From 7c3fdae4f5824152857e46ef9550226ad03f3b1e Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Sat, 30 Aug 2008 05:05:56 +0000
Subject: [PATCH] main window and dialogs do not enforce font

---
 doc/ChangeLog                            |    7 +
 src/gui/FWBMainWindow_q.ui               |    9 +-
 src/gui/PrefsDialog.cpp                  |    1 +
 src/gui/instdialog_q.ui                  |    9 +-
 src/gui/instoptionsdialog_q.ui           |    4 -
 src/gui/main.cpp                         |    3 +-
 test/pf/objects-for-regression-tests.fwb | 2149 +++++++++++-----------
 7 files changed, 1104 insertions(+), 1078 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 7be996dca..3e4bcd627 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,10 @@
+2008-08-29  Vadim Kurland  <vadim@vk.crocodile.org>
+
+	* making sure dialogs do not enforce font type and size if not
+	necessary. Main window and install dialog used to override system
+	font which led to problems with dialog layouts on some systems.
+
+
 2008-08-27  Vadim Kurland  <vadim@vk.crocodile.org>
 
 	* configure.in: Applied patch per bug #2079941: "Patch for
diff --git a/src/gui/FWBMainWindow_q.ui b/src/gui/FWBMainWindow_q.ui
index ecdf717ce..fcffb8e50 100644
--- a/src/gui/FWBMainWindow_q.ui
+++ b/src/gui/FWBMainWindow_q.ui
@@ -24,13 +24,6 @@
     <height>0</height>
    </size>
   </property>
-  <property name="font" >
-   <font>
-    <family>Sans Serif</family>
-    <pointsize>11</pointsize>
-    <stylestrategy>PreferDefault</stylestrategy>
-   </font>
-  </property>
   <property name="windowTitle" >
    <string>Firewall Builder</string>
   </property>
@@ -83,7 +76,7 @@
      <x>0</x>
      <y>0</y>
      <width>741</width>
-     <height>28</height>
+     <height>29</height>
     </rect>
    </property>
    <widget class="QMenu" name="editMenu" >
diff --git a/src/gui/PrefsDialog.cpp b/src/gui/PrefsDialog.cpp
index 79be5ea83..4997d1797 100644
--- a/src/gui/PrefsDialog.cpp
+++ b/src/gui/PrefsDialog.cpp
@@ -480,6 +480,7 @@ void PrefsDialog::accept()
     mw->setupAutoSave();
     mw->showDeletedObjects(st->getBool("UI/ShowDeletedObjects"));
     mw->updateTreeFont();
+//    app->setFont(st->getTreeFont());
     QDialog::accept();
 }
 
diff --git a/src/gui/instdialog_q.ui b/src/gui/instdialog_q.ui
index edebb13d8..8e3b46092 100644
--- a/src/gui/instdialog_q.ui
+++ b/src/gui/instdialog_q.ui
@@ -5,8 +5,8 @@
    <rect>
     <x>0</x>
     <y>0</y>
-    <width>564</width>
-    <height>663</height>
+    <width>854</width>
+    <height>621</height>
    </rect>
   </property>
   <property name="sizePolicy" >
@@ -74,7 +74,7 @@
       </sizepolicy>
      </property>
      <property name="currentIndex" >
-      <number>1</number>
+      <number>0</number>
      </property>
      <widget class="QWidget" name="page" >
       <property name="sizePolicy" >
@@ -259,6 +259,9 @@
             </property>
             <item>
              <widget class="QTableWidget" name="selectTable" >
+              <property name="alternatingRowColors" >
+               <bool>true</bool>
+              </property>
               <property name="selectionMode" >
                <enum>QAbstractItemView::NoSelection</enum>
               </property>
diff --git a/src/gui/instoptionsdialog_q.ui b/src/gui/instoptionsdialog_q.ui
index 4f0d05f0d..f0277419a 100644
--- a/src/gui/instoptionsdialog_q.ui
+++ b/src/gui/instoptionsdialog_q.ui
@@ -21,9 +21,6 @@
     <height>32767</height>
    </size>
   </property>
-  <property name="font" >
-   <font/>
-  </property>
   <property name="focusPolicy" >
    <enum>Qt::StrongFocus</enum>
   </property>
@@ -548,7 +545,6 @@
   <tabstop>okButton</tabstop>
   <tabstop>cancelButton</tabstop>
  </tabstops>
- <includes/>
  <resources/>
  <connections>
   <connection>
diff --git a/src/gui/main.cpp b/src/gui/main.cpp
index 5bce4dc5d..2fa7707fb 100644
--- a/src/gui/main.cpp
+++ b/src/gui/main.cpp
@@ -603,7 +603,6 @@ int main( int argc, char *argv[] )
         app->setOrganizationName(QLatin1String("NetCitadel LLC"));
         app->setApplicationName(QLatin1String("Firewall Builder"));
 
-
 /* need to initialize in order to be able to use FWBSettings */
         init(argv);
         init_platforms();
@@ -617,6 +616,8 @@ int main( int argc, char *argv[] )
 
         QPixmapCache::setCacheLimit(4096);
 
+//        app->setFont(st->getTreeFont());
+
 #ifdef ELC
         registered = init2(argv0,
                            "Firewall Builder",
diff --git a/test/pf/objects-for-regression-tests.fwb b/test/pf/objects-for-regression-tests.fwb
index ecd10d352..b787d31f4 100644
--- a/test/pf/objects-for-regression-tests.fwb
+++ b/test/pf/objects-for-regression-tests.fwb
@@ -1,145 +1,149 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1219023782" id="root">
-  <Library id="sysid99" name="Deleted Objects" ro="False">
-    <ICMP6Service id="idE0C27650" name="ipv6 dest unreachable" comment="No route to destination" code="0" type="1"/>
-    <Library id="id40E233F3" name="West Coast" color="#FFFFFF" ro="False">
-      <ObjectGroup id="id40E233F4" name="Objects">
-        <ObjectGroup id="id40E233F4_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40E233F5" name="Addresses"/>
-        <ObjectGroup id="id40E233F6" name="Groups">
-          <ObjectGroup id="id40E23403" name="West Coast Servers"/>
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1219936397" id="root">
+  <Library id="sysid99" ro="False" name="Deleted Objects" comment="">
+    <ICMP6Service id="idE0C27650" code="0" type="1" name="ipv6 dest unreachable" comment="No route to destination"/>
+    <Library id="id40E233F3" color="#FFFFFF" ro="False" name="West Coast" comment="">
+      <ObjectGroup id="id40E233F4" name="Objects" comment="">
+        <ObjectGroup id="id40E233F4_og_ats_1" name="Address Tables" comment=""/>
+        <ObjectGroup id="id40E233F5" name="Addresses" comment=""/>
+        <ObjectGroup id="id40E233F6" name="Groups" comment="">
+          <ObjectGroup id="id40E23403" name="West Coast Servers" comment=""/>
         </ObjectGroup>
-        <ObjectGroup id="id40E233F7" name="Hosts"/>
-        <ObjectGroup id="id40E233F8" name="Networks"/>
-        <ObjectGroup id="id40E233F9" name="Address Ranges"/>
+        <ObjectGroup id="id40E233F7" name="Hosts" comment=""/>
+        <ObjectGroup id="id40E233F8" name="Networks" comment=""/>
+        <ObjectGroup id="id40E233F9" name="Address Ranges" comment=""/>
       </ObjectGroup>
-      <ServiceGroup id="id40E233FA" name="Services">
-        <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices"/>
-        <ServiceGroup id="id40E233FB" name="Groups"/>
-        <ServiceGroup id="id40E233FC" name="ICMP"/>
-        <ServiceGroup id="id40E233FD" name="IP"/>
-        <ServiceGroup id="id40E233FE" name="TCP"/>
-        <ServiceGroup id="id40E233FF" name="UDP"/>
-        <ServiceGroup id="id40E23400" name="Custom"/>
-        <ServiceGroup id="id40E233FA_userservices" name="Users"/>
+      <ServiceGroup id="id40E233FA" name="Services" comment="">
+        <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices" comment=""/>
+        <ServiceGroup id="id40E233FB" name="Groups" comment=""/>
+        <ServiceGroup id="id40E233FC" name="ICMP" comment=""/>
+        <ServiceGroup id="id40E233FD" name="IP" comment=""/>
+        <ServiceGroup id="id40E233FE" name="TCP" comment=""/>
+        <ServiceGroup id="id40E233FF" name="UDP" comment=""/>
+        <ServiceGroup id="id40E23400" name="Custom" comment=""/>
+        <ServiceGroup id="id40E233FA_userservices" name="Users" comment=""/>
       </ServiceGroup>
-      <ObjectGroup id="id40E23401" name="Firewalls"/>
-      <IntervalGroup id="id40E23402" name="Time"/>
+      <ObjectGroup id="id40E23401" name="Firewalls" comment=""/>
+      <IntervalGroup id="id40E23402" name="Time" comment=""/>
     </Library>
-    <Library id="id40D07E7A" name="LAX" color="#FFFFFF" ro="False">
-      <ObjectGroup id="id40D07E7B" name="Objects">
-        <ObjectGroup id="id40D07E7B_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40D07E7C" name="Addresses">
-          <IPv4 id="id40E238E6" name="laxftp1" address="10.1.10.10" netmask="255.255.255.255"/>
-          <IPv4 id="id40E238E7" name="laxweb1" address="10.1.10.11" netmask="255.255.255.255"/>
+    <Library id="id40D07E7A" color="#FFFFFF" ro="False" name="LAX" comment="">
+      <ObjectGroup id="id40D07E7B" name="Objects" comment="">
+        <ObjectGroup id="id40D07E7B_og_ats_1" name="Address Tables" comment=""/>
+        <ObjectGroup id="id40D07E7C" name="Addresses" comment="">
+          <IPv4 id="id40E238E6" name="laxftp1" comment="" address="10.1.10.10" netmask="255.255.255.255"/>
+          <IPv4 id="id40E238E7" name="laxweb1" comment="" address="10.1.10.11" netmask="255.255.255.255"/>
         </ObjectGroup>
-        <ObjectGroup id="id40D07E7D" name="Groups">
-          <ObjectGroup id="id40E23565" name="LAX Servers"/>
+        <ObjectGroup id="id40D07E7D" name="Groups" comment="">
+          <ObjectGroup id="id40E23565" name="LAX Servers" comment=""/>
         </ObjectGroup>
-        <ObjectGroup id="id40D07E7E" name="Hosts"/>
-        <ObjectGroup id="id40D07E7F" name="Networks"/>
-        <ObjectGroup id="id40D07E80" name="Address Ranges"/>
+        <ObjectGroup id="id40D07E7E" name="Hosts" comment=""/>
+        <ObjectGroup id="id40D07E7F" name="Networks" comment=""/>
+        <ObjectGroup id="id40D07E80" name="Address Ranges" comment=""/>
       </ObjectGroup>
-      <ServiceGroup id="id40D07E81" name="Services">
-        <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices"/>
-        <ServiceGroup id="id40D07E82" name="Groups"/>
-        <ServiceGroup id="id40D07E83" name="ICMP"/>
-        <ServiceGroup id="id40D07E84" name="IP"/>
-        <ServiceGroup id="id40D07E85" name="TCP"/>
-        <ServiceGroup id="id40D07E86" name="UDP"/>
-        <ServiceGroup id="id40D07E87" name="Custom"/>
-        <ServiceGroup id="id40D07E81_userservices" name="Users"/>
+      <ServiceGroup id="id40D07E81" name="Services" comment="">
+        <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices" comment=""/>
+        <ServiceGroup id="id40D07E82" name="Groups" comment=""/>
+        <ServiceGroup id="id40D07E83" name="ICMP" comment=""/>
+        <ServiceGroup id="id40D07E84" name="IP" comment=""/>
+        <ServiceGroup id="id40D07E85" name="TCP" comment=""/>
+        <ServiceGroup id="id40D07E86" name="UDP" comment=""/>
+        <ServiceGroup id="id40D07E87" name="Custom" comment=""/>
+        <ServiceGroup id="id40D07E81_userservices" name="Users" comment=""/>
       </ServiceGroup>
-      <ObjectGroup id="id40D07E88" name="Firewalls"/>
-      <IntervalGroup id="id40D07E89" name="Time"/>
+      <ObjectGroup id="id40D07E88" name="Firewalls" comment=""/>
+      <IntervalGroup id="id40D07E89" name="Time" comment=""/>
     </Library>
-    <Library id="id40C3E07E" name="SFO" color="#FFFFFF" ro="False">
-      <ObjectGroup id="id40C3E07F" name="Objects">
-        <ObjectGroup id="id40C3E07F_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40C3E081" name="Groups">
-          <ObjectGroup id="id40E23562" name="SFO Servers"/>
+    <Library id="id40C3E07E" color="#FFFFFF" ro="False" name="SFO" comment="">
+      <ObjectGroup id="id40C3E07F" name="Objects" comment="">
+        <ObjectGroup id="id40C3E07F_og_ats_1" name="Address Tables" comment=""/>
+        <ObjectGroup id="id40C3E081" name="Groups" comment="">
+          <ObjectGroup id="id40E23562" name="SFO Servers" comment=""/>
         </ObjectGroup>
-        <ObjectGroup id="id40C3E080" name="Addresses">
-          <IPv4 id="id40E238E9" name="sfoweb1" address="10.2.10.11" netmask="255.255.255.255"/>
-          <IPv4 id="id40E238E8" name="sfoftp1" address="10.2.10.10" netmask="255.255.255.255"/>
+        <ObjectGroup id="id40C3E080" name="Addresses" comment="">
+          <IPv4 id="id40E238E9" name="sfoweb1" comment="" address="10.2.10.11" netmask="255.255.255.255"/>
+          <IPv4 id="id40E238E8" name="sfoftp1" comment="" address="10.2.10.10" netmask="255.255.255.255"/>
         </ObjectGroup>
       </ObjectGroup>
     </Library>
-    <Library id="id44EC13FB8791" name="tmp" color="#d2ffd0" ro="False">
-      <ObjectGroup id="id44EC13FC8791" name="Objects">
-        <ObjectGroup id="id44EC13FD8791" name="Addresses"/>
-        <ObjectGroup id="id44EC13FE8791" name="DNS Names"/>
-        <ObjectGroup id="id44EC13FF8791" name="Address Tables"/>
-        <ObjectGroup id="id44EC14008791" name="Groups"/>
-        <ObjectGroup id="id44EC14018791" name="Hosts"/>
-        <ObjectGroup id="id44EC14028791" name="Networks"/>
-        <ObjectGroup id="id44EC14038791" name="Address Ranges"/>
+    <Library id="id44EC13FB8791" color="#d2ffd0" ro="False" name="tmp" comment="">
+      <ObjectGroup id="id44EC13FC8791" name="Objects" comment="">
+        <ObjectGroup id="id44EC13FD8791" name="Addresses" comment=""/>
+        <ObjectGroup id="id44EC13FE8791" name="DNS Names" comment=""/>
+        <ObjectGroup id="id44EC13FF8791" name="Address Tables" comment=""/>
+        <ObjectGroup id="id44EC14008791" name="Groups" comment=""/>
+        <ObjectGroup id="id44EC14018791" name="Hosts" comment=""/>
+        <ObjectGroup id="id44EC14028791" name="Networks" comment=""/>
+        <ObjectGroup id="id44EC14038791" name="Address Ranges" comment=""/>
       </ObjectGroup>
-      <ServiceGroup id="id44EC14048791" name="Services">
-        <ServiceGroup id="id44EC14058791" name="Groups"/>
-        <ServiceGroup id="id44EC14068791" name="ICMP"/>
-        <ServiceGroup id="id44EC14078791" name="IP"/>
-        <ServiceGroup id="id44EC14088791" name="TCP"/>
-        <ServiceGroup id="id44EC14098791" name="UDP"/>
-        <ServiceGroup id="id44EC140A8791" name="Custom"/>
-        <ServiceGroup id="id44EC140B8791" name="TagServices"/>
-        <ServiceGroup id="id44EC14048791_userservices" name="Users"/>
+      <ServiceGroup id="id44EC14048791" name="Services" comment="">
+        <ServiceGroup id="id44EC14058791" name="Groups" comment=""/>
+        <ServiceGroup id="id44EC14068791" name="ICMP" comment=""/>
+        <ServiceGroup id="id44EC14078791" name="IP" comment=""/>
+        <ServiceGroup id="id44EC14088791" name="TCP" comment=""/>
+        <ServiceGroup id="id44EC14098791" name="UDP" comment=""/>
+        <ServiceGroup id="id44EC140A8791" name="Custom" comment=""/>
+        <ServiceGroup id="id44EC140B8791" name="TagServices" comment=""/>
+        <ServiceGroup id="id44EC14048791_userservices" name="Users" comment=""/>
       </ServiceGroup>
-      <ObjectGroup id="id44EC140C8791" name="Firewalls"/>
-      <IntervalGroup id="id44EC140D8791" name="Time"/>
+      <ObjectGroup id="id44EC140C8791" name="Firewalls" comment=""/>
+      <IntervalGroup id="id44EC140D8791" name="Time" comment=""/>
     </Library>
-    <AddressTable id="id44F7056328576" name="atbl" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" run_time="True"/>
-    <Interface id="id45DE9D012560" name="pcn1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-      <IPv4 id="id45DE9D032560" name="openbsd-4.0:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+    <AddressTable id="id44F7056328576" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" run_time="True" name="atbl" comment=""/>
+    <Interface id="id45DE9D012560" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="pcn1" comment="">
+      <IPv4 id="id45DE9D032560" name="openbsd-4.0:pcn1:ip" comment="" address="10.1.1.1" netmask="255.255.255.0"/>
     </Interface>
-    <Interface id="id4848A43B4626" name="ppp0" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
+    <Interface id="id4848A43B4626" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="ppp0" comment=""/>
     <ServiceRef ref="ip-IP_Fragments"/>
     <ServiceRef ref="id3B58E3F1"/>
     <ServiceRef ref="sysid1"/>
     <ServiceRef ref="id3C6820443"/>
     <ObjectRef ref="sysid0"/>
+    <ObjectRef ref="sysid0"/>
+    <ObjectRef ref="sysid0"/>
+    <ObjectRef ref="id3B0C63E1"/>
+    <ObjectRef ref="sysid0"/>
   </Library>
-  <Library id="syslib001" name="User" comment="User defined objects" color="#d2ffd0" ro="False">
-    <ObjectGroup id="stdid01_1" name="Objects">
-      <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
-        <AddressTable id="id4389EE9018346" name="addr-table-1" filename="addr-table-1.tbl" run_time="False"/>
-        <AddressTable id="id4389EE9118346" name="block these" comment="this is run-time table" filename="block-hosts.tbl" run_time="True"/>
-        <AddressTable id="id452762A75348" name="spammers" comment="empty file name; should generate code like this:&#10;&#10;table &lt;spammers&gt; persist&#10;&#10;without &quot;file 'blah'&quot;&#10;&#10;" filename="" run_time="True"/>
+  <Library id="syslib001" color="#d2ffd0" ro="False" name="User" comment="User defined objects">
+    <ObjectGroup id="stdid01_1" name="Objects" comment="">
+      <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables" comment="">
+        <AddressTable id="id4389EE9018346" filename="addr-table-1.tbl" run_time="False" name="addr-table-1" comment=""/>
+        <AddressTable id="id4389EE9118346" filename="block-hosts.tbl" run_time="True" name="block these" comment="this is run-time table"/>
+        <AddressTable id="id452762A75348" filename="" run_time="True" name="spammers" comment="empty file name; should generate code like this:&#10;&#10;table &lt;spammers&gt; persist&#10;&#10;without &quot;file 'blah'&quot;&#10;&#10;"/>
       </ObjectGroup>
-      <ObjectGroup id="stdid16_1" name="Addresses">
-        <IPv4 id="id4388C37D674" name="sapmhost1" address="61.150.47.112" netmask="255.255.255.255"/>
-        <IPv4 id="id446FCEEA10619" name="spamhost2" address="7.7.7.7" netmask="255.255.255.255"/>
-        <IPv4 id="id44F7082928576" name="some address" address="1.1.1.1" netmask="255.255.255.255"/>
-        <IPv6 id="id48416A7216880" name="6bone.net" address="2001:5c0:0:2::24" netmask="128"/>
-        <IPv6 id="id48416A7116880" name="altavista" address="3ffe:1200:2001:1:8000::1" netmask="128"/>
-        <IPv4 id="id417B3641" name="net_address" address="192.168.1.0" netmask="255.255.255.255"/>
+      <ObjectGroup id="stdid16_1" name="Addresses" comment="">
+        <IPv4 id="id4388C37D674" name="sapmhost1" comment="" address="61.150.47.112" netmask="255.255.255.255"/>
+        <IPv4 id="id446FCEEA10619" name="spamhost2" comment="" address="7.7.7.7" netmask="255.255.255.255"/>
+        <IPv4 id="id44F7082928576" name="some address" comment="" address="1.1.1.1" netmask="255.255.255.255"/>
+        <IPv6 id="id48416A7216880" name="6bone.net" comment="" address="2001:5c0:0:2::24" netmask="128"/>
+        <IPv6 id="id48416A7116880" name="altavista" comment="" address="3ffe:1200:2001:1:8000::1" netmask="128"/>
+        <IPv4 id="id417B3641" name="net_address" comment="" address="192.168.1.0" netmask="255.255.255.255"/>
       </ObjectGroup>
-      <ObjectGroup id="stdid04_1" name="Groups">
-        <ObjectGroup id="id3B4572AF" name="group1">
+      <ObjectGroup id="stdid04_1" name="Groups" comment="">
+        <ObjectGroup id="id3B4572AF" name="group1" comment="">
           <ObjectRef ref="host-hostA"/>
           <ObjectRef ref="host-hostB"/>
         </ObjectGroup>
-        <ObjectGroup id="id3B4572B5" name="platform">
+        <ObjectGroup id="id3B4572B5" name="platform" comment="">
           <ObjectRef ref="id3AFC0F70"/>
           <ObjectRef ref="id3AFC191C"/>
         </ObjectGroup>
-        <ObjectGroup id="id3BBC0EFC" name="netgroup1">
+        <ObjectGroup id="id3BBC0EFC" name="netgroup1" comment="">
           <ObjectRef ref="net-Internal_net"/>
           <ObjectRef ref="id3B022266"/>
         </ObjectGroup>
-        <ObjectGroup id="id3CD87A9A" name="group-range-1">
+        <ObjectGroup id="id3CD87A9A" name="group-range-1" comment="">
           <ObjectRef ref="id3CD87A53"/>
           <ObjectRef ref="id3CD87A5E"/>
           <ObjectRef ref="id3CD87A6D"/>
           <ObjectRef ref="id3CD87A7C"/>
           <ObjectRef ref="id3CD87A8B"/>
         </ObjectGroup>
-        <ObjectGroup id="id3D8FED30" name="group2">
+        <ObjectGroup id="id3D8FED30" name="group2" comment="">
           <ObjectRef ref="host-hostA"/>
         </ObjectGroup>
-        <ObjectGroup id="id3DE69469" name="egroup"/>
-        <ObjectGroup id="id3DE6946A" name="egroup2">
+        <ObjectGroup id="id3DE69469" name="egroup" comment=""/>
+        <ObjectGroup id="id3DE6946A" name="egroup2" comment="">
           <ObjectRef ref="id3DE69469"/>
         </ObjectGroup>
         <ObjectGroup id="id4390C25525682" name="at group" comment="this group is a combination of a regular address object and an address table in run-time mode">
@@ -148,40 +152,40 @@
           <ObjectRef ref="id446FB0EA10619"/>
           <ObjectRef ref="id446FCEEA10619"/>
         </ObjectGroup>
-        <ObjectGroup id="id446FB0EA10619" name="tbl group">
+        <ObjectGroup id="id446FB0EA10619" name="tbl group" comment="">
           <ObjectRef ref="id4389EE9018346"/>
         </ObjectGroup>
-        <ObjectGroup id="id4653861721432" name="f2i1,3">
+        <ObjectGroup id="id4653861721432" name="f2i1,3" comment="">
           <ObjectRef ref="id3AFB6706"/>
           <ObjectRef ref="id3AFB68D2"/>
         </ObjectGroup>
-        <ObjectGroup id="id4653B74121432" name="f2i1">
+        <ObjectGroup id="id4653B74121432" name="f2i1" comment="">
           <ObjectRef ref="id3AFB6706"/>
         </ObjectGroup>
-        <ObjectGroup id="id4834A2238571" name="ipv6 addresses">
+        <ObjectGroup id="id4834A2238571" name="ipv6 addresses" comment="">
           <ObjectRef ref="id48416A7016880"/>
           <ObjectRef ref="id48416A7216880"/>
           <ObjectRef ref="id48416A7116880"/>
         </ObjectGroup>
-        <ObjectGroup id="id4834A2278571" name="ipv4 ipv6 addresses">
+        <ObjectGroup id="id4834A2278571" name="ipv4 ipv6 addresses" comment="">
           <ObjectRef ref="id417B3641"/>
           <ObjectRef ref="id4388C37D674"/>
           <ObjectRef ref="id48416A7216880"/>
           <ObjectRef ref="id48416A7116880"/>
         </ObjectGroup>
       </ObjectGroup>
-      <ObjectGroup id="stdid02_1" name="Hosts">
+      <ObjectGroup id="stdid02_1" name="Hosts" comment="">
         <Host id="id3B64FFAC" name="broadcast" comment="broadcast on internal subnet">
-          <Interface id="id3B64FFAC-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3B64FFAC-i-ipv4" name="address" address="192.168.1.255" netmask="255.255.255.255"/>
+          <Interface id="id3B64FFAC-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3B64FFAC-i-ipv4" name="address" comment="" address="192.168.1.255" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="host-hostA" name="hostA">
-          <Interface id="host-hostA-i" name="hostA_eth0" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="host-hostA-i-ipv4" name="address" address="192.168.1.10" netmask="255.255.255.255"/>
+        <Host id="host-hostA" name="hostA" comment="">
+          <Interface id="host-hostA-i" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="hostA_eth0" comment="">
+            <IPv4 id="host-hostA-i-ipv4" name="address" comment="" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -195,9 +199,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3B3D5A3B" name="hostA-2">
-          <Interface id="id3B3D5A3B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3B3D5A3B-i-1-addr" name="address" address="192.168.1.10" netmask="255.255.255.255"/>
+        <Host id="id3B3D5A3B" name="hostA-2" comment="">
+          <Interface id="id3B3D5A3B-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3B3D5A3B-i-1-addr" name="address" comment="" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -212,16 +216,16 @@
           </HostOptions>
         </Host>
         <Host id="id3AFADBF9" name="hostA-NAT" comment="translated address for hostA">
-          <Interface id="id3AFADBF9-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3AFADBF9-i-ipv4" name="address" address="22.22.22.23" netmask="255.255.255.255"/>
+          <Interface id="id3AFADBF9-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3AFADBF9-i-ipv4" name="address" comment="" address="22.22.22.23" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="host-hostB" name="hostB">
-          <Interface id="host-hostB-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="host-hostB-i-ipv4" name="address" address="192.168.1.20" netmask="255.255.255.255"/>
+        <Host id="host-hostB" name="hostB" comment="">
+          <Interface id="host-hostB-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="host-hostB-i-ipv4" name="address" comment="" address="192.168.1.20" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.20">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -232,41 +236,41 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="id3BD6736B" name="hostB-NAT">
-          <Interface id="id3BD6736B-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3BD6736B-i-ipv4" name="address" address="22.22.23.24" netmask="255.255.255.255"/>
+        <Host id="id3BD6736B" name="hostB-NAT" comment="">
+          <Interface id="id3BD6736B-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3BD6736B-i-ipv4" name="address" comment="" address="22.22.23.24" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
         <Host id="id3AFC0F70" name="host-fw2" comment="this host has the same IP address as firewall1 and firewall2">
-          <Interface id="id3AFC0F70-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3AFC0F70-i-ipv4" name="host-fw2-addr" address="22.22.22.22" netmask="255.255.255.255"/>
+          <Interface id="id3AFC0F70-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3AFC0F70-i-ipv4" name="host-fw2-addr" comment="" address="22.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
         <Host id="id3AFC191C" name="hostF-int" comment="the same address as internal iface of firewall1">
-          <Interface id="id3AFC191C-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3AFC191C-i-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.255"/>
+          <Interface id="id3AFC191C-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3AFC191C-i-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
         <Host id="id3B19C5EB" name="outside-host" comment="some host outside our network">
-          <Interface id="id3B19C5EB-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3B19C5EB-i-ipv4" name="address" address="200.200.200.200" netmask="255.255.255.255"/>
+          <Interface id="id3B19C5EB-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3B19C5EB-i-ipv4" name="address" comment="" address="200.200.200.200" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="host-secondary1-com" name="secondary1.com">
-          <Interface id="host-secondary1-com-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="host-secondary1-com-i-ipv4" name="address" address="211.11.11.11" netmask="255.255.255.255"/>
+        <Host id="host-secondary1-com" name="secondary1.com" comment="">
+          <Interface id="host-secondary1-com-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="host-secondary1-com-i-ipv4" name="address" comment="" address="211.11.11.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.11.11.11">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -277,9 +281,9 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="host-secondary2-com" name="secondary2.com">
-          <Interface id="host-secondary2-com-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="host-secondary2-com-i-ipv4" name="address" address="211.22.22.22" netmask="255.255.255.255"/>
+        <Host id="host-secondary2-com" name="secondary2.com" comment="">
+          <Interface id="host-secondary2-com-i" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="host-secondary2-com-i-ipv4" name="address" comment="" address="211.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.22.22.22">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -290,10 +294,10 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host id="id3BF1B3E1" name="host-with_mac">
-          <Interface id="id3BF1B3E2" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3BF1B3E2-ipv4" name="address" address="192.168.1.10" netmask="255.255.255.0"/>
-            <physAddress id="id3BF1B3E2-pa" name="unknown-pa" address="00:10:4b:de:e9:6f"/>
+        <Host id="id3BF1B3E1" name="host-with_mac" comment="">
+          <Interface id="id3BF1B3E2" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3BF1B3E2-ipv4" name="address" comment="" address="192.168.1.10" netmask="255.255.255.0"/>
+            <physAddress id="id3BF1B3E2-pa" address="00:10:4b:de:e9:6f" name="unknown-pa" comment=""/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -304,10 +308,10 @@
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
-        <Host id="id3BF1B3E7" name="host-with_mac-2">
-          <Interface id="id3BF1B3E8" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3BF1B3E8-ipv4" name="host-with_mac-2:addr" address="0.0.0.0" netmask="0.0.0.0"/>
-            <physAddress id="id3BF1B3E8-pa" name="unknown-pa" address="00:10:4b:de:e9:6f"/>
+        <Host id="id3BF1B3E7" name="host-with_mac-2" comment="">
+          <Interface id="id3BF1B3E8" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3BF1B3E8-ipv4" name="host-with_mac-2:addr" comment="" address="0.0.0.0" netmask="0.0.0.0"/>
+            <physAddress id="id3BF1B3E8-pa" address="00:10:4b:de:e9:6f" name="unknown-pa" comment=""/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -321,10 +325,10 @@
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
-        <Host id="id3BF23930" name="z-host">
-          <Interface id="id3BF23931" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-            <IPv4 id="id3BF23931-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
-            <physAddress id="id3BF23931-pa" name="unknown-pa" address="00:a0:24:53:06:8c"/>
+        <Host id="id3BF23930" name="z-host" comment="">
+          <Interface id="id3BF23931" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="unknown" comment="">
+            <IPv4 id="id3BF23931-ipv4" name="address" comment="" address="0.0.0.0" netmask="0.0.0.0"/>
+            <physAddress id="id3BF23931-pa" address="00:a0:24:53:06:8c" name="unknown-pa" comment=""/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -338,9 +342,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3CD87A53" name="n192.168.1.11">
-          <Interface id="id3CD87A53-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3CD87A53-i-1-addr" name="address" address="192.168.1.11" netmask="255.255.255.255"/>
+        <Host id="id3CD87A53" name="n192.168.1.11" comment="">
+          <Interface id="id3CD87A53-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3CD87A53-i-1-addr" name="address" comment="" address="192.168.1.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.11">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -355,9 +359,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3CD87A5E" name="n192.168.1.12">
-          <Interface id="id3CD87A5E-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3CD87A5E-i-1-addr" name="address" address="192.168.1.12" netmask="255.255.255.255"/>
+        <Host id="id3CD87A5E" name="n192.168.1.12" comment="">
+          <Interface id="id3CD87A5E-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3CD87A5E-i-1-addr" name="address" comment="" address="192.168.1.12" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.12">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -372,9 +376,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3CD87A6D" name="n192.168.1.13">
-          <Interface id="id3CD87A6D-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3CD87A6D-i-1-addr" name="address" address="192.168.1.13" netmask="255.255.255.255"/>
+        <Host id="id3CD87A6D" name="n192.168.1.13" comment="">
+          <Interface id="id3CD87A6D-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3CD87A6D-i-1-addr" name="address" comment="" address="192.168.1.13" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.13">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -389,9 +393,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3CD87A7C" name="n192.168.1.14">
-          <Interface id="id3CD87A7C-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3CD87A7C-i-1-addr" name="address" address="192.168.1.14" netmask="255.255.255.255"/>
+        <Host id="id3CD87A7C" name="n192.168.1.14" comment="">
+          <Interface id="id3CD87A7C-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3CD87A7C-i-1-addr" name="address" comment="" address="192.168.1.14" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.14">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -406,9 +410,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3CD87A8B" name="n192.168.1.15">
-          <Interface id="id3CD87A8B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3CD87A8B-i-1-addr" name="address" address="192.168.1.15" netmask="255.255.255.255"/>
+        <Host id="id3CD87A8B" name="n192.168.1.15" comment="">
+          <Interface id="id3CD87A8B-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3CD87A8B-i-1-addr" name="address" comment="" address="192.168.1.15" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.15">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -423,9 +427,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3D58118B" name="hostC">
-          <Interface id="id3D58118B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3D58118B-i-1-addr" name="address" address="192.168.1.100" netmask="255.255.255.255"/>
+        <Host id="id3D58118B" name="hostC" comment="">
+          <Interface id="id3D58118B-i" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface-1" comment="">
+            <IPv4 id="id3D58118B-i-1-addr" name="address" comment="" address="192.168.1.100" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.100">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -440,9 +444,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3D58118F" name="hostC-1">
-          <Interface id="id3D581193" name="eth0" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3D581194" name="hostC-1:eth0" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Host id="id3D58118F" name="hostC-1" comment="">
+          <Interface id="id3D581193" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="">
+            <IPv4 id="id3D581194" name="hostC-1:eth0" comment="" address="192.168.1.100" netmask="255.255.255.0"/>
           </Interface>
           <Management address="192.168.1.100">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -457,9 +461,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host id="id3E7ABEC4" name="nat-addr1">
-          <Interface id="id3E7ABEC6" name="interface1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3E7ABEC7" name="nat-addr1:interface1(ip)" address="22.22.22.50" netmask="255.255.255.255"/>
+        <Host id="id3E7ABEC4" name="nat-addr1" comment="">
+          <Interface id="id3E7ABEC6" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface1" comment="">
+            <IPv4 id="id3E7ABEC7" name="nat-addr1:interface1(ip)" comment="" address="22.22.22.50" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -470,9 +474,9 @@
             <Option name="use_mac_addr">false</Option>
           </HostOptions>
         </Host>
-        <Host id="id3E7ABECA" name="nat-addr2">
-          <Interface id="id3E7ABECC" name="interface1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-            <IPv4 id="id3E7ABECD" name="nat-addr2:interface1(ip)" address="22.22.22.51" netmask="255.255.255.255"/>
+        <Host id="id3E7ABECA" name="nat-addr2" comment="">
+          <Interface id="id3E7ABECC" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="interface1" comment="">
+            <IPv4 id="id3E7ABECD" name="nat-addr2:interface1(ip)" comment="" address="22.22.22.51" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -483,8 +487,8 @@
             <Option name="use_mac_addr">false</Option>
           </HostOptions>
         </Host>
-        <Host id="id3EE25A56" name="dyn host">
-          <Interface id="id3EE25A58" name="eth0" bridgeport="False" dyn="True" security_level="0" unnum="False" unprotected="False"/>
+        <Host id="id3EE25A56" name="dyn host" comment="">
+          <Interface id="id3EE25A58" bridgeport="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="eth0" comment=""/>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
             <FWBDManagement enabled="False" identity="" port="-1"/>
@@ -495,44 +499,44 @@
           </HostOptions>
         </Host>
       </ObjectGroup>
-      <ObjectGroup id="stdid03_1" name="Networks">
-        <Network id="net-Internal_net" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="stdid03_1" name="Networks" comment="">
+        <Network id="net-Internal_net" name="Internal_net" comment="" address="192.168.1.0" netmask="255.255.255.0"/>
         <Network id="id3B022266" name="dmz_net" comment="DMZ net - using NAT" address="192.168.2.0" netmask="255.255.255.0"/>
-        <Network id="id3B665641" name="external_net" address="22.22.22.0" netmask="255.255.255.0"/>
-        <Network id="id3B665643" name="foreign_net" address="33.33.33.0" netmask="255.255.255.0"/>
-        <Network id="id3FDCD983" name="foreign_net2" address="33.33.44.0" netmask="255.255.255.0"/>
-        <Network id="id43F7DCF631316" name="22.22.22/28" address="22.22.22.0" netmask="255.255.255.240"/>
-        <NetworkIPv6 id="id4834B9206131" name="net-fe80" address="fe80::" netmask="64"/>
-        <NetworkIPv6 id="id48416A7016880" name="DIGITAL-CA-DEC" address="3ffe:1200:2000::" netmask="36"/>
-        <Network id="id3CEBFDFC" name="n-192.168.1.0" address="192.168.1.0" netmask="255.255.255.0"/>
-        <Network id="id4733FFE419714" name="n-192.168.2.0" address="192.168.2.0" netmask="255.255.255.0"/>
+        <Network id="id3B665641" name="external_net" comment="" address="22.22.22.0" netmask="255.255.255.0"/>
+        <Network id="id3B665643" name="foreign_net" comment="" address="33.33.33.0" netmask="255.255.255.0"/>
+        <Network id="id3FDCD983" name="foreign_net2" comment="" address="33.33.44.0" netmask="255.255.255.0"/>
+        <Network id="id43F7DCF631316" name="22.22.22/28" comment="" address="22.22.22.0" netmask="255.255.255.240"/>
+        <NetworkIPv6 id="id4834B9206131" name="net-fe80" comment="" address="fe80::" netmask="64"/>
+        <NetworkIPv6 id="id48416A7016880" name="DIGITAL-CA-DEC" comment="" address="3ffe:1200:2000::" netmask="36"/>
+        <Network id="id3CEBFDFC" name="n-192.168.1.0" comment="" address="192.168.1.0" netmask="255.255.255.0"/>
+        <Network id="id4733FFE419714" name="n-192.168.2.0" comment="" address="192.168.2.0" netmask="255.255.255.0"/>
       </ObjectGroup>
-      <ObjectGroup id="stdid15_1" name="Address Ranges">
-        <AddressRange id="id3CD8769F" name="test_range_1" start_address="192.168.1.11" end_address="192.168.1.15"/>
-        <AddressRange id="id43F7DCF831316" name="22.22.22.1-22.22.22.5" start_address="22.22.22.1" end_address="22.22.22.5"/>
+      <ObjectGroup id="stdid15_1" name="Address Ranges" comment="">
+        <AddressRange id="id3CD8769F" name="test_range_1" comment="" start_address="192.168.1.11" end_address="192.168.1.15"/>
+        <AddressRange id="id43F7DCF831316" name="22.22.22.1-22.22.22.5" comment="" start_address="22.22.22.1" end_address="22.22.22.5"/>
       </ObjectGroup>
-      <ObjectGroup id="id4386458A18448" name="DNS Names">
-        <DNSName id="id43869E8E18346" name="buildmaster (ct)" comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" run_time="False"/>
-        <DNSName id="id43869E8F18346" name="buildmaster (rt)" comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" run_time="True"/>
-        <DNSName id="id43869E8C18346" name="cnn (ct)" dnsrec="www.cnn.com" dnsrectype="A" run_time="False"/>
-        <DNSName id="id43869E8D18346" name="cnn (rt)" dnsrec="www.cnn.com" dnsrectype="A" run_time="True"/>
-        <DNSName id="id4387287918346" name="google (ct)" dnsrec="www.google.com" dnsrectype="A" run_time="False"/>
-        <DNSName id="id4387287A18346" name="google (rt)" dnsrec="www.google.com" dnsrectype="A" run_time="True"/>
-        <DNSName id="id44EC181D8791" name="heise" dnsrec="www.heise.de" dnsrectype="A" run_time="True"/>
+      <ObjectGroup id="id4386458A18448" name="DNS Names" comment="">
+        <DNSName id="id43869E8E18346" dnsrec="buildmaster" dnsrectype="A" run_time="False" name="buildmaster (ct)" comment="an example of a local host"/>
+        <DNSName id="id43869E8F18346" dnsrec="buildmaster" dnsrectype="A" run_time="True" name="buildmaster (rt)" comment="an example of a local host"/>
+        <DNSName id="id43869E8C18346" dnsrec="www.cnn.com" dnsrectype="A" run_time="False" name="cnn (ct)" comment=""/>
+        <DNSName id="id43869E8D18346" dnsrec="www.cnn.com" dnsrectype="A" run_time="True" name="cnn (rt)" comment=""/>
+        <DNSName id="id4387287918346" dnsrec="www.google.com" dnsrectype="A" run_time="False" name="google (ct)" comment=""/>
+        <DNSName id="id4387287A18346" dnsrec="www.google.com" dnsrectype="A" run_time="True" name="google (rt)" comment=""/>
+        <DNSName id="id44EC181D8791" dnsrec="www.heise.de" dnsrectype="A" run_time="True" name="heise" comment=""/>
       </ObjectGroup>
     </ObjectGroup>
-    <ServiceGroup id="stdid05_1" name="Services">
-      <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
-        <TagService id="id43EC6B892355" name="ipsec_tag" tagcode="ipsec_tag"/>
-        <TagService id="id43F4556A28869" name="INTNET" tagcode="INTNET"/>
-        <TagService id="id1391120443" name="tag2" tagcode="tag2"/>
+    <ServiceGroup id="stdid05_1" name="Services" comment="">
+      <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices" comment="">
+        <TagService id="id43EC6B892355" tagcode="ipsec_tag" name="ipsec_tag" comment=""/>
+        <TagService id="id43F4556A28869" tagcode="INTNET" name="INTNET" comment=""/>
+        <TagService id="id1391120443" tagcode="tag2" name="tag2" comment=""/>
       </ServiceGroup>
-      <ServiceGroup id="stdid10_1" name="Groups">
-        <ServiceGroup id="id3B457567" name="svcgroup1">
+      <ServiceGroup id="stdid10_1" name="Groups" comment="">
+        <ServiceGroup id="id3B457567" name="svcgroup1" comment="">
           <ServiceRef ref="id3B457561"/>
           <ServiceRef ref="ip-IPSEC"/>
         </ServiceGroup>
-        <ServiceGroup id="id3C1A66C9" name="large group TCP">
+        <ServiceGroup id="id3C1A66C9" name="large group TCP" comment="">
           <ServiceRef ref="id3B20468D"/>
           <ServiceRef ref="tcp-IRC"/>
           <ServiceRef ref="id3B5009F7"/>
@@ -571,7 +575,7 @@
           <ServiceRef ref="id3AEDBE00"/>
           <ServiceRef ref="id3B4FF1B8"/>
         </ServiceGroup>
-        <ServiceGroup id="id3CD878C8" name="small group TCP">
+        <ServiceGroup id="id3CD878C8" name="small group TCP" comment="">
           <ServiceRef ref="tcp-Auth"/>
           <ServiceRef ref="tcp-HTTP"/>
           <ServiceRef ref="tcp-SMTP"/>
@@ -580,35 +584,35 @@
           <ServiceRef ref="id3B4FED69"/>
           <ServiceRef ref="id3AECF776"/>
         </ServiceGroup>
-        <ServiceGroup id="id3DE6946C" name="sgroup"/>
+        <ServiceGroup id="id3DE6946C" name="sgroup" comment=""/>
       </ServiceGroup>
-      <ServiceGroup id="stdid07_1" name="ICMP">
-        <ICMPService id="id3C1A5D46" name="any ICMP" code="-1" type="-1"/>
-        <ICMPService id="id3D0E95E4" name="Any unreach." code="-1" type="3"/>
+      <ServiceGroup id="stdid07_1" name="ICMP" comment="">
+        <ICMPService id="id3C1A5D46" code="-1" type="-1" name="any ICMP" comment=""/>
+        <ICMPService id="id3D0E95E4" code="-1" type="3" name="Any unreach." comment=""/>
       </ServiceGroup>
-      <ServiceGroup id="stdid06_1" name="IP">
-        <IPService id="id3B457561" name="ICMP" fragm="False" lsrr="False" protocol_num="1" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService id="id3B6659A5" name="TS" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="True"/>
-        <IPService id="id3C6820443" name="tos 0x20" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x20" ts="False"/>
-        <IPService id="id3C6920443" name="dscp 0x20" dscp="0x20" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="" ts="False"/>
-        <IPService id="idC5F120443" name="tos 0x10" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x10" ts="False"/>
+      <ServiceGroup id="stdid06_1" name="IP" comment="">
+        <IPService id="id3B457561" fragm="False" lsrr="False" protocol_num="1" rr="False" short_fragm="False" ssrr="False" ts="False" name="ICMP" comment=""/>
+        <IPService id="id3B6659A5" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="True" name="TS" comment=""/>
+        <IPService id="id3C6820443" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x20" ts="False" name="tos 0x20" comment=""/>
+        <IPService id="id3C6920443" dscp="0x20" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="" ts="False" name="dscp 0x20" comment=""/>
+        <IPService id="idC5F120443" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x10" ts="False" name="tos 0x10" comment=""/>
       </ServiceGroup>
-      <ServiceGroup id="stdid09_1" name="TCP">
-        <TCPService id="tcp-IRC" name="irc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
-        <TCPService id="id3B20468D" name="test-TCP" comment="port range" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="10000" dst_range_end="11000"/>
-        <TCPService id="id3B5009F7" name="squid" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
-        <TCPService id="id3B58E3F1" name="xmas-tree" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
-        <TCPService id="id3C1A66EF" name="gopher" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="70" dst_range_end="70"/>
-        <TCPService id="id3E59AD29" name="tcp-1080" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
+      <ServiceGroup id="stdid09_1" name="TCP" comment="">
+        <TCPService id="tcp-IRC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
+        <TCPService id="id3B20468D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="test-TCP" comment="port range" src_range_start="0" src_range_end="0" dst_range_start="10000" dst_range_end="11000"/>
+        <TCPService id="id3B5009F7" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
+        <TCPService id="id3B58E3F1" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="xmas-tree" comment="" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id3C1A66EF" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="gopher" comment="" src_range_start="0" src_range_end="0" dst_range_start="70" dst_range_end="70"/>
+        <TCPService id="id3E59AD29" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp-1080" comment="" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid08_1" name="UDP"/>
-      <ServiceGroup id="stdid13_1" name="Custom">
+      <ServiceGroup id="stdid08_1" name="UDP" comment=""/>
+      <ServiceGroup id="stdid13_1" name="Custom" comment="">
         <CustomService id="id3B64FE22" name="talk" comment="Talk support">
           <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
           <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
         </CustomService>
-        <CustomService id="id41F9FFBA" name="natproto">
+        <CustomService id="id41F9FFBA" name="natproto" comment="">
           <CustomServiceCommand platform="ipf"></CustomServiceCommand>
           <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables"></CustomServiceCommand>
@@ -617,16 +621,16 @@
           <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
-      <ServiceGroup id="stdid05_1_userservices" name="Users">
-        <UserService id="id4849253820246" name="user2000" userid="2000"/>
-        <UserService id="id484A558E5896" name="user500" userid="500"/>
-        <UserService id="id484A6C525896" name="proxy" userid="proxy"/>
+      <ServiceGroup id="stdid05_1_userservices" name="Users" comment="">
+        <UserService id="id4849253820246" name="user2000" comment="" userid="2000"/>
+        <UserService id="id484A558E5896" name="user500" comment="" userid="500"/>
+        <UserService id="id484A6C525896" name="proxy" comment="" userid="proxy"/>
       </ServiceGroup>
     </ServiceGroup>
-    <ObjectGroup id="stdid12_1" name="Firewalls">
-      <Firewall id="fw-firewall2" name="firewall" comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" host_OS="openbsd" inactive="False" lastCompiled="1157930800" lastInstalled="0" lastModified="1202682308" platform="pf" ro="False" version="">
-        <NAT id="nat-firewall2" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="nat-firewall2-0" disabled="False" position="0">
+    <ObjectGroup id="stdid12_1" name="Firewalls" comment="">
+      <Firewall id="fw-firewall2" host_OS="openbsd" inactive="False" lastCompiled="1157930800" lastInstalled="0" lastModified="1202682308" platform="pf" ro="False" version="" name="firewall" comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule">
+        <NAT id="nat-firewall2" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="nat-firewall2-0" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -647,7 +651,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3EE25AA2" comment="illegal rule - host 'dyn host' has dynamic address" disabled="True" position="1">
+          <NATRule id="id3EE25AA2" disabled="True" position="1" comment="illegal rule - host 'dyn host' has dynamic address">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -668,7 +672,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="nat-firewall2-1" disabled="False" position="2">
+          <NATRule id="nat-firewall2-1" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -689,7 +693,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CDB43B8" disabled="False" position="3">
+          <NATRule id="id3CDB43B8" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -711,8 +715,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="pol-firewall2" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B09D29D" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+        <Policy id="pol-firewall2" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3B09D29D" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -729,7 +733,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-0" comment="Automatically generated rule blocking short fragments" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
+          <PolicyRule id="pol-firewall2-0" action="Deny" direction="Inbound" disabled="False" log="True" position="1" comment="Automatically generated rule blocking short fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -749,7 +753,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-1" comment="Automatically generated anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
+          <PolicyRule id="pol-firewall2-1" action="Deny" direction="Inbound" disabled="False" log="True" position="2" comment="Automatically generated anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -770,7 +774,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B92DFC5" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id3B92DFC5" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -785,7 +789,7 @@
             </Itf>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3C4E4C38" comment="code should go into INPUT chain with &#10;address in destination for comparison" action="Deny" direction="Inbound" disabled="False" log="True" position="4">
+          <PolicyRule id="id3C4E4C38" action="Deny" direction="Inbound" disabled="False" log="True" position="4" comment="code should go into INPUT chain with &#10;address in destination for comparison">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -802,7 +806,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CE59C76" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id3CE59C76" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -827,7 +831,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B6659FC" action="Deny" direction="Both" disabled="False" log="True" position="6">
+          <PolicyRule id="id3B6659FC" action="Deny" direction="Both" disabled="False" log="True" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -849,7 +853,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B45E" action="Accept" direction="Both" disabled="True" log="False" position="7">
+          <PolicyRule id="id3BF1B45E" action="Accept" direction="Both" disabled="True" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E1"/>
             </Src>
@@ -872,7 +876,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B44E" action="Accept" direction="Both" disabled="True" log="False" position="8">
+          <PolicyRule id="id3BF1B44E" action="Accept" direction="Both" disabled="True" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E7"/>
             </Src>
@@ -895,7 +899,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-3" comment="this rule is limited to 4 simultaneous&#10;connections by rule options" action="Accept" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="pol-firewall2-3" action="Accept" direction="Both" disabled="False" log="False" position="9" comment="this rule is limited to 4 simultaneous&#10;connections by rule options">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
@@ -923,7 +927,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4250E683" action="Accept" direction="Both" disabled="False" log="False" position="10">
+          <PolicyRule id="id4250E683" action="Accept" direction="Both" disabled="False" log="False" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -952,7 +956,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-2" action="Accept" direction="Both" disabled="False" log="False" position="11">
+          <PolicyRule id="pol-firewall2-2" action="Accept" direction="Both" disabled="False" log="False" position="11" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -989,7 +993,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD8770E" action="Accept" direction="Both" disabled="False" log="False" position="12">
+          <PolicyRule id="id3CD8770E" action="Accept" direction="Both" disabled="False" log="False" position="12" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1018,7 +1022,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD87B1E" comment="testing rule shading - this rule is exactly &#10;the same as pervious one, but uses group &#10;instead of address range" action="Accept" direction="Both" disabled="True" log="False" position="13">
+          <PolicyRule id="id3CD87B1E" action="Accept" direction="Both" disabled="True" log="False" position="13" comment="testing rule shading - this rule is exactly &#10;the same as pervious one, but uses group &#10;instead of address range">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1042,7 +1046,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-4" action="Accept" direction="Both" disabled="False" log="False" position="14">
+          <PolicyRule id="pol-firewall2-4" action="Accept" direction="Both" disabled="False" log="False" position="14" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1066,7 +1070,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CE597E3" comment="this rule and the next one can be&#10;used to test shading" action="Accept" direction="Both" disabled="True" log="False" position="15">
+          <PolicyRule id="id3CE597E3" action="Accept" direction="Both" disabled="True" log="False" position="15" comment="this rule and the next one can be&#10;used to test shading">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1089,7 +1093,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CE591F6" action="Accept" direction="Both" disabled="False" log="False" position="16">
+          <PolicyRule id="id3CE591F6" action="Accept" direction="Both" disabled="False" log="False" position="16" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1112,7 +1116,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3EE2579E" comment="illegal rule - object firewall8 has&#10;dynamic interface" action="Accept" direction="Both" disabled="True" log="False" position="17">
+          <PolicyRule id="id3EE2579E" action="Accept" direction="Both" disabled="True" log="False" position="17" comment="illegal rule - object firewall8 has&#10;dynamic interface">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D581152"/>
@@ -1132,7 +1136,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-5" comment="Automatically generated 'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="18">
+          <PolicyRule id="pol-firewall2-5" action="Accept" direction="Both" disabled="False" log="False" position="18" comment="Automatically generated 'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -1156,7 +1160,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-7" comment="Automatically generated 'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="19">
+          <PolicyRule id="pol-firewall2-7" action="Deny" direction="Both" disabled="False" log="True" position="19" comment="Automatically generated 'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1182,15 +1186,15 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="fw-firewall2-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="if-FW-firewall2-eth1" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="if-FW-firewall2-eth1-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
+        <Routing id="fw-firewall2-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="if-FW-firewall2-eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="if-FW-firewall2-eth1-ipv4" name="address" comment="" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="if-FW-firewall2-eth0" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="if-FW-firewall2-eth0-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="if-FW-firewall2-eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="if-FW-firewall2-eth0-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3E5F1D39" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3E5F1D3B" name="firewall:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F1D39" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3E5F1D3B" name="firewall:lo(ip)" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -1318,9 +1322,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy rules&#10;Also using interface policy on eth1 to test specific case with negation and&#10;rule shading depection&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930802" lastInstalled="0" lastModified="1200415171" platform="pf" ro="False" version="">
-        <NAT id="id3AF5AA0D" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3C98491C" disabled="False" position="0">
+      <Firewall id="id3AF5AA0A" host_OS="openbsd" inactive="False" lastCompiled="1157930802" lastInstalled="0" lastModified="1200415171" platform="pf" ro="False" version="" name="firewall1" comment="this object is used to test all kinds of negation in policy rules&#10;Also using interface policy on eth1 to test specific case with negation and&#10;rule shading depection&#10;">
+        <NAT id="id3AF5AA0D" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3C98491C" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1341,7 +1345,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFADC09" disabled="False" position="1">
+          <NATRule id="id3AFADC09" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1362,7 +1366,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CD23959" disabled="False" position="2">
+          <NATRule id="id3CD23959" disabled="False" position="2" comment="">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1383,7 +1387,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B1328FB" disabled="False" position="3">
+          <NATRule id="id3B1328FB" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1404,7 +1408,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E7ABBCD" disabled="False" position="4">
+          <NATRule id="id3E7ABBCD" disabled="False" position="4" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1426,7 +1430,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E7ABFA4" comment="more examples&#10;of NAT rules with&#10;multiple objects in TSrc&#10;in firewall3" disabled="False" position="5">
+          <NATRule id="id3E7ABFA4" disabled="False" position="5" comment="more examples&#10;of NAT rules with&#10;multiple objects in TSrc&#10;in firewall3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1448,7 +1452,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AF5AAD3" disabled="False" position="6">
+          <NATRule id="id3AF5AAD3" disabled="False" position="6" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1469,7 +1473,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CCA1B57" disabled="False" position="7">
+          <NATRule id="id3CCA1B57" disabled="False" position="7" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1490,7 +1494,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B50F7CB" disabled="False" position="8">
+          <NATRule id="id3B50F7CB" disabled="False" position="8" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B022266"/>
             </OSrc>
@@ -1511,7 +1515,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D94B" disabled="False" position="9">
+          <NATRule id="id3BD8D94B" disabled="False" position="9" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1532,7 +1536,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D9DD" disabled="False" position="10">
+          <NATRule id="id3BD8D9DD" disabled="False" position="10" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1553,7 +1557,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0EA4" disabled="False" position="11">
+          <NATRule id="id3BBC0EA4" disabled="False" position="11" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1574,7 +1578,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0F93" disabled="False" position="12">
+          <NATRule id="id3BBC0F93" disabled="False" position="12" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1595,7 +1599,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BC6BCE5" disabled="False" position="13">
+          <NATRule id="id3BC6BCE5" disabled="False" position="13" comment="">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1616,7 +1620,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3FDCD893" disabled="False" position="14">
+          <NATRule id="id3FDCD893" disabled="False" position="14" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3B665643"/>
               <ObjectRef ref="id3FDCD983"/>
@@ -1639,8 +1643,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3AF5AA0C" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C5987DC" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id3AF5AA0C" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3C5987DC" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -1657,7 +1661,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD34BEF" action="Deny" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id3CD34BEF" action="Deny" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </Src>
@@ -1677,7 +1681,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAB4" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
+          <PolicyRule id="id3AF5AAB4" action="Deny" direction="Inbound" disabled="False" log="True" position="2" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1695,7 +1699,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAAB" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="3">
+          <PolicyRule id="id3AF5AAAB" action="Deny" direction="Outbound" disabled="False" log="True" position="3" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -1712,7 +1716,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D58886F" comment="testing rule shading: this rule is not&#10;shaded by rule #1" action="Accept" direction="Inbound" disabled="False" log="False" position="4">
+          <PolicyRule id="id3D58886F" action="Accept" direction="Inbound" disabled="False" log="False" position="4" comment="testing rule shading: this rule is not&#10;shaded by rule #1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1730,7 +1734,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3CCA26E4" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id3CCA26E4" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1750,7 +1754,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B9AB902" action="Deny" direction="Both" disabled="True" log="True" position="6">
+          <PolicyRule id="id3B9AB902" action="Deny" direction="Both" disabled="True" log="True" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1770,7 +1774,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFC0F90" comment="hostF has the same IP address as firewal." action="Accept" direction="Both" disabled="False" log="True" position="7">
+          <PolicyRule id="id3AFC0F90" action="Accept" direction="Both" disabled="False" log="True" position="7" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1788,7 +1792,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4119961C" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="8">
+          <PolicyRule id="id4119961C" action="Deny" direction="Both" disabled="False" log="True" position="8" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -1812,7 +1816,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E10" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="9">
+          <PolicyRule id="id3B021E10" action="Deny" direction="Both" disabled="False" log="True" position="9" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1837,7 +1841,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0B4A13" comment="this rule is shaded by rule above." action="Deny" direction="Both" disabled="False" log="True" position="10">
+          <PolicyRule id="id3B0B4A13" action="Deny" direction="Both" disabled="False" log="True" position="10" comment="this rule is shaded by rule above.">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1858,7 +1862,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B5535B7" comment="this rule shades rule below" action="Deny" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id3B5535B7" action="Deny" direction="Both" disabled="False" log="True" position="11" comment="this rule shades rule below">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1879,7 +1883,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B11F63D" action="Deny" direction="Both" disabled="False" log="True" position="12">
+          <PolicyRule id="id3B11F63D" action="Deny" direction="Both" disabled="False" log="True" position="12" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -1901,7 +1905,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id41199643" comment="testing negation in the policy rule" action="Reject" direction="Both" disabled="False" log="True" position="13">
+          <PolicyRule id="id41199643" action="Reject" direction="Both" disabled="False" log="True" position="13" comment="testing negation in the policy rule">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -1925,7 +1929,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E6F" comment="testing negation in service field" action="Deny" direction="Both" disabled="True" log="True" position="14">
+          <PolicyRule id="id3B021E6F" action="Deny" direction="Both" disabled="True" log="True" position="14" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1947,7 +1951,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CCA2CF4" comment="testing negation in service field" action="Accept" direction="Both" disabled="True" log="True" position="15">
+          <PolicyRule id="id3CCA2CF4" action="Accept" direction="Both" disabled="True" log="True" position="15" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1967,7 +1971,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3B45739A" action="Deny" direction="Both" disabled="False" log="True" position="16">
+          <PolicyRule id="id3B45739A" action="Deny" direction="Both" disabled="False" log="True" position="16" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -1987,7 +1991,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAC8" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="17">
+          <PolicyRule id="id3AF5AAC8" action="Accept" direction="Both" disabled="False" log="False" position="17" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2005,7 +2009,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAE3" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="18">
+          <PolicyRule id="id3AF5AAE3" action="Deny" direction="Both" disabled="False" log="True" position="18" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2026,21 +2030,21 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3AF5AA0A-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3AF5AA96" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3AF5AA96-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3AF5AA0A-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3AF5AA96" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3AF5AA96-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3AF5AA99" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3AF5AA99-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3AF5AA99" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3AF5AA99-ipv4" name="address" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3B0B4BC8" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0B4BC8-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id3B0B4BC8" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="">
+          <IPv4 id="id3B0B4BC8-ipv4" name="address" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3B0B4D35" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0B4D35-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3B0B4D35" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3B0B4D35-ipv4" name="address" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id3B11F434" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3B11F434-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        <Interface id="id3B11F434" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="">
+          <IPv4 id="id3B11F434-ipv4" name="address" comment="" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -2165,9 +2169,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3DE69291" name="firewall13" comment="testing detection of empty groups" host_OS="openbsd" inactive="False" lastCompiled="1157930804" lastInstalled="0" lastModified="1193632387" platform="pf" ro="False" version="">
-        <NAT id="id3DE69292" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3DE69752" disabled="False" position="0">
+      <Firewall id="id3DE69291" host_OS="openbsd" inactive="False" lastCompiled="1157930804" lastInstalled="0" lastModified="1193632387" platform="pf" ro="False" version="" name="firewall13" comment="testing detection of empty groups">
+        <NAT id="id3DE69292" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3DE69752" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DE69469"/>
             </OSrc>
@@ -2188,7 +2192,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DE697CD" disabled="False" position="1">
+          <NATRule id="id3DE697CD" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DE69469"/>
               <ObjectRef ref="id3B19C5EB"/>
@@ -2210,7 +2214,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DE69866" disabled="False" position="2">
+          <NATRule id="id3DE69866" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2232,8 +2236,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3DE692BD" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3DE6946F" action="Accept" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id3DE692BD" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3DE6946F" action="Accept" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DE6946A"/>
               <ObjectRef ref="id3B19C5EB"/>
@@ -2252,7 +2256,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3DE6947B" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id3DE6947B" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2270,7 +2274,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3DE69487" action="Deny" direction="Both" disabled="False" log="True" position="2">
+          <PolicyRule id="id3DE69487" action="Deny" direction="Both" disabled="False" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2291,12 +2295,12 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3DE69291-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3DE6935E" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3DE6935F" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Routing id="id3DE69291-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3DE6935E" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3DE6935F" name="address" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3DE6937E" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3DE6937F" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id3DE6937E" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3DE6937F" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -2370,9 +2374,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3AFB66C6" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " host_OS="openbsd" inactive="False" lastCompiled="1157930805" lastInstalled="0" lastModified="1215407591" platform="pf" ro="False" version="">
-        <NAT id="id3AFB66C7" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3AFB66C8" disabled="False" position="0">
+      <Firewall id="id3AFB66C6" host_OS="openbsd" inactive="False" lastCompiled="1157930805" lastInstalled="0" lastModified="1215407591" platform="pf" ro="False" version="" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options ">
+        <NAT id="id3AFB66C7" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3AFB66C8" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2396,7 +2400,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3AFB66D6" disabled="False" position="1">
+          <NATRule id="id3AFB66D6" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2421,7 +2425,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3CABE6DF" disabled="False" position="2">
+          <NATRule id="id3CABE6DF" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2445,7 +2449,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A827" disabled="False" position="3">
+          <NATRule id="id40E9A827" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2469,7 +2473,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A83B" disabled="False" position="4">
+          <NATRule id="id40E9A83B" disabled="False" position="4" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2494,7 +2498,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A850" disabled="False" position="5">
+          <NATRule id="id40E9A850" disabled="False" position="5" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2518,7 +2522,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A8DE" disabled="False" position="6">
+          <NATRule id="id40E9A8DE" disabled="False" position="6" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2542,7 +2546,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A8F2" disabled="False" position="7">
+          <NATRule id="id40E9A8F2" disabled="False" position="7" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2567,7 +2571,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id40E9A907" disabled="False" position="8">
+          <NATRule id="id40E9A907" disabled="False" position="8" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2591,7 +2595,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id431BEFED" disabled="False" position="9">
+          <NATRule id="id431BEFED" disabled="False" position="9" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2612,7 +2616,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69BD" disabled="False" position="10">
+          <NATRule id="id3AFB69BD" disabled="False" position="10" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2634,7 +2638,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BEEF6D2" disabled="False" position="11">
+          <NATRule id="id3BEEF6D2" disabled="False" position="11" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2655,7 +2659,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD67563" disabled="False" position="12">
+          <NATRule id="id3BD67563" disabled="False" position="12" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostB"/>
             </OSrc>
@@ -2678,7 +2682,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3BD6757E" disabled="True" position="13">
+          <NATRule id="id3BD6757E" disabled="True" position="13" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2699,7 +2703,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B66568B" comment="NETMAP " disabled="True" position="14">
+          <NATRule id="id3B66568B" disabled="True" position="14" comment="NETMAP ">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2720,7 +2724,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B6656EF" comment="NETMAP" disabled="True" position="15">
+          <NATRule id="id3B6656EF" disabled="True" position="15" comment="NETMAP">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2741,7 +2745,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id431C0728" disabled="False" position="16">
+          <NATRule id="id431C0728" disabled="False" position="16" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2762,7 +2766,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id431C0714" disabled="False" position="17">
+          <NATRule id="id431C0714" disabled="False" position="17" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2783,7 +2787,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id431C0700" disabled="False" position="18">
+          <NATRule id="id431C0700" disabled="False" position="18" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2804,7 +2808,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id431C355F" disabled="False" position="19">
+          <NATRule id="id431C355F" disabled="False" position="19" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2825,7 +2829,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69F7" disabled="False" position="20">
+          <NATRule id="id3AFB69F7" disabled="False" position="20" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2846,7 +2850,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id414BEA12" disabled="False" position="21">
+          <NATRule id="id414BEA12" disabled="False" position="21" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2867,7 +2871,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id414BEC22" disabled="False" position="22">
+          <NATRule id="id414BEC22" disabled="False" position="22" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2888,7 +2892,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id546F21844" disabled="False" group="" position="23">
+          <NATRule id="id546F21844" disabled="False" group="" position="23" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2909,7 +2913,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B7313C4" disabled="False" position="24">
+          <NATRule id="id3B7313C4" disabled="False" position="24" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2930,7 +2934,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E59ADF3" disabled="False" position="25">
+          <NATRule id="id3E59ADF3" disabled="False" position="25" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2951,7 +2955,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id40ECF000" disabled="False" position="26">
+          <NATRule id="id40ECF000" disabled="False" position="26" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2972,7 +2976,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E59AC6D" disabled="False" position="27">
+          <NATRule id="id3E59AC6D" disabled="False" position="27" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2993,7 +2997,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id41F9FFBB" disabled="False" position="28">
+          <NATRule id="id41F9FFBB" disabled="False" position="28" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3014,7 +3018,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id41FA0A82" disabled="False" position="29">
+          <NATRule id="id41FA0A82" disabled="False" position="29" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3039,8 +3043,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3AFB66E4" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id41451D62" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+        <Policy id="id3AFB66E4" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id41451D62" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3060,7 +3064,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB6708" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id3AFB6708" action="Deny" direction="Inbound" disabled="False" log="True" position="1" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3082,7 +3086,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id465385F321432" comment="rules 2,3,4 test group&#10;usage in interface&#10;all three rules should yield&#10;the same config" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
+          <PolicyRule id="id465385F321432" action="Deny" direction="Inbound" disabled="False" log="True" position="2" comment="rules 2,3,4 test group&#10;usage in interface&#10;all three rules should yield&#10;the same config">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3107,7 +3111,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4653B74421432" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="3">
+          <PolicyRule id="id4653B74421432" action="Deny" direction="Inbound" disabled="False" log="True" position="3" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3133,7 +3137,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4653860421432" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="4">
+          <PolicyRule id="id4653860421432" action="Deny" direction="Inbound" disabled="False" log="True" position="4" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3159,7 +3163,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB6710" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="5">
+          <PolicyRule id="id3AFB6710" action="Deny" direction="Outbound" disabled="False" log="True" position="5" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3181,7 +3185,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66E5" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="6">
+          <PolicyRule id="id3AFB66E5" action="Deny" direction="Both" disabled="False" log="True" position="6" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3202,7 +3206,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C6FD2" comment="sends TCP RST and makes custom record in the log" action="Reject" direction="Both" disabled="False" log="True" position="7">
+          <PolicyRule id="id3B0C6FD2" action="Reject" direction="Both" disabled="False" log="True" position="7" comment="sends TCP RST and makes custom record in the log">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3226,7 +3230,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D8FEDA9" action="Accept" direction="Both" disabled="False" log="False" position="8">
+          <PolicyRule id="id3D8FEDA9" action="Accept" direction="Both" disabled="False" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FED30"/>
@@ -3245,7 +3249,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D8FEE11" action="Accept" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="id3D8FEE11" action="Accept" direction="Both" disabled="False" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
             </Src>
@@ -3264,7 +3268,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AFB66EF" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="10">
+          <PolicyRule id="id3AFB66EF" action="Accept" direction="Both" disabled="False" log="False" position="10" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3284,7 +3288,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447B8D" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces" action="Accept" direction="Both" disabled="True" log="True" position="11">
+          <PolicyRule id="id3C447B8D" action="Accept" direction="Both" disabled="True" log="True" position="11" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3302,7 +3306,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3C447BCB" action="Accept" direction="Both" disabled="False" log="False" position="12">
+          <PolicyRule id="id3C447BCB" action="Accept" direction="Both" disabled="False" log="False" position="12" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3323,7 +3327,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AFB66F9" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="13">
+          <PolicyRule id="id3AFB66F9" action="Deny" direction="Both" disabled="False" log="True" position="13" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3345,21 +3349,21 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3AFB66C6-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3AFB6703" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3AFB6703-ipv4" name="fw2:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3AFB66C6-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3AFB6703" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3AFB6703-ipv4" name="fw2:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3AFB6706" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3AFB6706-ipv4" name="fw2:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3AFB6706" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3AFB6706-ipv4" name="fw2:eth1:ip" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3AFB68D2" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3AFB68D2-ipv4" name="fw2:eth3:ip" address="22.22.23.23" netmask="255.255.255.0"/>
+        <Interface id="id3AFB68D2" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="">
+          <IPv4 id="id3AFB68D2-ipv4" name="fw2:eth3:ip" comment="" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3B0221F1" name="eth2" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0221F1-ipv4" name="fw2:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id3B0221F1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth2" comment="">
+          <IPv4 id="id3B0221F1-ipv4" name="fw2:eth2:ip" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3CD2449F" name="lo" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3CD2449F-ipv4" name="lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3CD2449F" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3CD2449F-ipv4" name="lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="192.168.2.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -3493,9 +3497,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3B0C6380" name="firewall4" comment="this object is used to test a configuration where firewall has dynamic address " host_OS="openbsd" inactive="False" lastCompiled="1157930815" lastInstalled="0" lastModified="1200415196" platform="pf" ro="False" version="">
-        <NAT id="id3B0C6381" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3B0C6382" disabled="False" position="0">
+      <Firewall id="id3B0C6380" host_OS="openbsd" inactive="False" lastCompiled="1157930815" lastInstalled="0" lastModified="1219936397" platform="pf" ro="False" version="" name="firewall4" comment="this object is used to test a configuration where firewall has dynamic address ">
+        <NAT id="id3B0C6381" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3B0C6382" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3518,7 +3522,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B0C6390" disabled="False" position="1">
+          <NATRule id="id3B0C6390" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3541,7 +3545,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B202AFF" disabled="False" position="2">
+          <NATRule id="id3B202AFF" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3562,7 +3566,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E797EFF" comment="SDNAT rule&#10;" disabled="False" position="3">
+          <NATRule id="id3E797EFF" disabled="False" position="3" comment="SDNAT rule&#10;">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3583,9 +3587,30 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
+          <NATRule id="id14151X17863" disabled="False" position="4" comment="">
+            <OSrc neg="False">
+              <ObjectRef ref="net-Internal_net"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id3CD88A77"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
         </NAT>
-        <Policy id="id3B0C639E" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B54F071" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id3B0C639E" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3B54F071" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -3602,7 +3627,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63E3" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id3B0C63E3" action="Deny" direction="Inbound" disabled="False" log="True" position="1" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3620,7 +3645,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63EB" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="2">
+          <PolicyRule id="id3B0C63EB" action="Deny" direction="Outbound" disabled="False" log="True" position="2" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3638,7 +3663,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C639F" comment="hostF has the same IP address as firewal." action="Accept" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id3B0C639F" action="Accept" direction="Both" disabled="False" log="True" position="3" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3658,7 +3683,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63B4" action="Deny" direction="Both" disabled="False" log="True" position="4">
+          <PolicyRule id="id3B0C63B4" action="Deny" direction="Both" disabled="False" log="True" position="4" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3680,7 +3705,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63A9" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id3B0C63A9" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3702,7 +3727,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63BF" comment="testing negation in service field" action="Deny" direction="Both" disabled="True" log="True" position="6">
+          <PolicyRule id="id3B0C63BF" action="Deny" direction="Both" disabled="True" log="True" position="6" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3725,7 +3750,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63CB" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="7">
+          <PolicyRule id="id3B0C63CB" action="Accept" direction="Both" disabled="False" log="False" position="7" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3745,7 +3770,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63D5" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="8">
+          <PolicyRule id="id3B0C63D5" action="Deny" direction="Both" disabled="False" log="True" position="8" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3767,21 +3792,21 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3B0C6380-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3B0C63DF" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0C63DF-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3B0C6380-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3B0C63DF" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3B0C63DF-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3B0C63E1" name="eth1" bridgeport="False" dyn="True" label="" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3B0C63E1-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
+        <Interface id="id3B0C63E1" bridgeport="False" dyn="True" label="" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3B0C63E1-ipv4" name="address" comment="" address="0.0.0.0" netmask="0.0.0.0"/>
         </Interface>
-        <Interface id="id3B0C63F3" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0C63F3-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id3B0C63F3" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="">
+          <IPv4 id="id3B0C63F3-ipv4" name="address" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3B0C63F5" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3B0C63F5-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3B0C63F5" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3B0C63F5-ipv4" name="address" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id3CD88A77" name="eth3" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3CD88A77-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
+        <Interface id="id3CD88A77" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth3" comment="">
+          <IPv4 id="id3CD88A77-ipv4" name="address" comment="" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
         <Management address="222.222.222.222">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -3901,9 +3926,9 @@
           <Option name="use_tables">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3E1FC43C" name="firewall5" comment="testing IP fragments and scrub" host_OS="openbsd" inactive="False" lastCompiled="1157930819" lastInstalled="0" lastModified="1200415199" platform="pf" ro="False" version="">
-        <NAT id="id3E1FC43D" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3E1FC8FC" disabled="True" position="0">
+      <Firewall id="id3E1FC43C" host_OS="openbsd" inactive="False" lastCompiled="1157930819" lastInstalled="0" lastModified="1200415199" platform="pf" ro="False" version="" name="firewall5" comment="testing IP fragments and scrub">
+        <NAT id="id3E1FC43D" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3E1FC8FC" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3925,8 +3950,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3E1FC469" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3E1FC62E" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id3E1FC469" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3E1FC62E" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3951,7 +3976,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E1FC7B6" action="Deny" direction="Both" disabled="False" log="True" position="1">
+          <PolicyRule id="id3E1FC7B6" action="Deny" direction="Both" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3976,7 +4001,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E1FC47F" action="Deny" direction="Both" disabled="False" log="True" position="2">
+          <PolicyRule id="id3E1FC47F" action="Deny" direction="Both" disabled="False" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3997,15 +4022,15 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3E1FC43C-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3E1FC489" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3E1FC48A" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Routing id="id3E1FC43C-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3E1FC489" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3E1FC48A" name="address" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3E1FC48C" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3E1FC48D" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id3E1FC48C" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3E1FC48D" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3E5F1D4C" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3E5F1D4E" name="firewall5:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F1D4C" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3E5F1D4E" name="firewall5:lo(ip)" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -4082,10 +4107,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3C698F1D" name="firewall6" comment="testing rule with firewall in dst and negation" host_OS="openbsd" inactive="False" lastCompiled="1157930821" lastInstalled="0" lastModified="1200415203" platform="pf" ro="False" version="">
-        <NAT id="id3C698F1E" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id3C698F9D" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C699028" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+      <Firewall id="id3C698F1D" host_OS="openbsd" inactive="False" lastCompiled="1157930821" lastInstalled="0" lastModified="1200415203" platform="pf" ro="False" version="" name="firewall6" comment="testing rule with firewall in dst and negation">
+        <NAT id="id3C698F1E" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id3C698F9D" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3C699028" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4102,7 +4127,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C698FB2" action="Deny" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id3C698FB2" action="Deny" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4123,21 +4148,21 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3C698F1D-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3C699013" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C699013-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3C698F1D-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3C699013" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3C699013-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C69901D" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3C69901D-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3C69901D" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3C69901D-ipv4" name="address" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C699030" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C699030-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id3C699030" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="">
+          <IPv4 id="id3C699030-ipv4" name="address" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C699032" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C699032-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3C699032" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3C699032-ipv4" name="address" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id3C699034" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3C699034-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        <Interface id="id3C699034" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="">
+          <IPv4 id="id3C699034-ipv4" name="address" comment="" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -4209,10 +4234,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3C69BD4F" name="firewall7" comment="testing rules with broadcasts" host_OS="openbsd" inactive="False" lastCompiled="1157930822" lastInstalled="0" lastModified="1200415209" platform="pf" ro="False" version="">
-        <NAT id="id3C69BD50" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id3C69BD51" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C69BDE1" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+      <Firewall id="id3C69BD4F" host_OS="openbsd" inactive="False" lastCompiled="1157930822" lastInstalled="0" lastModified="1200415209" platform="pf" ro="False" version="" name="firewall7" comment="testing rules with broadcasts">
+        <NAT id="id3C69BD50" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id3C69BD51" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3C69BDE1" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4232,7 +4257,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C69BF13" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id3C69BF13" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4251,21 +4276,21 @@
             <PolicyRuleOptions/>
           </PolicyRule>
         </Policy>
-        <Routing id="id3C69BD4F-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3C69BD5C" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C69BD5C-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3C69BD4F-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3C69BD5C" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3C69BD5C-ipv4" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C69BD5E" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3C69BD5E-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3C69BD5E" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3C69BD5E-ipv4" name="address" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C69BD68" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C69BD68-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id3C69BD68" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="">
+          <IPv4 id="id3C69BD68-ipv4" name="address" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3C69BD6A" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3C69BD6A-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3C69BD6A" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3C69BD6A-ipv4" name="address" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id3C69BD6C" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3C69BD6C-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        <Interface id="id3C69BD6C" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="">
+          <IPv4 id="id3C69BD6C-ipv4" name="address" comment="" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -4337,9 +4362,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3D581152" name="firewall8" host_OS="openbsd" inactive="False" lastCompiled="1157930823" lastInstalled="0" lastModified="1200415211" platform="pf" ro="False" version="">
-        <NAT id="id3D581156" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3D58164E" disabled="False" position="0">
+      <Firewall id="id3D581152" host_OS="openbsd" inactive="False" lastCompiled="1157930823" lastInstalled="0" lastModified="1200415211" platform="pf" ro="False" version="" name="firewall8" comment="">
+        <NAT id="id3D581156" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3D58164E" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4360,7 +4385,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58163D" disabled="False" position="1">
+          <NATRule id="id3D58163D" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4381,7 +4406,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5812BC" disabled="False" position="2">
+          <NATRule id="id3D5812BC" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4402,7 +4427,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D581322" disabled="False" position="3">
+          <NATRule id="id3D581322" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4423,7 +4448,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5812AE" disabled="False" position="4">
+          <NATRule id="id3D5812AE" disabled="False" position="4" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4444,7 +4469,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5812CC" disabled="False" position="5">
+          <NATRule id="id3D5812CC" disabled="False" position="5" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4465,7 +4490,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5812FA" disabled="False" position="6">
+          <NATRule id="id3D5812FA" disabled="False" position="6" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4486,7 +4511,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58130E" disabled="False" position="7">
+          <NATRule id="id3D58130E" disabled="False" position="7" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4507,7 +4532,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id40ECF00B" disabled="False" position="8">
+          <NATRule id="id40ECF00B" disabled="False" position="8" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4529,8 +4554,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3D581155" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3E5F239B" action="Accounting" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id3D581155" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3E5F239B" action="Accounting" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4550,7 +4575,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E5F2391" action="Accounting" direction="Both" disabled="False" log="True" position="1">
+          <PolicyRule id="id3E5F2391" action="Accounting" direction="Both" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4570,7 +4595,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D5811A5" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id3D5811A5" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4588,7 +4613,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D58119B" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id3D58119B" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4606,7 +4631,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D5811FB" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id3D5811FB" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4624,7 +4649,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D5811B1" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id3D5811B1" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4645,18 +4670,18 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3D581152-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3D58115B" name="eth1" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3D58115D" name="firewall8:eth1:1" address="33.33.33.34" netmask="255.255.255.0"/>
-          <IPv4 id="id3D58115E" name="firewall8:eth1:0" address="33.33.33.33" netmask="255.255.255.0"/>
+        <Routing id="id3D581152-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3D58115B" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id3D58115D" name="firewall8:eth1:1" comment="" address="33.33.33.34" netmask="255.255.255.0"/>
+          <IPv4 id="id3D58115E" name="firewall8:eth1:0" comment="" address="33.33.33.33" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3D581188" name="eth0" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3D58118A" name="firewall8:eth0" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id3D581188" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3D58118A" name="firewall8:eth0" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3E5F18E9" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3E5F18EB" name="firewall8:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F18E9" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3E5F18EB" name="firewall8:lo(ip)" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id3EE256C2" name="ppp0" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
+        <Interface id="id3EE256C2" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="ppp0" comment=""/>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
@@ -4699,9 +4724,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3E853CBE" name="firewall9" comment="testing rules with broadcasts" host_OS="freebsd" inactive="False" lastCompiled="1157930825" lastInstalled="0" lastModified="1200415214" platform="pf" ro="False" version="">
-        <NAT id="id3E853CBF" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3E853EF8" disabled="True" position="0">
+      <Firewall id="id3E853CBE" host_OS="freebsd" inactive="False" lastCompiled="1157930825" lastInstalled="0" lastModified="1200415214" platform="pf" ro="False" version="" name="firewall9" comment="testing rules with broadcasts">
+        <NAT id="id3E853CBF" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id3E853EF8" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4722,7 +4747,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E853F16" disabled="False" position="1">
+          <NATRule id="id3E853F16" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4744,8 +4769,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3E853CC0" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3E853CCE" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+        <Policy id="id3E853CC0" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id3E853CCE" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4765,7 +4790,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E853CEF" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id3E853CEF" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4783,7 +4808,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3E853D1B" action="Accept" direction="Both" disabled="True" log="False" position="2">
+          <PolicyRule id="id3E853D1B" action="Accept" direction="Both" disabled="True" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id3E853CD8"/>
             </Src>
@@ -4801,7 +4826,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3E853CC1" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id3E853CC1" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4819,7 +4844,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3E853D26" action="Deny" direction="Both" disabled="False" log="True" position="4">
+          <PolicyRule id="id3E853D26" action="Deny" direction="Both" disabled="False" log="True" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4840,13 +4865,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id3E853CBE-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3E853CCB" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3E853CCC" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id3E853CBE-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3E853CCB" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id3E853CCC" name="address" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3E853CD8" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id3E853CDE" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3E853CDF" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E853CD8" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id3E853CDE" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3E853CDF" name="address" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -4921,9 +4946,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id43867C1018346" name="firewall33" comment="testing DNSName object" host_OS="freebsd" inactive="False" lastCompiled="1157930808" lastInstalled="0" lastModified="1193632397" platform="pf" ro="False" version="">
-        <NAT id="id43867C4818346" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43876E2618346" disabled="False" position="0">
+      <Firewall id="id43867C1018346" host_OS="freebsd" inactive="False" lastCompiled="1157930808" lastInstalled="0" lastModified="1193632397" platform="pf" ro="False" version="" name="firewall33" comment="testing DNSName object">
+        <NAT id="id43867C4818346" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id43876E2618346" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4944,7 +4969,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E5218346" disabled="False" position="1">
+          <NATRule id="id43876E5218346" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4965,7 +4990,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E6918346" disabled="False" position="2">
+          <NATRule id="id43876E6918346" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4987,7 +5012,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E7B18346" disabled="False" position="3">
+          <NATRule id="id43876E7B18346" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5010,8 +5035,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id43867C1618346" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43867C2418346" action="Accept" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id43867C1618346" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id43867C2418346" action="Accept" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8C18346"/>
             </Src>
@@ -5029,7 +5054,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43869E9018346" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id43869E9018346" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8D18346"/>
             </Src>
@@ -5047,7 +5072,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43869E9E18346" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id43869E9E18346" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8E18346"/>
             </Src>
@@ -5065,7 +5090,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43869EAA18346" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id43869EAA18346" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8F18346"/>
             </Src>
@@ -5083,7 +5108,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4386E38318346" action="Deny" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id4386E38318346" action="Deny" direction="Both" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5103,7 +5128,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386E37718346" action="Deny" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id4386E37718346" action="Deny" direction="Both" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5123,7 +5148,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43867C3018346" action="Accept" direction="Both" disabled="False" log="False" position="6">
+          <PolicyRule id="id43867C3018346" action="Accept" direction="Both" disabled="False" log="False" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5141,7 +5166,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4386C10D18346" action="Accept" direction="Both" disabled="False" log="False" position="7">
+          <PolicyRule id="id4386C10D18346" action="Accept" direction="Both" disabled="False" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5159,7 +5184,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id438728A918346" action="Accept" direction="Both" disabled="False" log="False" position="8">
+          <PolicyRule id="id438728A918346" action="Accept" direction="Both" disabled="False" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5178,7 +5203,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id438728BA18346" action="Accept" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="id438728BA18346" action="Accept" direction="Both" disabled="False" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5197,7 +5222,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id438728CD18346" action="Accept" direction="Both" disabled="False" log="False" position="10">
+          <PolicyRule id="id438728CD18346" action="Accept" direction="Both" disabled="False" log="False" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5216,7 +5241,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43867C3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id43867C3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5237,13 +5262,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id43867C5718346" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id43867C5818346" name="eth0.100" comment="VLAN interface" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
-        <Interface id="id43867C5918346" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43867C5B18346" name="firewall33:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Routing id="id43867C5718346" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id43867C5818346" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth0.100" comment="VLAN interface"/>
+        <Interface id="id43867C5918346" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id43867C5B18346" name="firewall33:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id43867C5C18346" name="eth1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43867C5E18346" name="firewall33:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Interface id="id43867C5C18346" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id43867C5E18346" name="firewall33:eth1:ip" comment="" address="192.168.1.100" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -5335,9 +5360,9 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4389EDAE18346" name="firewall34" comment="testing AddressTable object" host_OS="openbsd" inactive="False" lastCompiled="1210047001" lastInstalled="0" lastModified="1210046836" platform="pf" ro="False" version="">
-        <NAT id="id4389EE4818346" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4389EEB018346" disabled="False" position="0">
+      <Firewall id="id4389EDAE18346" host_OS="openbsd" inactive="False" lastCompiled="1210047001" lastInstalled="0" lastModified="1210046836" platform="pf" ro="False" version="" name="firewall34" comment="testing AddressTable object">
+        <NAT id="id4389EE4818346" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id4389EEB018346" disabled="False" position="0" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id4389EE9118346"/>
             </OSrc>
@@ -5358,7 +5383,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id446FDDE610619" disabled="False" position="1">
+          <NATRule id="id446FDDE610619" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id4390C25525682"/>
             </OSrc>
@@ -5379,7 +5404,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43891B6E674" disabled="False" position="2">
+          <NATRule id="id43891B6E674" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5400,7 +5425,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id467A0FE823947" disabled="False" position="3">
+          <NATRule id="id467A0FE823947" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5421,7 +5446,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id467A0FF823947" disabled="False" position="4">
+          <NATRule id="id467A0FF823947" disabled="False" position="4" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5442,7 +5467,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id467A209B23947" disabled="False" position="5">
+          <NATRule id="id467A209B23947" disabled="False" position="5" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5463,7 +5488,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id467A20AD23947" disabled="False" position="6">
+          <NATRule id="id467A20AD23947" disabled="False" position="6" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5485,8 +5510,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id4389EDB418346" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4389EDB518346" action="Accept" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id4389EDB418346" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id4389EDB518346" action="Accept" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5504,7 +5529,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4388CFEA674" action="Deny" direction="Both" disabled="False" log="True" position="1">
+          <PolicyRule id="id4388CFEA674" action="Deny" direction="Both" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5524,7 +5549,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4390C25825682" action="Deny" direction="Both" disabled="False" log="True" position="2">
+          <PolicyRule id="id4390C25825682" action="Deny" direction="Both" disabled="False" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5544,7 +5569,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id446FB0ED10619" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id446FB0ED10619" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5564,7 +5589,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id452762A85348" action="Deny" direction="Both" disabled="False" log="True" position="4">
+          <PolicyRule id="id452762A85348" action="Deny" direction="Both" disabled="False" log="True" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id452762A75348"/>
             </Src>
@@ -5584,7 +5609,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EDC118346" action="Deny" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id4389EDC118346" action="Deny" direction="Both" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5605,7 +5630,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388CFF8674" action="Deny" direction="Both" disabled="False" log="True" position="6">
+          <PolicyRule id="id4388CFF8674" action="Deny" direction="Both" disabled="False" log="True" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
             </Src>
@@ -5625,7 +5650,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388C36F674" action="Deny" direction="Both" disabled="False" log="True" position="7">
+          <PolicyRule id="id4388C36F674" action="Deny" direction="Both" disabled="False" log="True" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -5646,7 +5671,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388F5A9674" action="Accept" direction="Both" disabled="True" log="False" position="8">
+          <PolicyRule id="id4388F5A9674" action="Accept" direction="Both" disabled="True" log="False" position="8" comment="">
             <Src neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -5665,7 +5690,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4389EEA118346" action="Accept" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="id4389EEA118346" action="Accept" direction="Both" disabled="False" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5700,7 +5725,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EDCD18346" action="Accept" direction="Both" disabled="False" log="False" position="10">
+          <PolicyRule id="id4389EDCD18346" action="Accept" direction="Both" disabled="False" log="False" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5718,7 +5743,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4389EE3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id4389EE3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5739,13 +5764,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4389EE8318346" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4389EE8418346" name="eth0.100" comment="VLAN interface" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
-        <Interface id="id4389EE8518346" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4389EE8718346" name="firewall34:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Routing id="id4389EE8318346" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4389EE8418346" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth0.100" comment="VLAN interface"/>
+        <Interface id="id4389EE8518346" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id4389EE8718346" name="firewall34:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id4389EE8818346" name="eth1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4389EE8A18346" name="firewall34:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Interface id="id4389EE8818346" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id4389EE8A18346" name="firewall34:eth1:ip" comment="" address="192.168.1.100" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -5837,9 +5862,9 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id43EC5DDC2355" name="firewall38" comment="testing rules with tag service" host_OS="freebsd" inactive="False" lastCompiled="1215308407" lastInstalled="0" lastModified="1215308308" platform="pf" ro="False" version="">
-        <NAT id="id43EC5E1F2355" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43EC5E2E2355" disabled="False" position="0">
+      <Firewall id="id43EC5DDC2355" host_OS="freebsd" inactive="False" lastCompiled="1215308407" lastInstalled="0" lastModified="1215308308" platform="pf" ro="False" version="" name="firewall38" comment="testing rules with tag service">
+        <NAT id="id43EC5E1F2355" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id43EC5E2E2355" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5860,7 +5885,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43EC5E6E2355" disabled="False" position="1">
+          <NATRule id="id43EC5E6E2355" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5882,8 +5907,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id43EC5DE22355" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43EC5DE32355" action="Tag" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id43EC5DE22355" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id43EC5DE32355" action="Tag" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5909,7 +5934,7 @@
               <Option name="tagobject_id">id43F4556A28869</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F447F228869" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id43F447F228869" action="Accept" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5927,7 +5952,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43F4555D28869" action="Accept" direction="Outbound" disabled="False" log="False" position="2">
+          <PolicyRule id="id43F4555D28869" action="Accept" direction="Outbound" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5945,7 +5970,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43F462CA28869" action="Accept" direction="Outbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id43F462CA28869" action="Accept" direction="Outbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5963,7 +5988,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43EC5DEF2355" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id43EC5DEF2355" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5981,7 +6006,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43EC6B8B2355" action="Accept" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id43EC6B8B2355" action="Accept" direction="Both" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5999,7 +6024,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id1391220443" action="Accept" direction="Both" disabled="False" group="" log="False" position="6">
+          <PolicyRule id="id1391220443" action="Accept" direction="Both" disabled="False" group="" log="False" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6018,7 +6043,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43EC6BAF2355" action="Accept" direction="Both" disabled="True" log="False" position="7">
+          <PolicyRule id="id43EC6BAF2355" action="Accept" direction="Both" disabled="True" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6036,7 +6061,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43EC6BC02355" action="Accept" direction="Both" disabled="False" log="False" position="8">
+          <PolicyRule id="id43EC6BC02355" action="Accept" direction="Both" disabled="False" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6055,7 +6080,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43EC6BEA2355" action="Accept" direction="Both" disabled="True" log="False" position="9">
+          <PolicyRule id="id43EC6BEA2355" action="Accept" direction="Both" disabled="True" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6074,7 +6099,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id43F4407F28542" action="Classify" direction="Both" disabled="False" log="False" position="10">
+          <PolicyRule id="id43F4407F28542" action="Classify" direction="Both" disabled="False" log="False" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6101,7 +6126,7 @@
               <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43EC5E132355" action="Deny" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id43EC5E132355" action="Deny" direction="Both" disabled="False" log="True" position="11" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6122,16 +6147,16 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id43EC5E3C2355" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id43EC5E3D2355" name="le0" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43EC5E3F2355" name="firewall38:le0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id43EC5E3C2355" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id43EC5E3D2355" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False" name="le0" comment="">
+          <IPv4 id="id43EC5E3F2355" name="firewall38:le0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id43EC5E402355" name="enc0" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id43EC5E412355" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43EC5E432355" name="firewall38:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id43EC5E402355" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id43EC5E412355" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id43EC5E432355" name="firewall38:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id43F447EB28869" name="enc1" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id43F447EC28869" name="firewall38:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id43F447EB28869" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False" name="enc1" comment="">
+          <IPv4 id="id43F447EC28869" name="firewall38:enc1:ip" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -6252,9 +6277,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id43F7DBEE31316" name="firewall3" comment="testing NAT rules with multiple objects in TSrc and TDst and NAT rule options" host_OS="openbsd" inactive="False" lastCompiled="1157930807" lastInstalled="0" lastModified="1200415192" platform="pf" ro="False" version="">
-        <NAT id="id43F7DC6531316" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43F7DC6631316" disabled="False" position="0">
+      <Firewall id="id43F7DBEE31316" host_OS="openbsd" inactive="False" lastCompiled="1157930807" lastInstalled="0" lastModified="1200415192" platform="pf" ro="False" version="" name="firewall3" comment="testing NAT rules with multiple objects in TSrc and TDst and NAT rule options">
+        <NAT id="id43F7DC6531316" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id43F7DC6631316" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6282,7 +6307,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id43F7DCC331316" disabled="False" position="1">
+          <NATRule id="id43F7DCC331316" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6315,7 +6340,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id43F7DCD731316" disabled="False" position="2">
+          <NATRule id="id43F7DCD731316" disabled="False" position="2" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6343,7 +6368,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id43F7DD1431316" disabled="False" position="3">
+          <NATRule id="id43F7DD1431316" disabled="False" position="3" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6371,7 +6396,7 @@
               <Option name="pf_static_port">True</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id43F7E942514" disabled="False" position="4">
+          <NATRule id="id43F7E942514" disabled="False" position="4" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6401,8 +6426,8 @@
             </NATRuleOptions>
           </NATRule>
         </NAT>
-        <Policy id="id43F7DBF431316" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43F7DC4131316" comment="All other attempts to connect to&#10;the firewall are denied and logged" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id43F7DBF431316" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id43F7DC4131316" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="All other attempts to connect to&#10;the firewall are denied and logged">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6422,7 +6447,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7DC4D31316" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id43F7DC4D31316" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -6448,16 +6473,16 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id43F7DC7431316" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id43F7DC7531316" name="le0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id43F7DCEB31316" name="firewall3:le0:ip-1" address="22.22.22.21" netmask="255.255.255.0"/>
-          <IPv4 id="id43F7DCEC31316" name="firewall3:le0:ip-2" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Routing id="id43F7DC7431316" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id43F7DC7531316" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="le0" comment="">
+          <IPv4 id="id43F7DCEB31316" name="firewall3:le0:ip-1" comment="" address="22.22.22.21" netmask="255.255.255.0"/>
+          <IPv4 id="id43F7DCEC31316" name="firewall3:le0:ip-2" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id43F7DC7631316" name="le1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43F7DC7831316" name="firewall3:le1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id43F7DC7631316" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="le1" comment="">
+          <IPv4 id="id43F7DC7831316" name="firewall3:le1:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id43F7DC7931316" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id43F7DC7B31316" name="firewall3:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id43F7DC7931316" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id43F7DC7B31316" name="firewall3:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -6572,9 +6597,9 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id445DB34232739" name="firewall39" comment="testing branching rules" host_OS="freebsd" inactive="False" lastCompiled="1157930813" lastInstalled="0" lastModified="1190517710" platform="pf" ro="False" version="">
-        <NAT id="id445DB3CF32739" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id445DB3D032739" disabled="False" position="0">
+      <Firewall id="id445DB34232739" host_OS="freebsd" inactive="False" lastCompiled="1157930813" lastInstalled="0" lastModified="1190517710" platform="pf" ro="False" version="" name="firewall39" comment="testing branching rules">
+        <NAT id="id445DB3CF32739" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id445DB3D032739" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6595,7 +6620,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id445DB3DE32739" disabled="False" position="1">
+          <NATRule id="id445DB3DE32739" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6617,8 +6642,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id445DB34832739" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id445DB34932739" action="Tag" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id445DB34832739" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id445DB34932739" action="Tag" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6644,7 +6669,7 @@
               <Option name="tagobject_id">id43F4556A28869</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445DB35532739" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id445DB35532739" action="Accept" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6662,7 +6687,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB36132739" comment="logging is not allowed with 'anchor'&#10;compiler should not generate 'log' keyword&#10;" action="Branch" direction="Inbound" disabled="False" log="True" position="2">
+          <PolicyRule id="id445DB36132739" action="Branch" direction="Inbound" disabled="False" log="True" position="2" comment="logging is not allowed with 'anchor'&#10;compiler should not generate 'log' keyword&#10;">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6683,7 +6708,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445DB36D32739" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id445DB36D32739" action="Branch" direction="Inbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6704,7 +6729,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445DB37932739" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id445DB37932739" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6722,7 +6747,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB38532739" action="Branch" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id445DB38532739" action="Branch" direction="Both" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6743,7 +6768,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445DB39132739" action="Accept" direction="Both" disabled="False" log="False" position="6">
+          <PolicyRule id="id445DB39132739" action="Accept" direction="Both" disabled="False" log="False" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6761,7 +6786,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB39D32739" action="Accept" direction="Both" disabled="False" log="False" position="7">
+          <PolicyRule id="id445DB39D32739" action="Accept" direction="Both" disabled="False" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6780,7 +6805,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB3AA32739" action="Accept" direction="Both" disabled="True" log="False" position="8">
+          <PolicyRule id="id445DB3AA32739" action="Accept" direction="Both" disabled="True" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6799,7 +6824,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB3B732739" action="Classify" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="id445DB3B732739" action="Classify" direction="Both" disabled="False" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6826,7 +6851,7 @@
               <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445DB3C332739" action="Deny" direction="Both" disabled="False" log="True" position="10">
+          <PolicyRule id="id445DB3C332739" action="Deny" direction="Both" disabled="False" log="True" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6847,8 +6872,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id445DB3FE32739" name="rule2_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id445DB40A32739" action="Accept" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id445DB3FE32739" name="rule2_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id445DB40A32739" action="Accept" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6866,7 +6891,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB42332739" action="Deny" direction="Both" disabled="False" log="True" position="1">
+          <PolicyRule id="id445DB42332739" action="Deny" direction="Both" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6887,8 +6912,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id445DB3FF32739" name="rule3_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id445DB41632739" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id445DB3FF32739" name="rule3_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id445DB41632739" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6906,7 +6931,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB43032739" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id445DB43032739" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6925,7 +6950,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445DB43E32739" action="Deny" direction="Both" disabled="False" log="True" position="2">
+          <PolicyRule id="id445DB43E32739" action="Deny" direction="Both" disabled="False" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6946,17 +6971,17 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id445DB40032739" name="rule5_branch" ipv6_rule_set="False" top_rule_set="False"/>
-        <Routing id="id445DB3EC32739" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id445DB3ED32739" name="le0" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id445DB3EF32739" name="firewall39:le0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Policy id="id445DB40032739" name="rule5_branch" comment="" ipv6_rule_set="False" top_rule_set="False"/>
+        <Routing id="id445DB3EC32739" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id445DB3ED32739" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False" name="le0" comment="">
+          <IPv4 id="id445DB3EF32739" name="firewall39:le0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id445DB3F032739" name="enc0" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id445DB3F132739" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id445DB3F332739" name="firewall39:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id445DB3F032739" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id445DB3F132739" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id445DB3F332739" name="firewall39:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id445DB3F432739" name="enc1" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id445DB3F632739" name="firewall39:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id445DB3F432739" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False" name="enc1" comment="">
+          <IPv4 id="id445DB3F632739" name="firewall39:enc1:ip" comment="" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -7077,9 +7102,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id44948F9F2976" name="firewall40" comment="testing Route action&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1193632410" platform="pf" ro="False" version="">
-        <NAT id="id449490392976" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id449490482976" comment="Translate source address&#10;for outgoing connections" disabled="False" position="0">
+      <Firewall id="id44948F9F2976" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1193632410" platform="pf" ro="False" version="" name="firewall40" comment="testing Route action&#10;">
+        <NAT id="id449490392976" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id449490482976" disabled="False" position="0" comment="Translate source address&#10;for outgoing connections">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -7100,7 +7125,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id4494A6FF3539" comment="Translate source address&#10;for outgoing connections" disabled="False" position="1">
+          <NATRule id="id4494A6FF3539" disabled="False" position="1" comment="Translate source address&#10;for outgoing connections">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -7122,8 +7147,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id44948FA52976" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id44957E2D3539" action="Accept" direction="Both" disabled="False" log="False" position="0">
+        <Policy id="id44948FA52976" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id44957E2D3539" action="Accept" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7148,7 +7173,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id44957E3A3539" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id44957E3A3539" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7173,7 +7198,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id449490212976" action="Route" direction="Inbound" disabled="False" log="False" position="2">
+          <PolicyRule id="id449490212976" action="Route" direction="Inbound" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7216,7 +7241,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4494AF342976" action="Route" direction="Inbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id4494AF342976" action="Route" direction="Inbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7258,7 +7283,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id44958DBE3539" action="Accept" direction="Outbound" disabled="False" log="False" position="4">
+          <PolicyRule id="id44958DBE3539" action="Accept" direction="Outbound" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id44948F9F2976"/>
             </Src>
@@ -7276,7 +7301,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id4494902D2976" action="Deny" disabled="False" log="True" position="5">
+          <PolicyRule id="id4494902D2976" action="Deny" disabled="False" log="True" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7297,18 +7322,18 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id449490652976" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id449490662976" name="le1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+        <Routing id="id449490652976" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id449490662976" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="le1" comment="">
           <IPv4 id="id449490682976" name="firewall40:le1:ip" comment="This is a test address, change it to your real one" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id449490692976" name="fxp0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4494906B2976" name="firewall40:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id449490692976" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="fxp0" comment="">
+          <IPv4 id="id4494906B2976" name="firewall40:fxp0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4494906C2976" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4494906E2976" name="firewall40:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4494906C2976" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id4494906E2976" name="firewall40:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id4494906F2976" name="le2" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id449490712976" name="firewall40:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
+        <Interface id="id4494906F2976" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="le2" comment="">
+          <IPv4 id="id449490712976" name="firewall40:le2:ip" comment="" address="192.0.3.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -7420,10 +7445,10 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id44EC18128791" name="firewall41" comment="testing rule shadowing with run-time objects, rules with such objects should be ignored&#10;&#10;" host_OS="freebsd" inactive="False" lastCompiled="1157930818" lastInstalled="0" lastModified="1193632413" platform="pf" ro="False" version="">
-        <NAT id="id44EC18168791" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id44EC18158791" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id44EC181E8791" action="Accept" direction="Both" disabled="False" log="True" position="0">
+      <Firewall id="id44EC18128791" host_OS="freebsd" inactive="False" lastCompiled="1157930818" lastInstalled="0" lastModified="1193632413" platform="pf" ro="False" version="" name="firewall41" comment="testing rule shadowing with run-time objects, rules with such objects should be ignored&#10;&#10;">
+        <NAT id="id44EC18168791" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id44EC18158791" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id44EC181E8791" action="Accept" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7441,7 +7466,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id44F7056428576" action="Accept" direction="Both" disabled="False" log="True" position="1">
+          <PolicyRule id="id44F7056428576" action="Accept" direction="Both" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7459,7 +7484,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id44F707E428576" action="Accept" direction="Both" disabled="False" log="True" position="2">
+          <PolicyRule id="id44F707E428576" action="Accept" direction="Both" disabled="False" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7478,12 +7503,12 @@
             <PolicyRuleOptions/>
           </PolicyRule>
         </Policy>
-        <Routing id="id44EC18178791" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id44EC18188791" name="eth0" bridgeport="False" dyn="False" label="ext" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id44EC18198791" name="firewall41:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
+        <Routing id="id44EC18178791" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id44EC18188791" bridgeport="False" dyn="False" label="ext" security_level="0" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id44EC18198791" name="firewall41:eth0:ip" comment="" address="1.1.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id44EC181A8791" name="eth1" bridgeport="False" dyn="False" label="int" security_level="50" unnum="False" unprotected="False">
-          <IPv4 id="id44EC181B8791" name="firewall41:eth1:ip" address="2.2.2.2" netmask="255.255.255.0"/>
+        <Interface id="id44EC181A8791" bridgeport="False" dyn="False" label="int" security_level="50" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id44EC181B8791" name="firewall41:eth1:ip" comment="" address="2.2.2.2" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -7535,9 +7560,9 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4699449021967" name="firewall10-1" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" inactive="False" lastCompiled="1202682006" lastInstalled="0" lastModified="1202681966" platform="pf" ro="False" version="3.x">
-        <NAT id="id469944D321967" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id469944D421967" disabled="True" position="0">
+      <Firewall id="id4699449021967" host_OS="openbsd" inactive="False" lastCompiled="1202682006" lastInstalled="0" lastModified="1202681966" platform="pf" ro="False" version="3.x" name="firewall10-1" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;">
+        <NAT id="id469944D321967" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id469944D421967" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7558,7 +7583,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id469944E221967" disabled="False" position="1">
+          <NATRule id="id469944E221967" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7580,8 +7605,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id4699449621967" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4699449721967" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id4699449621967" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id4699449721967" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7602,7 +7627,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id469944A321967" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id469944A321967" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7637,7 +7662,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id469944AF21967" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id469944AF21967" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -7672,7 +7697,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id469944C721967" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id469944C721967" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7693,13 +7718,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id469944F021967" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id469944F121967" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id469944F321967" name="firewall10-1:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id469944F021967" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id469944F121967" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id469944F321967" name="firewall10-1:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id469944F421967" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id469944F521967" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id469944F721967" name="firewall10-1:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id469944F421967" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id469944F521967" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id469944F721967" name="firewall10-1:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -7827,9 +7852,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4699570022254" name="firewall10-2" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" inactive="False" lastCompiled="1202682007" lastInstalled="0" lastModified="1202682031" platform="pf" ro="False" version="4.x">
-        <NAT id="id4699573822254" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4699573922254" disabled="True" position="0">
+      <Firewall id="id4699570022254" host_OS="openbsd" inactive="False" lastCompiled="1202682007" lastInstalled="0" lastModified="1202682031" platform="pf" ro="False" version="4.x" name="firewall10-2" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;">
+        <NAT id="id4699573822254" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id4699573922254" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7850,7 +7875,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id4699574722254" disabled="False" position="1">
+          <NATRule id="id4699574722254" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7872,8 +7897,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id4699570622254" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4699570722254" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id4699570622254" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id4699570722254" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7894,7 +7919,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699571422254" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id4699571422254" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7929,7 +7954,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699572022254" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id4699572022254" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -7964,7 +7989,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699572C22254" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id4699572C22254" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7985,13 +8010,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4699575522254" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4699575622254" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4699575822254" name="firewall10-2:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id4699575522254" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4699575622254" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id4699575822254" name="firewall10-2:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4699575922254" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id4699575A22254" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
-          <IPv4 id="id4699575C22254" name="firewall10-2:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4699575922254" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id4699575A22254" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True" name="lo0" comment="">
+          <IPv4 id="id4699575C22254" name="firewall10-2:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -8119,9 +8144,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id469948EA22616" name="firewall10-3" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682008" lastInstalled="0" lastModified="1202681977" platform="pf" ro="False" version="3.x">
-        <NAT id="id4699492222616" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4699492322616" disabled="True" position="0">
+      <Firewall id="id469948EA22616" host_OS="openbsd" inactive="False" lastCompiled="1202682008" lastInstalled="0" lastModified="1202681977" platform="pf" ro="False" version="3.x" name="firewall10-3" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;">
+        <NAT id="id4699492222616" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id4699492322616" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8142,7 +8167,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id4699493122616" disabled="False" position="1">
+          <NATRule id="id4699493122616" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8164,8 +8189,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id469948F022616" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id469948F122616" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id469948F022616" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id469948F122616" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8186,7 +8211,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id469948FE22616" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id469948FE22616" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8221,7 +8246,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699490A22616" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id4699490A22616" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8256,7 +8281,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699491622616" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id4699491622616" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8277,13 +8302,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4699493F22616" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4699494022616" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4699494222616" name="firewall10-3:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id4699493F22616" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4699494022616" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id4699494222616" name="firewall10-3:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4699494322616" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id4699494422616" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4699494622616" name="firewall10-3:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4699494322616" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id4699494422616" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id4699494622616" name="firewall10-3:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -8411,9 +8436,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4699494C22616" name="firewall10-4" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682010" lastInstalled="0" lastModified="1202681983" platform="pf" ro="False" version="4.x">
-        <NAT id="id4699498422616" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4699498522616" disabled="True" position="0">
+      <Firewall id="id4699494C22616" host_OS="openbsd" inactive="False" lastCompiled="1202682010" lastInstalled="0" lastModified="1202681983" platform="pf" ro="False" version="4.x" name="firewall10-4" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;">
+        <NAT id="id4699498422616" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id4699498522616" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8434,7 +8459,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id4699499322616" disabled="False" position="1">
+          <NATRule id="id4699499322616" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8456,8 +8481,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id4699495222616" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4699495322616" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id4699495222616" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id4699495322616" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8478,7 +8503,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699496022616" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id4699496022616" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8513,7 +8538,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699496C22616" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id4699496C22616" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8548,7 +8573,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4699497822616" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id4699497822616" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8569,13 +8594,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id469949A122616" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id469949A222616" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id469949A422616" name="firewall10-4:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id469949A122616" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id469949A222616" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id469949A422616" name="firewall10-4:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id469949A522616" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id469949A622616" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
-          <IPv4 id="id469949A822616" name="firewall10-4:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id469949A522616" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id469949A622616" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True" name="lo0" comment="">
+          <IPv4 id="id469949A822616" name="firewall10-4:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -8703,9 +8728,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id46F605DE10002" name="firewall10-5" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682011" lastInstalled="0" lastModified="1202681989" platform="pf" ro="False" version="3.x">
-        <NAT id="id46F6061610002" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id46F6061710002" disabled="True" position="0">
+      <Firewall id="id46F605DE10002" host_OS="openbsd" inactive="False" lastCompiled="1202682011" lastInstalled="0" lastModified="1202681989" platform="pf" ro="False" version="3.x" name="firewall10-5" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;Using &quot;pass all outgoing&quot;&#10;">
+        <NAT id="id46F6061610002" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id46F6061710002" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8726,7 +8751,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id46F6062510002" disabled="False" position="1">
+          <NATRule id="id46F6062510002" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8748,8 +8773,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id46F605E410002" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id46F6520210002" comment="This adds &quot;pass  out ... keep state&quot; &#10;rule that compiler 2.1.14&#10;does not add automatically for pf 3.x&#10;Note that checkbox &quot;add 'keep state'&quot;&#10;is on in options&#10;" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
+        <Policy id="id46F605E410002" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id46F6520210002" action="Accept" direction="Outbound" disabled="False" log="False" position="0" comment="This adds &quot;pass  out ... keep state&quot; &#10;rule that compiler 2.1.14&#10;does not add automatically for pf 3.x&#10;Note that checkbox &quot;add 'keep state'&quot;&#10;is on in options&#10;">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8784,7 +8809,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F605E510002" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id46F605E510002" action="Accept" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8805,7 +8830,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F605F210002" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id46F605F210002" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8840,7 +8865,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F605FE10002" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id46F605FE10002" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8875,7 +8900,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F6060A10002" action="Deny" direction="Both" disabled="False" log="True" position="4">
+          <PolicyRule id="id46F6060A10002" action="Deny" direction="Both" disabled="False" log="True" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8896,13 +8921,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id46F6063310002" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id46F6063410002" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id46F6063610002" name="firewall10-5:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id46F6063310002" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id46F6063410002" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id46F6063610002" name="firewall10-5:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id46F6063710002" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id46F6063810002" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id46F6063A10002" name="firewall10-5:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id46F6063710002" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id46F6063810002" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id46F6063A10002" name="firewall10-5:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -9030,9 +9055,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id46F6064010002" name="firewall10-6" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682012" lastInstalled="0" lastModified="1202681995" platform="pf" ro="False" version="4.x">
-        <NAT id="id46F6067810002" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id46F6067910002" disabled="True" position="0">
+      <Firewall id="id46F6064010002" host_OS="openbsd" inactive="False" lastCompiled="1202682012" lastInstalled="0" lastModified="1202681995" platform="pf" ro="False" version="4.x" name="firewall10-6" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;Using &quot;pass all outgoing&quot;&#10;">
+        <NAT id="id46F6067810002" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id46F6067910002" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9053,7 +9078,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id46F6068710002" disabled="False" position="1">
+          <NATRule id="id46F6068710002" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9075,8 +9100,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id46F6064610002" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id46F6064710002" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id46F6064610002" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id46F6064710002" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -9097,7 +9122,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F6065410002" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id46F6065410002" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -9132,7 +9157,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F6066010002" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id46F6066010002" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="via ipsec">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -9167,7 +9192,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46F6066C10002" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id46F6066C10002" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -9188,13 +9213,13 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id46F6069510002" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id46F6069610002" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id46F6069810002" name="firewall10-6:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id46F6069510002" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id46F6069610002" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id46F6069810002" name="firewall10-6:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id46F6069910002" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
-        <Interface id="id46F6069A10002" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
-          <IPv4 id="id46F6069C10002" name="firewall10-6:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id46F6069910002" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False" name="enc0" comment=""/>
+        <Interface id="id46F6069A10002" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True" name="lo0" comment="">
+          <IPv4 id="id46F6069C10002" name="firewall10-6:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -9322,9 +9347,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id476458AA9697" name="firewall40-1" comment="testing Route action&#10;with load balancing&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1197750649" platform="pf" ro="False" version="">
-        <NAT id="id476458FA9697" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id476458FB9697" comment="Translate source address&#10;for outgoing connections" disabled="False" position="0">
+      <Firewall id="id476458AA9697" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1197750649" platform="pf" ro="False" version="" name="firewall40-1" comment="testing Route action&#10;with load balancing&#10;">
+        <NAT id="id476458FA9697" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id476458FB9697" disabled="False" position="0" comment="Translate source address&#10;for outgoing connections">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -9345,7 +9370,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id476459099697" comment="Translate source address&#10;for outgoing connections" disabled="False" position="1">
+          <NATRule id="id476459099697" disabled="False" position="1" comment="Translate source address&#10;for outgoing connections">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -9367,8 +9392,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id476458B09697" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id47646C979697" action="Route" direction="Inbound" disabled="False" log="False" position="0">
+        <Policy id="id476458B09697" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id47646C979697" action="Route" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9427,7 +9452,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47646C869697" action="Route" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id47646C869697" action="Route" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9486,7 +9511,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47646C759697" action="Route" direction="Inbound" disabled="False" log="False" position="2">
+          <PolicyRule id="id47646C759697" action="Route" direction="Inbound" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9545,7 +9570,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476480059697" action="Route" direction="Inbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id476480059697" action="Route" direction="Inbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9604,7 +9629,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476480169697" action="Route" direction="Inbound" disabled="False" log="False" position="4">
+          <PolicyRule id="id476480169697" action="Route" direction="Inbound" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9663,7 +9688,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476480279697" action="Route" direction="Inbound" disabled="False" log="False" position="5">
+          <PolicyRule id="id476480279697" action="Route" direction="Inbound" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9722,7 +9747,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476458C99697" action="Route" direction="Inbound" disabled="False" log="False" position="6">
+          <PolicyRule id="id476458C99697" action="Route" direction="Inbound" disabled="False" log="False" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9781,7 +9806,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476458D69697" action="Route" direction="Inbound" disabled="False" log="False" position="7">
+          <PolicyRule id="id476458D69697" action="Route" direction="Inbound" disabled="False" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9840,7 +9865,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4764592B9697" action="Route" direction="Inbound" disabled="False" log="False" position="8">
+          <PolicyRule id="id4764592B9697" action="Route" direction="Inbound" disabled="False" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9899,7 +9924,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4764BABB9697" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;Run compiler with&#10;command line argument -xt&#10;to convert errors to warnings&#10;and make it generate .conf &#10;file anyway" action="Route" direction="Inbound" disabled="False" log="False" position="9">
+          <PolicyRule id="id4764BABB9697" action="Route" direction="Inbound" disabled="False" log="False" position="9" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;Run compiler with&#10;command line argument -xt&#10;to convert errors to warnings&#10;and make it generate .conf &#10;file anyway">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9958,7 +9983,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4764BACC9697" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;" action="Route" direction="Inbound" disabled="False" log="False" position="10">
+          <PolicyRule id="id4764BACC9697" action="Route" direction="Inbound" disabled="False" log="False" position="10" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -10017,7 +10042,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id476509419697" comment="this should fail because&#10;it ip address in next hop&#10;is illegal" action="Route" direction="Inbound" disabled="False" log="False" position="11">
+          <PolicyRule id="id476509419697" action="Route" direction="Inbound" disabled="False" log="False" position="11" comment="this should fail because&#10;it ip address in next hop&#10;is illegal">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -10077,18 +10102,18 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id476459179697" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id476459189697" name="le1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+        <Routing id="id476459179697" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id476459189697" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="le1" comment="">
           <IPv4 id="id4764591A9697" name="firewall40-1:le1:ip" comment="This is a test address, change it to your real one" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4764591B9697" name="fxp0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4764591D9697" name="firewall40-1:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id4764591B9697" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="fxp0" comment="">
+          <IPv4 id="id4764591D9697" name="firewall40-1:fxp0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4764591E9697" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id476459209697" name="firewall40-1:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4764591E9697" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id476459209697" name="firewall40-1:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id476459219697" name="le2" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id476459239697" name="firewall40-1:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
+        <Interface id="id476459219697" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="le2" comment="">
+          <IPv4 id="id476459239697" name="firewall40-1:le2:ip" comment="" address="192.0.3.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -10200,11 +10225,11 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4833F62B6131" name="firewall-ipv6-1" host_OS="freebsd" inactive="False" lastCompiled="1216421258" lastInstalled="0" lastModified="1216421251" platform="pf" ro="False" version="">
-        <NAT id="id4833F62F6131" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id483F5B7623190" name="Policy_ipv4" ipv6_rule_set="False" top_rule_set="False"/>
-        <Policy id="id4833F62E6131" name="Policy" ipv6_rule_set="True" top_rule_set="True">
-          <PolicyRule id="id4841FADE30813" action="Accept" direction="Both" disabled="False" group="" log="False" position="0">
+      <Firewall id="id4833F62B6131" host_OS="freebsd" inactive="False" lastCompiled="1216421258" lastInstalled="0" lastModified="1216421251" platform="pf" ro="False" version="" name="firewall-ipv6-1" comment="">
+        <NAT id="id4833F62F6131" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id483F5B7623190" name="Policy_ipv4" comment="" ipv6_rule_set="False" top_rule_set="False"/>
+        <Policy id="id4833F62E6131" name="Policy" comment="" ipv6_rule_set="True" top_rule_set="True">
+          <PolicyRule id="id4841FADE30813" action="Accept" direction="Both" disabled="False" group="" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10224,7 +10249,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4837BFE628819" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" action="Accept" direction="Both" disabled="False" group="" log="False" position="1">
+          <PolicyRule id="id4837BFE628819" action="Accept" direction="Both" disabled="False" group="" log="False" position="1" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler">
             <Src neg="False">
               <ObjectRef ref="id4834B9206131"/>
             </Src>
@@ -10244,7 +10269,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834578B6131" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id4834578B6131" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id48416A7216880"/>
             </Src>
@@ -10264,7 +10289,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834577C6131" action="Accept" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id4834577C6131" action="Accept" direction="Both" disabled="False" log="True" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="id48416A7116880"/>
             </Src>
@@ -10284,7 +10309,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834D3038571" action="Accept" direction="Both" disabled="False" group="" log="True" position="4">
+          <PolicyRule id="id4834D3038571" action="Accept" direction="Both" disabled="False" group="" log="True" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10304,7 +10329,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834D3108571" action="Accept" direction="Both" disabled="False" group="" log="True" position="5">
+          <PolicyRule id="id4834D3108571" action="Accept" direction="Both" disabled="False" group="" log="True" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10324,7 +10349,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4835040E8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="6">
+          <PolicyRule id="id4835040E8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10344,7 +10369,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4835041F8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="7">
+          <PolicyRule id="id4835041F8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10364,7 +10389,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834576F6131" action="Accept" direction="Inbound" disabled="False" log="True" position="8">
+          <PolicyRule id="id4834576F6131" action="Accept" direction="Inbound" disabled="False" log="True" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10384,7 +10409,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4834B9216131" action="Accept" direction="Both" disabled="False" log="True" position="9">
+          <PolicyRule id="id4834B9216131" action="Accept" direction="Both" disabled="False" log="True" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834B9206131"/>
             </Src>
@@ -10404,7 +10429,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id483566468571" action="Accept" direction="Both" disabled="False" log="True" position="10">
+          <PolicyRule id="id483566468571" action="Accept" direction="Both" disabled="False" log="True" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10424,7 +10449,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id483566548571" action="Accept" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id483566548571" action="Accept" direction="Both" disabled="False" log="True" position="11" comment="">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10445,14 +10470,14 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4833F6306131" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4833F6316131" name="eth0" bridgeport="False" dyn="False" label="" security_level="50" unnum="False" unprotected="False">
-          <IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
-          <IPv6 id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
+        <Routing id="id4833F6306131" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4833F6316131" bridgeport="False" dyn="False" label="" security_level="50" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" comment="" address="1.1.1.1" netmask="255.255.255.0"/>
+          <IPv6 id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" comment="" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
         </Interface>
-        <Interface id="id4841FADB30813" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4841FADC30813" name="firewall-ipv6-1:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
-          <IPv6 id="id4841FADD30813" name="firewall-ipv6-1:lo:ipv6" address="::1" netmask="128"/>
+        <Interface id="id4841FADB30813" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id4841FADC30813" name="firewall-ipv6-1:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
+          <IPv6 id="id4841FADD30813" name="firewall-ipv6-1:lo:ipv6" comment="" address="::1" netmask="128"/>
         </Interface>
         <Management address="1.1.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -10607,11 +10632,11 @@
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4848A4294626" name="firewall-base-rulesets" comment="this firewall is used to test a rule in the global policy of object &quot;firewall&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1188097225" lastInstalled="1142003872" lastModified="1212696462" platform="pf" ro="False" version="">
-        <NAT id="id4848A4304626" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id4848A42F4626" name="Policy" ipv6_rule_set="False" top_rule_set="True"/>
+      <Firewall id="id4848A4294626" host_OS="openbsd" inactive="False" lastCompiled="1188097225" lastInstalled="1142003872" lastModified="1212696462" platform="pf" ro="False" version="" name="firewall-base-rulesets" comment="this firewall is used to test a rule in the global policy of object &quot;firewall&quot;&#10;">
+        <NAT id="id4848A4304626" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id4848A42F4626" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True"/>
         <Policy id="id4848A4414626" name="web_server_inbound" comment="Basic rules for web servers.&#10;" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id4848A4424626" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+          <PolicyRule id="id4848A4424626" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10631,7 +10656,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848A44F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id4848A44F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10654,7 +10679,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id48493B6E4626" name="mail_server_inbound" comment="Basic rules for mail servers" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id48493B6F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
+          <PolicyRule id="id48493B6F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10674,7 +10699,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id48493B7B4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id48493B7B4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10697,7 +10722,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id484B0A134626" name="mail_server_outbound" comment="Basic rules for mail servers" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id484B0A2D4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
+          <PolicyRule id="id484B0A2D4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10718,7 +10743,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484B0A3A4626" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="1">
+          <PolicyRule id="id484B0A3A4626" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10741,7 +10766,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id484B3D324626" name="web_server_outbound" comment="Basic rules for web servers.&#10;" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id484B3D3F4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
+          <PolicyRule id="id484B3D3F4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10762,7 +10787,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484B3D4C4626" action="Accept" direction="Outbound" disabled="False" log="False" position="1">
+          <PolicyRule id="id484B3D4C4626" action="Accept" direction="Outbound" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10783,15 +10808,15 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4848A4314626" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4848A4324626" name="en0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id4848A4344626" name="firewall-base-rulesets:en0:ip" address="33.33.33.33" netmask="255.255.255.0"/>
+        <Routing id="id4848A4314626" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4848A4324626" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="en0" comment="">
+          <IPv4 id="id4848A4344626" name="firewall-base-rulesets:en0:ip" comment="" address="33.33.33.33" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4848A4354626" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4848A4374626" name="firewall-base-rulesets:en1:ip" address="172.16.1.1" netmask="255.255.255.0"/>
+        <Interface id="id4848A4354626" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="en1" comment="">
+          <IPv4 id="id4848A4374626" name="firewall-base-rulesets:en1:ip" comment="" address="172.16.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4848A4384626" name="en2" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4848A43A4626" name="firewall-base-rulesets:en2:ip" address="192.168.100.1" netmask="255.255.255.0"/>
+        <Interface id="id4848A4384626" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="en2" comment="">
+          <IPv4 id="id4848A43A4626" name="firewall-base-rulesets:en2:ip" comment="" address="192.168.100.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.100.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -10859,10 +10884,10 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id484A05C44626" name="firewall51" comment="testing branching rules that point&#10;at rule sets defined in object&#10;firewall-base-rulesets" host_OS="openbsd" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1212696679" platform="pf" ro="False" version="">
-        <NAT id="id484A06174626" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id484A05CA4626" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id484A05CB4626" action="Branch" direction="Both" disabled="False" log="False" position="0">
+      <Firewall id="id484A05C44626" host_OS="openbsd" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1212696679" platform="pf" ro="False" version="" name="firewall51" comment="testing branching rules that point&#10;at rule sets defined in object&#10;firewall-base-rulesets">
+        <NAT id="id484A06174626" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id484A05CA4626" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id484A05CB4626" action="Branch" direction="Both" disabled="False" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10907,7 +10932,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484B704C4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="1">
+          <PolicyRule id="id484B704C4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -10952,7 +10977,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A05D84626" action="Branch" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id484A05D84626" action="Branch" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10997,7 +11022,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484B705F4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="3">
+          <PolicyRule id="id484B705F4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostB"/>
             </Src>
@@ -11042,7 +11067,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A05E44626" action="Branch" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id484A05E44626" action="Branch" direction="Both" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -11065,8 +11090,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id484A06094626" name="rule2_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id484A060A4626" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id484A06094626" name="rule2_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id484A060A4626" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="True">
               <ObjectRef ref="id3CEBFDFC"/>
               <ObjectRef ref="id4733FFE419714"/>
@@ -11088,16 +11113,16 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id484A06184626" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id484A06194626" name="en0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id484A061B4626" name="firewall51:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id484A06184626" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id484A06194626" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="en0" comment="">
+          <IPv4 id="id484A061B4626" name="firewall51:en0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id484A061C4626" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id484A061E4626" name="firewall51:en1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id484A061C4626" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="en1" comment="">
+          <IPv4 id="id484A061E4626" name="firewall51:en1:ip" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id484A061F4626" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id484A06224626" name="firewall51:lo:ip1" address="127.0.0.1" netmask="255.0.0.0"/>
-          <IPv4 id="id484A06234626" name="firewall51:lo:ip2" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id484A061F4626" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id484A06224626" name="firewall51:lo:ip1" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
+          <IPv4 id="id484A06234626" name="firewall51:lo:ip2" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -11191,10 +11216,10 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id4848F19020246" name="firewall62" comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="openbsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212808094" platform="pf" ro="False" version="4.x">
-        <NAT id="id4848F1D320246" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id4848F19620246" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id484A6C465896" comment="rule from FR 1948872&#10;should generate&#10;pass in quick on en0 user proxy&#10;" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="0">
+      <Firewall id="id4848F19020246" host_OS="openbsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212808094" platform="pf" ro="False" version="4.x" name="firewall62" comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;">
+        <NAT id="id4848F1D320246" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id4848F19620246" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id484A6C465896" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="0" comment="rule from FR 1948872&#10;should generate&#10;pass in quick on en0 user proxy&#10;">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11214,7 +11239,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848F19720246" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id4848F19720246" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11235,7 +11260,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A55A15896" action="Accept" direction="Both" disabled="False" group="" log="False" position="2">
+          <PolicyRule id="id484A55A15896" action="Accept" direction="Both" disabled="False" group="" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11255,7 +11280,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A8D2620246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="3">
+          <PolicyRule id="id484A8D2620246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11276,7 +11301,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A599620246" action="Accept" direction="Both" disabled="False" group="" log="False" position="4">
+          <PolicyRule id="id484A599620246" action="Accept" direction="Both" disabled="False" group="" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11297,7 +11322,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A8D3820246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="5">
+          <PolicyRule id="id484A8D3820246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11318,7 +11343,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848F1A320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="6">
+          <PolicyRule id="id4848F1A320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="6" comment="">
             <Src neg="False">
               <ObjectRef ref="id4848F1D520246"/>
             </Src>
@@ -11338,7 +11363,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848F1AF20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="7">
+          <PolicyRule id="id4848F1AF20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="7" comment="">
             <Src neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -11358,7 +11383,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848F1BB20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="8">
+          <PolicyRule id="id4848F1BB20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="8" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11378,7 +11403,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A558F5896" action="Accept" direction="Both" disabled="False" group="" log="False" position="9">
+          <PolicyRule id="id484A558F5896" action="Accept" direction="Both" disabled="False" group="" log="False" position="9" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11399,7 +11424,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484AF47A20246" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="10">
+          <PolicyRule id="id484AF47A20246" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="10" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11419,7 +11444,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A261420246" action="Accept" direction="Both" disabled="False" group="" log="False" position="11">
+          <PolicyRule id="id484A261420246" action="Accept" direction="Both" disabled="False" group="" log="False" position="11" comment="">
             <Src neg="True">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -11439,7 +11464,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id484A260320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="12">
+          <PolicyRule id="id484A260320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="12" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11459,7 +11484,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4848F1C720246" action="Deny" direction="Both" disabled="False" log="False" position="13">
+          <PolicyRule id="id4848F1C720246" action="Deny" direction="Both" disabled="False" log="False" position="13" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11480,12 +11505,12 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id4848F1D420246" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id4848F1D520246" name="en0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id4848F1D720246" name="firewall62:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Routing id="id4848F1D420246" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id4848F1D520246" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="en0" comment="">
+          <IPv4 id="id4848F1D720246" name="firewall62:en0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id4848F1D820246" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id4848F1DA20246" name="firewall62:en1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
+        <Interface id="id4848F1D820246" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="en1" comment="">
+          <IPv4 id="id4848F1DA20246" name="firewall62:en1:ip" comment="" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -11574,9 +11599,9 @@
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id530B20443" name="firewall63" comment="testing tos matching" host_OS="openbsd" inactive="False" lastCompiled="1215308098" lastInstalled="0" lastModified="1215308090" platform="pf" ro="False" version="">
-        <NAT id="id533820443" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id533920443" disabled="True" position="0">
+      <Firewall id="id530B20443" host_OS="openbsd" inactive="False" lastCompiled="1215308098" lastInstalled="0" lastModified="1215308090" platform="pf" ro="False" version="" name="firewall63" comment="testing tos matching">
+        <NAT id="id533820443" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id533920443" disabled="True" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -11598,8 +11623,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id531120443" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id531220443" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id531120443" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id531220443" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11623,7 +11648,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="idDCDE20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="1">
+          <PolicyRule id="idDCDE20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11647,7 +11672,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="idF3EB20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="2">
+          <PolicyRule id="idF3EB20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11668,7 +11693,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id531F20443" comment="DSCP matching is not&#10;supported by pf" action="Deny" direction="Both" disabled="True" log="True" position="3">
+          <PolicyRule id="id531F20443" action="Deny" direction="Both" disabled="True" log="True" position="3" comment="DSCP matching is not&#10;supported by pf">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11692,7 +11717,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id532C20443" action="Deny" direction="Both" disabled="False" log="True" position="4">
+          <PolicyRule id="id532C20443" action="Deny" direction="Both" disabled="False" log="True" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11713,15 +11738,15 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id534720443" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id534820443" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id534A20443" name="firewall63:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Routing id="id534720443" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id534820443" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="">
+          <IPv4 id="id534A20443" name="firewall63:eth1:ip" comment="" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id534B20443" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id534D20443" name="firewall63:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id534B20443" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="eth0" comment="">
+          <IPv4 id="id534D20443" name="firewall63:eth0:ip" comment="" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id534E20443" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id535020443" name="firewall63:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id534E20443" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id535020443" name="firewall63:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -11851,7 +11876,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <IntervalGroup id="stdid11_1" name="Time"/>
+    <IntervalGroup id="stdid11_1" name="Time" comment=""/>
     <ObjectRef ref="id483F5B7623190"/>
     <ObjectRef ref="id4833F6316131"/>
     <ObjectRef ref="id4833F62E6131"/>
@@ -11873,39 +11898,39 @@
     <ObjectRef ref="id4848F1D320246"/>
     <ObjectRef ref="id4848F1D420246"/>
   </Library>
-  <Library id="id415276C8" name="lab" color="#FFFFFF" ro="False">
-    <ObjectGroup id="id415276C9" name="Objects">
-      <ObjectGroup id="id415276C9_og_ats_1" name="Address Tables"/>
-      <ObjectGroup id="id415276CA" name="Addresses">
-        <IPv4 id="id4144D59F" name="hst1" address="10.3.14.10" netmask="255.255.255.255"/>
-        <IPv4 id="id4144D5A0" name="hst2" address="10.3.14.40" netmask="255.255.255.255"/>
+  <Library id="id415276C8" color="#FFFFFF" ro="False" name="lab" comment="">
+    <ObjectGroup id="id415276C9" name="Objects" comment="">
+      <ObjectGroup id="id415276C9_og_ats_1" name="Address Tables" comment=""/>
+      <ObjectGroup id="id415276CA" name="Addresses" comment="">
+        <IPv4 id="id4144D59F" name="hst1" comment="" address="10.3.14.10" netmask="255.255.255.255"/>
+        <IPv4 id="id4144D5A0" name="hst2" comment="" address="10.3.14.40" netmask="255.255.255.255"/>
       </ObjectGroup>
-      <ObjectGroup id="id415276CB" name="Groups"/>
-      <ObjectGroup id="id415276CC" name="Hosts"/>
-      <ObjectGroup id="id415276CD" name="Networks">
-        <Network id="id414C5C51" name="n-10.3.14" address="10.3.14.0" netmask="255.255.255.0"/>
-        <Network id="id414C70BE" name="labnet" address="10.1.1.0" netmask="255.255.255.0"/>
-        <Network id="id414C7BA7" name="n-10.1.2" address="10.1.2.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="id415276CB" name="Groups" comment=""/>
+      <ObjectGroup id="id415276CC" name="Hosts" comment=""/>
+      <ObjectGroup id="id415276CD" name="Networks" comment="">
+        <Network id="id414C5C51" name="n-10.3.14" comment="" address="10.3.14.0" netmask="255.255.255.0"/>
+        <Network id="id414C70BE" name="labnet" comment="" address="10.1.1.0" netmask="255.255.255.0"/>
+        <Network id="id414C7BA7" name="n-10.1.2" comment="" address="10.1.2.0" netmask="255.255.255.0"/>
       </ObjectGroup>
-      <ObjectGroup id="id415276CE" name="Address Ranges"/>
-      <ObjectGroup id="id4386458B18448" name="DNS Names"/>
+      <ObjectGroup id="id415276CE" name="Address Ranges" comment=""/>
+      <ObjectGroup id="id4386458B18448" name="DNS Names" comment=""/>
     </ObjectGroup>
-    <ServiceGroup id="id415276CF" name="Services">
-      <ServiceGroup id="id415276CF_og_tag_1" name="TagServices">
-        <TagService id="id4847247323126" name="INTNET" tagcode="INTNET"/>
+    <ServiceGroup id="id415276CF" name="Services" comment="">
+      <ServiceGroup id="id415276CF_og_tag_1" name="TagServices" comment="">
+        <TagService id="id4847247323126" tagcode="INTNET" name="INTNET" comment=""/>
       </ServiceGroup>
-      <ServiceGroup id="id415276D0" name="Groups"/>
-      <ServiceGroup id="id415276D1" name="ICMP"/>
-      <ServiceGroup id="id415276D2" name="IP"/>
-      <ServiceGroup id="id415276D3" name="TCP"/>
-      <ServiceGroup id="id415276D4" name="UDP"/>
-      <ServiceGroup id="id415276D5" name="Custom"/>
-      <ServiceGroup id="id415276CF_userservices" name="Users"/>
+      <ServiceGroup id="id415276D0" name="Groups" comment=""/>
+      <ServiceGroup id="id415276D1" name="ICMP" comment=""/>
+      <ServiceGroup id="id415276D2" name="IP" comment=""/>
+      <ServiceGroup id="id415276D3" name="TCP" comment=""/>
+      <ServiceGroup id="id415276D4" name="UDP" comment=""/>
+      <ServiceGroup id="id415276D5" name="Custom" comment=""/>
+      <ServiceGroup id="id415276CF_userservices" name="Users" comment=""/>
     </ServiceGroup>
-    <ObjectGroup id="id415276D6" name="Firewalls">
-      <Firewall id="id3AF5A2BA" name="labfw-openbsd" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1172032243" lastInstalled="1172032344" lastModified="1212609898" platform="pf" ro="False" version="">
-        <NAT id="id3AF5A2BD" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id414E693E" disabled="False" position="0">
+    <ObjectGroup id="id415276D6" name="Firewalls" comment="">
+      <Firewall id="id3AF5A2BA" host_OS="openbsd" inactive="False" lastCompiled="1172032243" lastInstalled="1172032344" lastModified="1212609898" platform="pf" ro="False" version="" name="labfw-openbsd" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;">
+        <NAT id="id3AF5A2BD" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id414E693E" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
             </OSrc>
@@ -11926,7 +11951,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id414E7DF6" disabled="False" position="1">
+          <NATRule id="id414E7DF6" disabled="False" position="1" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id414C5C51"/>
@@ -11950,8 +11975,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id3AF5A2BC" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id48472A0C23126" action="Tag" direction="Both" disabled="False" group="" log="False" position="0">
+        <Policy id="id3AF5A2BC" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id48472A0C23126" action="Tag" direction="Both" disabled="False" group="" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11993,7 +12018,7 @@
               <Option name="tagobject_id">id4847247323126</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id414C70C1" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id414C70C1" action="Deny" direction="Inbound" disabled="False" log="True" position="1" comment="">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id414C7BA7"/>
@@ -12014,7 +12039,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id414C47E4" action="Deny" direction="Outbound" disabled="False" log="True" position="2">
+          <PolicyRule id="id414C47E4" action="Deny" direction="Outbound" disabled="False" log="True" position="2" comment="">
             <Src neg="True">
               <ObjectRef ref="id3AF5A2BA"/>
               <ObjectRef ref="id414C70BE"/>
@@ -12035,7 +12060,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id41441D4F" action="Accept" direction="Both" disabled="False" log="False" position="3">
+          <PolicyRule id="id41441D4F" action="Accept" direction="Both" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12053,7 +12078,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id445E76C726850" action="Branch" direction="Inbound" disabled="False" log="False" position="4">
+          <PolicyRule id="id445E76C726850" action="Branch" direction="Inbound" disabled="False" log="False" position="4" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12075,7 +12100,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id414E7E0E" action="Accept" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id414E7E0E" action="Accept" direction="Both" disabled="False" log="False" position="5" comment="">
             <Src neg="False">
               <ObjectRef ref="id414C5C51"/>
               <ObjectRef ref="id414C70BE"/>
@@ -12095,7 +12120,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AF5A757" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="6">
+          <PolicyRule id="id3AF5A757" action="Accept" direction="Both" disabled="False" log="False" position="6" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
               <ObjectRef ref="id414C70BE"/>
@@ -12114,7 +12139,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AF5A762" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="7">
+          <PolicyRule id="id3AF5A762" action="Deny" direction="Both" disabled="False" log="True" position="7" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12135,8 +12160,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id445E76D326850" name="rule3_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id445E77D326850" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id445E76D326850" name="rule3_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id445E77D326850" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12156,7 +12181,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id445E77BB26850" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id445E77BB26850" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -12182,15 +12207,15 @@
             <PolicyRuleOptions/>
           </PolicyRule>
         </Policy>
-        <Routing id="id3AF5A2BA-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id3AF5A2CB" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id3AF5A2CB-ipv4" name="labfw-openbsd:pcn0:ip" address="10.3.14.120" netmask="255.255.255.0"/>
+        <Routing id="id3AF5A2BA-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id3AF5A2CB" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="">
+          <IPv4 id="id3AF5A2CB-ipv4" name="labfw-openbsd:pcn0:ip" comment="" address="10.3.14.120" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id3AFB7090" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id3AFB7090-ipv4" name="labfw-openbsd:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3AFB7090" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id3AFB7090-ipv4" name="labfw-openbsd:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id414C70BB" name="pcn1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id414C70BD" name="labfw-openbsd:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+        <Interface id="id414C70BB" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="pcn1" comment="">
+          <IPv4 id="id414C70BD" name="labfw-openbsd:pcn1:ip" comment="" address="10.1.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="10.3.14.120">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -12312,9 +12337,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id42B5D8FC" name="labfw-fbsd" host_OS="freebsd" inactive="True" lastCompiled="1157930826" lastInstalled="0" lastModified="1147032998" platform="pf" ro="False" version="">
-        <NAT id="id42B5D93E" name="NAT" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id42B5D93F" disabled="False" position="0">
+      <Firewall id="id42B5D8FC" host_OS="freebsd" inactive="True" lastCompiled="1157930826" lastInstalled="0" lastModified="1147032998" platform="pf" ro="False" version="" name="labfw-fbsd" comment="">
+        <NAT id="id42B5D93E" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <NATRule id="id42B5D93F" disabled="False" position="0" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
             </OSrc>
@@ -12336,8 +12361,8 @@
             <NATRuleOptions/>
           </NATRule>
         </NAT>
-        <Policy id="id42B5D901" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id42B5D977" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
+        <Policy id="id42B5D901" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id42B5D977" action="Deny" direction="Inbound" disabled="False" log="True" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id42B5D8FC"/>
@@ -12358,7 +12383,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id42B5D982" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id42B5D982" action="Deny" direction="Outbound" disabled="False" log="True" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id42B5D8FC"/>
               <ObjectRef ref="id414C70BE"/>
@@ -12379,7 +12404,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id42B5D99C" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id42B5D99C" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12397,7 +12422,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id42B5D902" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="3">
+          <PolicyRule id="id42B5D902" action="Deny" direction="Both" disabled="False" log="True" position="3" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12417,7 +12442,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id42B5D929" comment="need this because PF consults&#10;policy rules after nat as well" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id42B5D929" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="need this because PF consults&#10;policy rules after nat as well">
             <Src neg="False">
               <ObjectRef ref="id42B5D8FC"/>
             </Src>
@@ -12435,7 +12460,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id42B612DC" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="5">
+          <PolicyRule id="id42B612DC" action="Accept" direction="Both" disabled="False" log="False" position="5" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
             </Src>
@@ -12453,7 +12478,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id42B5D934" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="6">
+          <PolicyRule id="id42B5D934" action="Deny" direction="Both" disabled="False" log="True" position="6" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12474,15 +12499,15 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Routing id="id42B5D8FC-routing" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id42B5D95D" name="lnc0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id42B5D98D" name="labfw-fbsd:lnc0:ip" address="10.3.14.121" netmask="255.255.255.0"/>
+        <Routing id="id42B5D8FC-routing" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id42B5D95D" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False" name="lnc0" comment="">
+          <IPv4 id="id42B5D98D" name="labfw-fbsd:lnc0:ip" comment="" address="10.3.14.121" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id42B5D98E" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id42B5D9A6" name="labfw-fbsd:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id42B5D98E" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo0" comment="">
+          <IPv4 id="id42B5D9A6" name="labfw-fbsd:lo0:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface id="id42B5D9A7" name="lnc1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id42B5D9AB" name="labfw-fbsd:lnc1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+        <Interface id="id42B5D9A7" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lnc1" comment="">
+          <IPv4 id="id42B5D9AB" name="labfw-fbsd:lnc1:ip" comment="" address="10.1.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="10.3.14.121">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -12610,10 +12635,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id45DE9C5B2560" name="openbsd-4.0" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202683169" lastInstalled="1202683190" lastModified="1202683163" platform="pf" ro="False" version="ge_3.7">
-        <NAT id="id45DE9CDB2560" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id45DE9C612560" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id47B0069F19082" action="Accept" direction="Both" disabled="True" log="False" position="0">
+      <Firewall id="id45DE9C5B2560" host_OS="openbsd" inactive="False" lastCompiled="1202683169" lastInstalled="1202683190" lastModified="1202683163" platform="pf" ro="False" version="ge_3.7" name="openbsd-4.0" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;">
+        <NAT id="id45DE9CDB2560" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id45DE9C612560" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id47B0069F19082" action="Accept" direction="Both" disabled="True" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id4144D5A0"/>
             </Src>
@@ -12633,7 +12658,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id45DE9C6F2560" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id45DE9C6F2560" action="Deny" direction="Outbound" disabled="False" log="True" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id45DE9C5B2560"/>
             </Src>
@@ -12653,7 +12678,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id45DE9C7C2560" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id45DE9C7C2560" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12671,7 +12696,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id45DE9C882560" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id45DE9C882560" action="Branch" direction="Inbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12693,7 +12718,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id45DE9CC22560" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id45DE9CC22560" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id45DE9C5B2560"/>
             </Src>
@@ -12711,7 +12736,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id45DE9CCF2560" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id45DE9CCF2560" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12732,8 +12757,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id45DE9C942560" name="rule3_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id45DE9C952560" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id45DE9C942560" name="rule3_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id45DE9C952560" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12753,7 +12778,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id45DE9CA12560" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id45DE9CA12560" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -12779,12 +12804,12 @@
             <PolicyRuleOptions/>
           </PolicyRule>
         </Policy>
-        <Routing id="id45DE9CFA2560" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id45DE9CFB2560" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id45DE9CFD2560" name="openbsd-4.0:pcn0:ip" address="10.3.14.54" netmask="255.255.255.0"/>
+        <Routing id="id45DE9CFA2560" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id45DE9CFB2560" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="">
+          <IPv4 id="id45DE9CFD2560" name="openbsd-4.0:pcn0:ip" comment="" address="10.3.14.54" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id45DE9CFE2560" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id45DE9D002560" name="openbsd-4.0:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id45DE9CFE2560" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id45DE9D002560" name="openbsd-4.0:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="10.3.14.54">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -12906,10 +12931,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id47B07CD419082" name="openbsd-4.2" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202686003" lastInstalled="1202686020" lastModified="1202685992" platform="pf" ro="False" version="4.x">
-        <NAT id="id47B07D4319082" name="NAT" ipv6_rule_set="False" top_rule_set="True"/>
-        <Policy id="id47B07CDA19082" name="Policy" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id47B07CDB19082" action="Accept" direction="Both" disabled="True" log="False" position="0">
+      <Firewall id="id47B07CD419082" host_OS="openbsd" inactive="False" lastCompiled="1202686003" lastInstalled="1202686020" lastModified="1202685992" platform="pf" ro="False" version="4.x" name="openbsd-4.2" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;">
+        <NAT id="id47B07D4319082" name="NAT" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Policy id="id47B07CDA19082" name="Policy" comment="" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id47B07CDB19082" action="Accept" direction="Both" disabled="True" log="False" position="0" comment="">
             <Src neg="False">
               <ObjectRef ref="id4144D5A0"/>
             </Src>
@@ -12929,7 +12954,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47B07CE719082" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
+          <PolicyRule id="id47B07CE719082" action="Deny" direction="Outbound" disabled="False" log="True" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id47B07CD419082"/>
             </Src>
@@ -12949,7 +12974,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47B07CF319082" action="Accept" direction="Both" disabled="False" log="False" position="2">
+          <PolicyRule id="id47B07CF319082" action="Accept" direction="Both" disabled="False" log="False" position="2" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12967,7 +12992,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id47B07CFF19082" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
+          <PolicyRule id="id47B07CFF19082" action="Branch" direction="Inbound" disabled="False" log="False" position="3" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12989,7 +13014,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47B07D2B19082" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="4">
+          <PolicyRule id="id47B07D2B19082" action="Accept" direction="Both" disabled="False" log="False" position="4" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id47B07CD419082"/>
             </Src>
@@ -13007,7 +13032,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id47B07D3719082" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id47B07D3719082" action="Deny" direction="Both" disabled="False" log="True" position="5" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -13028,8 +13053,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy id="id47B07D0B19082" name="rule3_branch" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id47B07D0C19082" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
+        <Policy id="id47B07D0B19082" name="rule3_branch" comment="" ipv6_rule_set="False" top_rule_set="False">
+          <PolicyRule id="id47B07D0C19082" action="Deny" direction="Both" disabled="False" log="True" position="0" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -13049,7 +13074,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id47B07D1819082" action="Accept" direction="Both" disabled="False" log="False" position="1">
+          <PolicyRule id="id47B07D1819082" action="Accept" direction="Both" disabled="False" log="False" position="1" comment="">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -13075,12 +13100,12 @@
             <PolicyRuleOptions/>
           </PolicyRule>
         </Policy>
-        <Routing id="id47B07D4419082" name="Routing" ipv6_rule_set="False" top_rule_set="True"/>
-        <Interface id="id47B07D4519082" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
-          <IPv4 id="id47B07D4719082" name="openbsd-4.2:pcn0:ip" address="10.3.14.50" netmask="255.255.255.0"/>
+        <Routing id="id47B07D4419082" name="Routing" comment="" ipv6_rule_set="False" top_rule_set="True"/>
+        <Interface id="id47B07D4519082" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="">
+          <IPv4 id="id47B07D4719082" name="openbsd-4.2:pcn0:ip" comment="" address="10.3.14.50" netmask="255.255.255.0"/>
         </Interface>
-        <Interface id="id47B07D4819082" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
-          <IPv4 id="id47B07D4A19082" name="openbsd-4.2:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id47B07D4819082" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="">
+          <IPv4 id="id47B07D4A19082" name="openbsd-4.2:lo:ip" comment="" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="10.3.14.50">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -13209,121 +13234,121 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <IntervalGroup id="id415276D7" name="Time"/>
+    <IntervalGroup id="id415276D7" name="Time" comment=""/>
   </Library>
-  <Library id="id4387B43718346" name="transfer" color="#FFFFFF" ro="False">
-    <ObjectGroup id="id4387B43818346" name="Objects">
-      <ObjectGroup id="id4387B43918346" name="Addresses"/>
-      <ObjectGroup id="id4387B43A18346" name="DNS Names"/>
-      <ObjectGroup id="id4387B43B18346" name="Address Tables"/>
-      <ObjectGroup id="id4387B43C18346" name="Groups"/>
-      <ObjectGroup id="id4387B43D18346" name="Hosts"/>
-      <ObjectGroup id="id4387B43E18346" name="Networks"/>
-      <ObjectGroup id="id4387B43F18346" name="Address Ranges"/>
+  <Library id="id4387B43718346" color="#FFFFFF" ro="False" name="transfer" comment="">
+    <ObjectGroup id="id4387B43818346" name="Objects" comment="">
+      <ObjectGroup id="id4387B43918346" name="Addresses" comment=""/>
+      <ObjectGroup id="id4387B43A18346" name="DNS Names" comment=""/>
+      <ObjectGroup id="id4387B43B18346" name="Address Tables" comment=""/>
+      <ObjectGroup id="id4387B43C18346" name="Groups" comment=""/>
+      <ObjectGroup id="id4387B43D18346" name="Hosts" comment=""/>
+      <ObjectGroup id="id4387B43E18346" name="Networks" comment=""/>
+      <ObjectGroup id="id4387B43F18346" name="Address Ranges" comment=""/>
     </ObjectGroup>
-    <ServiceGroup id="id4387B44018346" name="Services">
-      <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices"/>
-      <ServiceGroup id="id4387B44118346" name="Groups"/>
-      <ServiceGroup id="id4387B44218346" name="ICMP"/>
-      <ServiceGroup id="id4387B44318346" name="IP"/>
-      <ServiceGroup id="id4387B44418346" name="TCP"/>
-      <ServiceGroup id="id4387B44518346" name="UDP"/>
-      <ServiceGroup id="id4387B44618346" name="Custom"/>
-      <ServiceGroup id="id4387B44018346_userservices" name="Users"/>
+    <ServiceGroup id="id4387B44018346" name="Services" comment="">
+      <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices" comment=""/>
+      <ServiceGroup id="id4387B44118346" name="Groups" comment=""/>
+      <ServiceGroup id="id4387B44218346" name="ICMP" comment=""/>
+      <ServiceGroup id="id4387B44318346" name="IP" comment=""/>
+      <ServiceGroup id="id4387B44418346" name="TCP" comment=""/>
+      <ServiceGroup id="id4387B44518346" name="UDP" comment=""/>
+      <ServiceGroup id="id4387B44618346" name="Custom" comment=""/>
+      <ServiceGroup id="id4387B44018346_userservices" name="Users" comment=""/>
     </ServiceGroup>
-    <ObjectGroup id="id4387B44718346" name="Firewalls"/>
-    <IntervalGroup id="id4387B44818346" name="Time"/>
+    <ObjectGroup id="id4387B44718346" name="Firewalls" comment=""/>
+    <IntervalGroup id="id4387B44818346" name="Time" comment=""/>
   </Library>
-  <Library id="syslib000" name="Standard" comment="Standard objects" color="#d4f8ff" ro="True">
-    <ServiceGroup id="stdid05" name="Services">
-      <ServiceGroup id="stdid06" name="IP">
-        <IPService id="ip-IP_Fragments" name="ip_fragments" comment="'Short' fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
-        <IPService id="ip-IPSEC" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService id="ip-RR" name="RR" comment="Route recording packets" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService id="ip-SRR" name="SRR" comment="All sorts of Source Routing Packets" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
-        <IPService id="id3D703C8F" name="GRE" comment="Generic Routing Encapsulation&#10;" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService id="id3CB12797" name="AH" comment="IPSEC Authentication Header Protocol" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
+  <Library id="syslib000" color="#d4f8ff" ro="True" name="Standard" comment="Standard objects">
+    <ServiceGroup id="stdid05" name="Services" comment="">
+      <ServiceGroup id="stdid06" name="IP" comment="">
+        <IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments"/>
+        <IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol"/>
+        <IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets"/>
+        <IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets"/>
+        <IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;"/>
+        <IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid09" name="TCP">
-        <TCPService id="tcp-Auth" name="auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
-        <TCPService id="tcp-DNS_zone_transf" name="dns-tcp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
-        <TCPService id="tcp-FTP" name="ftp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
-        <TCPService id="tcp-HTTP" name="http" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
-        <TCPService id="tcp-NNTP" name="nntp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
-        <TCPService id="tcp-SMTP" name="smtp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
-        <TCPService id="tcp-SSH" name="ssh" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
-        <TCPService id="tcp-Telnet" name="telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
-        <TCPService id="tcp-uucp" name="uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
-        <TCPService id="id3AEDBE6E" name="daytime" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
-        <TCPService id="id3B4FEDA3" name="eklogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
-        <TCPService id="id3B4FED69" name="https" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
-        <TCPService id="id3AECF776" name="imap" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
-        <TCPService id="id3B4FED9F" name="imaps" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
-        <TCPService id="id3B4FF13C" name="irc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
-        <TCPService id="id3B4FEE21" name="klogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
-        <TCPService id="id3B4FEE23" name="ksh" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
-        <TCPService id="id3AECF778" name="ldap" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
-        <TCPService id="id3B4FF000" name="linuxconf" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
-        <TCPService id="id3B4FEEEE" name="mysql" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
-        <TCPService id="id3B4FEE7A" name="nfs" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
-        <TCPService id="id3B4FEE1D" name="pop3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
-        <TCPService id="id3B4FF0EA" name="postgres" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
-        <TCPService id="id3AECF782" name="printer" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
-        <TCPService id="id3B4FEF7C" name="quake" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
-        <TCPService id="id3AECF77A" name="rexec" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
-        <TCPService id="id3AECF77C" name="rlogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
-        <TCPService id="id3AECF77E" name="rshell" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
-        <TCPService id="id3B4FEF34" name="rwhois" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
-        <TCPService id="id3B4FF04C" name="smtps" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
-        <TCPService id="id3B4FEE76" name="socks" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
-        <TCPService id="id3AEDBE00" name="sunrpc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
-        <TCPService id="id3B4FF1B8" name="xfs" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
-        <TCPService id="tcp-TCP-SYN" name="tcp-syn" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
-        <TCPService id="tcp-FTP_data" name="ftp data" comment="FTP data channel.&#10;  Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10;  but many ftp server implementations do so." ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
-        <TCPService id="id3B4FF09A" name="squid" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
-        <TCPService id="tcp-All_TCP" name="All TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
-        <TCPService id="tcp-DNS" name="domain" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+      <ServiceGroup id="stdid09" name="TCP" comment="">
+        <TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
+        <TCPService id="tcp-DNS_zone_transf" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="dns-tcp" comment="" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
+        <TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+        <TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
+        <TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+        <TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
+        <TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
+        <TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
+        <TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
+        <TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
+        <TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
+        <TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
+        <TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
+        <TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
+        <TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
+        <TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
+        <TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
+        <TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
+        <TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
+        <TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
+        <TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
+        <TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
+        <TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
+        <TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
+        <TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
+        <TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
+        <TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
+        <TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
+        <TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
+        <TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
+        <TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
+        <TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10;  Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10;  but many ftp server implementations do so." src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
+        <TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
+        <TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid08" name="UDP">
-        <UDPService id="udp-DNS" name="domain" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
-        <UDPService id="udp-All_UDP" name="All UDP" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
-        <UDPService id="udp-bootpc" name="bootpc" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
+      <ServiceGroup id="stdid08" name="UDP" comment="">
+        <UDPService id="udp-DNS" name="domain" comment="" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <UDPService id="udp-All_UDP" name="All UDP" comment="" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <UDPService id="udp-bootpc" name="bootpc" comment="" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid10" name="Groups">
-        <ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP">
+      <ServiceGroup id="stdid10" name="Groups" comment="">
+        <ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="">
           <ServiceRef ref="icmp-Time_exceeded"/>
           <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
           <ServiceRef ref="icmp-ping_reply"/>
           <ServiceRef ref="icmp-Unreachables"/>
         </ServiceGroup>
-        <ServiceGroup id="id3CB1279B" name="IPSEC">
+        <ServiceGroup id="id3CB1279B" name="IPSEC" comment="">
           <ServiceRef ref="id3CB12797"/>
           <ServiceRef ref="ip-IPSEC"/>
         </ServiceGroup>
-        <ServiceGroup id="id3F530CC8" name="DNS">
+        <ServiceGroup id="id3F530CC8" name="DNS" comment="">
           <ServiceRef ref="udp-DNS"/>
           <ServiceRef ref="tcp-DNS"/>
         </ServiceGroup>
       </ServiceGroup>
-      <ServiceGroup id="stdid07" name="ICMP">
-        <ICMPService id="icmp-ping_request" name="ping request" code="0" type="8"/>
-        <ICMPService id="icmp-Unreachables" name="all ICMP unreachables" code="-1" type="3"/>
-        <ICMPService id="id3C20EEB5" name="any ICMP" code="-1" type="-1"/>
-        <ICMPService id="icmp-Time_exceeded" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" code="0" type="11"/>
-        <ICMPService id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" code="1" type="11"/>
-        <ICMPService id="icmp-ping_reply" name="ping reply" code="0" type="0"/>
+      <ServiceGroup id="stdid07" name="ICMP" comment="">
+        <ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment=""/>
+        <ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment=""/>
+        <ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment=""/>
+        <ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute"/>
+        <ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment=""/>
+        <ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment=""/>
       </ServiceGroup>
     </ServiceGroup>
-    <AnyIPService id="sysid1" name="Any" comment="Any IP Service" protocol_num="0"/>
+    <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service"/>
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" address="0.0.0.0" netmask="0.0.0.0"/>
-    <AnyInterval id="sysid2" name="Any" comment="Any Interval" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
-    <IntervalGroup id="stdid11" name="Time">
-      <Interval id="int-afterhours" name="afterhours" comment="any day 6:00pm - 12:00am" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
-      <Interval id="id3C63479C" name="Sat" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1"/>
-      <Interval id="id3C63479E" name="Sun" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1"/>
+    <AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval"/>
+    <IntervalGroup id="stdid11" name="Time" comment="">
+      <Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am"/>
+      <Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment=""/>
+      <Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment=""/>
     </IntervalGroup>
-    <ObjectGroup id="stdid01" name="Objects">
-      <ObjectGroup id="stdid03" name="Networks">
+    <ObjectGroup id="stdid01" name="Objects" comment="">
+      <ObjectGroup id="stdid03" name="Networks" comment="">
         <Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" address="192.168.1.0" netmask="255.255.255.0"/>
       </ObjectGroup>
     </ObjectGroup>