diff --git a/src/parsers/PIXCfgLexer.cpp b/src/parsers/PIXCfgLexer.cpp
index 87815f517..1db4c6d9f 100644
--- a/src/parsers/PIXCfgLexer.cpp
+++ b/src/parsers/PIXCfgLexer.cpp
@@ -44,15 +44,15 @@ PIXCfgLexer::PIXCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState&
 
 void PIXCfgLexer::initLiterals()
 {
-	literals["full"] = 125;
 	literals["parameter-problem"] = 91;
+	literals["full"] = 125;
 	literals["FWSM"] = 67;
 	literals["port-object"] = 54;
 	literals["notifications"] = 111;
 	literals["duplex"] = 131;
 	literals["dns"] = 56;
 	literals["no"] = 63;
-	literals["static"] = 162;
+	literals["static"] = 163;
 	literals["esp"] = 18;
 	literals["time-range"] = 117;
 	literals["gre"] = 19;
@@ -65,32 +65,32 @@ void PIXCfgLexer::initLiterals()
 	literals["eigrp"] = 17;
 	literals["icmp-type"] = 51;
 	literals["permit"] = 74;
-	literals["remark"] = 152;
+	literals["remark"] = 153;
 	literals["network"] = 10;
 	literals["igmp"] = 20;
 	literals["range"] = 32;
 	literals["destination"] = 44;
-	literals["setroute"] = 165;
+	literals["setroute"] = 166;
 	literals["vlan"] = 129;
 	literals["debugging"] = 107;
 	literals["controller"] = 118;
 	literals["interface"] = 101;
-	literals["dhcp"] = 144;
+	literals["dhcp"] = 145;
 	literals["aui"] = 122;
 	literals["Version"] = 68;
 	literals["auto"] = 123;
 	literals["subnet"] = 33;
 	literals["time-exceeded"] = 96;
 	literals["outside"] = 119;
-	literals["shutdown"] = 142;
+	literals["shutdown"] = 143;
 	literals["group-object"] = 46;
 	literals["eq"] = 77;
 	literals["fragments"] = 116;
-	literals["norandomseq"] = 163;
+	literals["norandomseq"] = 164;
 	literals["unreachable"] = 100;
 	literals["delay"] = 134;
 	literals["ip"] = 6;
-	literals["security-level"] = 141;
+	literals["security-level"] = 142;
 	literals["mobile-redirect"] = 90;
 	literals["ospf"] = 25;
 	literals["name"] = 12;
@@ -105,11 +105,11 @@ void PIXCfgLexer::initLiterals()
 	literals["timestamp-reply"] = 97;
 	literals["description"] = 30;
 	literals["alerts"] = 105;
-	literals["netmask"] = 161;
+	literals["netmask"] = 162;
 	literals["lt"] = 79;
 	literals["internal"] = 58;
 	literals["bnc"] = 124;
-	literals["global"] = 159;
+	literals["global"] = 160;
 	literals["nos"] = 24;
 	literals["extended"] = 73;
 	literals["certificate"] = 64;
@@ -117,13 +117,14 @@ void PIXCfgLexer::initLiterals()
 	literals["telnet"] = 37;
 	literals["udp"] = 42;
 	literals["hold-time"] = 135;
+	literals["management-only"] = 137;
 	literals["baseT"] = 126;
 	literals["ipinip"] = 22;
-	literals["standby"] = 145;
+	literals["standby"] = 146;
 	literals["crypto"] = 55;
 	literals["object"] = 29;
 	literals["pim"] = 9;
-	literals["secondary"] = 164;
+	literals["secondary"] = 165;
 	literals["emergencies"] = 108;
 	literals["disable"] = 113;
 	literals["mask-reply"] = 88;
@@ -136,7 +137,7 @@ void PIXCfgLexer::initLiterals()
 	literals["call-home"] = 57;
 	literals["log"] = 103;
 	literals["snp"] = 28;
-	literals["mac-address"] = 137;
+	literals["mac-address"] = 138;
 	literals["established"] = 82;
 	literals["deny"] = 75;
 	literals["information-request"] = 87;
@@ -148,20 +149,20 @@ void PIXCfgLexer::initLiterals()
 	literals["resetoutside"] = 62;
 	literals["ddns"] = 132;
 	literals["ipv6"] = 136;
-	literals["rip"] = 140;
+	literals["rip"] = 141;
 	literals["baseTX"] = 127;
-	literals["access-group"] = 153;
+	literals["access-group"] = 154;
 	literals["critical"] = 106;
 	literals["standard"] = 76;
 	literals["quit"] = 5;
 	literals["community-list"] = 7;
 	literals["network-object"] = 47;
 	literals["hostname"] = 70;
-	literals["server"] = 151;
+	literals["server"] = 152;
 	literals["information-reply"] = 86;
 	literals["icmp6"] = 40;
-	literals["authentication-certificate"] = 150;
-	literals["switchport"] = 146;
+	literals["authentication-certificate"] = 151;
+	literals["switchport"] = 147;
 	literals["ipsec"] = 23;
 	literals["conversion-error"] = 84;
 	literals["host"] = 31;
@@ -169,26 +170,26 @@ void PIXCfgLexer::initLiterals()
 	literals["nameif"] = 128;
 	literals["pcp"] = 26;
 	literals["service-object"] = 53;
-	literals["nat"] = 155;
+	literals["nat"] = 156;
 	literals["access-list"] = 72;
 	literals["informational"] = 110;
 	literals["igrp"] = 21;
 	literals["traceroute"] = 99;
-	literals["address"] = 143;
+	literals["address"] = 144;
 	literals["log-input"] = 104;
 	literals["router-advertisement"] = 93;
 	literals["resetinbound"] = 60;
 	literals["router-solicitation"] = 94;
-	literals["access"] = 147;
+	literals["access"] = 148;
 	literals["icmp-object"] = 50;
 	literals["source-quench"] = 95;
-	literals["scopy"] = 148;
+	literals["scopy"] = 149;
 	literals["protocol"] = 48;
 	literals["object-group"] = 45;
 	literals["inactive"] = 114;
-	literals["multicast"] = 138;
+	literals["multicast"] = 139;
 	literals["exit"] = 121;
-	literals["version"] = 149;
+	literals["version"] = 150;
 	literals["neq"] = 80;
 	literals["alternate-address"] = 83;
 	literals["password-recovery"] = 59;
@@ -541,9 +542,9 @@ void PIXCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 2484 "pix.g"
+#line 2488 "pix.g"
 		newline();
-#line 547 "PIXCfgLexer.cpp"
+#line 548 "PIXCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -665,9 +666,9 @@ void PIXCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 2479 "pix.g"
+#line 2483 "pix.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 671 "PIXCfgLexer.cpp"
+#line 672 "PIXCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -907,9 +908,9 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		}  // ( ... )+
 		}
 		if ( inputState->guessing==0 ) {
-#line 2525 "pix.g"
+#line 2529 "pix.g"
 			_ttype = IPV6;
-#line 913 "PIXCfgLexer.cpp"
+#line 914 "PIXCfgLexer.cpp"
 		}
 		}
 	}
@@ -1054,9 +1055,9 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				}  // ( ... )+
 				}
 				if ( inputState->guessing==0 ) {
-#line 2513 "pix.g"
+#line 2517 "pix.g"
 					_ttype = IPV4;
-#line 1060 "PIXCfgLexer.cpp"
+#line 1061 "PIXCfgLexer.cpp"
 				}
 			}
 			else {
@@ -1137,9 +1138,9 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}  // ( ... )+
 					}
 					if ( inputState->guessing==0 ) {
-#line 2516 "pix.g"
+#line 2520 "pix.g"
 						_ttype = NUMBER;
-#line 1143 "PIXCfgLexer.cpp"
+#line 1144 "PIXCfgLexer.cpp"
 					}
 				}
 				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
@@ -1158,9 +1159,9 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					_loop336:;
 					}  // ( ... )+
 					if ( inputState->guessing==0 ) {
-#line 2518 "pix.g"
+#line 2522 "pix.g"
 						_ttype = INT_CONST;
-#line 1164 "PIXCfgLexer.cpp"
+#line 1165 "PIXCfgLexer.cpp"
 					}
 				}
 			else {
@@ -1420,9 +1421,9 @@ void PIXCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			_loop351:;
 			} // ( ... )*
 			if ( inputState->guessing==0 ) {
-#line 2533 "pix.g"
+#line 2537 "pix.g"
 				_ttype = WORD;
-#line 1426 "PIXCfgLexer.cpp"
+#line 1427 "PIXCfgLexer.cpp"
 			}
 		}
 	else {
@@ -1851,7 +1852,7 @@ const unsigned long PIXCfgLexer::_tokenSet_0_data_[] = { 4294958072UL, 1UL, 0UL,
 // 0x90 0x91 0x92 0x93 0x94 0x95 0x96 0x97 0x98 0x99 0x9a 0x9b 0x9c 0x9d 
 // 0x9e 0x9f 0xa0 0xa1 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7 0xa8 0xa9 0xaa 0xab 
 // 0xac 0xad 0xae 0xaf 0xb0 0xb1 0xb2 0xb3 0xb4 0xb5 0xb6 0xb7 0xb8 0xb9 
-// 0xba 0xbb 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 
+// 0xba 0xbb 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 0xc4 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_0(_tokenSet_0_data_,16);
 const unsigned long PIXCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
@@ -1863,7 +1864,7 @@ const unsigned long PIXCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 429496729
 // 0x92 0x93 0x94 0x95 0x96 0x97 0x98 0x99 0x9a 0x9b 0x9c 0x9d 0x9e 0x9f 
 // 0xa0 0xa1 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7 0xa8 0xa9 0xaa 0xab 0xac 0xad 
 // 0xae 0xaf 0xb0 0xb1 0xb2 0xb3 0xb4 0xb5 0xb6 0xb7 0xb8 0xb9 0xba 0xbb 
-// 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 
+// 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 0xc4 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_1(_tokenSet_1_data_,16);
 const unsigned long PIXCfgLexer::_tokenSet_2_data_[] = { 0UL, 67043328UL, 0UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0 1 2 3 4 5 6 7 8 9 a b c d e f 
@@ -1888,6 +1889,6 @@ const unsigned long PIXCfgLexer::_tokenSet_6_data_[] = { 4294967288UL, 429496729
 // 0x92 0x93 0x94 0x95 0x96 0x97 0x98 0x99 0x9a 0x9b 0x9c 0x9d 0x9e 0x9f 
 // 0xa0 0xa1 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7 0xa8 0xa9 0xaa 0xab 0xac 0xad 
 // 0xae 0xaf 0xb0 0xb1 0xb2 0xb3 0xb4 0xb5 0xb6 0xb7 0xb8 0xb9 0xba 0xbb 
-// 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 
+// 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 0xc4 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgLexer::_tokenSet_6(_tokenSet_6_data_,16);
 
diff --git a/src/parsers/PIXCfgParser.cpp b/src/parsers/PIXCfgParser.cpp
index 371da22db..2b28a1d1f 100644
--- a/src/parsers/PIXCfgParser.cpp
+++ b/src/parsers/PIXCfgParser.cpp
@@ -644,7 +644,7 @@ void PIXCfgParser::ssh_command() {
 	try {      // for error handling
 		match(SSH);
 		if ( inputState->guessing==0 ) {
-#line 1707 "pix.g"
+#line 1709 "pix.g"
 			
 			importer->clear();
 			
@@ -659,7 +659,7 @@ void PIXCfgParser::ssh_command() {
 			match(INT_CONST);
 			}
 			if ( inputState->guessing==0 ) {
-#line 1712 "pix.g"
+#line 1714 "pix.g"
 				
 				// set ssh timeout here
 				
@@ -688,7 +688,7 @@ void PIXCfgParser::ssh_command() {
 			{
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1722 "pix.g"
+#line 1724 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -697,7 +697,7 @@ void PIXCfgParser::ssh_command() {
 			interface_label();
 			}
 			if ( inputState->guessing==0 ) {
-#line 1727 "pix.g"
+#line 1729 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "ssh_commands_" + intf_label;
@@ -740,7 +740,7 @@ void PIXCfgParser::telnet_command() {
 	try {      // for error handling
 		match(TELNET);
 		if ( inputState->guessing==0 ) {
-#line 1747 "pix.g"
+#line 1749 "pix.g"
 			
 			importer->clear();
 			
@@ -766,7 +766,7 @@ void PIXCfgParser::telnet_command() {
 			{
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1754 "pix.g"
+#line 1756 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -775,7 +775,7 @@ void PIXCfgParser::telnet_command() {
 			interface_label();
 			}
 			if ( inputState->guessing==0 ) {
-#line 1759 "pix.g"
+#line 1761 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "telnet_commands_" + intf_label;
@@ -818,7 +818,7 @@ void PIXCfgParser::http_command() {
 	try {      // for error handling
 		match(HTTP);
 		if ( inputState->guessing==0 ) {
-#line 1781 "pix.g"
+#line 1783 "pix.g"
 			
 			importer->clear();
 			
@@ -854,7 +854,7 @@ void PIXCfgParser::http_command() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1786 "pix.g"
+#line 1788 "pix.g"
 				
 				consumeUntil(NEWLINE);
 				
@@ -872,7 +872,7 @@ void PIXCfgParser::http_command() {
 			{
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1792 "pix.g"
+#line 1794 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -881,7 +881,7 @@ void PIXCfgParser::http_command() {
 			interface_label();
 			}
 			if ( inputState->guessing==0 ) {
-#line 1797 "pix.g"
+#line 1799 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "http_commands_" + intf_label;
@@ -933,7 +933,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			{
 			match(UNREACHABLE);
 			if ( inputState->guessing==0 ) {
-#line 1827 "pix.g"
+#line 1829 "pix.g"
 				
 				consumeUntil(NEWLINE);
 				
@@ -967,7 +967,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1834 "pix.g"
+#line 1836 "pix.g"
 				
 				importer->clear();
 				
@@ -975,7 +975,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			hostaddr_expr();
 			if ( inputState->guessing==0 ) {
-#line 1838 "pix.g"
+#line 1840 "pix.g"
 				
 				importer->SaveTmpAddrToSrc();
 				
@@ -1005,7 +1005,7 @@ void PIXCfgParser::icmp_top_level_command() {
 			}
 			interface_label();
 			if ( inputState->guessing==0 ) {
-#line 1843 "pix.g"
+#line 1845 "pix.g"
 				
 				std::string intf_label = LT(0)->getText();
 				std::string acl_name = "icmp_commands_" + intf_label;
@@ -1048,7 +1048,7 @@ void PIXCfgParser::nat_top_level_command() {
 		match(NAT);
 		match(OPENING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1929 "pix.g"
+#line 1931 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1085,7 +1085,7 @@ void PIXCfgParser::global_top_level_command() {
 		match(GLOBAL);
 		match(OPENING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 2025 "pix.g"
+#line 2027 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1094,7 +1094,7 @@ void PIXCfgParser::global_top_level_command() {
 		}
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 2030 "pix.g"
+#line 2032 "pix.g"
 			
 			importer->tmp_global_pool.pool_interface = LT(0)->getText();
 			
@@ -1104,7 +1104,7 @@ void PIXCfgParser::global_top_level_command() {
 		num = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 2035 "pix.g"
+#line 2037 "pix.g"
 			
 			importer->tmp_global_pool.str_num = num->getText();
 			importer->tmp_global_pool.netmask = "255.255.255.255";
@@ -1121,7 +1121,7 @@ void PIXCfgParser::global_top_level_command() {
 		{
 			match(INTRFACE);
 			if ( inputState->guessing==0 ) {
-#line 2048 "pix.g"
+#line 2050 "pix.g"
 				
 				importer->tmp_global_pool.start = LT(0)->getText();
 				importer->tmp_global_pool.end = LT(0)->getText();
@@ -1135,7 +1135,7 @@ void PIXCfgParser::global_top_level_command() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2054 "pix.g"
+#line 2056 "pix.g"
 				
 				importer->tmp_global_pool.start = importer->tmp_a;
 				importer->tmp_global_pool.end = importer->tmp_a;
@@ -1157,7 +1157,7 @@ void PIXCfgParser::global_top_level_command() {
 			match(MINUS);
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2063 "pix.g"
+#line 2065 "pix.g"
 				
 				importer->tmp_global_pool.end = importer->tmp_a;
 				
@@ -1183,7 +1183,7 @@ void PIXCfgParser::global_top_level_command() {
 			match(NETMASK);
 			match(IPV4);
 			if ( inputState->guessing==0 ) {
-#line 2072 "pix.g"
+#line 2074 "pix.g"
 				
 				importer->tmp_global_pool.netmask = LT(0)->getText();
 				
@@ -1203,7 +1203,7 @@ void PIXCfgParser::global_top_level_command() {
 		}
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 2078 "pix.g"
+#line 2080 "pix.g"
 			
 			importer->addGlobalPool();
 			*dbg << " " << importer->tmp_global_pool.start
@@ -1230,7 +1230,7 @@ void PIXCfgParser::static_top_level_command() {
 		match(STATIC);
 		match(OPENING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 2090 "pix.g"
+#line 2092 "pix.g"
 			
 			importer->clear();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1239,20 +1239,20 @@ void PIXCfgParser::static_top_level_command() {
 		}
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 2094 "pix.g"
+#line 2096 "pix.g"
 			importer->prenat_interface = LT(0)->getText();
 #line 1245 "PIXCfgParser.cpp"
 		}
 		match(COMMA);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 2096 "pix.g"
+#line 2098 "pix.g"
 			importer->postnat_interface = LT(0)->getText();
 #line 1252 "PIXCfgParser.cpp"
 		}
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 2098 "pix.g"
+#line 2100 "pix.g"
 			
 			importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
 			*dbg << " DNAT rule ";
@@ -1283,7 +1283,7 @@ void PIXCfgParser::static_top_level_command() {
 		}
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 2113 "pix.g"
+#line 2115 "pix.g"
 			
 			importer->pushNATRule();
 			*dbg << std::endl;
@@ -1314,7 +1314,7 @@ void PIXCfgParser::access_group() {
 		match(INTRFACE);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1902 "pix.g"
+#line 1904 "pix.g"
 			
 			std::string intf_label = LT(0)->getText();
 			importer->setCurrentLineNumber(LT(0)->getLine());
@@ -4115,7 +4115,7 @@ void PIXCfgParser::remark() {
 	try {      // for error handling
 		match(REMARK);
 		if ( inputState->guessing==0 ) {
-#line 1884 "pix.g"
+#line 1886 "pix.g"
 			
 			importer->setCurrentLineNumber(LT(0)->getLine());
 			*dbg << LT(1)->getLine() << ":";
@@ -5981,6 +5981,7 @@ void PIXCfgParser::interface_parameters() {
 		case DELAY:
 		case HOLD_TIME:
 		case IPV6_C:
+		case MANAGEMENT_ONLY:
 		case MAC_ADDRESS:
 		case MULTICAST:
 		case PPPOE:
@@ -6020,7 +6021,7 @@ void PIXCfgParser::vlan_interface() {
 			importer->setInterfaceVlanId(vlan_id->getText());
 			*dbg << " VLAN: " << vlan_id->getText() << std::endl;
 			
-#line 6024 "PIXCfgParser.cpp"
+#line 6025 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6041,12 +6042,12 @@ void PIXCfgParser::sec_level() {
 		sec_level = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1548 "pix.g"
+#line 1550 "pix.g"
 			
 			importer->setInterfaceSecurityLevel(sec_level->getText());
 			*dbg << "SEC_LEVEL: " << sec_level->getText() << std::endl;
 			
-#line 6050 "PIXCfgParser.cpp"
+#line 6051 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6065,12 +6066,12 @@ void PIXCfgParser::nameif() {
 		match(NAMEIF);
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1567 "pix.g"
+#line 1569 "pix.g"
 			
 			importer->setInterfaceParametes(LT(0)->getText(), "", "");
 			*dbg << " NAMEIF: " << LT(0)->getText() << std::endl;
 			
-#line 6074 "PIXCfgParser.cpp"
+#line 6075 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6088,7 +6089,7 @@ void PIXCfgParser::interface_description() {
 	try {      // for error handling
 		match(DESCRIPTION);
 		if ( inputState->guessing==0 ) {
-#line 1576 "pix.g"
+#line 1578 "pix.g"
 			
 			*dbg << LT(1)->getLine() << ":";
 			std::string descr;
@@ -6101,7 +6102,7 @@ void PIXCfgParser::interface_description() {
 			*dbg << " DESCRIPTION " << descr << std::endl;
 			//consumeUntil(NEWLINE);
 			
-#line 6105 "PIXCfgParser.cpp"
+#line 6106 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6124,12 +6125,12 @@ void PIXCfgParser::switchport() {
 		vlan_num = LT(1);
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1697 "pix.g"
+#line 1699 "pix.g"
 			
 			importer->addMessageToLog("Switch port vlan " + vlan_num->getText());
 			*dbg << "Switch port vlan " <<  vlan_num->getText() << std::endl;
 			
-#line 6133 "PIXCfgParser.cpp"
+#line 6134 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6147,13 +6148,13 @@ void PIXCfgParser::shutdown() {
 	try {      // for error handling
 		match(SHUTDOWN);
 		if ( inputState->guessing==0 ) {
-#line 1591 "pix.g"
+#line 1593 "pix.g"
 			
 			importer->ignoreCurrentInterface();
 			*dbg<< LT(1)->getLine() << ":"
 			<< " INTERFACE SHUTDOWN " << std::endl;
 			
-#line 6157 "PIXCfgParser.cpp"
+#line 6158 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6199,13 +6200,13 @@ void PIXCfgParser::interface_no_commands() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1540 "pix.g"
+#line 1542 "pix.g"
 			
 			*dbg << " INTERFACE \"NO\" COMMAND: "
 			<< LT(0)->getText() << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 6209 "PIXCfgParser.cpp"
+#line 6210 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6263,6 +6264,11 @@ void PIXCfgParser::unsupported_interface_commands() {
 			match(IPV6_C);
 			break;
 		}
+		case MANAGEMENT_ONLY:
+		{
+			match(MANAGEMENT_ONLY);
+			break;
+		}
 		case MAC_ADDRESS:
 		{
 			match(MAC_ADDRESS);
@@ -6300,13 +6306,13 @@ void PIXCfgParser::unsupported_interface_commands() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1532 "pix.g"
+#line 1534 "pix.g"
 			
 			*dbg << " UNSUPPORTED INTERFACE COMMAND: "
 			<< LT(0)->getText() << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 6310 "PIXCfgParser.cpp"
+#line 6316 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6375,23 +6381,23 @@ void PIXCfgParser::v7_ip_address() {
 
 void PIXCfgParser::v6_dhcp_address() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  dhcp = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1625 "pix.g"
+#line 1627 "pix.g"
 	std::string lbl;
-#line 6381 "PIXCfgParser.cpp"
+#line 6387 "PIXCfgParser.cpp"
 	
 	try {      // for error handling
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1627 "pix.g"
+#line 1629 "pix.g"
 			
 			lbl = LT(0)->getText();
 			
-#line 6390 "PIXCfgParser.cpp"
+#line 6396 "PIXCfgParser.cpp"
 		}
 		dhcp = LT(1);
 		match(DHCP);
 		if ( inputState->guessing==0 ) {
-#line 1631 "pix.g"
+#line 1633 "pix.g"
 			
 			std::string addr = dhcp->getText();
 			importer->addInterfaceAddress(lbl, addr, "");
@@ -6401,7 +6407,7 @@ void PIXCfgParser::v6_dhcp_address() {
 			// "setroute", "retry" etc.  which we do not support
 			consumeUntil(NEWLINE);
 			
-#line 6405 "PIXCfgParser.cpp"
+#line 6411 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6417,25 +6423,25 @@ void PIXCfgParser::v6_dhcp_address() {
 void PIXCfgParser::v6_static_address() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  a = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  m = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1642 "pix.g"
+#line 1644 "pix.g"
 	std::string lbl;
-#line 6423 "PIXCfgParser.cpp"
+#line 6429 "PIXCfgParser.cpp"
 	
 	try {      // for error handling
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1644 "pix.g"
+#line 1646 "pix.g"
 			
 			lbl = LT(0)->getText();
 			
-#line 6432 "PIXCfgParser.cpp"
+#line 6438 "PIXCfgParser.cpp"
 		}
 		a = LT(1);
 		match(IPV4);
 		m = LT(1);
 		match(IPV4);
 		if ( inputState->guessing==0 ) {
-#line 1648 "pix.g"
+#line 1650 "pix.g"
 			
 			std::string addr = a->getText();
 			std::string netm = m->getText();
@@ -6445,7 +6451,7 @@ void PIXCfgParser::v6_static_address() {
 			// in case there are some other parameters after address and netmask
 			consumeUntil(NEWLINE);
 			
-#line 6449 "PIXCfgParser.cpp"
+#line 6455 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6465,7 +6471,7 @@ void PIXCfgParser::v7_dhcp_address() {
 		dhcp = LT(1);
 		match(DHCP);
 		if ( inputState->guessing==0 ) {
-#line 1664 "pix.g"
+#line 1666 "pix.g"
 			
 			std::string addr = dhcp->getText();
 			importer->addInterfaceAddress(addr, "");
@@ -6473,7 +6479,7 @@ void PIXCfgParser::v7_dhcp_address() {
 			<< " INTRFACE ADDRESS: " << addr << std::endl;
 			consumeUntil(NEWLINE);
 			
-#line 6477 "PIXCfgParser.cpp"
+#line 6483 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6550,7 +6556,7 @@ void PIXCfgParser::v7_static_address() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 1675 "pix.g"
+#line 1677 "pix.g"
 			
 			std::string addr = a->getText();
 			std::string netm = m->getText();
@@ -6568,7 +6574,7 @@ void PIXCfgParser::v7_static_address() {
 			}
 			consumeUntil(NEWLINE);
 			
-#line 6572 "PIXCfgParser.cpp"
+#line 6578 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6589,13 +6595,13 @@ void PIXCfgParser::icmp_types_for_icmp_command() {
 		{
 			match(INT_CONST);
 			if ( inputState->guessing==0 ) {
-#line 1863 "pix.g"
+#line 1865 "pix.g"
 				
 				importer->icmp_type = LT(0)->getText();
 				importer->icmp_code = "0";
 				importer->icmp_spec = "";
 				
-#line 6599 "PIXCfgParser.cpp"
+#line 6605 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6633,13 +6639,13 @@ void PIXCfgParser::icmp_types_for_icmp_command() {
 			}
 			}
 			if ( inputState->guessing==0 ) {
-#line 1870 "pix.g"
+#line 1872 "pix.g"
 				
 				importer->icmp_type = "";
 				importer->icmp_code = "0";
 				importer->icmp_spec = LT(0)->getText();
 				
-#line 6643 "PIXCfgParser.cpp"
+#line 6649 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6664,29 +6670,29 @@ void PIXCfgParser::nat_old_top_level_command() {
 	try {      // for error handling
 		interface_label();
 		if ( inputState->guessing==0 ) {
-#line 1938 "pix.g"
+#line 1940 "pix.g"
 			
 			importer->prenat_interface = LT(0)->getText();
 			
-#line 6672 "PIXCfgParser.cpp"
+#line 6678 "PIXCfgParser.cpp"
 		}
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 1942 "pix.g"
+#line 1944 "pix.g"
 			
 			importer->newUnidirRuleSet("nat", libfwbuilder::NAT::TYPENAME );
 			*dbg << " SNAT rule ";
 			importer->rule_type = libfwbuilder::NATRule::SNAT;
 			
-#line 6682 "PIXCfgParser.cpp"
+#line 6688 "PIXCfgParser.cpp"
 		}
 		match(INT_CONST);
 		if ( inputState->guessing==0 ) {
-#line 1950 "pix.g"
+#line 1952 "pix.g"
 			
 			importer->nat_num = LT(0)->getText();
 			
-#line 6690 "PIXCfgParser.cpp"
+#line 6696 "PIXCfgParser.cpp"
 		}
 		nat_addr_match();
 		{ // ( ... )*
@@ -6703,12 +6709,12 @@ void PIXCfgParser::nat_old_top_level_command() {
 		} // ( ... )*
 		match(NEWLINE);
 		if ( inputState->guessing==0 ) {
-#line 1962 "pix.g"
+#line 1964 "pix.g"
 			
 			importer->pushNATRule();
 			*dbg << std::endl;
 			
-#line 6712 "PIXCfgParser.cpp"
+#line 6718 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6729,14 +6735,14 @@ void PIXCfgParser::nat_new_top_level_command() {
 		interface_label();
 		match(CLOSING_PAREN);
 		if ( inputState->guessing==0 ) {
-#line 2014 "pix.g"
+#line 2016 "pix.g"
 			
 			importer->addMessageToLog(
 			QString("Warning: Import of ASA 8.3 nat command "
 			"is not supported at this time"));
 			consumeUntil(NEWLINE);
 			
-#line 6740 "PIXCfgParser.cpp"
+#line 6746 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6759,11 +6765,11 @@ void PIXCfgParser::nat_addr_match() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 1970 "pix.g"
+#line 1972 "pix.g"
 				
 				importer->nat_a = importer->tmp_a;
 				
-#line 6767 "PIXCfgParser.cpp"
+#line 6773 "PIXCfgParser.cpp"
 			}
 			{
 			switch ( LA(1)) {
@@ -6772,11 +6778,11 @@ void PIXCfgParser::nat_addr_match() {
 			{
 				single_addr();
 				if ( inputState->guessing==0 ) {
-#line 1978 "pix.g"
+#line 1980 "pix.g"
 					
 					importer->nat_nm = importer->tmp_a;
 					
-#line 6780 "PIXCfgParser.cpp"
+#line 6786 "PIXCfgParser.cpp"
 				}
 				break;
 			}
@@ -6803,11 +6809,11 @@ void PIXCfgParser::nat_addr_match() {
 			acl_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 1984 "pix.g"
+#line 1986 "pix.g"
 				
 				importer->nat_acl = acl_name->getText();
 				
-#line 6811 "PIXCfgParser.cpp"
+#line 6817 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -6908,13 +6914,13 @@ void PIXCfgParser::nat_command_last_parameters() {
 		
 		}
 		if ( inputState->guessing==0 ) {
-#line 2002 "pix.g"
+#line 2004 "pix.g"
 			
 			importer->static_max_conn = max_conn->getText();
 			if (max_emb_conn)
 			importer->static_max_emb_conn = max_emb_conn->getText();
 			
-#line 6918 "PIXCfgParser.cpp"
+#line 6924 "PIXCfgParser.cpp"
 		}
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -6978,22 +6984,22 @@ void PIXCfgParser::static_starts_with_tcp_udp() {
 		}
 		}
 		if ( inputState->guessing==0 ) {
-#line 2166 "pix.g"
+#line 2168 "pix.g"
 			
 			importer->protocol = LT(0)->getText();
 			*dbg << " SERVICE TCP/UDP " << LT(0)->getText() << " ";
 			
-#line 6987 "PIXCfgParser.cpp"
+#line 6993 "PIXCfgParser.cpp"
 		}
 		static_mapped_addr_match();
 		tcp_udp_port_spec();
 		if ( inputState->guessing==0 ) {
-#line 2180 "pix.g"
+#line 2182 "pix.g"
 			
 			importer->mapped_port_spec = importer->tmp_port_spec_2;
 			*dbg << "mapped port " << importer->mapped_port_spec << " ";
 			
-#line 6997 "PIXCfgParser.cpp"
+#line 7003 "PIXCfgParser.cpp"
 		}
 		{
 		switch ( LA(1)) {
@@ -7002,22 +7008,22 @@ void PIXCfgParser::static_starts_with_tcp_udp() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2190 "pix.g"
+#line 2192 "pix.g"
 				
 				importer->real_a = importer->tmp_a;
 				importer->real_nm = importer->tmp_nm;
 				*dbg << "real: " << importer->real_a;
 				
-#line 7012 "PIXCfgParser.cpp"
+#line 7018 "PIXCfgParser.cpp"
 			}
 			tcp_udp_port_spec();
 			if ( inputState->guessing==0 ) {
-#line 2201 "pix.g"
+#line 2203 "pix.g"
 				
 				importer->real_port_spec = importer->tmp_port_spec_2;
 				*dbg << "real port " << importer->real_port_spec << " ";
 				
-#line 7021 "PIXCfgParser.cpp"
+#line 7027 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7027,12 +7033,12 @@ void PIXCfgParser::static_starts_with_tcp_udp() {
 			acl_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 2208 "pix.g"
+#line 2210 "pix.g"
 				
 				importer->real_addr_acl = acl_name->getText();
 				*dbg << "real: " << importer->real_addr_acl;
 				
-#line 7036 "PIXCfgParser.cpp"
+#line 7042 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7075,13 +7081,13 @@ void PIXCfgParser::static_mapped_addr_match() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2133 "pix.g"
+#line 2135 "pix.g"
 				
 				importer->mapped_a = importer->tmp_a;
 				importer->mapped_nm = importer->tmp_nm;
 				*dbg << "mapped: " << importer->mapped_a;
 				
-#line 7085 "PIXCfgParser.cpp"
+#line 7091 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7089,13 +7095,13 @@ void PIXCfgParser::static_mapped_addr_match() {
 		{
 			match(INTRFACE);
 			if ( inputState->guessing==0 ) {
-#line 2140 "pix.g"
+#line 2142 "pix.g"
 				
 				importer->mapped_a = "interface";
 				importer->mapped_nm = "";
 				*dbg << "mapped: " << importer->mapped_a;
 				
-#line 7099 "PIXCfgParser.cpp"
+#line 7105 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7127,13 +7133,13 @@ void PIXCfgParser::static_real_addr_match() {
 		{
 			single_addr();
 			if ( inputState->guessing==0 ) {
-#line 2151 "pix.g"
+#line 2153 "pix.g"
 				
 				importer->real_a = importer->tmp_a;
 				importer->real_nm = importer->tmp_nm;
 				*dbg << "real: " << importer->real_a;
 				
-#line 7137 "PIXCfgParser.cpp"
+#line 7143 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7143,12 +7149,12 @@ void PIXCfgParser::static_real_addr_match() {
 			acl_name = LT(1);
 			match(WORD);
 			if ( inputState->guessing==0 ) {
-#line 2158 "pix.g"
+#line 2160 "pix.g"
 				
 				importer->real_addr_acl = acl_name->getText();
 				*dbg << "real: " << importer->real_addr_acl;
 				
-#line 7152 "PIXCfgParser.cpp"
+#line 7158 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7180,12 +7186,12 @@ void PIXCfgParser::static_command_common_last_parameters() {
 		{
 			match(DNS);
 			if ( inputState->guessing==0 ) {
-#line 2238 "pix.g"
+#line 2240 "pix.g"
 				
 				importer->addMessageToLog(
 				QString("Warning: 'static' command option 'dns' is not supported"));
 				
-#line 7189 "PIXCfgParser.cpp"
+#line 7195 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7193,12 +7199,12 @@ void PIXCfgParser::static_command_common_last_parameters() {
 		{
 			match(NORANDOMSEQ);
 			if ( inputState->guessing==0 ) {
-#line 2244 "pix.g"
+#line 2246 "pix.g"
 				
 				importer->addMessageToLog(
 				QString("Warning: 'static' command option 'norandomseq' is not supported"));
 				
-#line 7202 "PIXCfgParser.cpp"
+#line 7208 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7208,12 +7214,12 @@ void PIXCfgParser::static_command_common_last_parameters() {
 			nm = LT(1);
 			match(IPV4);
 			if ( inputState->guessing==0 ) {
-#line 2250 "pix.g"
+#line 2252 "pix.g"
 				
 				importer->real_nm = nm->getText();
 				*dbg << "real netmask: " << importer->real_nm;
 				
-#line 7217 "PIXCfgParser.cpp"
+#line 7223 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7258,13 +7264,13 @@ void PIXCfgParser::static_command_common_last_parameters() {
 			
 			}
 			if ( inputState->guessing==0 ) {
-#line 2257 "pix.g"
+#line 2259 "pix.g"
 				
 				importer->static_max_conn = max_conn->getText();
 				if (max_emb_conn)
 				importer->static_max_emb_conn = max_emb_conn->getText();
 				
-#line 7268 "PIXCfgParser.cpp"
+#line 7274 "PIXCfgParser.cpp"
 			}
 			break;
 		}
@@ -7425,6 +7431,7 @@ const char* PIXCfgParser::tokenNames[] = {
 	"\"delay\"",
 	"\"hold-time\"",
 	"\"ipv6\"",
+	"\"management-only\"",
 	"\"mac-address\"",
 	"\"multicast\"",
 	"PPPOE",
@@ -7490,7 +7497,7 @@ const char* PIXCfgParser::tokenNames[] = {
 const unsigned long PIXCfgParser::_tokenSet_0_data_[] = { 2UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_0(_tokenSet_0_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_1_data_[] = { 536895346UL, 2172657788UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_1_data_[] = { 536895346UL, 2172657788UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "service" "http" "ssh" "telnet" "icmp" "object-group" "crypto" 
 // "dns" "no" "certificate" "PIX" "ASA" "FWSM" "hostname" "access-list" 
@@ -7510,7 +7517,7 @@ const unsigned long PIXCfgParser::_tokenSet_4_data_[] = { 1073676864UL, 10048UL,
 // "ospf" "pcp" "pptp" "snp" "object" "icmp" "icmp6" "tcp" "udp" "object-group" 
 // "deny" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_4(_tokenSet_4_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_5_data_[] = { 3758120818UL, 2172657791UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_5_data_[] = { 3758120818UL, 2172657791UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "host" "range" "subnet" "service" "http" "ssh" 
 // "telnet" "icmp" "object-group" "crypto" "dns" "no" "certificate" "PIX" 
@@ -7530,7 +7537,7 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_8(_tokenSet_8_dat
 const unsigned long PIXCfgParser::_tokenSet_9_data_[] = { 16UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_9(_tokenSet_9_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_10_data_[] = { 134275088UL, 16778936UL, 131392UL, 8388608UL, 0UL, 11UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_10_data_[] = { 134275088UL, 16778936UL, 131392UL, 8388608UL, 0UL, 22UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 WORD IPV6 "pptp" "http" "ssh" "telnet" INT_CONST "tcp" 
 // "udp" "dns" "hostname" "access-list" "echo" "outside" MINUS "netmask" 
 // "norandomseq" 
@@ -7539,7 +7546,7 @@ const unsigned long PIXCfgParser::_tokenSet_11_data_[] = { 536805952UL, 128UL, 0
 // "ip" "pim" "ah" "eigrp" "esp" "gre" "igmp" "igrp" "ipinip" "ipsec" "nos" 
 // "ospf" "pcp" "pptp" "snp" INT_CONST 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_11(_tokenSet_11_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_12_data_[] = { 1610637170UL, 2172657788UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_12_data_[] = { 1610637170UL, 2172657788UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "service" "http" "ssh" "telnet" "icmp" "object-group" 
 // "crypto" "dns" "no" "certificate" "PIX" "ASA" "FWSM" "hostname" "access-list" 
@@ -7557,28 +7564,28 @@ const unsigned long PIXCfgParser::_tokenSet_15_data_[] = { 2684362768UL, 12289UL
 // "gt" "lt" "neq" "established" "interface" "any" "log" "log-input" "fragments" 
 // "time-range" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_15(_tokenSet_15_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_16_data_[] = { 1610637170UL, 2172706940UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_16_data_[] = { 1610637170UL, 2172706940UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "service" "http" "ssh" "telnet" "icmp" "object-group" 
 // "group-object" "network-object" "crypto" "dns" "no" "certificate" "PIX" 
 // "ASA" "FWSM" "hostname" "access-list" "interface" "controller" LINE_COMMENT 
 // "exit" "nameif" "access-group" COLON_COMMENT "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_16(_tokenSet_16_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_17_data_[] = { 1610637170UL, 2172805244UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_17_data_[] = { 1610637170UL, 2172805244UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "service" "http" "ssh" "telnet" "icmp" "object-group" 
 // "group-object" "protocol-object" "crypto" "dns" "no" "certificate" "PIX" 
 // "ASA" "FWSM" "hostname" "access-list" "interface" "controller" LINE_COMMENT 
 // "exit" "nameif" "access-group" COLON_COMMENT "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_17(_tokenSet_17_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_18_data_[] = { 1610637170UL, 2172936316UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_18_data_[] = { 1610637170UL, 2172936316UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "service" "http" "ssh" "telnet" "icmp" "object-group" 
 // "group-object" "icmp-object" "crypto" "dns" "no" "certificate" "PIX" 
 // "ASA" "FWSM" "hostname" "access-list" "interface" "controller" LINE_COMMENT 
 // "exit" "nameif" "access-group" COLON_COMMENT "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_18(_tokenSet_18_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_19_data_[] = { 1610637170UL, 2178965628UL, 335UL, 54525984UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_19_data_[] = { 1610637170UL, 2178965628UL, 335UL, 54525984UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "service" "http" "ssh" "telnet" "icmp" "object-group" 
 // "group-object" "service-object" "port-object" "crypto" "dns" "no" "certificate" 
@@ -7618,7 +7625,7 @@ const unsigned long PIXCfgParser::_tokenSet_27_data_[] = { 536870928UL, 8193UL,
 // NEWLINE "object" "range" "object-group" "eq" "gt" "lt" "neq" "established" 
 // "log" "log-input" "fragments" "time-range" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_27(_tokenSet_27_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 671113074UL, 2172657917UL, 516431UL, 58720160UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 671113074UL, 2172657917UL, 516431UL, 58720160UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "pptp" "object" "range" "service" "http" "ssh" "telnet" "icmp" INT_CONST 
 // "object-group" "crypto" "dns" "no" "certificate" "PIX" "ASA" "FWSM" 
@@ -7628,7 +7635,7 @@ const unsigned long PIXCfgParser::_tokenSet_28_data_[] = { 671113074UL, 21726579
 // "fragments" "time-range" "controller" LINE_COMMENT "exit" "nameif" "access-group" 
 // COLON_COMMENT "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_28(_tokenSet_28_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_29_data_[] = { 671113074UL, 2172657916UL, 131407UL, 58720160UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_29_data_[] = { 671113074UL, 2172657916UL, 131407UL, 58720160UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "pptp" "object" "service" "http" "ssh" "telnet" "icmp" INT_CONST "object-group" 
 // "crypto" "dns" "no" "certificate" "PIX" "ASA" "FWSM" "hostname" "access-list" 
@@ -7646,13 +7653,13 @@ const unsigned long PIXCfgParser::_tokenSet_31_data_[] = { 671113232UL, 8377UL,
 // "object-group" "hostname" "eq" "gt" "lt" "neq" "echo" "established" 
 // "log" "log-input" "fragments" "time-range" "outside" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_31(_tokenSet_31_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_32_data_[] = { 2818629648UL, 16791225UL, 516416UL, 3146208UL, 0UL, 10UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_32_data_[] = { 2818629648UL, 16791225UL, 516416UL, 3146208UL, 0UL, 20UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE IPV4 WORD IPV6 "pptp" "object" "host" "range" "http" "ssh" "telnet" 
 // INT_CONST "tcp" "udp" "destination" "object-group" "dns" "hostname" 
 // "access-list" "eq" "gt" "lt" "neq" "echo" "established" "interface" 
 // "any" "log" "log-input" "fragments" "time-range" "netmask" "norandomseq" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_32(_tokenSet_32_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 2684387186UL, 2172657917UL, 4294959439UL, 66060799UL, 3993042945UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 2684387186UL, 2172657917UL, 4294959439UL, 66060799UL, 3691118593UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" IPV4 
 // WORD "object" "host" "range" "service" "http" "ssh" "telnet" "icmp" 
 // INT_CONST "object-group" "crypto" "dns" "no" "certificate" "PIX" "ASA" 
@@ -7665,15 +7672,16 @@ const unsigned long PIXCfgParser::_tokenSet_33_data_[] = { 2684387186UL, 2172657
 // "time-range" "controller" "outside" LINE_COMMENT "exit" "nameif" "dhcp" 
 // "access-group" COLON_COMMENT "nat" CLOSING_PAREN COMMA "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_33(_tokenSet_33_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_34_data_[] = { 1108345408UL, 2147483648UL, 0UL, 0UL, 294911UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_34_data_[] = { 1108345408UL, 2147483648UL, 0UL, 0UL, 589823UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "ip" "pim" "igmp" "ospf" "description" "no" "nameif" "vlan" "speed" 
-// "duplex" "ddns" "forward" "delay" "hold-time" "ipv6" "mac-address" "multicast" 
-// PPPOE "rip" "security-level" "shutdown" "switchport" 
+// "duplex" "ddns" "forward" "delay" "hold-time" "ipv6" "management-only" 
+// "mac-address" "multicast" PPPOE "rip" "security-level" "shutdown" "switchport" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_34(_tokenSet_34_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_35_data_[] = { 1108345408UL, 2147483648UL, 0UL, 50331648UL, 294911UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_35_data_[] = { 1108345408UL, 2147483648UL, 0UL, 50331648UL, 589823UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "ip" "pim" "igmp" "ospf" "description" "no" LINE_COMMENT "exit" "nameif" 
 // "vlan" "speed" "duplex" "ddns" "forward" "delay" "hold-time" "ipv6" 
-// "mac-address" "multicast" PPPOE "rip" "security-level" "shutdown" "switchport" 
+// "management-only" "mac-address" "multicast" PPPOE "rip" "security-level" 
+// "shutdown" "switchport" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_35(_tokenSet_35_data_,12);
 const unsigned long PIXCfgParser::_tokenSet_36_data_[] = { 16384UL, 0UL, 0UL, 8388608UL, 0UL, 0UL, 0UL, 0UL };
 // WORD "outside" 
@@ -7684,7 +7692,7 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_37(_tokenSet_37_d
 const unsigned long PIXCfgParser::_tokenSet_38_data_[] = { 16UL, 16778880UL, 0UL, 8388608UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE INT_CONST "tcp" "udp" "dns" "outside" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_38(_tokenSet_38_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_39_data_[] = { 3758120818UL, 2172659455UL, 335UL, 62914592UL, 2382364673UL, 4UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_39_data_[] = { 3758120818UL, 2172659455UL, 335UL, 62914592UL, 469762049UL, 9UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" WORD 
 // "object" "description" "host" "range" "subnet" "service" "http" "ssh" 
 // "telnet" "icmp" INT_CONST "tcp" "udp" "object-group" "crypto" "dns" 
@@ -7692,17 +7700,17 @@ const unsigned long PIXCfgParser::_tokenSet_39_data_[] = { 3758120818UL, 2172659
 // "controller" "outside" LINE_COMMENT "exit" "nameif" "access-group" COLON_COMMENT 
 // "nat" "global" "static" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_39(_tokenSet_39_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_40_data_[] = { 0UL, 16778880UL, 0UL, 0UL, 0UL, 10UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_40_data_[] = { 0UL, 16778880UL, 0UL, 0UL, 0UL, 20UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_40(_tokenSet_40_data_,12);
 const unsigned long PIXCfgParser::_tokenSet_41_data_[] = { 134275072UL, 184UL, 131392UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // IPV4 WORD IPV6 "pptp" "http" "ssh" "telnet" INT_CONST "hostname" "access-list" 
 // "echo" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_41(_tokenSet_41_data_,8);
-const unsigned long PIXCfgParser::_tokenSet_42_data_[] = { 16UL, 16778880UL, 0UL, 0UL, 0UL, 10UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_42_data_[] = { 16UL, 16778880UL, 0UL, 0UL, 0UL, 20UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE INT_CONST "tcp" "udp" "dns" "netmask" "norandomseq" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PIXCfgParser::_tokenSet_42(_tokenSet_42_data_,12);
-const unsigned long PIXCfgParser::_tokenSet_43_data_[] = { 536903538UL, 2172659452UL, 335UL, 54525984UL, 2382364673UL, 14UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PIXCfgParser::_tokenSet_43_data_[] = { 536903538UL, 2172659452UL, 335UL, 54525984UL, 469762049UL, 29UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE "quit" "ip" "timeout" "pim" "network" "names" "name" IPV4 
 // WORD "object" "service" "http" "ssh" "telnet" "icmp" INT_CONST "tcp" 
 // "udp" "object-group" "crypto" "dns" "no" "certificate" "PIX" "ASA" "FWSM" 
diff --git a/src/parsers/PIXCfgParser.hpp b/src/parsers/PIXCfgParser.hpp
index 03a63ec06..0f4b0a391 100644
--- a/src/parsers/PIXCfgParser.hpp
+++ b/src/parsers/PIXCfgParser.hpp
@@ -224,10 +224,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 196;
+	static const int NUM_TOKENS = 197;
 #else
 	enum {
-		NUM_TOKENS = 196
+		NUM_TOKENS = 197
 	};
 #endif
 	
diff --git a/src/parsers/PIXCfgParserTokenTypes.hpp b/src/parsers/PIXCfgParserTokenTypes.hpp
index b254c660b..412845ded 100644
--- a/src/parsers/PIXCfgParserTokenTypes.hpp
+++ b/src/parsers/PIXCfgParserTokenTypes.hpp
@@ -145,65 +145,66 @@ struct CUSTOM_API PIXCfgParserTokenTypes {
 		DELAY = 134,
 		HOLD_TIME = 135,
 		IPV6_C = 136,
-		MAC_ADDRESS = 137,
-		MULTICAST = 138,
-		PPPOE = 139,
-		RIP = 140,
-		SEC_LEVEL = 141,
-		SHUTDOWN = 142,
-		ADDRESS = 143,
-		DHCP = 144,
-		STANDBY = 145,
-		SWITCHPORT = 146,
-		ACCESS = 147,
-		SCOPY = 148,
-		VERSION_WORD_LOW = 149,
-		AUTHENTICATION_CERTIFICATE = 150,
-		SERVER = 151,
-		REMARK = 152,
-		ACCESS_GROUP = 153,
-		COLON_COMMENT = 154,
-		NAT = 155,
-		OPENING_PAREN = 156,
-		CLOSING_PAREN = 157,
-		COMMA = 158,
-		GLOBAL = 159,
-		MINUS = 160,
-		NETMASK = 161,
-		STATIC = 162,
-		NORANDOMSEQ = 163,
-		SECONDARY = 164,
-		SETROUTE = 165,
-		Whitespace = 166,
-		HEX_CONST = 167,
-		NEG_INT_CONST = 168,
-		DIGIT = 169,
-		HEXDIGIT = 170,
-		NUMBER_ADDRESS_OR_WORD = 171,
-		PIPE_CHAR = 172,
-		NUMBER_SIGN = 173,
-		PERCENT = 174,
-		AMPERSAND = 175,
-		APOSTROPHE = 176,
-		STAR = 177,
-		PLUS = 178,
-		DOT = 179,
-		SLASH = 180,
-		COLON = 181,
-		SEMICOLON = 182,
-		LESS_THAN = 183,
-		EQUALS = 184,
-		GREATER_THAN = 185,
-		QUESTION = 186,
-		COMMERCIAL_AT = 187,
-		OPENING_SQUARE = 188,
-		CLOSING_SQUARE = 189,
-		CARET = 190,
-		UNDERLINE = 191,
-		OPENING_BRACE = 192,
-		CLOSING_BRACE = 193,
-		TILDE = 194,
-		EXLAMATION = 195,
+		MANAGEMENT_ONLY = 137,
+		MAC_ADDRESS = 138,
+		MULTICAST = 139,
+		PPPOE = 140,
+		RIP = 141,
+		SEC_LEVEL = 142,
+		SHUTDOWN = 143,
+		ADDRESS = 144,
+		DHCP = 145,
+		STANDBY = 146,
+		SWITCHPORT = 147,
+		ACCESS = 148,
+		SCOPY = 149,
+		VERSION_WORD_LOW = 150,
+		AUTHENTICATION_CERTIFICATE = 151,
+		SERVER = 152,
+		REMARK = 153,
+		ACCESS_GROUP = 154,
+		COLON_COMMENT = 155,
+		NAT = 156,
+		OPENING_PAREN = 157,
+		CLOSING_PAREN = 158,
+		COMMA = 159,
+		GLOBAL = 160,
+		MINUS = 161,
+		NETMASK = 162,
+		STATIC = 163,
+		NORANDOMSEQ = 164,
+		SECONDARY = 165,
+		SETROUTE = 166,
+		Whitespace = 167,
+		HEX_CONST = 168,
+		NEG_INT_CONST = 169,
+		DIGIT = 170,
+		HEXDIGIT = 171,
+		NUMBER_ADDRESS_OR_WORD = 172,
+		PIPE_CHAR = 173,
+		NUMBER_SIGN = 174,
+		PERCENT = 175,
+		AMPERSAND = 176,
+		APOSTROPHE = 177,
+		STAR = 178,
+		PLUS = 179,
+		DOT = 180,
+		SLASH = 181,
+		COLON = 182,
+		SEMICOLON = 183,
+		LESS_THAN = 184,
+		EQUALS = 185,
+		GREATER_THAN = 186,
+		QUESTION = 187,
+		COMMERCIAL_AT = 188,
+		OPENING_SQUARE = 189,
+		CLOSING_SQUARE = 190,
+		CARET = 191,
+		UNDERLINE = 192,
+		OPENING_BRACE = 193,
+		CLOSING_BRACE = 194,
+		TILDE = 195,
+		EXLAMATION = 196,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus
diff --git a/src/parsers/PIXCfgParserTokenTypes.txt b/src/parsers/PIXCfgParserTokenTypes.txt
index 47536c520..c9a94e408 100644
--- a/src/parsers/PIXCfgParserTokenTypes.txt
+++ b/src/parsers/PIXCfgParserTokenTypes.txt
@@ -133,62 +133,63 @@ FORWARD="forward"=133
 DELAY="delay"=134
 HOLD_TIME="hold-time"=135
 IPV6_C="ipv6"=136
-MAC_ADDRESS="mac-address"=137
-MULTICAST="multicast"=138
-PPPOE=139
-RIP="rip"=140
-SEC_LEVEL="security-level"=141
-SHUTDOWN="shutdown"=142
-ADDRESS="address"=143
-DHCP="dhcp"=144
-STANDBY="standby"=145
-SWITCHPORT="switchport"=146
-ACCESS="access"=147
-SCOPY="scopy"=148
-VERSION_WORD_LOW="version"=149
-AUTHENTICATION_CERTIFICATE="authentication-certificate"=150
-SERVER="server"=151
-REMARK="remark"=152
-ACCESS_GROUP="access-group"=153
-COLON_COMMENT=154
-NAT="nat"=155
-OPENING_PAREN=156
-CLOSING_PAREN=157
-COMMA=158
-GLOBAL="global"=159
-MINUS=160
-NETMASK="netmask"=161
-STATIC="static"=162
-NORANDOMSEQ="norandomseq"=163
-SECONDARY="secondary"=164
-SETROUTE="setroute"=165
-Whitespace=166
-HEX_CONST=167
-NEG_INT_CONST=168
-DIGIT=169
-HEXDIGIT=170
-NUMBER_ADDRESS_OR_WORD=171
-PIPE_CHAR=172
-NUMBER_SIGN=173
-PERCENT=174
-AMPERSAND=175
-APOSTROPHE=176
-STAR=177
-PLUS=178
-DOT=179
-SLASH=180
-COLON=181
-SEMICOLON=182
-LESS_THAN=183
-EQUALS=184
-GREATER_THAN=185
-QUESTION=186
-COMMERCIAL_AT=187
-OPENING_SQUARE=188
-CLOSING_SQUARE=189
-CARET=190
-UNDERLINE=191
-OPENING_BRACE=192
-CLOSING_BRACE=193
-TILDE=194
-EXLAMATION=195
+MANAGEMENT_ONLY="management-only"=137
+MAC_ADDRESS="mac-address"=138
+MULTICAST="multicast"=139
+PPPOE=140
+RIP="rip"=141
+SEC_LEVEL="security-level"=142
+SHUTDOWN="shutdown"=143
+ADDRESS="address"=144
+DHCP="dhcp"=145
+STANDBY="standby"=146
+SWITCHPORT="switchport"=147
+ACCESS="access"=148
+SCOPY="scopy"=149
+VERSION_WORD_LOW="version"=150
+AUTHENTICATION_CERTIFICATE="authentication-certificate"=151
+SERVER="server"=152
+REMARK="remark"=153
+ACCESS_GROUP="access-group"=154
+COLON_COMMENT=155
+NAT="nat"=156
+OPENING_PAREN=157
+CLOSING_PAREN=158
+COMMA=159
+GLOBAL="global"=160
+MINUS=161
+NETMASK="netmask"=162
+STATIC="static"=163
+NORANDOMSEQ="norandomseq"=164
+SECONDARY="secondary"=165
+SETROUTE="setroute"=166
+Whitespace=167
+HEX_CONST=168
+NEG_INT_CONST=169
+DIGIT=170
+HEXDIGIT=171
+NUMBER_ADDRESS_OR_WORD=172
+PIPE_CHAR=173
+NUMBER_SIGN=174
+PERCENT=175
+AMPERSAND=176
+APOSTROPHE=177
+STAR=178
+PLUS=179
+DOT=180
+SLASH=181
+COLON=182
+SEMICOLON=183
+LESS_THAN=184
+EQUALS=185
+GREATER_THAN=186
+QUESTION=187
+COMMERCIAL_AT=188
+OPENING_SQUARE=189
+CLOSING_SQUARE=190
+CARET=191
+UNDERLINE=192
+OPENING_BRACE=193
+CLOSING_BRACE=194
+TILDE=195
+EXLAMATION=196
diff --git a/src/parsers/pix.g b/src/parsers/pix.g
index f96dc5fc4..c8c12d667 100644
--- a/src/parsers/pix.g
+++ b/src/parsers/pix.g
@@ -1516,6 +1516,8 @@ unsupported_interface_commands :
             IGMP
         |
             IPV6_C
+        |
+            MANAGEMENT_ONLY
         |
             MAC_ADDRESS
         |
@@ -2295,6 +2297,8 @@ tokens
     HOLD_TIME = "hold-time";
     IPV6_C = "ipv6";
     MAC_ADDRESS = "mac-address";
+    MANAGEMENT_ONLY = "management-only";
+
     MULTICAST = "multicast";
     NETMASK = "netmask";
 
diff --git a/src/unit_tests/PIXImporterTest/test_data/fwsm1.output b/src/unit_tests/PIXImporterTest/test_data/fwsm1.output
index 11163e244..cd020d256 100644
--- a/src/unit_tests/PIXImporterTest/test_data/fwsm1.output
+++ b/src/unit_tests/PIXImporterTest/test_data/fwsm1.output
@@ -5,7 +5,6 @@
 12: Interface parameters: vlan0350  
 12: Interface label: vlan0350
 14: Interface address: 192.0.2.1/255.255.255.0
-14: Parser error: line 16:2: unexpected token: management-only
 18: New interface: Vlan351
 18: Interface parameters: vlan0351  
 18: Interface label: vlan0351