <ServiceRef ref="id68"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id346" disabled="False" group="" position="4" action="Translate" comment="Created during import of  line 140">
+          <NATRule id="id521" disabled="False" group="" position="13" action="Translate" comment="Created during import of  line 149">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id18"/>
+              <ObjectRef ref="id27"/>
             </ODst>
             <OSrv neg="False">
-              <ServiceRef ref="id54"/>
+              <ServiceRef ref="id67"/>
             </OSrv>
             <TSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </TSrc>
             <TDst neg="False">
-              <ObjectRef ref="id19"/>
+              <ObjectRef ref="id28"/>
             </TDst>
             <TSrv neg="False">
-              <ServiceRef ref="id55"/>
+              <ServiceRef ref="id68"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id364" disabled="False" group="" position="5" action="Translate" comment="Created during import of  line 142">
+          <NATRule id="id539" disabled="False" group="" position="14" action="Translate" comment="Created during import of  line 151">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ODst>
             <OSrv neg="False">
-              <ServiceRef ref="id54"/>
+              <ServiceRef ref="id67"/>
             </OSrv>
             <TSrc neg="False">
               <ObjectRef ref="sysid0"/>
@@ -659,25 +916,25 @@
               <ObjectRef ref="id11"/>
             </TDst>
             <TSrv neg="False">
-              <ServiceRef ref="id56"/>
+              <ServiceRef ref="id69"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id382" disabled="False" group="" position="6" action="Translate" comment="Created during import of  line 143">
+          <NATRule id="id557" disabled="False" group="" position="15" action="Translate" comment="Created during import of  line 152">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ODst>
             <OSrv neg="False">
-              <ServiceRef ref="id54"/>
+              <ServiceRef ref="id67"/>
             </OSrv>
             <TSrc neg="False">
               <ObjectRef ref="sysid0"/>
@@ -686,22 +943,22 @@
               <ObjectRef ref="id11"/>
             </TDst>
             <TSrv neg="False">
-              <ServiceRef ref="id56"/>
+              <ServiceRef ref="id69"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id400" disabled="False" group="" position="7" action="Translate" comment="Created during import of  line 144">
+          <NATRule id="id575" disabled="False" group="" position="16" action="Translate" comment="Created during import of  line 153">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
             <ODst neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ODst>
             <OSrv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -716,28 +973,28 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <ItfInb neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </ItfInb>
             <ItfOutb neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
-        <Policy id="id65" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id67" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Imported from ssh_commands_outside&#10;Created during import of  line 193">
+        <Policy id="id78" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id80" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Imported from ssh_commands_outside&#10;Created during import of  line 202">
             <Src neg="False">
-              <ObjectRef ref="id20"/>
+              <ObjectRef ref="id29"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id63"/>
+              <ObjectRef ref="id76"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -746,18 +1003,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id79" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Imported from ssh_commands_inside&#10;Created during import of  line 191">
+          <PolicyRule id="id92" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Imported from ssh_commands_inside&#10;Created during import of  line 200">
             <Src neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id63"/>
+              <ObjectRef ref="id76"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -766,18 +1023,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id91" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Imported from ssh_commands_inside&#10;Created during import of  line 192">
+          <PolicyRule id="id104" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Imported from ssh_commands_inside&#10;Created during import of  line 201">
             <Src neg="False">
-              <ObjectRef ref="id45"/>
+              <ObjectRef ref="id57"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id63"/>
+              <ObjectRef ref="id76"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -786,18 +1043,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id103" disabled="False" group="" log="True" position="3" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 98">
+          <PolicyRule id="id116" disabled="False" group="" log="True" position="3" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 98">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id24"/>
+              <ObjectRef ref="id33"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -807,18 +1064,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id115" disabled="False" group="" log="True" position="4" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 99">
+          <PolicyRule id="id128" disabled="False" group="" log="True" position="4" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 99">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id36"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -828,39 +1085,39 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id127" disabled="False" group="" log="True" position="5" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 100">
+          <PolicyRule id="id140" disabled="False" group="" log="True" position="5" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 100">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id32"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id51"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="id428"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="log_level">warning</Option>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id139" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 101">
-            <Src neg="False">
               <ObjectRef ref="id41"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id64"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id603"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="log_level">warning</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id152" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 101">
+            <Src neg="False">
+              <ObjectRef ref="id50"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -869,7 +1126,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id151" disabled="False" group="" log="True" position="7" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 102">
+          <PolicyRule id="id164" disabled="False" group="" log="True" position="7" action="Deny" direction="Inbound" comment="Imported from inside_in&#10;Created during import of  line 102">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -877,10 +1134,10 @@
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -890,18 +1147,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id163" disabled="False" group="" log="True" position="8" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 93">
+          <PolicyRule id="id176" disabled="False" group="" log="True" position="8" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 93">
             <Src neg="False">
-              <ObjectRef ref="id24"/>
+              <ObjectRef ref="id33"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id58"/>
+              <ServiceRef ref="id71"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -911,18 +1168,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id175" disabled="False" group="" log="True" position="9" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 94">
+          <PolicyRule id="id188" disabled="False" group="" log="True" position="9" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 94">
             <Src neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id36"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id58"/>
+              <ServiceRef ref="id71"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -932,18 +1189,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id187" disabled="False" group="" log="True" position="10" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 95">
+          <PolicyRule id="id200" disabled="False" group="" log="True" position="10" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 95">
             <Src neg="False">
-              <ObjectRef ref="id32"/>
+              <ObjectRef ref="id41"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id58"/>
+              <ServiceRef ref="id71"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -953,18 +1210,18 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id199" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 96">
+          <PolicyRule id="id212" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 96">
             <Src neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -973,7 +1230,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id211" disabled="False" group="" log="True" position="12" action="Deny" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 97">
+          <PolicyRule id="id224" disabled="False" group="" log="True" position="12" action="Deny" direction="Outbound" comment="Imported from inside_out&#10;Created during import of  line 97">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -981,10 +1238,10 @@
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id428"/>
+              <ObjectRef ref="id603"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -994,18 +1251,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id223" disabled="False" group="" log="True" position="13" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 89">
+          <PolicyRule id="id236" disabled="False" group="" log="True" position="13" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 89">
             <Src neg="False">
-              <ObjectRef ref="id24"/>
+              <ObjectRef ref="id33"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -1015,18 +1272,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id235" disabled="False" group="" log="True" position="14" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 90">
+          <PolicyRule id="id248" disabled="False" group="" log="True" position="14" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 90">
             <Src neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id36"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -1036,28 +1293,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id247" disabled="False" group="" log="True" position="15" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 91">
-            <Src neg="False">
-              <ObjectRef ref="id32"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id51"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="id422"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="log_level">warning</Option>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id259" disabled="False" group="" log="True" position="16" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 92">
+          <PolicyRule id="id260" disabled="False" group="" log="True" position="15" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 91">
             <Src neg="False">
               <ObjectRef ref="id41"/>
             </Src>
@@ -1065,10 +1301,31 @@
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id422"/>
+              <ObjectRef ref="id597"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="log_level">warning</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id272" disabled="False" group="" log="True" position="16" action="Deny" direction="Inbound" comment="Imported from outside_in&#10;Created during import of  line 92">
+            <Src neg="False">
+              <ObjectRef ref="id50"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id64"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id597"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -1080,16 +1337,16 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Policy id="id431" name="id12251X6282.0" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id433" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Created during import of  line 104">
+        <Policy id="id606" name="id12251X6282.0" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id608" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Created during import of  line 104">
             <Src neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id50"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id51"/>
+              <ServiceRef ref="id64"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -1103,8 +1360,8 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Policy id="id445" name="id12594X2458.0" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id447" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Created during import of  line 106">
+        <Policy id="id620" name="id12594X2458.0" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id622" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Created during import of  line 106">
             <Src neg="False">
               <ObjectRef ref="id11"/>
             </Src>
@@ -1112,7 +1369,7 @@
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id53"/>
+              <ServiceRef ref="id66"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -1126,28 +1383,28 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Routing id="id418" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Routing id="id593" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </Routing>
-        <Interface id="id420" dedicated_failover="False" dyn="False" security_level="0" unnum="True" unprotected="False" name="Ethernet0" comment="Created during import of  line 16" ro="False">
+        <Interface id="id595" dedicated_failover="False" dyn="False" security_level="0" unnum="True" unprotected="False" name="Ethernet0" comment="Created during import of  line 16" ro="False">
           <InterfaceOptions/>
-          <Interface id="id422" dedicated_failover="False" dyn="False" label="outside" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="Created during import of  line 21" ro="False">
-            <IPv4 id="id424" name="pix1:Ethernet0.101:ip" comment="Created during import of  line 24" ro="False" address="192.0.2.253" netmask="255.255.255.0"/>
+          <Interface id="id597" dedicated_failover="False" dyn="False" label="outside" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="Created during import of  line 21" ro="False">
+            <IPv4 id="id599" name="pix1:Ethernet0.101:ip" comment="Created during import of  line 24" ro="False" address="192.0.2.253" netmask="255.255.255.0"/>
             <InterfaceOptions>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">101</Option>
             </InterfaceOptions>
           </Interface>
-          <Interface id="id425" dedicated_failover="False" dyn="False" label="dmz20" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="Created during import of  line 27" ro="False">
-            <IPv4 id="id427" name="pix1:Ethernet0.102:ip" comment="Created during import of  line 30" ro="False" address="10.0.0.253" netmask="255.255.255.0"/>
+          <Interface id="id600" dedicated_failover="False" dyn="False" label="dmz20" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="Created during import of  line 27" ro="False">
+            <IPv4 id="id602" name="pix1:Ethernet0.102:ip" comment="Created during import of  line 30" ro="False" address="10.0.0.253" netmask="255.255.255.0"/>
             <InterfaceOptions>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">102</Option>
             </InterfaceOptions>
           </Interface>
         </Interface>
-        <Interface id="id428" dedicated_failover="False" dyn="False" label="inside" security_level="100" unnum="False" unprotected="False" name="Ethernet1" comment="Created during import of  line 33" ro="False">
-          <IPv4 id="id429" name="pix1:Ethernet1:ip" comment="Created during import of  line 37" ro="False" address="10.1.1.206" netmask="255.255.255.0"/>
+        <Interface id="id603" dedicated_failover="False" dyn="False" label="inside" security_level="100" unnum="False" unprotected="False" name="Ethernet1" comment="Created during import of  line 33" ro="False">
+          <IPv4 id="id604" name="pix1:Ethernet1:ip" comment="Created during import of  line 37" ro="False" address="10.1.1.206" netmask="255.255.255.0"/>
           <InterfaceOptions/>
         </Interface>
         <FirewallOptions>
@@ -1168,7 +1425,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <ObjectGroup id="id459" name="Clusters" comment="" ro="False"/>
-    <IntervalGroup id="id460" name="Time" comment="" ro="False"/>
+    <ObjectGroup id="id634" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id635" name="Time" comment="" ro="False"/>
   </Library>
 </FWObjectDatabase>
diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output
index d54965886..9341c1a14 100644
--- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output
+++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.output
@@ -33,36 +33,25 @@ Object Group (network) outside.id12051X6282.src.net.1
 Object Group (network) outside.id12051X6282.src.net.2
 Object Group (network) network-zone-inside
 Object Group (network) network-zone-dmz20
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: id12251X6282.0
-Ruleset: id12594X2458.0
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
-Ruleset: nat
+Global address pool: number 1, interface outside, address range interface-interface, netmask 255.255.255.255 
+Source translation rule ("nat" command)
+Global address pool: number 2, interface outside, address range 192.0.2.10-192.0.2.10, netmask 255.255.255.255 
+Global address pool: number 2, interface outside, address range 192.0.2.11-192.0.2.15, netmask 255.255.255.255 
+Global address pool: number 2, interface outside, address range 192.0.2.128-192.0.2.128, netmask 255.255.255.240 
+Global address pool: number 2, interface dmz20, address range 10.0.0.128-10.0.0.128, netmask 255.255.255.240 
+Source translation rule ("nat" command)
+Source translation rule ("nat" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
+Destination translation rule ("static" command)
 Interface Ethernet0.101 ruleset outside_in direction 'in' 
 Interface Ethernet1 ruleset inside_in direction 'in' 
 Interface Ethernet1 ruleset inside_out direction 'out' 
-Ruleset: ssh_commands_inside
 Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_outside
 Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in' 
diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test
index 8380f7ec4..ad03dd28a 100644
--- a/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test
+++ b/src/unit_tests/PIXImporterTest/test_data/pix7-nat.test
@@ -129,9 +129,18 @@ failover interface ip failover 172.17.1.253 255.255.255.252 standby 172.17.1.254
 no asdm history enable
 arp timeout 14400
 
-! nat-control
-! global (outside) 1 interface
-! nat (inside) 1 access-list id12251X6282.0
+nat-control
+global (outside) 1 interface
+nat (inside) 1 access-list id12251X6282.0
+
+global (outside) 2 192.0.2.10
+global (outside) 2 192.0.2.11-192.0.2.15
+global (outside) 2 192.0.2.128 netmask 255.255.255.240
+global (dmz20) 2 10.0.0.128 netmask 255.255.255.240
+
+nat (inside) 2 10.1.1.1 255.255.255.255
+nat (inside) 2 10.1.1.32 255.255.255.240
+
   
 static (inside,dmz20) 10.0.0.16 10.1.1.16 netmask 255.255.255.240
 static (inside,dmz20) 10.0.0.100 10.1.1.100 netmask 255.255.255.255
diff --git a/src/unit_tests/PIXImporterTest/test_data/pix7.output b/src/unit_tests/PIXImporterTest/test_data/pix7.output
index dae0edcea..3a5136504 100644
--- a/src/unit_tests/PIXImporterTest/test_data/pix7.output
+++ b/src/unit_tests/PIXImporterTest/test_data/pix7.output
@@ -31,29 +31,11 @@ Warning: interface Ethernet6 was not imported because it is in "shutdown" mode
 Object Group (network) outside.id12051X6282.src.net.0
 Object Group (network) outside.id12051X6282.src.net.1
 Object Group (network) outside.id12051X6282.src.net.2
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: outside_in
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_out
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: inside_in
-Ruleset: id12251X6282.0
 Interface Ethernet1 ruleset inside_in direction 'in' 
 Interface Ethernet0.101 ruleset outside_in direction 'in' 
 Interface Ethernet0.101 ruleset outside_in direction 'in' 
 Interface Ethernet1 ruleset inside_in direction 'in' 
 Interface Ethernet1 ruleset inside_out direction 'out' 
-Ruleset: ssh_commands_inside
 Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_inside
 Interface Ethernet1 ruleset ssh_commands_inside direction 'in' 
-Ruleset: ssh_commands_outside
 Interface Ethernet0.101 ruleset ssh_commands_outside direction 'in'